two ports to outside VLAN ASA 5510

[http80]

Hey guys,

I'm rather new to configuring network devices, but it seems now I have to do it:
I'm in a "sub-organisation" of an University and we want to share an ASA 5510+Sec+ with an department of the University.
(Yes, nobody else is there who can cofigure this stuff)

From the University the department and we have
TWO external IP addresses with
two physical ethernet ports on the same subnet:
128.135.010.5
128.135.010.6

we have TWO VLANs:
VLAN1 128.135.120.1 255.255.255.255
VLAN2 128.135.127.1 255.255.255.255

We need separate VPN access to the VLANs.
(No multicontext mode...)

I want to assign the
two ports of the ASA to the two external IP addresses
and
two ports of the ASA to the two internal VLANs

I want the traffic from
VLAN1 to be routed over the PORT with external IP 128.135.010.5
and from
VLAN2 to be routed over the PORT with external IP 128.135.010.6

(So the two VLANs are independent from each other. Just a few security policies will allow us to use printers of the university department.)

So now my questions:
1.) How do I assign two ports to the same outside VLAN?
2.) How do I route traffic from an internal VLAN to a specific ASA Port.

I hope you can give me some hints because I could not find a solution for this problem.

Thanks for the help

 

[Supergrrover]

The VPN is pretty easy. Take a look at this and use separate VPN groups -

cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806ab788.shtml

The outside may take some work. Maybe a switch between.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[http80]

Thanks for the answer, thats how I want to make it with the VPN.

But yes, the outside seems to take some work.
(We need our own outside IPs (128.135.010.5,128.135.010.6)because we need to stay independent)

So I would be happy if anyone has an idea:
how to get working the two ports to the outside?

 

[Supergrrover]

What has to go through the ip's separately? If its only services it is just a basic setup with port mapping and some ACLs. For the VLANs appearing as the different ip then you only need two Nat/global pairs and that will do the job.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[Supergrrover]

cisco.com/en/US/products/ps6120/products_configuration_example09186a0080862017.shtml

Just looked at your ips. Are you natting as these are all public? A little confused.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[http80]

Sorry, I didn't mention that also the two "internal" VLANs are public. So ASA should work as bridge.

The two IPs in the outside VLAN are just for public services and the routing at the University network. (All our domains point at the 128.135.010.5 IP).

So the problem is how to split the outgoing traffic over the two eth-ports.