ASA/Router/Switch NAT for DMZ

Question

I have a Question. We actually have a Cisco 1812 Router and we're Switching to an ASA 5512-X. The Problem is, the ASA 5512-X only has 6 Ports. The 1812, had 8. All in use.

We need to translate 3 Public IP Adresses into our Private IP Adresses for our Servers in the DMZ. We also need the other Ports. Our Situation now is, that the 3 IP Adresses are translated from the Router. But with the ASA we don't have enough Ports for this.

My Question is, can I "forward" those 3 IP Addresses from the ASA over the BLUE Port (in my Picture) to the Switch (I think i need Layer3 for this?!) and the Switch does the Translation?

The Translation should be: Public IP A,B or C comes in from the Internet to the ASA, get forwarded to the switch and the switch translates it to the correct private IP. Public IP A to Public IP B.

I have asked this in another Forum and got the answer, that an ASA can't replace a Router. Yes this is right but we don't need much functionality.

We have 4 seperate subnet. One DMZ. And three AP with two different VLAN. Thats all. And you see, this er six ports. 4 for our subnets, 1 for WIFI (I Hope i can only use one for 3 APs) and 1 for DMZ.

Are their any other solutions? Maybe using a normal router? a newer one, not the 1812.

Answer 1

Back on the stage :) One small and unimportant detail: according to Cisco, one model of 2960 is Layer 3 capable - 2960XR.

Speaking about your possible configuration, it woud be nice to have two additional switches (vlan capable, not dumbs). I'd use 4 interfaces: "outside", "inside", "DMZ" and "wifi".

"Outside" link goes to your ISP;

"DMZ" - to the DMZ switch with the servers;

"WIFI" connects to the additional wifi network switch. Here you define subinterfaces for 2 wifi vlans. On the switch side corresponding port should be in dot1q trunk mode. Probably you'd need WIFI AP to be in trunk mode too.

"Inside" goes to the second additional switch, which is connecting your internal subnets; define here subinterfaces for the subnets and put switch's port into trunk mode.

One example of such configuration (alas, without the switches): https://www.speaknetworks.com/cisco-asa-dmz-configuration-example/

Answer 2

In fact, you could implement a solution with the servers connected to the switch with your old router too. I mean, you could connect the switch to one of the router's port, have 2 ports free, and servers connect through the switch. I hope you agree that the need for NAT does not mean that every NAT-ed device must use an individual port on the router/ASA?

So, IMO the place for doing NAT should be ASA and your switch could be Layer2.

Put one ASA's port into your DMZ, give it appropriate security level, connect there the switch, tell the servers to use ASA's DMZ port as a gateway and you are done. Oh, the NAT rules, of course, - not too hard with ASDM.

I think, the rest of your configuration could be somewhat optimised too (in the part of using ASA's ports), but let's stop here.

Answer 3

First off, in your picture you show a 2960 switch, I am not aware of any 2960s being layer 3, they are all layer 2.

You can use a 2960 layer 2 switch her to meet all your needs. On the ASA, all of the inside networks can share a single port, using sub interfaces with VLANs. You set your switch to a trunk port with the appropriate allowed VLANs and you can then assign the appropriate ports on the switch to access the appropriate VLAN.