Guest network setup using ASA 5520

[mbroberson1]

Looking into setting up a guest network. We would like to give a certain amount of our internet bandwidth to the guest network and setup DHCP on the ASA for the quest network. The guest network needs to be totally segmented from our corporate network.

[Farrukh Haroon]

Do you have a proxy server on your network?

You could create a separate zone/interface for the GUEST users giving it a lower security level as the inside. For DHCP have a look at:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806c1cd5.shtml

Regards

Farrukh

[mbroberson1]

We have a microsoft ISA server as our proxy server.

[Farrukh Haroon]

"We would like to give a certain amount of our internet bandwidth to the guest network"

I don't think the ASA supports this inherently. There are third party plug-ins for this tough.

Regards

Farrukh

[mbroberson1]

So you can't throttle a port on the ASA?

[Farrukh Haroon]

No you can actually, have a look at:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/qos.html

Regards

Farrukh

[mbroberson1]

So the configuration would be like to plug in from a switch port to the ASA port and set up DHCP for the ASA interface on the ASA and use QOS to port throttle the interface?

[Farrukh Haroon]

Yup, you could throttle based on the DHCP pool you assign.

Regards

Farrukh

[mbroberson1]

So the configuration I described looks accurate? Come out of the switch port that is assigned to the guest network vlan into the interface/port on the ASA that will be for the guest network. The ASA interface/port ip address will be the default-gateway for the clients correct?

[Farrukh Haroon]

Yes the ASA will be the default gateway.

[mbroberson1]

Looks like a easy configuration then?

[Farrukh Haroon]

Seems simple, but then that is a 'relative' thing :)

Regards

Farrukh

[mbroberson1]

Right...;-)

Thanks

[mbroberson1]

Would we need to configure a vlan on the ASA also to coin side with the vlan on the LAN?

[Farrukh Haroon]

You don't need to configure any vlans/sub-interfaces unless you require more zones than the interfaces built-in to your box (5).

You just choose any unused interface and set it up like this:

interface gig 0/2

no shut

nameif GUESTS

security-l 50

ip address

Regards

Farrukh