A
A
Andrey2021-08-14 08:01:20
Computer networks
Andrey, 2021-08-14 08:01:20

How to set up a cisco ASA firewall to communicate between two devices?

Please help me with this simple situation. I must say right away that my knowledge of networking matters is minimal, so I can’t solve this simple task right away, and for a specialist it’s probably 5 minutes, but it so happened that I had to set up such equipment in the project, which I had never done before . The deadlines are burning, but there is no connection! There are two devices (namely devices, not computers). IP1=192.168.5.50, IP2=192.168.1.201. They need to communicate with each other. They connect through the cisco ISA 3000 firewall. What needs to be configured in this firewall to make everything work? Routes, NAT, one thing or all together? And how exactly? Will it be possible to connect with a laptop to the port instead of one of the devices and ping the other device to check the connection? I work with ASA by means of ASDM. I would like not to resort to working with the CLI, better through mouse clicking. Is there any way to copy running-config to startup-config using the mouse? BVI IP=192.168.1.202. It is possible to connect another device with IP=192.168.1.51. How can I find out what mode the ASA is in, routed or transparent? If you configure the route, then what gateway address should I set? Do I understand correctly that the changes are activated, written to the device by the Apply button? The configuration is attached. Thanks in advance! are written to the device by the Apply button? The configuration is attached. Thanks in advance! are written to the device by the Apply button? The configuration is attached. Thanks in advance!

: Hardware: 1783-SAD4T0S, 8192 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
: Written by user1 at 10:56:41.958 NOVDT Sat Aug 14 2021
!
ASA Version 9.6(2)
!
firewall transparent
hostname stratix5950
enable password 6qQOg/48CzKPezeS encrypted
names

!
interface GigabitEthernet1/1
nameif outside1
bridge-group 1
security-level 0
!
interface GigabitEthernet1/2
nameif inside1
bridge-group 1
security-level 100
!
interface GigabitEthernet1/3
nameif outside2
bridge-group 1
security-level 0
!
interface GigabitEthernet1/4
nameif inside2
bridge-group 1
security-level 100
!
interface Management1/1
management-only
nameif management
security-level 100
ip address 169.254.0.1 255.255.255.0
!
interface BVI1
description FW-001
ip address 192.168.1.202 255.255.255.0
!
ftp mode passive
clock timezone NOVST 6
clock summer-time NOVDT recurring last Sun Mar 2:00 last Sun Oct 3:00
same-security-traffic permit inter-interface
object network 192.168.1.99
host 192.168.1.99
object network TTT
host 192.168.1.99
object network 192.168.5.50
object network 192_168_1_201
host 192.168.1.201
object network 192_168_5_50
host 192.168.5.50
access-list allowAll extended permit ip any any
access-list sfrCipAccessList extended permit udp any any neq 2222
access-list permitp any access-
AccessList extended list etherAll ethertype permit any
pager lines 24
logging asdm informational
hardware-bypass boot-delay module-up sfr
hardware-bypass GigabitEthernet 1/1-1/2
hardware-bypass GigabitEthernet 1/3-1/4
mtu outside1 1500
mtu inside1 1500
mtu outside2 1500
mtu inside2 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 1024
!
object network 192_168_1_201 nat (inside2, outside2
) static 192.168.5.90
object network 192_168_5_50 nat
(outside2,inside2)
static
192.168.1.60 allowAll in interface inside1 access-group etherAll in interface outside2 access-group allowAll in interface outside2 access-group etherAll in interface inside2 access-group allowAll in interface inside2
route inside1 192.168.1.51 255.255.255.255 192.168.1.1 1
route outside1 192.168.1.85 255.255.255.255 192.168.1.1 1
route inside2 192.168.1.201 255.255.255.255 192.168.1.1 1
route outside2 192.168.5.50 255.255.255.255 192.168.1.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0 :10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03: 00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn- hold down 0:00:15
user-identity default-domain LOCAL
http server enable
http 169.254.0.0 255.255.255.0 management
http 192.168.1.98 255.255.255.255 management
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 169.254.0.5-169.254.0.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl server-version tlsv1.2
dynamic-access-policy-record DfltAccessPolicy
username user1 password .swFj2RXERmq51zP encrypted
!
class-map sfrclass
match access-list sfrCipAccessList
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class sfrclass
sfr fail-open monitor-only
set connection random-sequence-number disable
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:6638538ce5bfedeebad69e60ffc59385
: end

Answer the question

In order to leave comments, you need to log in

1 answer(s)
D
DDwrt100, 2021-08-19
@DDwrt100

firewall transparent
It looks like you have asa configured in trasparent mode. If I remember correctly, in this mode you need one more L3 device to connect two different subnets.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question