dslreports logo

Suggested pre-reading:

»Cisco Forum FAQ »Router configuration to run server (with and without port forwarding)
»Cisco Forum FAQ »PIX Firewall/ASA configuration to run server (with and without port forwarding)

Introduction

There is typically NAT/PAT consideration to access the Internet from private network using Private IP addresses. As mentioned on the reading above, you must use Internet-routable (Public) IP address to go out to the Internet. Therefore there should be NAT/PAT process that translate Private IP address into Public IP address.

Since in this case there are two devices (router and ASA or PIX firewall), you must choose one between the two devices to do such NAT/PAT process. When you decide to have the router to do the NAT/PAT, then Sample Configuration 1 is a good place to start. When you decide to have the ASA or PIX firewall to do the NAT/PAT, then Sample Configuration 2 and 3 are good places to start.

In addition, you also need to have proper IP routing in place to intercommunicate the Internet (ISP), router, firewall, and LAN users. As for any routing implementation, basically each device and subnet must know how to reach other device or other subnet. For simple network, static routes should do the job. For more complex network such as Sample Configuration 3, the router might need to run dynamic routing with ISP routers.

As noted, the above links are suggested prerequisite reading since this sample configuration presents the next chapter of the prerequisite reading. In addition, you must have a familiarity of both older PIX OS commands and newer PIX/ASA OS commands; or at least familiar enough with the older PIX OS commands to configure PIX/ASA running newer OS commands. If you are new to CLI specifically for router, PIX, and ASA; then check out the following FAQ for info.

»Cisco Forum FAQ »Straight-forward way to configure Cisco router: Introduction to CLI
»Cisco Forum FAQ »Straight-forward way to configure Cisco PIX Firewall/ASA: Introduction to CLI

1. One exit to ISP, Router performs NAT/PAT, PIX/ASA performs no NAT/PAT

This sample configuration assumes the followings:

* You have one ISP providing single path to your router
* You set the router to do the NAT/PAT and basic firewall, where you leave the PIX to do the stateful firewall.
* There is one ISP IP block you receive; the 1.1.0.0/30 where 1.1.0.1 is the default gateway and you use 1.1.0.2 (the only usable Public IP address for all servers and other machines in your LAN)
* You receive the ISP IP block statically (traditional static IP assignment, absolutely no PPP nor DHCP)
* You are running servers visible to the public
* The servers are web, mail, and ftp
* Your internal web server IP address is 10.10.11.2
* Your internal ftp server IP address is 10.10.11.3
* Your internal mail server IP address is 10.10.11.4
* You use 1.1.0.2 to be your three server's public IP address (static PAT)
* You use a range of 10.10.11.30 to 10.10.11.254 to be your LAN workstations' public IP address (dynamic NAT and PAT)
* You permit only internal host of 10.10.11.5 to telnet and to pdm to the PIX
* Internal hosts are receiving IP address automatically (as DHCP clients) from the PIX
* Since the PIX outside interface subnet is /30, there would be no other IP-based hosts between the PIX and the router within the same subnet

Router Configuration



PIX Firewall Configuration



2. Single exit to ISP, Router performs no NAT/PAT, PIX/ASA performs NAT/PAT and is as the IPSec VPN Concentrator

Scenario 2.1
There are two ISP IP blocks you receive

This sample configuration assumes the followings:

* You have one ISP providing single path to your router
* You set the PIX/ASA to do the NAT/PAT, the stateful firewall, and IPSec VPN Concentrator
* There are two ISP IP blocks you receive. One is the 1.1.0.0/30 where 1.1.0.1 is the default gateway and you use 1.1.0.2 as your router WAN interface IP address. The second IP block is 1.0.1.0/24 where IP address within this subnet will be the server Public IP addresses, router LAN interface IP address, and PIX Outside interface IP address
* You receive the ISP IP blocks statically (traditional static IP assignment, absolutely no PPP nor DHCP)
* You are running servers visible to the public
* The servers are web, mail, and ftp
* Your internal web server IP address is 10.10.11.2
* Your internal ftp server IP address is 10.10.11.3
* Your internal mail server IP address is 10.10.11.4
* You use 1.0.1.3 to be the web server's public IP address (static NAT)
* You use 1.0.1.4 to be the ftp server's public IP address (static NAT)
* You use 1.0.1.5 to be the mail server's public IP address (static NAT)
* You use 1.0.1.254 to be your LAN workstations' public IP address (dynamic PAT)
* You permit only internal hosts of 10.10.8.0/24 to telnet and to pdm to the PIX and router
* The remote users will VPN in using specific Group Authentication credential, which in this sample configuration is Admin as the Group Name and is ******** as the Group Password as indicated on the vpngroup Admin password ******** command
* The VPN users log in as Admin receive IP address within the admin range from 192.168.0.1 to 192.168.0.254.
* No external AAA (Authentication, Authorization, and Accounting) server as the TACACS+/RADIUS server
* Telnet attempt to the PIX/ASA itself is not authenticated

Router Configuration



PIX Firewall Configuration



More Sample Configurations of Setting Up ASA/PIX Firewall as Internet Firewall and IPSec VPN Concentrator
»Cisco Forum FAQ »Configure PIX/ASA as both Internet Firewall and VPN Concentrator

Some discussions:
»[Config] ASA5505 setup
»[HELP] Please Help with Cisco 1841 T1 Config

Scenario 2.2
There is only one ISP IP block you receive

* You have one ISP providing single path to your router
* There is one ISP IP block you receive, which is 1.0.1.0/29 via PPPoE negotiation on the router
* By implementing IRB (Integrated Routing Bridging), router interfaces and PIX/ASA Outside interface are within the same broadcast domain, hence enabling the PIX/ASA to do the NAT/PAT and the stateful firewall with just one ISP IP block while the router keep its routing capability
* The router has 1.0.1.1 IP address and you assign 1.0.1.2 IP address for the PIX/ASA Outside interface
* The router receives default gateway to reach the Internet as 1.0.1.6 via PPPoE negotiation on the router
* The 1.0.1.3 IP address is used as NAT/PAT-ed IP address to host your Public servers of ftp, mail, and web
* You use 10.0.0.0/24 Private subnet as your internal subnet

Router



PIX Firewall Configuration



3. Multiple exit to ISP (Failover Routing), Router performs no NAT/PAT, PIX/ASA performs NAT/PAT

This sample configuration assumes the followings:

* You have one ISP providing multiple path to your router
* There is SLA between you and ISP in providing failover routing mechanism
* You set the PIX to do the NAT/PAT and to provide stateful firewall features, where you leave the router to do the failover routing (source routing).
* There are two ISP IP blocks you receive for LAN machines, which are the 1.0.0.0/24 and the 1.0.1.0/24
* There are two more ISP IP blocks you receive for WAN connectivity, which are 1.1.0.0/30 and 1.1.0.4/30
* The ISP path #1 subnet is 1.1.0.0/30 where the 1.1.0.2 is on your side
* The ISP path #2 subnet is 1.1.0.4/30 where the 1.1.0.6 is on your side
* You receive all of these ISP IP blocks statically (traditional static IP assignment, absolutely no PPP nor DHCP)
* Both 1.1.0.1 and 1.1.0.5 are on the ISP router that serve as your default gateway to the Internet
* ISP router is set to use path #1 primary to reach the 1.0.0.0/24; and to use path #2 as alternate
* Likewise, the ISP router is set to use path #2 primary to reach the 1.0.1.0/24; and to use path #1 as alternate
* The network visible to your ISP are only the ones that they assign to you, which are the 1.1.0.0/29 and the 1.0.0.0/23. Other IP addresses or subnets are internal and are only visible to your network
* You are running servers visible to the public
* The servers are using 1.0.0.0/24 block and the workstations are using 1.0.1.0/24 block
* The servers are web, mail, and ftp
* Your internal web server IP address is 10.10.11.2
* Your internal ftp server IP address is 10.10.11.3
* Your internal mail server IP address is 10.10.11.4
* You use 1.0.0.3 to be your three server's public IP address (static PAT)
* You use a range of 1.0.1.1 to 1.0.1.254 to be your LAN workstations' public IP address (dynamic NAT and PAT)
* You permit only internal host of 10.10.11.5 to telnet and to pdm to the PIX
* Internal hosts are receiving IP address automatically (as DHCP clients) from the PIX
* Since the PIX outside interface subnet is /30, there would be no other IP-based hosts between the PIX and the router within the same subnet

Router Configuration



PIX Firewall Configuration



Note:
This is just a sample configuration and not intended as working configuration on any network design. Your actual failover routing mechanism might be different than is suggested here due to the SLA between you and your ISP.

4. Single exit to ISP, dual PIX/ASA performs Active/Active or Active/Standby

PIX/ASA: Active/Active Failover Configuration Example
PIX/ASA: Active/Standby Failover Configuration Example

Supplemental Sample Configurations
»Cisco Forum FAQ »Setting Up Network With ISP WAN and Public IP Block subnets running NAT

Discussions

»[Config] Asa 5505 possible NAT issue
»[Config] 2911 router and 3560 switch with squid proxy server in between


Feedback received on this FAQ entry:
  • thnx for ur useful document. I wonder if we could use "IP unnumbered" in scenario 2.2 ? or we have to give the solution just by IRB ?

    2010-03-31 00:41:48



Expand got feedback?

by aryoba See Profile
last modified: 2015-08-17 14:05:23