I could really use some help getting this ASA 5510 configuration done. I?m by no means a firewall guru but since I?m the only network engineer at my company I?ve been asked to make the new Firewall/VPN work. I?m trying to setup the network to have a DMZ for our web servers and OWA so everything in the DMZ will have an IP of 192.168.2.0. My Internal network will have an IP of 192.168.0.0 and the people coming in on the VPN will get an IP of 192.168.3.0. Is this the best way to do it or can someone give me some tips on what?s the best way to do it? The servers in the DMZ and Inside network need to be able to communicate between each other for Active Directory and DNS traffic plus my users on the VPN and Internal networks need to be able to Remote Desktop into the servers in the DMZ and Internal network. I?ll paste my config below so any help would be greatly appreciated. Thanks. I guess it's to much data so I'll put the other half in the next post and I'll attach it as a doc to the original post.
ASA Version 7.2(2)
!
hostname asa5510
domain-name test.com
enable password XXXXXXXXXXX encrypted
names
dns-guard
!
interface Ethernet0/0
nameif External
security-level 0
ip address 209.x.x.10 255.255.255.248
!
interface Ethernet0/1
nameif Internal
security-level 90
ip address 192.168.0.1 255.255.255.0
!
interface Ethernet0/2
nameif DMZ
security-level 80
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
passwd XXXXXXXXXX encrypted
boot system disk0:/asa722-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00
dns server-group DefaultDNS
domain-name test.com
access-list External_access_in extended permit tcp any host 209.254.99.65 eq www
access-list External_access_in extended permit tcp any host 209.254.99.66 eq ftp
access-list DefaultRAGroup_splitTunnelAcl standard permit any
access-list Internal_nat0_outbound extended permit ip any 192.168.3.0 255.255.255.0
access-list Internal_nat0_outbound extended permit ip any 192.168.0.0 255.255.255.0
access-list DefaultRAGroup_splitTunnelAcl_1 standard permit any
access-list test_splitTunnelAcl standard permit any
access-list External_access_out extended permit ip 192.168.0.0 255.255.255.0 any
pager lines 24
logging asdm informational
mtu External 1500
mtu Internal 1500
mtu DMZ 1500
mtu management 1500
ip local pool VPN 192.168.3.1-192.168.3.254 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (External) 1 interface
nat (Internal) 0 access-list Internal_nat0_outbound
nat (DMZ) 1 0.0.0.0 0.0.0.0
nat (Internal) 1 0.0.0.0 0.0.0.0
static (DMZ,External) 209.254.99.65 192.168.2.2 netmask 255.255.255.255
static (DMZ,External) 209.254.99.66 192.168.2.3 netmask 255.255.255.255
access-group External_access_in in interface External
access-group External_access_out out interface External
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy NOS internal
group-policy NOS attributes
dns-server value 192.168.0.15
vpn-tunnel-protocol IPSec
username rabbit password XXXXXXXX encrypted privilege 0
username rabbit attributes
vpn-group-policy NOS
http server enable
http 192.168.0.0 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
****SEE BELOW FOR THE REST****
