Skip to main content

Getting to Internet Through ASA

Step 1: Setting up hostname
ciscoasa(config)# hostname XYZ01
XYZ01(config)#

Step 2: Configuring IP addresses on the interfaces
XYZ01(config)# interface ethernet 0/0
XYZ01(config-if)# nameif inside
XYZ01(config-if)# security-level 100
XYZ01(config-if)# ip address 192.168.1.1 255.255.255.0
XYZ01(config-if)# no shut
XYZ01(config)# interface ethernet 0/1
XYZ01(config-if)# nameif outside
XYZ01(config-if)# security-level 0
XYZ01(config-if)# ip address 10.1.1.1 255.255.255.252
XYZ01(config-if)# no shut

Step 3: Verifying Interfaces
XYZ01# show interface ip brief
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 192.168.1.1 YES manual up up
Ethernet0/1 10.1.1.1 YES manual up up
Ethernet0/2 unassigned YES unset administratively down up
Ethernet0/3 unassigned YES CONFIG administratively down up
Ethernet0/4 unassigned YES unset administratively down down
Ethernet0/5 unassigned YES unset administratively down down

Step 4: Verifying outside connectivity
XYZ01# ping 10.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 80/164/360 ms

Step 5: configuring Nat
This setting meant the IPs you want should able to access internet. Usually it always your complete internal IP range. But in our scenario we are using only one subnet range and we want allow then can access internet.

XYZ01(config)# nat (inside) 1 192.168.1.0 255.255.255.0

Notice the command syntax specifically 1 this is always maps to global command. Now when we configure global we will say we want nat id 1 to be mapped with this global command. This make more sense when you have multiple nat ids, which will than give us flexibility to use different Public Ip addresses for different nat ids using global command

XYZ01(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
Notice in global command instead of mapping to Public IP address we used interface which will strating doing Port Address Translation (PAT) instead of NAT because we number of private IP addresses required to access internet.

Step 6: Verifying Nat Configuration
XYZ01# sho running-config nat
nat (inside) 1 192.168.1.0 255.255.255.0

XYZ01# sho running-config global
global (outside) 1 interface

Step 7: Configuring default route
XYZ01(config)# route outside 0 0 10.1.1.2
Notice 0 0 = 0.0.0.0 0.0.0.0 = Match All

Step 8: Check your connectivity with internet
XYZ01# ping 4.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/110/130 ms

I will be trying put the same by using ASDM, somtime later in the week.
Labels:

Comments

Post a Comment

Popular posts from this blog

Image Recovery Using ROMMON mode

If incase ASA system image is lost or got corrupted we can recover it by booting ASA in ROMMON mode and executing following commands please refer above mentioned diagram. Step 1: Make sure you have assigned the right IP address to the PC which has ASA system image and tftp installed. Step 2: Set the following parameters rommon #0> address 10.1.1.254 rommon #1 > server 10.1.1.1 rommon #2> interface GigabitEthernet0/0 GigabitEthernet0/1 MAC Address: 000f. f775.4b54 rommon #3> file asa801 -k8. bin Step 3: Verify your configured parameters in ROMON mode rommon #4> set ROMMON Variable Settings: ADDRESS=10.1.1.254 SERVER=10.1.1.1 PORT=GigabitEthernet0/0 VLAN=untagged IMAGE=asa801-k8. bin CONFIG= rommon #12> set ROMMON Variable Settings: ADDRESS=10.1.1.50 SERVER=10.1.1.1 ------- output omitted for brevity ----- rommon #13> unset ADDRESS ROMMON Variable Settings: ADDRESS=0.0.0.0 SERVER=10.1.1.1 GATEWAY=0.0.0.0 ------- output omitted f...
3 comments
Read more

VPN Site-to-Site IOS

In this tutorial I am going to show you how we can configure site to site VPN on two IOS routers. In this example I have used 3750 Router in emulated environment. VPN stands for Virtual Private Network, in which you extend your corporate network across internet in secure fashion. In VPN it has different types and two main types are as follows: Site-to-Site VPN Remote Access VPN Site-to-Site is manly used to do connectivity between HQ and branches. Whereas, Remote Access is mainly used by mobile user, software is installed and proper credentials provided so that they can connect to Corporate Network from anywhere and can access anything they are authorized for. Following is diagram with related information we need to start with. So there are following steps your need to do on both routers in order to make them communicate over the Service Provider Network Securely. Step 1: IKE Phase 1 Step 2: IKE Phase key Step 3: IKE Phase 2 (transform-set) Step 4: Interested traffic (wh...
Post a Comment
Read more