I am attempting to setup a temporary network for a company in transition that is moving into a new building. They just bought and had installed an AT&T business internet connection. They have a couple devices they would like in a DMZ - a rather old server (that basically must have a static IP reservation) and a modern machine running their proprietary application. Everything else can just do whatever - an internet connection is all thats needed. They have a bunch of mid-2000's Cisco gear lying around, and I grabbed an ASA 5510 to make this work.
My main issue thus far is when attempting to connect the ASA to the gateway (an Arris BGW210-700, branded AT&T and running AT&T software), I am not sure how to do this.
I was planning on setting up something like this on the ASA:
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
And add a default route to send all traffic out to the gateway via that interface.
But, I am not sure how to setup the AT&T gateway to allow this. I found some setting called "IP Passthrough" that seemed like it would do the job:
I decided to use manual mode, as I felt that would make NAT for the DMZ easy. There aren't a lot of options for manual IP passthrough - really I can only add the MAC address of the device being used (so I entered the MAC address of Eth0/0 on the ASA) But....Eth0/0 on the ASA remains down/down.
I have a few questions:
Am I going about accomplishing this correctly/cleanly? I readily admit to being in the dark on this. Has anyone successfully done this (firewall behind an ISP provided gateway)? I feel like it must be a fairly common SOHO scenario.
Assuming I am going down the correct path, do I need to enter the WAN address of the gateway as the ip address and mask for the Eth0/0 interface? I assume I need to enter something, as IP Passthrough with DHCP-Fixed didn't work (and I set the ASA interface to DHCP). There are other settings in the gateway that caught my eye as well; cascading router for one. Do I need other settings like that modified?
I'd love to hear from anyone who has experience doing this.
Thanks guys. I appreciate you.