Polycom and Cisco ASA 5510

[sullyjman12]

We are implementing a Polycom VBP 4555-E3 Firewall/ NAT traversal unit that will need a public ip address so outside systems can dial into our polycom system.  One of the requirements needed for this device to be sure its not natted and has direct access to the internet.  I have a public address that we can use for our DMZ, but I guess I dont understand how I can setup the ASA to not nat the Polycom unit.

All our ports on the Cisco ASA are being used in case that comes up.  Any input would be great.

Thanks! 

[Kureli Sankar]

You can simply do identity static

static (dmz,outside) x.x.x.x x.x.x.x net 255.255.255.255

replace x.x.x.x with the public address of the polycomm on the dmz.

-KS

[hobbe · Accepted solution]

Hi according to what you have stated in your initial post you can not use the ASA.

"

One of the requirements needed for this device to be sure its not natted and has direct access to the internet. "

If you set the device up behind the ASA you do not have "direct access to the internet" since it is then behind a firewall.

No matter how we se it they (the manufacturer) will in case of problems then state that your are breaching the requirements.

So what you will have to do to get this unit up and running according to spec is to use a switch outside your ASA towards your ISP and jack the polycom in there and give it a ip address default gw and so on.

If you do not have a switch outside of your ASA already this is a perfect time to be able to set one up.

There are many advantages to have a switch outside of the asa.

Good luck

HTH

[sullyjman12]

Thanks hobbe, I kind of figured something like this would need to be done.  Appericate it, I am implementing it next week so ill keep you updated!

[sullyjman12]

So I put a switch in front of the firewall, I talked to my ISP and they have given me a slash /27 address for public IP addresses.  I setup a test box on the outside switch and configured one of the open addresses we have to test to make sure I can reach it and I cant.

I am assuming my ISP is pointing my public address (/27) to my Cisco ASA port?  If that is the case what is the next step in getting a public address for this box?

[Lee Valentin · Accepted solution]

What is your gateway? Provide a show IP and show run route.

Whatever the gateway is for your firewall, the same should be done for your Polycom.

[sullyjman12]

Thanks Verizon gave me the wrong gateway to use, I did as you suggested and it came online.  Looks like it will be smooth from here.  Thanks!

[sullyjman12]

So the block of ip addresses I was given was a 65.242.6.X/27 address, however the gateway im using is a 63.125.x.x

Here is the weird part and I think this is an OS thing. 

I got the switch up in place as I stated earlier, gave the polycom device (which is running some hacked verison of linux) the public address and whatnot and I cant ping anything at all like google.  However if I grab a windows box put the exact same information on its network card I can surf the web and do anything and everything on the web. 

Its really strange. 

[hobbe]

Hi

Here is one of the great parts of having a switch on the outside of the firewall.

You can setup a monitor port in the switch.

With this monitor port you can observe what the polycom device is sending and recieving, it could just be that it is not allowing pings out to the internet via fx wireshark.

This way you will know what hits the wire and is sent out, also you can check what is coming back.

great for analysing what the problem is.

Another good thing you can do, if the switch can setup access-lists.

If there is a problem on any of the devices (zero day bug or similar) on any of the ports showing up on the internet you can block that with an access-list in the switch.

Or just use if for IDS sensor purposes.

Many good things from a little switch, but make shure that you are ok with it beeing a SPOF (Single Point Of Faliure).

The block used does not seem to match the block of the ip address of the gateway.

And Yes you should try to mask the IP addresses (not show them openly) so that people are not tempted to "test them" or something similar.

or atleast not supply the correct ones.

Good luck

HTH

[sullyjman12]

Unfornually the switch I installed in front of the Cisco ASA is just some generic Linksys switch (single point of failure is not an issue since that has been like that with the Cisco ASA).  So capturing the packets when I try to run the ping test from the polycom is not an option.    I have a Ubuntu box too that I tried giving this public information and it couldnt communicate out either, so this looks it has to do with the way Linux does networking, as I stated before if I put the IP info on a windows xp machine and plug it in it works just fine.  Its really strange

[sullyjman12]

Just to update everyone I got it working.  I knew this had to be an issue with Linux because it worked fine on the windows box.  Did some research and added two lines since the gateway I was given was different than the subnet of the public IP blocks.

the two lines I added was:

route add -host 63.125.107.x dev eth1

route add default gw 63.125.107.x

Presto worked!  I know this has nothing to do with Cisco, its a Linux issue but im sure someone might find this useful!