0

We have an asa5505 and I need to figure out how to isolate one physical interface to the other but remaining with access to our servers. my original thought was to put them on the same subnet as the main network and isolate them via the feature to block certain interfaces from eachother... But this doesnt seem to do the trick as they are on different subnets.

Is there any ideas?

Thanks!

Lbaker101
  • 309
  • 2
  • 8
  • 18
  • By default, the ASA blocks traffic between interfaces at the same security level. Of course, security levels only come into play when there are no ACL's on the interface. Can you give a brief description of the topology - most importantly, where are the servers? – Paul Ackerman Dec 05 '11 at 14:46
  • Hey Paul, the servers plug into a switch that plugs into port 0/3. So basically 0/0 is the internet port 0/1 is the data port 0/2 0/3 is the server port 0/4 is the dev team (server access. blocked from 0/1 traffic) I wanted to put them on seperate subnets. for example data is 192.168.10.x 0/2 would be 192.168.20.x and so on. Because it puts it on different subnets though it makes so they will not communicate. Maybe i'm doing it weird though. Lol. – Lbaker101 Dec 05 '11 at 20:50
  • Do you have a windows cluster or something that needs to be on the same subnet? If not, I'm not sure I understand why they would not communicate just because they are on different subnets. I agree with Jeff, put them on unique interfaces and subnets then use firewall rules to allow/disallow traffic as needed. If you absolutely must separate traffic on the same subnet, there are a couple ways. You can use host-based firewalls or IPSec to determine allowed connections on the important servers or use interface ACLs on the switches themselves but that will be messy. Easier in the firewall. – Paul Ackerman Dec 05 '11 at 21:30
  • I have enabled to allow networks of the same security level to connect. I have also allowed any/any on both the dev/server/ISP interfaces (to rule out security). Right now i'm working through ASDM while I learn the CLI a bit more. so the 3 networks are: 0/0 is the ISP interface 192.168.10.x 255.255.255.0 (data) 0/1 192.168.30.x 255.255.255.0 (server interface) 0/3 192.168.40.x 255.255.255.0 (Dev interface) 0/4 So i'm guessing i'm missing something. Let me go test it again. Thanks! – Lbaker101 Dec 05 '11 at 22:26

1 Answers1

3

On the "Server Interface"... ALLOW all traffic from "Client Interface" Destined to Servers DENY all traffic from "Client Interface"

In that order. You could restrict the ALLOW rule to specific ports if needed.

On the "Server Interface"... ALLOW all traffic from Servers DENY all traffic from "Server Interface"

In that order. Again, you could restrict the ALLOW rule to specific ports if needed.

JeffM
  • 124
  • 2
  • I can seperate the subnets and put them on different networks but then they would not communicate with eachother. If its on the same I need both networks to communicate with the servers but totally blocked from eachother. I didnt think about taking the firewall route though so I will let you guys know how that works out! – Lbaker101 Dec 05 '11 at 16:31