Simple Question: Not using "outside" or "inside" for interface namif

[mst2irad4113]

Hello All,

I have what I hope is an easy question.

Device: ASA5512

IOS: 9.5(2)

Goal: I would like to set up my ASA to use interface names that are not "outside" and "inside".

Information: I know how to change the names of the interfaces, add NAT rule, add route, set security levels, and add ACLs... but there seems to be something missing that using "outside" and "inside" does that I can't see.

Question: When an interface is named "outside" it automatically set's its security level; same with "inside". I would like to know what is done (automatically) so that I can use CLI to do it with my custom interface names.

[Julio E. Moisa]

Hi 

Please correct me if I am not understanding the question correctly.

When you use outside name the image set the security level to 0 automatically and for "inside" name to 100. It is made by the image for security best practice. 

Basically if the image detects the first letters starting with "out" or other words except "inside" it will set security level 0

Please rate the comment if it is useful

:-)

[mst2irad4113]

Correct. When I name an interface "outside" it does set the security level to 0 and "inside" sets it to 100.

What I am trying to do is not use either "outside" or "inside" for my interface names.

Example:

- nameif Internet_Network     (for WAN)

- nameif Home_Network        (for LAN)

I set those interfaces to their correct security levels; 0 for Internet_Network and 100 for Home_Network.

In addition, I entered the route and ACLs but the Home_Network can't reach the Internet_Network.

I know if I just use "inside" and "outside" things will work, but I prefer not to use generic names.

[Julio E. Moisa]

Yeap totally agree, I like change the names for the interfaces.

Basically if the image detects the first letters starting with "out" or other words except "inside" it will set security level to 0

Also remember that the ACL will be associated to the access-groups and them associated to the nameif under the respective interface. 

Hope the comments were useful

:-)

[mst2irad4113]

I have configured my interfaces

interface GigabitEthernet0/0

- nameif Dirty_Internet

- security-level 0

- 192.168.1.3 255.255.255.0

interface GigatbitEthernet0/1

- nameif Clean_Home

- security-level 100

- 192.168.100.1 255.255.255.0

route 0 0 192.168.1.1 Dirty_Internet

access-group Dirty_Internet_in in interface Dirty_Internet

nat (Clean_Home,Dirty_Internet) source static any interface unidirectional

Traffic is not passing through... I feel like I am missing something basic.

[Julio E. Moisa]

Hi

Try this config, assuming your routing is ok (default route, static routes to internal networks:

object-group network PRIVATE-NETS
network-object 192.168.0.0 255.255.0.0

access-group Clean_Home_in in interface Clean_Home   (remember to create your ACL to translate from internal to public)

nat (Clean_Home,Dirty_Internet) source dynamic PRIVATE-NETS interface

[Richard Burts]

I wonder if the issue is about the NAT. I am not clear about the logic of source static. I would expect to see something more like that Julio suggests that makes the translation dynamic.

HTH

Rick