2

New to Cisco here, and wanting to know if an idea is possible with my ASA 5506-X (version 9.5).

The ASA has a public/external IP that (for example) is z.z.z.3. Currently, it is performing SNAT for my internal LAN, handling site-to-site VPNs, etc. (I believe in Cisco terms it's called PAT.)

I have another machine that we'll call Host X. It also has a public IP (z.z.z.4) on the same subnet as the ASA. The diagram below shows how things are currently set up.

Network diagram showing router connected to ASA and "Host X"

My question is:
Can I have the ASA be a firewall for Host X with the restrictions below?

  • Host X must keep it's public IP (I have no admin access to Host X)
  • I have additional empty physical interfaces on the ASA.
  • The ASA must be able to continue doing source NAT for the internal LAN so they have access to the Internet.
  • The ASA must keep it's current external IP address so it can continue being a terminating point for the site-to-site VPNs (not pictured).

That way I can lock down access to Host X with ASA access-lists rather than rely on Host X's firewall. I know this sort of thing would be easy with Linux, but I can't quite wrap my head around how the ASA should be configured.

Improve this question
1
  • Did any of the answers help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively you can answer your own question and accept the answer.
    – Ron Maupin ♦
    Aug 6, 2017 at 2:34

2 Answers 2

Reset to default
1

Yes, ASA can be firewall for another public IP.

Write a specific route for host_x on the router pointing towards firewall and similarly change the default gateway on host_x to point to the firewall IP z.z.z.3 

Router(config)# ip route z.z.z.4 255.255.255.255 z.z.z.3

Also, you need to enable the command same-security-level intra-interface traffic command on the firewall.

This way, you can control the traffic going to and fro by the access-list defined on interface connecting to the switch on the firewall.

I know changing default gateway in the host_x requires admin access. I think all the scenarios require changing the default gateway on host_x.

Improve this answer
1
  • 1
    I've been pondering this and since the router is on the same link, would it ignore the route? In other words, a packet destined for z.z.z.4 -- wouldn't the router at z.z.z.2 just send out an arp who-has for z.z.z.4 and then direct the packets there? Or does that static route take precedence over local on-link route and get it over to the ASA?
    – Willie
    May 12, 2017 at 22:12
0

You can use Multiple Context Mode, and 2 instance inside, one for your present configuration, and second for transparent firewall mode for ip-less. You can read about here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/ha_contexts.html

Be careful, and don't forget to make backup of your configuration.

Improve this answer
1
  • This seems like it would work well. A transparent firewall combined with a routed one is exactly what I need. Unfortunately, the ASA 5506-X doesn't have support for Multiple Context Mode. Still, would be a good solution for anyone with a higher level ASA.
    – Willie
    May 13, 2017 at 0:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.