Cisco ASA Configuration

[CHiLL]

We have just switched to Virgin as our ISP and found out that they don't provide a router as part of their service. Thankfully we are still in contact with our existing ISP, so we still have Internet access behind their Juniper firewall. We also have Smoothwall acting as our filtering and part firewall. However this is only a virtual appliance and sits within our internal network. Not ideal IMHO. We have just approved the purchase of the Smoothwall S4 that will sit between our core switch and our ISP's firewall, but that won't be coming until Easter.

 

We have a spare Cisco ASA 5512-X that hasn't been used in a couple of years (since we left our previous ISP) back in 2016. Since that was last configured, our network has completely changed as part of a revamp. I have taken a backup of the config anyway and performed a factory reset on the device. I have configured the device to what appears to be the correct configuration. As the new Virgin line is a separate new line, it can be used separately without disrupting our existing ISP connection or users. The ASA is currently connected to the new ISP line and also hooked up to a laptop via Ethernet. I have confirmed that the laptop can access the Internet perfectly fine and receive the full 200Mb we're expecting. It is not connected to our live network in any way.

 

The reason for this thread is that I am certainly no expert when it comes to configuring a router. I've done what I think needs to be done, but would like some advice or clarification (or even someone to look over the configuration) if possible. The last thing I want to do is hook this up to our live network and potentially expose us to the Internet. I've used Nmap as a penetration test and all appears OK. Though it did detect the following open ports:

 

7443 - Protocol: TCP - State: Open - Service: Oracleas-https - Version:

8000 - Protocol: TCP - State: Open - Service: http-alt - Version: squid

8080 - Protocol: TCP - State: Open - Service: http-proxy - Version: squid

8443 - Protocol: TCP - State: Open - Service: https-alt - Version:

 

I haven't opened any of these ports and cannot see them listed in my config at all. Is this normal?

[Ric_]

It depends on how your new connection is handed off. I'd assume you are getting something with an IP but if your external IP block is spare to that, the ASA won't really do the trick. The 5512-X didn't have a huge throughput either so it might be cutting it close friending upon the connection and what you plan to do.

 

Fortunately, the smaller Cisco routers are pretty cheap so you can put one of those in front or add a less expensive device in front of the firewall.

 

At the same time, it sounds like routing and firewalls may not be your strong suit so it may be advantageous to bring in a third party to set up what you want and then you can learn how to maintain it.

 

Also... I've typically found ADSM makes horrible configs so you really need to know how to use the CLI. Likewise with the silly Cisco router GUI.

Edited March 1, 2019 by Ric_

[Wave9_Lee]

You only need a solution until Easter?

[CHiLL]

It depends on how your new connection is handed off. I'd assume you are getting something with an IP but if your external IP block is spare to that, the ASA won't really do the trick. The 5512-X didn't have a huge throughput either so it might be cutting it close friending upon the connection and what you plan to do.

 

Fortunately, the smaller Cisco routers are pretty cheap so you can put one of those in front or add a less expensive device in front of the firewall.

 

At the same time, it sounds like routing and firewalls may not be your strong suit so it may be advantageous to bring in a third party to set up what you want and then you can learn how to maintain it.

 

Also... I've typically found ADSM makes horrible configs so you really need to know how to use the CLI. Likewise with the silly Cisco router GUI.

Virgin have provided a small Cisco gateway device that sits between their media converter and our ASA.

 

We have been given 5 usable IP addresses from Virgin on a /29 subnet. I have configured the ASA with the Gateway IP provided from Virgin and set the routers external/outside port to the first usable IP from the provided range. That leaves us with 4 IP addresses that we can use for say, FED, RDS, HAP, etc.

 

Our new line is 200/200. I believe the ports on the ASA are 1Gb ports, which I think should be able to manage the throughput we need.

 

You only need a solution until Easter?

The new Virgin line and the ASA will be the new solution required to be up and running at the end of March. Our current ISP and provided Juniper router will be terminated/removed at that date.

[Ric_]

The ASA should be fine for what you describe. With noting, gigabit ports on a firewall does not mean you'll get gigabit throughput... The 5512-X is rated for 200Mbps of encrypted traffic though so you should be safe.

[CHiLL]

The ASA should be fine for what you describe. With noting, gigabit ports on a firewall does not mean you'll get gigabit throughput... The 5512-X is rated for 200Mbps of encrypted traffic though so you should be safe.

Is that 200Mbps combined, or can it process 200Mbsps in and 200Mbps out simultaneously (400Mbps combined)?

Edited March 1, 2019 by CHiLL

[Ric_]

Is that 200Mbps combined, or can it process 200Mbsps in and 200Mbps out simultaneously (400Mbps combined)?

I'm not 100% but I think it is combined. It doesn't sound like you are going to be performing IDS or sending all your traffic down a VPN though so you should be fine.

 

I did realise that it sounds like you will ultimately be switching to your Juniper firewall... Why not just add a second outside interface on that and then you just have to update the NATs to switch over to your new connection?

[CHiLL]

I'm not 100% but I think it is combined. It doesn't sound like you are going to be performing IDS or sending all your traffic down a VPN though so you should be fine.

 

I did realise that it sounds like you will ultimately be switching to your Juniper firewall... Why not just add a second outside interface on that and then you just have to update the NATs to switch over to your new connection?

Sorry, I think I've made things a bit more confusing than it ought to be!

 

Existing/old configuration (contract soon to expire):

Client > Core Switch > Smoothwall Filtering > Router (Juniper) > Gateway > ISP (RM)

The Juniper is not ours, it is owned and configured/managed by RM. It will be removed when the contract expires at the end of this month.

 

New configuration (currently active alongside the RM connection, but not used by our users/clients...only when we are happy with the configuration of the Cisco ASA device will it be used by our users):

Client > Core Switch > Smoothwall Filtering > Router (Cisco ASA) > Gateway > ISP (Virgin)

 

I hope that makes more sense!

Edited March 1, 2019 by CHiLL