2

First, a disclosure: This is my first Cisco device ever. Only ever used dumb hubs/switches and computers before.

We need to use an ASA 5505 to route UDP traffic from one (otherwise air-gapped) private network (192.168.3.x, inside) to another (otherwise air-gapped) network (10.10.10.x, outside). Each network currently has < 5 machines connected by a simple unmanaged switch. The 5505 will have its one outside port connected to the outside switch and its one inside port connected to the inside switch. Traffic is only allowed to flow from inside to outside not the reverse, hence UDP.

I've managed to get it to work for ONE machine on the outside, by setting that machine's address as the gateway. However, it is NOT actually a gateway, it is just a Windows desktop, so this will not work for my actual requirements. But I cannot figure out how to have the firewall just route all traffic received from the inside to the outside network. It is probably quite simple, but it escapes me.

Oh, we've not yet been able to get anything to connect via telnet or SSH to the 5505, but we (barely) managed to get the web/java interface to work from a Windows Embedded Standard 7 desktop (one of the inside machines). Apologies in advance if this is an inappropriate question here.

My running-config.cfg values (from a backup made by the GUI) are:

 Cryptochecksum: f11dee8e 05035a66 fe2a7a49 813a2eed 
 : Saved
 : Written by enable_15 at 10:02:20.369 UTC Wed Apr 13 2016
 !
 ASA Version 8.2(5) 
 !
 hostname ciscoasa
 names
 !
 interface Ethernet0/0
  switchport access vlan 2
 !
 interface Ethernet0/1
 !
 interface Ethernet0/2
 !
 interface Ethernet0/3
 !
 interface Ethernet0/4
 !
 interface Ethernet0/5
 !
 interface Ethernet0/6
 !
 interface Ethernet0/7
 !
 interface Vlan1
  nameif inside
  security-level 100
  ip address 192.168.3.1 255.255.255.0 
 !
 interface Vlan2
  nameif outside
  security-level 0
  ip address 10.10.10.100 255.255.255.0 
 !
 ftp mode passive
 pager lines 24
 logging asdm informational
 mtu inside 1500
 mtu outside 1500
 icmp unreachable rate-limit 1 burst-size 1
 no asdm history enable
 arp timeout 14400
 nat-control
 global (outside) 1 interface
 nat (inside) 1 0.0.0.0 0.0.0.0
 route outside 0.0.0.0 0.0.0.0 10.10.10.10 1
 timeout xlate 3:00:00
 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
 timeout tcp-proxy-reassembly 0:01:00
 timeout floating-conn 0:00:00
 dynamic-access-policy-record DfltAccessPolicy
 http server enable
 http 192.168.3.0 255.255.255.0 inside
 no snmp-server location
 no snmp-server contact
 snmp-server enable traps snmp authentication linkup linkdown coldstart
 crypto ipsec security-association lifetime seconds 28800
 crypto ipsec security-association lifetime kilobytes 4608000
 telnet timeout 5
 ssh timeout 5
 console timeout 0
 dhcpd auto_config outside
 !
 dhcpd address 192.168.3.5-192.168.3.36 inside
 !

 threat-detection basic-threat
 threat-detection statistics access-list
 no threat-detection statistics tcp-intercept
 webvpn
 !
 class-map inspection_default
  match default-inspection-traffic
 !
 !
 policy-map type inspect dns preset_dns_map
  parameters
   message-length maximum client auto
   message-length maximum 512
 policy-map global_policy
  class inspection_default
   inspect dns preset_dns_map 
   inspect ftp 
   inspect h323 h225 
   inspect h323 ras 
   inspect rsh 
   inspect rtsp 
   inspect esmtp 
   inspect sqlnet 
   inspect skinny  
   inspect sunrpc 
   inspect xdmcp 
   inspect sip  
   inspect netbios 
   inspect tftp 
   inspect ip-options 
 !
 service-policy global_policy global
 prompt hostname context 
 no call-home reporting anonymous
 Cryptochecksum:f11dee8e05035a66fe2a7a49813a2eed
 : end

I hope that is useful. Thanks for looking at this.

4
  • which software version do you run on the ASA? Can you add the configuration in your question?
    – JFL
    Apr 13 '16 at 18:52
  • If you can tell me how to GET the configuration in a form that would be useful, I'll be glad to add it. ASA Version 8.2 (5) and Manager software version 6.4 (5). Apr 13 '16 at 19:02
  • If you want you can come to chat
    – JFL
    Apr 13 '16 at 19:06
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14 '17 at 1:21
2

Here's partial answer (to the SSH problem):

First, you need to generate the encryption keys

ip domain-name mycorp.com
crypto key generate rsa modulus 2048

Next, you need to configure user accounts

username jfl privilege 15 password opensesame
!<additional accounts>
aaa authentication ssh console local

Finally, allow SSH from the desired addresses

ssh 192.168.3.0 255.255.255.0 inside
ssh version 2
1
  • (typed while smiling) Thanks for the info, but I'm not sure how to use CLI instructions in order to obtain access to the CLI itself, which is what I've not yet figured out how to get working. However, that wasn't my real problem (which has been resolved by removing the static route I'd added). I just mentioned that I have no CLI access because a CLI-only solution would not have helped me. Thanks anyway, though, for trying. Apr 14 '16 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.