1

I have a Question. We actually have a Cisco 1812 Router and we're Switching to an ASA 5512-X. The Problem is, the ASA 5512-X only has 6 Ports. The 1812, had 8. All in use.

We need to translate 3 Public IP Adresses into our Private IP Adresses for our Servers in the DMZ. We also need the other Ports. Our Situation now is, that the 3 IP Adresses are translated from the Router. But with the ASA we don't have enough Ports for this.

My Question is, can I "forward" those 3 IP Addresses from the ASA over the BLUE Port (in my Picture) to the Switch (I think i need Layer3 for this?!) and the Switch does the Translation?

The Translation should be: Public IP A,B or C comes in from the Internet to the ASA, get forwarded to the switch and the switch translates it to the correct private IP. Public IP A to Public IP B.

I have asked this in another Forum and got the answer, that an ASA can't replace a Router. Yes this is right but we don't need much functionality.

We have 4 seperate subnet. One DMZ. And three AP with two different VLAN. Thats all. And you see, this er six ports. 4 for our subnets, 1 for WIFI (I Hope i can only use one for 3 APs) and 1 for DMZ.

Are their any other solutions? Maybe using a normal router? a newer one, not the 1812.

IsThisPossible?(Picture)

| improve this question | |
1

Back on the stage :) One small and unimportant detail: according to Cisco, one model of 2960 is Layer 3 capable - 2960XR.

Speaking about your possible configuration, it woud be nice to have two additional switches (vlan capable, not dumbs). I'd use 4 interfaces: "outside", "inside", "DMZ" and "wifi".

"Outside" link goes to your ISP;

"DMZ" - to the DMZ switch with the servers;

"WIFI" connects to the additional wifi network switch. Here you define subinterfaces for 2 wifi vlans. On the switch side corresponding port should be in dot1q trunk mode. Probably you'd need WIFI AP to be in trunk mode too.

"Inside" goes to the second additional switch, which is connecting your internal subnets; define here subinterfaces for the subnets and put switch's port into trunk mode.

One example of such configuration (alas, without the switches): https://www.speaknetworks.com/cisco-asa-dmz-configuration-example/

| improve this answer | |
  • I completely agree with using four ports. That's my plan. Outside goes to ISP - agree DMZ goes to seperate switch as the other networks. Not nice cause there are only 3 Servers in DMZ and using a own switch would be waste of money !? I will need for my inside network 10.100.100.0 about 80 Ports. So i would like to have DMZ, the other 3 subnet (not the 10.100.100.0) and the wifi ports on one Switch. – SystemCookie Feb 2 '16 at 14:35
  • PS: The link is exactly what i am looking for! Thx! I mark your answer as correct because it helped me a lot! – SystemCookie Feb 2 '16 at 14:37
  • IGlad it helped you. If you feel using the entire switch for the DMZ is a waste, you could do a simple trick - create there an isolated vlan (e.g vlan 999) and put 4 ports into it. Do not trunk it anywhere, it is simply isolating 4 ports from the rest of the switch. Connect there your 3 servers and DMZ interface of ASA, that's it. – Muti Onu Feb 5 '16 at 13:43
  • i have figured this out :) thanks to google :P i will do this! I am ordering the ASA and the Switch next week and i will go for a CCNA course :P i really like this topic! :) – SystemCookie Feb 6 '16 at 22:33
  • Altough I have a Problem. I have made two vlan (10,20) assigned. Assigned them two 4 Ports on the switch (One Port to ASA, 3 to Servers). So i am using 8 ports. I am able to ping inside to VLAN (not the problem) but i am not able to ping into the other Vlan. I am doing this in Simulation Tool. The "Package goes to the ASA" but is there thrown away. I thought that when the ASA is connected to both VLANS, they can communicate. PS: If you still reading this you're god! :D – SystemCookie Feb 8 '16 at 12:24
1

In fact, you could implement a solution with the servers connected to the switch with your old router too. I mean, you could connect the switch to one of the router's port, have 2 ports free, and servers connect through the switch. I hope you agree that the need for NAT does not mean that every NAT-ed device must use an individual port on the router/ASA?

So, IMO the place for doing NAT should be ASA and your switch could be Layer2.

Put one ASA's port into your DMZ, give it appropriate security level, connect there the switch, tell the servers to use ASA's DMZ port as a gateway and you are done. Oh, the NAT rules, of course, - not too hard with ASDM.

I think, the rest of your configuration could be somewhat optimised too (in the part of using ASA's ports), but let's stop here.

| improve this answer | |
  • I forget to explain, that the other Ports should be in another subnet. Like the DMZ inside IP is 10.100.100.0 and the other Ports should be in the Subnet 10.101.101.0. Maybe the solution is VLAN? But if the place for doing NAT is ASA, ASA sends the nat-ed IP to Switch and this Switch can handle it? Our actual Router is EOL so we need to change :) – SystemCookie Jan 28 '16 at 13:59
  • If you need to use the same 2960 switch for both subnets, yes, you could separate them with a pair of vlans. If you have more switches and connect one of them to your "inside"interface, you could live without VLANs. You wrote you have 4 subnets + dmz + wifi, now I see only two, which is right? – Muti Onu Jan 28 '16 at 14:28
  • Well, I do not know the size of your network and how it worked with 1812 router and without vlans. I think it is possible that every subnet was physically isolated and the subnets met only on 1812, am I right? And the router did DHCP for all the subnets? Chat - I must leave in 5 min and be online only tomorrow morning. – Muti Onu Jan 28 '16 at 15:11
  • Okay - I have enough time overthinking the network. So it would be nice to hear you again. It seems you have a lot of knowledge :) – SystemCookie Jan 28 '16 at 15:36
0

First off, in your picture you show a 2960 switch, I am not aware of any 2960s being layer 3, they are all layer 2.

You can use a 2960 layer 2 switch her to meet all your needs. On the ASA, all of the inside networks can share a single port, using sub interfaces with VLANs. You set your switch to a trunk port with the appropriate allowed VLANs and you can then assign the appropriate ports on the switch to access the appropriate VLAN.

| improve this answer | |
  • Thanks. So in conclusion, i can buy the ASA und the switch and i will be happy? Why do i need a trunk port? sorry - i am really newbie. But google helps me a lot, but not now. – SystemCookie Jan 28 '16 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.