Extranet with ASA - where to start?

[andy-gerace]

I have been handed a task from my predecessor that I am really at a loss on. I need to set up an "extranet" for clients outside of my company to connect to, but make sure that they do not have any access to any of my internal servers, etc. The servers they need access to are on a seperate subnet, etc. and will be setup in my current DMZ. I am using an ASA to terminate VPN clients, as well as L2L connections. Here's my question:

If I give these people VPN clients to connect to the extranet and then just specify that subnet as "interesting traffic" should that be secure enough? Or where would I start to get this setup?

[mpalardy]

Hi Andy,

Setting up a vpn from scratch with ASDM software is a pretty easier task than the infamous CLI.

I can't tell you what's secure enough to do VPN thru internet. Authencating clients is always a good practice and a good point. Encrypting data as well.

Giving access to restricted ressources is also concerned.

Configuration example

(cco required)

http://cisco.com/en/US/customer/products/hw/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

HTH

Mike