1

I am attempting to setup a temporary network for a company in transition that is moving into a new building. They just bought and had installed an AT&T business internet connection. They have a couple devices they would like in a DMZ - a rather old server (that basically must have a static IP reservation) and a modern machine running their proprietary application. Everything else can just do whatever - an internet connection is all thats needed. They have a bunch of mid-2000's Cisco gear lying around, and I grabbed an ASA 5510 to make this work.

My main issue thus far is when attempting to connect the ASA to the gateway (an Arris BGW210-700, branded AT&T and running AT&T software), I am not sure how to do this.

I was planning on setting up something like this on the ASA:

interface Ethernet0/0

description WAN_Interface

nameif WAN

security-level 0

ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx

And add a default route to send all traffic out to the gateway via that interface.

But, I am not sure how to setup the AT&T gateway to allow this. I found some setting called "IP Passthrough" that seemed like it would do the job:

https://forums.att.com/conversations/att-internet-equipment/bridgemode-vs-ip-passthrough-setup-information/5defbfffbad5f2f606ad5ed2

I decided to use manual mode, as I felt that would make NAT for the DMZ easy. There aren't a lot of options for manual IP passthrough - really I can only add the MAC address of the device being used (so I entered the MAC address of Eth0/0 on the ASA) But....Eth0/0 on the ASA remains down/down.

I have a few questions:

Am I going about accomplishing this correctly/cleanly? I readily admit to being in the dark on this. Has anyone successfully done this (firewall behind an ISP provided gateway)? I feel like it must be a fairly common SOHO scenario.

Assuming I am going down the correct path, do I need to enter the WAN address of the gateway as the ip address and mask for the Eth0/0 interface? I assume I need to enter something, as IP Passthrough with DHCP-Fixed didn't work (and I set the ASA interface to DHCP). There are other settings in the gateway that caught my eye as well; cascading router for one. Do I need other settings like that modified?

I'd love to hear from anyone who has experience doing this.

Thanks guys. I appreciate you.

1

We can help with the ASA configuration but you'll need to contact AT&T for help with their gateway. That's just something we can't help with as there are too many possibilities with it running their own firmware and such. Effectively, you need to put the AT&T gateway into bridged mode since your public address space will be configured on the ASA, which will also be performing your NATs.

These examples assume you are using ASA OS 8.3 or higher

For the ASA, what you have for the outside interface configuration is correct. You will obviously need to create an inside interace as well.

You will need a default route (like you mentioned), such as: (assuming your interface names are "inside" and "WAN")

route WAN 0.0.0.0 0.0.0.0 <gateway>

In addition to that, you SHOULD assign ACLs to each interface (even if they're allowing everything outbound), otherwise you will have no inherent protections.

You can create some basic ACLs and assign them like: (assuming your interface names are "inside" and "WAN")

access-list from_inside extended permit ip any any
access-list from_WAN extended deny ip any any
access-group from_inside in interface inside
access-group from_WAN in interface WAN

You will also need a basic NAT statement: (assuming your interface names are "inside" and "WAN")

nat (inside,WAN) after-auto source dynamic any interface

13
  • Thank you! This is helpful. I do have one issue though, when attempting to put in the NAT rule, the ASA doesn't like the format above. nat (inside,WAN) after-auto source dynamic any interface I am only allowed to get as far as nat (Inside) Everything else just produces an error. – jim Sep 23 '20 at 22:33
  • @jim What did you name your 2 interfaces? You can type show nameif if you don't want to see the rest of the interface config. – Jesse P. Sep 23 '20 at 23:16
  • P Just "Inside" and "Outside". nat (Inside? only gives the option for a ), closing parenthesis. – jim Sep 23 '20 at 23:39
  • @jim That's why, then. Like I said, I was accounting for you sticking with "WAN" since that's what you had in your original post. So, you'll need to type nat (inside,outside) after-auto source dynamic any interface. Keep in mind that there is no space between the first interface name, the comma, and the second interface name, if you're not copy/pasting what I typed. – Jesse P. Sep 23 '20 at 23:43
  • @jim If that doesn't solve the problem, copy/paste exactly what you're typing in so I can see exactly how it looks. – Jesse P. Sep 24 '20 at 0:46
2

"AT&T Business Fiber" is just a more expensive version of Residential Uverse. In a true business setting -- class A office space -- it might be delivered by ASE (vs. xPON), and business accounts can get static address blocks. (residential officially no longer allows statics.)

If you stick with a dynamic address, the configuration is just like any other residential Uverse setup: "DMZ+" or "IP Passthru" There are plenty of places around the internet detailing that process.

If you get a static address block, your life will be a bit easier. (T messing with their RG aside.) Under "Home Network" > "Subnets & DHCP", fill in the part under "Public Subnet". Leave the DHCP Pool "private". Then manually enter the public address information on each device you want on the public internet; the gateway is the address entered in the "public gateway address" box. (yes, this is an "overlayed network" - 192.168.1.0/24 and the static block are on the same wire)

[ AT&T will program those settings when you order a static block. But the user can edit them as well. ]

interface GigabitEthernet0/2
 flowcontrol send on
 nameif uverse
 security-level 0
 ip address 23.x.y.2 255.255.255.248
!
route uverse 0.0.0.0 0.0.0.0 23.x.y.1 10 
!
object network obj-inside-01
 subnet 192.168.0.0 255.255.0.0
 nat (inside,uverse) dynamic interface

Then run a cable from 0/2 to one of the LAN ports on the RG. (set the subnet to whatever your inside network(s) are.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.