1

I'm looking for a way to setup a route from my internal LAN to another router.

Here's the current situation: I have an ASA5512-X where all servers are connected and all the employees are connected to, so they can access the internal network. Another company has a Checkpoint Appliance on its LAN. When you are connected to this LAN you can open a Website (hosted at their building) where you can login to their VPN. This website (for example: 192.168.168.100) is only reachable through their CheckPoint Firewall. I don't have access to the Firewall yet. It wasn't configured by me. At the moment, when an employee wants to connect to their network he needs to change the LAN Cable and get the IP of a NOT-SO-SECURE-LAN (192.168.10.0/24), which isn't a good solution.

Both Firewalls have their own outside interface with static IP connected to an unmanaged switch as our modem only has one interface.

I'm looking for a route, where I can reach the website 192.168.168.100 from the internal LAN. When a package is addressed for 192.168.168.100 and sent to the CheckPoint Firewall. But the Checkpoint Firewall should never be allowed to access something in my internal network. It should be like a DMZ.

Is it possible to configure an Interface as part of the "not so secure LAN" ?

NOT-SO-SECURE-LAN: 192.168.10.0/24. GATEWAY: 192.168.10.1

IP ADDRESS OF INTERFACE ON ASA: 192.168.10.10

And then a route like (in linux it would be something like this):

ip route add 192.168.168.100 via 192.168.10.1 dev GigabitEthernet 0/X ?

enter image description here

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Feb 21, 2018 at 18:11

1 Answer 1

Reset to default
1

Yes, this is possible. Just configure the ASA as you would a client (with a static, not a DHCP address unless it is reserved), configure routing and firewall rules and connect it.

Caveats:

  1. When you add a route to (at least) 192.168.168.100/32 through your ASA you also need to add a route back to your network in the Checkpoint (and possibly beyond). There can be no ambiguous IP ranges on both sides (that are routed across).
  2. Failing transparent routing, you need to use source NAT, hiding the real IP address in your network behind 192.168.10.10
  3. The connections you allow have to be explicitly permitted on the ASA. Just allow connections from the clients you want to be able to connect out and no connections back in.
Improve this answer
4
  • But what happens if I'm opening the VPN Connection to their network ? Will the tunnel also will be routed?
    – SystemCookie
    Jan 25, 2018 at 12:58
  • The VPN client and the far VPN gateway need to be able to 'see' each other, requiring a working route. When established, the tunnel is terminated on the VPN client and the gateway. Connections through the tunnel are invisible to the routers outside the tunnel.
    – Zac67 ♦
    Jan 25, 2018 at 14:28
  • But the VPN gateway doesn't see the correct IP of my Laptop, it sees the nat'ed one ? Is this a Problem? Also if two people want to open the connection?
    – SystemCookie
    Jan 26, 2018 at 7:51
  • If you NAT or not (outside the tunnel) doesn't matter. The laptop needs to be able to talk to the VPN gateway and receive replies back. If it can load the HTTP portal page it's most probably fine - provided the VPN protocol doesn't mind NAT (like IPsec without NAT traversal does). However, if you don't have to NAT, don't do it.
    – Zac67 ♦
    Jan 26, 2018 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.