Anthony Curreri: IT Solutions

Even your Cisco ASA5505 can have a DMZ, though not a full one. With the base license you can create another interface and vlan, but you must restrict traffic from that interface to another.

Below I’m going to tell you how to set up a DMZ on your Cisco ASA5505. All I needed for my network was to have two network segments which had external access, but could not communicate with each other. This allows us to have two peoples workstations on the same ASA5505 device, but they don’t have the ability to infect one another. Also, one person is allowed to use the site-to-site vpn, and the other is not.

1. Open the Cisco ASDM
2. Click ‘Configuration’ at the top, ‘Interfaces’ on the left.
3. Click the ‘Add’ button on the right.
4. Specify the network jacks you want to be on the new vlan.
5. I recommend using ‘dmz’ for the network interface, and security level ‘50′.
6. Make sure ‘Use Static IP’ radio button is checked.
7. In the ip address field, enter the new interfaces ip, but on an un-used subnet. For example ‘192.168.8.1′
8. Subnet mask: ‘255.255.255.0′
9. Click the ‘Advanced’ tab at the top.
10. In the ‘VLAN ID’ field, type ‘3′. Having vlans 1, 2, and 12 or whatever is just dorky.
11. Under Block Traffic, select ‘vlan1 (inside)’.
12. Hit ‘Ok’, ‘Apply’

Great! You’ve created the interface, but you want to be able to browse to the outside. You’ll need to create a dynamic NAT for that.

1. Click ‘NAT’ on the left.
2. Click ‘Add’ at the top, select ‘Dynamic NAT Rule’.
3. Select the new interface ‘dmz’ from the drop down at the top.
4. Click the ‘…’ button on the right, and select the dmz network
5. Under ‘Dynamic Translation’ change ‘Interface’ to ‘Outside’.
6. Put a check next to the ‘outside’ address pool.
7. Hit ‘Ok’, ‘Apply’

One last thing. I really dig having at least a couple DHCP addresses on every port. So lets configure DHCP!

1. Click ‘Properties’ on the left.
2. Click the ‘+’ sign next to ‘DHCP Services’.
3. Click DHCP Server.
4. Under ‘Other DHCP Options’ make sure the ‘Enable auto-configuration…’ check box is un-checked.
5. The DNS Servers are probably the same for both subnets. Feel free to put them in out here, and leave the DNS Server boxes for each interface blank.
6. Hit the ‘Apply’ button.
7. Click the ‘dmz’ entry at the top, and click ‘Edit’.
8. Check the check box for ‘Enable DHCP server’.
9. Enter an address pool, for example: ‘192.168.8.50′ to ‘192.168.8.75′
10. Hit ‘Ok’, ‘Apply’.

Save and reload the device, and you should be in business!

Trackback URI | Comments RSS