Thanks so much. This looks exactly like what we are doing. Have you notice any issues with this configuration?
________________________________________ From: Ge Moua [EMAIL PROTECTED] Sent: Thursday, April 17, 2008 9:16 AM To: Mike Louis; 'Tim Franklin'; [email protected] Subject: RE: [c-nsp] ASA Transparent Mode with VLAN Trunks Email me offline for the accompanying topology diagram. See below for a working config of this: Regards, Ge Moua | Email: [EMAIL PROTECTED] Network Design Engineer University of Minnesota | Networking & Telecommunications Services ############################ ## SYSTEM EXECUTION SPACE ## ############################ asa5580# sh run : Saved : ASA Version 8.1(0)147 <system> ! firewall transparent hostname asa5580 enable password **REMOVED** encrypted no mac-address auto ! interface Management0/0 description ## Connect to Gi1/0/24 on Infotech-AN-01 * "outside" Mgmt Vlan 1000 for "admin" context on Cisco ASA-5580 ## ! interface Management0/1 shutdown ! interface GigabitEthernet3/0 description ## 802.1Q Trunk * Connect to Gi1/0/13 on Infotech-AN-01 ## ! interface GigabitEthernet3/0.200 description ## Vlan 200 * "inside" Vlan for Firewall Context "TEST-ASA5580-FW001" ## vlan 200 ! interface GigabitEthernet3/1 description ## 802.1Q Trunk * Connect to Gi1/0/14 on Infotech-AN-01 ## ! interface GigabitEthernet3/1.201 description ## Vlan 201 * "outside" Vlan for Firewall Context "TEST-ASA5580-FW001" ## vlan 201 ! interface GigabitEthernet3/2 description ## 802.1Q Trunk * Connect to Gi1/0/15 on Infotech-AN-01 ## ! interface GigabitEthernet3/2.202 description ## Vlan 202 * "inside" Vlan for Firewall Context "TEST-ASA5580-FW002" ## vlan 202 ! interface GigabitEthernet3/3 description ## 802.1Q Trunk * Connect to Gi1/0/16 on Infotech-AN-01 ## ! interface GigabitEthernet3/3.203 description ## Vlan 203 * "outside" Vlan for Firewall Context "TEST-ASA5580-FW002" ## vlan 203 ! interface GigabitEthernet4/0 shutdown ! interface GigabitEthernet4/1 shutdown ! interface GigabitEthernet4/2 shutdown ! interface GigabitEthernet4/3 shutdown ! interface TenGigabitEthernet5/0 description ## 802.1Q Trunk * Connect to TenGi2/4 on Infotech-BR-01 ## ! interface TenGigabitEthernet5/0.3708 description ## Vlan 3708 * "inside" Vlan for Firewall Context "CSERV-FW001" ## vlan 3708 ! interface TenGigabitEthernet5/0.3709 description ## Vlan 3709 * "outside" Vlan for Firewall Context "CSERV-FW001" ## vlan 3709 ! interface TenGigabitEthernet5/1 shutdown ! class default limit-resource All 0 limit-resource Mac-addresses 65535 limit-resource ASDM 5 limit-resource SSH 5 limit-resource Telnet 5 ! boot system disk0:/smp810-147-k8.bin ftp mode passive pager lines 24 no failover asdm image disk0:/asdm-61028.bin no asdm history enable arp timeout 14400 console timeout 0 admin-context admin context admin allocate-interface Management0/0 config-url disk0:/admin.cfg ! context TEST-ASA5580-FW001 allocate-interface GigabitEthernet3/0.200 allocate-interface GigabitEthernet3/1.201 config-url disk0:/TEST-ASA5580-FW001.cfg ! context TEST-ASA5580-FW002 allocate-interface GigabitEthernet3/2.202 allocate-interface GigabitEthernet3/3.203 config-url disk0:/TEST-ASA5580-FW002.cfg ! context CSERV-FW001 allocate-interface TenGigabitEthernet5/0.3708-TenGigabitEthernet5/0.3709 config-url disk0:/CSERV-FW001.cfg ! prompt hostname context Cryptochecksum:6dc963ea184ab1e2eceeeddcdda3211f : end ############################## ## VIRTUAL FIREWALL CONTEXT ## ############################## asa5580/CSERV-FW001# sh run : Saved : ASA Version 8.1(0)147 <context> ! firewall transparent hostname CSERV-FW001 domain-name ggnet.umn.edu enable password **REMOVED** encrypted names ! interface TenGigabitEthernet5/0.3708 nameif inside security-level 100 ! interface TenGigabitEthernet5/0.3709 nameif outside security-level 0 ! passwd **REMOVED** encrypted dns server-group DefaultDNS domain-name ggnet.umn.edu access-list PERMIT-ALL remark ## [START] PERMIT-ALL ## access-list PERMIT-ALL remark ## Reserve for Debugging or Emergency Use ## access-list PERMIT-ALL extended permit ip any any access-list PERMIT-ALL remark ## [END] PERMIT-ALL ## pager lines 24 logging enable logging timestamp logging monitor debugging logging buffered debugging logging trap debugging logging facility 23 logging host outside 192.168.249.59 mtu inside 1500 mtu outside 1500 ip address 128.101.58.134 255.255.255.240 icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside icmp permit any outside no asdm history enable arp timeout 14400 access-group PERMIT-ALL in interface inside access-group PERMIT-ALL in interface outside route outside 0.0.0.0 0.0.0.0 128.101.58.132 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ (outside) host 192.168.249.21 key **REMOVED** aaa-server TACACS+ (outside) host 192.168.249.22 key **REMOVED** aaa authentication ssh console TACACS+ aaa authentication telnet console TACACS+ aaa authentication enable console TACACS+ no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart telnet 160.94.221.0 255.255.255.248 inside telnet 192.168.224.0 255.255.224.0 outside telnet 134.84.20.0 255.255.255.0 outside telnet timeout 5 ssh 192.168.224.0 255.255.224.0 outside ssh 134.84.20.0 255.255.255.0 outside ssh timeout 5 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp ! service-policy global_policy global Cryptochecksum:8ec6a416d4238fbe77fa8493dc2a3ea4 : end -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Louis Sent: Thursday, April 17, 2008 7:59 AM To: Tim Franklin; [email protected] Subject: Re: [c-nsp] ASA Transparent Mode with VLAN Trunks We are making some progress on this however not completed yet. We had to assign multiple contexts to the firewall as expected, then assign a set of vlans on the outside interfaces (50,51) and then another set of vlans on the inside interfaces (100,101). The ASA would not let me assign the same vlan to the inside and outside interfaces. It appears VLAN tags are stripped in bound to the outside interface of the ASA and then reapplied (with a different tag) on the inside interface. Switches on each side are trunked accordingly. I have one side of the topology, ie one asa with multiple context working, still working on the second device. If anyone has a working configuration for this setup, can you please post to this forum? TIA Mike ________________________________________ From: [EMAIL PROTECTED] [EMAIL PROTECTED] On Behalf Of Tim Franklin [EMAIL PROTECTED] Sent: Thursday, April 17, 2008 4:28 AM To: [email protected] Subject: Re: [c-nsp] ASA Transparent Mode with VLAN Trunks On Wed, April 16, 2008 5:37 pm, Ge Moua wrote: > I tried emailing attachments to the 'list' before, and this was rejected. > I'm always open to sharing by any means necessary. Err... paste the text of the config? _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ Note: This message and any attachments is intended solely for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, legally privileged, confidential, and/or exempt from disclosure. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the original sender immediately by telephone or return email and destroy or delete this message along with any attachments immediately. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ Note: This message and any attachments is intended solely for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, legally privileged, confidential, and/or exempt from disclosure. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the original sender immediately by telephone or return email and destroy or delete this message along with any attachments immediately. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
