2

Upgrading an ASA5510 to an ASA5525-X, we want to change from transparent to routed mode so Packet Tracer will work. Also want to undo the change easily and without making our provider change routing at the same time.

Could we add a router like in the weird-looking config below? The routing is all static. To undo we'd move a few patch cords. Once we trust the new firewall, our provider would make a routing change and we'd remove the temporary extra router.

But in the temp setup, could we safely route from provider to subnet A to subnet B to subnet A to our internal network (a supernet of A and B)?

BEFORE [* = interface]

Provider Edge router*1.1.1.1 --old fw-- 1.1.1.2*my router to 1.1.0.0/16

AFTER

PE*1.1.1.1 --- 1.1.1.2*temp rtr*1.1.2.1 --- 1.1.2.2*new fw*1.1.1.1 --- 1.1.1.2*my router to 1.1.0.0/16

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 12, 2017 at 23:04

2 Answers 2

2

You can't do it that way, as new_fw will have the same route (1.1.1.0) on both sides of it (always preferring the connected one pointing to my_router).

Assuming your ISP is routing you a block of IPs (eg: /29), then I'd connect a switch to PE, and connect old_fw to the switch and keep everything status quo. Then, connect new_fw to the same switch, give it a new IP from your block (eg: 1.1.1.3) on the inside of new_fw, connect a workstation to test with. You can even configure it with the IP block that will eventually be between new_fw and my_rtr, so when you make the switchover and connect my_rtr to new_asa, things'll just work.

This allows you to test the new setup, without altering your existing setup (less adding a switch between your networks and the PE.

When you're done testing, you just need to move my_rtr to the new_fw (and if needed, change the new_asa external IP to that of my_rtr).

3
  • Our provider routes 1.1.0.0/16 (alias for our RFC1918 internal network) to 1.1.1.2/24. If the new fw routes 0/0 to 1.1.2.1 and 1.1.0.0/16 to
    – Paul
    Commented Dec 1, 2015 at 17:33
  • Took too long to edit the above comment. Here it is: Like your test plan but think we need temp-rtr. Our provider is an internal ISP. They route 1.1.0.0/16 (representing our RFC1918 internal network) to 1.1.1.2/24. Let the new fw route 1.1.0.0/16 to 1.1.1.2 and 0/0 to 1.1.2.1. Let temp-rtr route 10.17.0.0/16 to new fw outside interface (1.1.2.2) and 0/0 to provider (1.1.1.1). What am I missing?
    – Paul
    Commented Dec 1, 2015 at 17:47
  • Above should read "Let temp-rtr route 1.1.0.0/16 to new fw outside interface..."
    – Paul
    Commented Dec 1, 2015 at 18:01
2

So you could do this. However, there would be more involved. Stieveb, is correct that your "new-fw" would see two potential routes to 1.1.1.0/2? because you are trying to make a routed mode FW work like a transparent mode. What you could do, to make it work would be to put into place NAT for the 1.1.1.0/2? network on both the temp_rtr, facing the new_fw, and the new_fw facing the temp_rtr.

In this way both devices see different network numbering for that range on the side that they aren't directly connected to. I'm not saying that it's necessarily a great idea, but it would make your proposed config work.

If I were doing this, what I would do would be to create two copies of the config. One for the transparent, and one for the routed. In this way you could get rid of both routers and if something breaks due to the routed setup, you ssh into the new_fw, paste in the "transparent config" and move the two cables to place the my_rtr back inline. Given what I understand from your requirements in any event!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.