amr alrazzaz
As other responses have pointed out there is very little of the interface config from your router that can be directly transferred to the ASA. What you need to do is to examine the functionality of the router interface and figure out how that functionality would be implemented on the ASA.
Perhaps a starting point would be to evaluate the functions performed by the router (not necessarily just the outside interface) and determine what functions would remain on the router and what functions would move to the ASA.
- if there are several switches it suggests that the router is performing inter vlan routing. Is that the case? Should the inter vlan routing remain on the router or would you want to move it to the ASA?
- is the router perhaps acting as a DHCP server for the subnets of the vlans in your network? If so would this remain on the router or would you want to move it to the ASA?
- does the router enforce any security policies for the vlans of the network? If so would these remain on the router or would them move to the ASA?
- the crypto map on the router interface indicates that some type of VPN is operating. Is this a site to site VPN or is it a Remote Access VPN? Which ever type it is likely that you will want to move the VPN function from the router to the ASA.
- the ip nat outside indicates that the router is performing address translation for the networks on the inside. Probably you will want to move this function to the ASA.
- the router outside interface is configured to connect to a trunk and to process a vlan sending tagged Ethernet frames. You would want to configure the ASA interface for that function.
- it is not clear why the router has a primary and a secondary IP address. The ASA does not support secondary addressing. You need to clarify what functions the router is doing with both addresses and determine how they can be moved to the ASA. One of those addresses is used for a transit link for routing between the ISP and the router. This would be the address moved to the ASA interface. What is the other address used for? You would need to clarify this and then to find a way to implement that function on the ASA.
- there is an access list applied as a traffic filter on the router interface. We do not know what is in that access list. The ASA has a default security policy for its outside interface and this policy might already accomplish what the router acl does. If not you need to incorporate some of the router acl logic to the security policy of the ASA.
HTH
Rick
