Using an ASA as a router

[abtt-39]

Hello,

the question is in the title. 

Is it possible to use the ASA as a router between 2 internal networks?

interface GigabitEthernet1/1
nameif outside
security-level 100
ip address 10.0.1.254 255.255.255.0

interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.40.1.249 255.255.255.0

"outside" interface, connected to an L2 switch. 

A PC ( PC1) is connected to this switch

10.0.1.110 255.255.255.0 GW : 10.01.254

The "inside" interface is also connected to an L2 switch, to which PCs are connected. These PCs have IP 10.40.1.X /24 and Gateway 10.40.1.254. This gateway is the IP of the ISP router (VPN MPLS router).

From the "inside" network, I need to retrieve FTP data on PC1. And allow ICMP too. Same thing in reverse (from outside to inside).

But the problem is that if I add a route on the ASA, it asks me to configure the next hop Ip address. But in this diagram, I don't have one?

The goal is to isolate PC1. A laboratory analyzer is connected to this PC (PC not supplied by us). It sends data to this PC, and I can retrieve data via FTp on it to send it to the inside network.

[MHM Cisco World]

First I am busy these day so my reply maybe delay' that OK for you?

Now

Same Subnet 10.0.0.0/24 connect to two routers and ASA ?

That wrong.

MHM

[abtt-39]

yes.

[MHM Cisco World]

If Yes you use same subnet then static route or igp not help here. 

You need to use different subnet

MHM

[alexcarry1044]

Yes, you can use the ASA as a router between two internal networks. Set up bidirectional access rules allowing ICMP and FTP traffic between the "outside" and "inside" networks. Since you don’t have a next hop, you can use route statements with the connected interfaces. Make sure the ASA’s NAT and access lists are properly configured to ensure smooth communication between PC1 and the inside network.

[abtt-39]

Currently, I have not specified it, but ping and ftp are functional between the inside network and the 10.0.0.0/24 network, it is https which is not. But as the diagram shows, there is a router in the architecture that is not managed by us. This week, a technician from this company is coming, I will ask him to check.

[Marius Gunnerud]

If ping and ftp are working between the two networks that you want HTTP access to work then the issue is most likely not routing.  Have you configured NAT and access rules for the HTTP server?

[abtt-39]

Hello,

honestly, I have a doubt about the nat. The nat was configured with asdm

My question is that there are 2 networks directly connected to the ASA and a third which is not.

10.40.1.0 ( INSIDE) ==>ASA==>10.0.1.0 (OUTSIDE)==>Router / firewall (not managed by me) with INSIDe interface 10.0.1.253, outside interface 10.0.0.201==>PC2 (10.0.0.50/24 GW:10.0.0.201).

My diagram:

There is only one active nat rule:

Auto NAT Policies (Section 2)
1 (any) to (outside) source dynamic obj_any interface
translate_hits = 3791, untranslate_hits = 10180
Source - Origin: 0.0.0.0/0, Translated: 10.0.1.254/24

ANd yes from a PC in inside network (10.40.1.4), I can PINg 10.0.0.50 and i can acess to his FTP, but not in https

From a pc from the same network (PC TEMPO1 for exemple in my diagram), i can access web server to 10.0.0.50

[MHM Cisco World]

Again this not work since the same subnet connect to multi L3 devices

MHM

[abtt-39]

Why? i have static route for each PC of the outside interface

[abtt-39]

We will have a meeting with the router and analyzer installers to review the installation. From my point of view, the simplest solution would be to remove our firewall and their router, and have their PC and analyzer in our network. The problem is that we don't want external PCs on our network. We offered to provide them with PCs, but it seems that their hardware is analyzers with embedded Widnows.
So, we would return to the first diagram.

But my inside LAN PCs still need their gateway in 10.40.1.254.
If I replace the L2 switch in the first diagram (the one to which the ISP router is connected) with an L3 switch?

Currently, this L2 switch has:
ip default-gateway 10.40.1.254

On an L3 switch, would something like this work?

ip route 0.0.0.0 0.0.0.0 10.40.1.254
ip route 10.0.0.0 255.255.255.0 10.40.1.249

Concerning the ISP router, I don't have control over it