ASA 5510 firewall

[Carpua]

Hi all

i have 3 routers 1800series,1900series and 3800 from the outside. i wanted to know if i can pluged them directly into the firewall e0/0,e0/2,e0/3 considering the ports on the firewall are configured with the ip on the same subnet.

 

[Carpua]

The architecture im talking about is Router======firewall=======internal network

 

[VinceWhirlwind]

To make it easier to understand, add a switch to your layout:

You have three routers.
Each router has one interface in subnet 10.1.1.0/24: ROUTER1: 10.1.1.10, ROUTER2: 10.1.1.20, ROUTER3: 10.1.1.30
These interfaces are all patched into ports in VLAN 10 in a 2950.
The 2950 has a port in VLAN 10 patched into the firewall with IP address 10.1.1.1/24.
The firewall has routes, eg,
192.168.16.0/24 --> 10.1.1.10
192.168.17.0/24 --> 10.1.1.20
192.168.18.0/24 --> 10.1.1.30

Does that make more sense?

 

[Carpua]

hi Vince

the routers interface are on a different subnet. for example 196.40.172.1/30, 10.50.100.1/30, 10.59.8.1/30 and they are all looking for the .2 address as the next hop. please bear in mind that this routers are operationsl and are the third-party so changing the interface ip is out of option. and at the moment this routers are in operation

 

[VinceWhirlwind]

I seem to have misunderstood what you meant by "... the ports on the firewall are configured with the ip on the same subnet."

You mean you have three different routers, each with an interface in a different subnet, patching into the ASA?

If that's the case, what's the question?

 

[Carpua]

i wanna know if its safe to patch them directly into the firewall, like at the moment they are connecting directly to the internal network and we wanna put a firewall in between

 

[VinceWhirlwind]

No. You need a design before you start just "plugging things in". Sit down and draw up a logical layer3 representation of how it's going to work.

The ASA represents a new Layer-3 hop between the routers and the internal hosts. This means you will need to remove the existing addresses from the routers and put those addresses on the "inside" interfaces of the ASA, and create 3 new point-to-point subnets linking the routers to the ASA "Outside" interfaces.

 

[Carpua]

hi Vince

thanks very much for your help. i really appreciate it, everything working fine. my skype name is tefo3456 i could do with network engineer friends

 

[VinceWhirlwind]

If you got it working with nothing more than my very summary advice then you *are* a network engineer in my books!
I've never actually used Skype, but I'll be sure to fire it up to say G'Day to you.

 

[ADB100]

I'd say plugging them directly into the firewall was a waste of precious *physical* firewall ports. Use 802.1q sub-interfaces and a layer-2 switch - unless of course you will be needing the full 100Mbps to/from each router.....

Andy

 

[VinceWhirlwind]

I agree with ADB - when you draw up a design for your "gateway", it's good to have a few switches in there for physical connectivity.