Comments on: Cisco Router with Cisco ASA for Internet Access

By: BlogAdmin

BlogAdmin — Wed, 05 Dec 2012 14:11:46 +0000

Hi,

Do you have a static public IP on the outside interface of cisco811? Do you have more public IP addresses to assign to the ASA outside interface?
Also, what other kind of access do you have? i.e internet users from inside browsing the internet and also what kind of VPN is this?
Let me know the above and I will tell you how to proceed. I offer a paid service if you want me to connect remotely and fix it for you.

Harris

By: Francis Teo

Francis Teo — Wed, 05 Dec 2012 13:23:55 +0000

Hi – i came across your post and found it very relevant to what i am doing. Except i am no expert here.
I am not sure if you are still doing this – i do not mind paying for your service to modify my existing Site-To-Site VPN.
If you are keen we can explore working on it remotely.
Here are my settings
NOW -
ISP Cisco811 (VPN peer running no problem)

New
ISP Cisco811CiscoASA5100 (To use VPN Here )
VPN Peer to move to CiscoASA

Please let me know if you are keen.
Thanks
Francis

By: BlogAdmin

BlogAdmin — Mon, 20 Aug 2012 16:23:42 +0000

Max,

The stating NAT mapping of 192.168.1.0 to itself is basically used to avoid doing dynamic NAT on the ASA, since the dynamic NAT (for outbound communication) is done on the border router. Basically the internal LAN network passes untranslated from the inside of the ASA to its outside and then the border router does NAT to translate this private network into a public IP in order to get routed on the Internet.

By: max

max — Sun, 19 Aug 2012 20:51:21 +0000

Why are you creating a static NAT mapping of 192.168.1.0 to itself

By: SF

SF — Wed, 22 Feb 2012 20:28:03 +0000

Excellent !!

Thanks for clarifying that.

By: BlogAdmin

BlogAdmin — Wed, 22 Feb 2012 18:16:33 +0000

SF,

My last comment was about allowing the internal proxy. Basically on the ACL you permit only source IP of proxy to any destination and then deny everything else.

By: SF

SF — Tue, 21 Feb 2012 22:59:15 +0000

Thanks for the prompmt reply

But still trying to get my head around how to setup the firewall when an internal proxy is being used.

.The proxy server resides in inside network.
.All the clients go through it, when accessing web.

If I only allowed web traffic source from proxy server, would it be the correct way of setting up?

By: BlogAdmin

BlogAdmin — Tue, 21 Feb 2012 19:01:48 +0000

SF,

What you want to achieve can be done easily with access control lists (ACL). Basically you will need to apply an ACL (inbound direction) on the inside interface of ASA which will allow access to only the IP address of proxy and then deny everything else.

By: SF

SF — Mon, 20 Feb 2012 23:05:14 +0000

Hi All
Just wondering whether some one could shed light on this.
I am currently doing a network upgrade where ASA being installed. Everything is ok apart from proxy configuration.

WHAT I WOULD LIKE TO DO IS TO HAVE A INTERNAL PROXY SERVER SO THAT ALL CLIENTS GO THROUGH IT. BUT I DONT KNOW WHAT CONFIG NEED TO BE DONE IN ASA>

secondly for another project I WANT TO USE EXTERNAL PROXY, STILL STUCK WITH CONFIGURATION.

Appreciate if some one could help me.

By: Fernando

Fernando — Fri, 26 Aug 2011 05:20:19 +0000

@BlogAdmin,
thanks. I did try that but still no luck. Any more ideas? I can authenticate from FTP client but I do not get the list of folders…