3

enter image description here I have a topology as in the picture. It is designed to be a factory network. 2 ASAs in a failover cluster border the whole LAN. And it is pretty much clear how to configure them: outside interface to ISP, inside subinterfaces to different VLANs. But, I need ti have also HA clusters to border Workshops from the rest of the LAN. And I cannot understand, how exactly to configure ASAs. I thought to put them in a transparent mode. But in any case, the interface (Outside) from ASA to switch DSW3-RING need to be trunk, isn't it?

I got really confused thinking about it. Thanks in advance for help![topology]2

  • It would be helpful if you can specify the policy for the workshop firewalls. What are they allowed to reach, and what are they not? Is the ring a layer 2 trunk? – Ron Trunk Mar 29 '18 at 23:05
  • There are 3 vlans in a workshop, 1st need to have access to the Internet and 2nd needs to reach servers, the third does not have access in or out. From LAN to workshops it is planned to have 1 host, that have access to a host from the 1st vlan behind firewall. – mariiaaa Mar 30 '18 at 7:19
  • And yes, the ring is layer 2 trunk. – mariiaaa Mar 30 '18 at 7:19
3

Assuming you don't route between VLANs, you can create multiple subinterfaces (one for each VLAN) and connect them to the ring as a trunk. The physical interface won't have a name, only the subinterfaces will.

  • Thanks a lot! Can you also explain me how to configure routing? Do I configure default route on the workshop firewalls towards FW1-FW2?On the subinterface? And how do I configure static routes on FW1 and FW2 to workshops. On which subinterface/interface? – mariiaaa Apr 4 '18 at 11:34
  • @mariiaaa In your diagram, you have no router. Your default gateway should be the firewall interface. – Ron Trunk Apr 4 '18 at 12:02
  • I have added a picture to this question. Can you explain which routes and on which subinterfaces I need to configure to be able to ping from network behind WS1 to the network behind WS2? – mariiaaa Apr 4 '18 at 12:11
  • On WS1, you put a route to 172.16.108.0 with next hop of the WS2 firewall, office interface. Do the opposite on WS2 – Ron Trunk Apr 4 '18 at 16:04
  • Thank you very much! It works! I just dont get why the same configurations do not work if applied to on interface in management network. – mariiaaa Apr 5 '18 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.