hey guys,
Finally I setup my network infrastructure of dreams :)))) but I have some question that pop-ups in my mind. Let ms first to sheme my network.
ISP modem(USE PPPOE) --> ASA --> router 2611xm --> switch 2950 --> host
Question 1: After I config all devices I put it together but when I try to access the outside I don't have access, from the host --> sw --> router --> asa --> outside, but when I connect my laptop to the ASA is working perfectly why ?
I setup the route in my case are:
on the router: ip route 172.16.2.0 255.255.255.252 172.16.2.1
on the ASA: route Home-Network 172.16.30.160 255.255.255.240 172.16.2.2 1 (also on the ASA when I set the route I use inside or out side?)
Question 2: Why when I use this config I can access outside, below is the new config (with this I can access but from what I know is not ok to use default route)
on the router: ip route 0.0.0.0 0.0.0.0 172.16.2.1
on the ASA: route Home-Network 172.16.30.160 255.255.255.240 172.16.2.2 1 also on the ASA when I set the route I use inside or out side?)
Question 3: Do you have some tips to improve my network security and QoS?
From here are the config setting on each device
Cisco Switch 2950 config
Building configuration...
Current configuration : 5639 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname S1-BETA
!
enable secret 5 dddddddddd
!
username xxxx password 7 yyyyyy
!
class-map match-all SERVER
match access-group name SERVER
class-map match-all TRANSFER
match access-group name TRANSFER
class-map match-all MANAGEMENT
match access-group name MANAGEMENT
class-map match-all EMAIL
match access-group name EMAIL
class-map match-all WEB
match access-group name WEB
!
!
policy-map MARKING-TRAFFIC
class SERVER
police 3000000 8192 exceed-action drop
!
ip subnet-zero
!
ip dhcp snooping vlan 55
ip dhcp snooping
no ip domain-lookup
ip domain-name xxxxxx.com
ip ssh time-out 120
ip ssh authentication-retries 3
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
description this is a trunk port
switchport trunk native vlan 88
switchport trunk allowed vlan 19,29,55,88,94
switchport mode trunk
switchport nonegotiate
ip dhcp snooping trust
!
interface FastEthernet0/2
switchport access vlan 55
switchport mode access
switchport nonegotiate
switchport port-security maximum 8
spanning-tree portfast
spanning-tree bpduguard enable
ip dhcp snooping limit rate 6
!
interface FastEthernet0/3
switchport access vlan 94
switchport mode access
switchport port-security maximum 2
ip dhcp snooping trust
!
interface FastEthernet0/4 - f0/24
switchport access vlan 999
switchport mode access
shutdown
!
interface Vlan1
no ip address
no ip route-cache
shutdown
!
interface Vlan55
ip address 172.16.30.162 255.255.255.240
ip helper-address 172.16.30.161
no ip route-cache
!
ip default-gateway 172.16.30.161
ip http server
!
ip access-list extended EMAIL
permit tcp 172.16.30.160 0.0.0.15 any eq pop2
permit udp 172.16.30.160 0.0.0.15 any eq 109
permit tcp 172.16.30.160 0.0.0.15 any eq pop3
permit udp 172.16.30.160 0.0.0.15 any eq 110
permit tcp 172.16.30.160 0.0.0.15 any eq 995
permit udp 172.16.30.160 0.0.0.15 any eq 995
permit udp 172.16.30.160 0.0.0.15 any eq 25
permit tcp 172.16.30.160 0.0.0.15 any eq smtp
permit tcp 172.16.30.160 0.0.0.15 any eq 220
permit udp 172.16.30.160 0.0.0.15 any eq 220
permit tcp 172.16.30.160 0.0.0.15 any eq 143
permit udp 172.16.30.160 0.0.0.15 any eq 143
permit tcp 172.16.30.160 0.0.0.15 any eq 993
permit udp 172.16.30.160 0.0.0.15 any eq 993
ip access-list extended MANAGEMENT
permit tcp 172.16.30.160 0.0.0.15 any eq telnet
permit udp 172.16.30.160 0.0.0.15 any eq 23
permit tcp 172.16.30.160 0.0.0.15 any eq 22
permit udp 172.16.30.160 0.0.0.15 any eq 22
ip access-list extended SERVER
permit ip host 172.16.30.173 host 172.16.1.2
ip access-list extended TRANSFER
permit udp 172.16.30.160 0.0.0.15 any eq 20
permit tcp 172.16.30.160 0.0.0.15 any eq ftp-data
permit udp 172.16.30.160 0.0.0.15 any eq 21
permit tcp 172.16.30.160 0.0.0.15 any eq ftp
permit udp 172.16.30.160 0.0.0.15 any eq tftp
permit tcp 172.16.30.160 0.0.0.15 any eq 69
permit tcp 172.16.30.160 0.0.0.15 any eq 115
permit udp 172.16.30.160 0.0.0.15 any eq 115
ip access-list extended WEB
permit tcp 172.16.30.160 0.0.0.15 any eq www
permit udp 172.16.30.160 0.0.0.15 any eq 80
permit tcp 172.16.30.160 0.0.0.15 any eq 443
permit udp 172.16.30.160 0.0.0.15 any eq 443
banner motd ^C If you are not the ADMIN get the got!!!!^C
!
line con 0
exec-timeout 180 0
login local
line vty 0 4
exec-timeout 180 0
login local
transport input ssh
line vty 5 15
exec-timeout 180 0
login local
transport input ssh
!
!
end
---------------------------------------------------------------------------------------------------------
Cisco Router 2600 config
Building configuration...
Current configuration : 3386 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname R1-ALFA
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 10 log
security passwords min-length 10
enable secret ggggggggggggg
!
aaa new-model
!
!
aaa authentication login local_auth local
!
!
aaa session-id common
no network-clock-participate slot 1
no network-clock-participate wic 0
no ip source-route
no ip gratuitous-arps
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 172.16.30.161
ip dhcp excluded-address 172.16.30.175
ip dhcp excluded-address 172.16.30.162
ip dhcp excluded-address 172.16.30.173
ip dhcp excluded-address 172.16.30.172
ip dhcp excluded-address 172.16.30.171
!
ip dhcp pool theAPinside
network 172.16.30.160 255.255.255.240
default-router 172.16.30.161
dns-server 213.156.124.1
!
!
no ip bootp server
login block-for 180 attempts 3 within 180
!
multilink bundle-name authenticated
!
!
!
!
!
username rrrrrrrrrrr password vvvvvvvvvv
archive
log config
hidekeys
!
!
!
!
ip ssh port xxxxxxx rotary 12
!
class-map match-any SERVER
match access-group name SERVER
class-map match-any TRANSFER
match access-group name TRANSFER
class-map match-any MANAGEMENT
match access-group name MANAGEMENT
class-map match-any EMAIL
match access-group name EMAIL
class-map match-any WEB
match access-group name WEB
!
!
!
!
interface FastEthernet0/0
description The interface that talk with ASA for net
ip address 172.16.2.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
no cdp enable
no mop enabled
!
interface FastEthernet0/1
description The interface that let you to play inside
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no ip mroute-cache
duplex auto
speed auto
no cdp enable
no mop enabled
!
interface FastEthernet0/1.19
description The vlan from devices like printes (static)
encapsulation dot1Q 19
ip address 172.31.245.145 255.255.255.240
no cdp enable
!
interface FastEthernet0/1.29
description The vlan for something I don't know
encapsulation dot1Q 29
ip address 172.16.0.1 255.255.255.240
no cdp enable
!
interface FastEthernet0/1.55
description The vlan for play on net
encapsulation dot1Q 55
ip address 172.16.30.161 255.255.255.240
no cdp enable
!
interface FastEthernet0/1.88
shutdown
no cdp enable
!
interface FastEthernet0/1.94
description the vlan for farmvile
encapsulation dot1Q 94
ip address 172.16.1.1 255.255.255.240
no cdp enable
!
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.16.2.1
!
!
no ip http server
ip http secure-server
ip dns server
!
ip access-list extended fohSSH
deny tcp any any eq 22
permit tcp any any eq xxxxx
!
no cdp run
!
!
!
!
control-plane
!
!
banner motd ^CIf you're not the Admin get out!!^C
!
line con 0
exec-timeout 180 0
login authentication local_auth
line aux 0
login authentication local_auth
line vty 0 4
access-class fohSSH in
rotary 12
transport input ssh
line vty 5 9
access-class fohSSH in
rotary 12
transport input ssh
line vty 10
access-class fohSSH in
login authentication local_auth
rotary 12
transport input ssh
line vty 11 15
access-class fohSSH in
rotary 12
transport input ssh
!
!
end
------------------------------------------------------------------------------------------------------
ASA Version 8.4(5)
!
interface Ethernet0/0
description Home Outside Network
switchport access vlan 888
!
interface Ethernet0/1
description Home Inside Network
switchport access vlan 999
!
interface Vlan 8888
description This is the outside / ISP side
nameif outside
security-level 0
pppoe client vpdn group ISP-CON
ip address pppoe setroute
!
interface Vlan 999
description the Home Network
nameif Home-Network
security-level 100
ip address 172.16.2.1 255.255.255.252
!
nat (Home-Network,outside) after-auto source dynamic any interface
route Home-Network 172.16.30.160 255.255.255.240 172.16.2.2 1
!
vpdn group ISP-CON request dialout pppoe
vpdn group ISP-CON localname xxxxxxxxxxxxx
vpdn group ISP-CON ppp authentication pap
vpdn username ******* password ***** store-local
