03-13-2019 01:23 PM - edited 02-21-2020 08:56 AM
My CTO want to implement an external firewall that connects to a dmz and internal firewall to connect to the internal LAN using ASA. We currently have an one ASA between the ISP and LAN, no dmz. I am using cisco packet tracer to help with some of the basic configuration but I am having issue get my LAN to get to the internet or access a server in the DMZ. Any help will be appreciated.
03-13-2019 01:35 PM
Hi there,
I assume in your new topology the 'external' ASA will be NAT'ing both your internal and DMZ subnets (the entire 10.0.0.0/8)? If that is the case all you need to ensure is that the local routes to the DMZ layer3 switch are known by the internal layer3 switch and vice versa.
Static routing configured on all devices in the path would suffice for this.
Please share your config if this needs further explanation.
cheers,
Seb.
03-13-2019 04:34 PM
check routes and run a packet capture on the external FW to see if your LAN users hitting the internet, are actually hitting the external FW on its inside interface,
are you doing double NAT or only NAT on external FW?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide