07-11-2012 08:15 AM - edited 03-11-2019 04:29 PM
Hi,
We have an ASA 5520 which is in multiple context mode.
We are trying to pass traffic from the outside interface to the dmz interface.
I may be fundamentally wrong in the way i'm configuring this, but this is one ting im hoping someone may be able to help with. We have a /27 public ip range. We need a small amount of those addresses to be in the DMZ for SIP servers specifically. The rest of the addresses are NAT'd to the inside interface.
So i created the outside interface GigabitEthernet0/0 with 1.2.3.192/28
Inside Interface GigabitEthernet0/2 with 192.168.20.0/24
DMZ interface on GigabitEthernet0/2.1 with 1.2.3.208/29
So all i want to do is route traffic that comes in the outside interface and out to the DMZ interface for the 1.2.3.208/29 subnet. I set the gateway address as 1.2.3.214 which is the DMZ interface address on the ASA.
I hope this makes sense? Im sure im doing something stupid, im just stuck, and hoping someone can help.
I can provide more info if required.
Thanks
Birdy
07-11-2012 09:03 AM
That really should work. There are some things you should be aware of:
- If your g0/0 is a shared interface you should enable individual MAC-addresses per context so that the ASA can classify the traffic.
- Using a native VLAN on an interface that is also handling subinterfaces is not seen as a best practice. Better use only subinterfaces and the major interfaces should not be configured with any firewalling-settings.
- Your ACLs allow the traffic from outside to DMZ?
- If you still have nat-control enabled (you didn't write which version you are using), then you need a nat-config (nat-exemption) also for the communication between interfaces with public IP addresses.
07-11-2012 09:25 AM
Hi,
Thanks for your reply.
g0/0 isnt a shared interface.
I'll look into the sub-interfaces, thanks for the tip.
Yes i have ACL's allowing traffic outside to DMZ
Im not sure how to configure the NAT exemption rules? Version 8.2
Im sure i disabled nat-control. Do you know how i can check? I cant find in my config.
Thanks again
07-11-2012 10:01 AM
what is the output of:
show run nat
show run nat-control
show run static
07-12-2012 02:15 AM
Hi,
sh run nat:
nat (outside) 0 access-list outside_nat0_outbound outside
sh run nat-control:
no nat-control
sh run static:
Has static NAT definitions, none of which map to DMZ, only to management interfaces currently. There are static routes which are:
0.0.0.0 0.0.0.0 1.2.3.193
192.168.20.0 255.255.255.0 192.168.20.254
Thanks
07-12-2012 06:23 AM
what is your NAT-exemption on your outside-interface for? There could be something involved that drops your traffic.
Try the packet-tracer to simulate your traffic.
07-12-2012 07:06 AM
Apologies. I had not considered that i was sharing an interface between the admin context and the main context. submitted the mac-address auto command in the system context which has resolved this particular issue, although it does lock me out of the admin context!
Apologies again for missing the interface sharing, i know you pointed that out at the beginning and i just missed it.
Thank you for your time and help
Chris
07-12-2012 07:22 AM
No problem. But your admin-context should of course still work after that change. Any nearby devices with static arp-entries or L2-security enabled?
07-17-2012 07:47 AM
Hi,
Sorry, i was away on another project.
Im still having the problem where i cant connect to the admin context if i enable mac-address auto to solve the previous problem.
I do have a Cisco 1921 in front, i havent added any L2 security unless it is on by default. I do notice that the mac address for the admin context changes when i do a sh arp on the 1921, so the address for .194 (admin context ip address) is a different mac-address to .195 (which is the other context). Both go to the g0/0
Im sure im missing something obvious again, but im just not sure what it is.
Thanks
Chris
07-17-2012 08:27 AM
Hi Bro
This is how I would do it, if I were you. In your Cisco ASA (multi-context mode), you will have 3 contexts namely ADMIN CONTEXT, C1 CONTEXT and C2 CONTEXT. I would then allocate Management0/0 to ADMIN CONTEXT, GE0/0 and GE 0/1 to C1 CONTEXT and GE 0/2 and GE0/3 to C2 CONTEXT.
C1 CONTEXT = Catered for INSIDE LAN users
C2 CONTEXT – Catered for DMZ Servers
In C1 CONTEXT, GE0/0 will hold the Public IP for example 202.188.1.2/27 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/1 will hold the Private IP Address 192.168.20.1/24.
Meanwhile in C2 CONTEXT, GE0/2 will hold the Public IP for example 202.188.1.3/27 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/3 will hold the Private IP Address 192.168.30.1/24.
Next, in the C2 context, for all network traffic coming from the Internet to the DMZ Servers, you’ll need to enable static NAT e.g. 202.188.1.30 ••à 192.168.30.30. Please do ensure your Cisco Router has a host route for this entry.
Finally, for outbound traffic in C1 and C2, you could apply dynamic NAT instead, translate to the respective context’s OUTSIDE interface.
There are other factors to look into as well, e.g. ACL, routing etc. If you’d like, you could paste your configuration here, and I could advice further.
You’re in safe hands, as I’ve carried out many such deployments in the past.
07-17-2012 08:53 AM
Hi,
Unfortunately we cannot use NAT, we run OpenSIP/Asterisk servers from the DMZ and NAT causes too many problems with SIP we've found.
I see what saying about the contexts though.
Thanks
07-17-2012 09:04 AM
Hi Bro
If you want to have Public IP Address in your DMZ LAN, that's fine too :-) This means you'll need to breakdown the /27 to 2 /28. 1 /28 will be used on the OUTSIDE interface and the other /28 will be used in DMZ.
In C1 CONTEXT, GE0/0 will hold the Public IP for example 202.188.1.2/28 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/1 will hold the Private IP Address 192.168.20.1/24.
Meanwhile in C2 CONTEXT, GE0/2 will hold the Public IP for example 202.188.1.3/28 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/3 will hold the Private IP Address 202.188.1.17/28.
Next, in the C2 context, for all network traffic coming from the Internet to the DMZ Servers, you’ll need to either enable no nat-control or static(dmz,outside) 202.188.1.16 202.188.1.16 netmask 255.255.255.240 . Please do ensure your Cisco Router has the proper route for this entry i.e. ip route 202.188.1.16 255.255.255.240 202.188.1.3 name DMZ_SERVERS
Finally, for outbound traffic C2, you can just forward them either via nat (dmz) 0 access-list nonat or the same way as done in C1.
Good luck bro! May the force be with you :-)
P/S: If you think this comment is helpful, please do rate it nicely :-)
You’re in safe hands, as I’ve carried out many such deployments in the past.
07-17-2012 09:18 AM
Thanks again.
Only issue is that the 1921 has only 2 interfaces. One is for the internet connection and the other connects to the ASA.
Thanks
Chris
07-17-2012 09:28 AM
Hi Bro
Your Cisco Router 1921 has 2 interfaces, that's fine. In fact, that's all we need. The LAN interface will hold the IP Address 202.188.1.1/28 and the C1 OUTSIDE CONTEXT IP Address will be 202.188.1.2/28 and C2 OUTSIDE CONTEXT IP Address will be 202.188.1.3/28 :-)
07-17-2012 09:31 AM
Ahhh sorry, i see now.
Ok i'll have a look.
I'll let you know how i get on.
Thanks!
Chris
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide