Hello friend
Welcome to my video
We practice with a small example like above
In this video I explain how to configure basic security on Cisco Asa
Your network is divided into 3 roles which are outside, inside and DMZ
We have an example with a network with a web server
In this recipe you will protect a web server by connecting it to your Cisco ASA DMZ Network
In addition to protecting the web server the DMZ also protects the rest of the network
The basic ASA configuration setup is three interfaces connected to three Network segments
The ISP Network segment is connected to the GigabitEthernet 0/2 interface and labeled outside with
The security level of 0
The internal network has been connected to GigabitEthernet 0/1
and labelled as inside with a security level of 100
The DMZ segment, where the web server resides, is connected to GigaEthernet0/0
and labelled as DMZ with a security level of 50
The ASA's outside interface is configured with an IP address obtained from the ISP.
Here you can see that the ASA's inside interface is set with the IP address of 192.168.1.1
and it is the default gateway for the internal hosts.
The DMZ interface is configured with the IP address of 10.10.10.1
and it is the default gateway for hosts on the DMZ network segment
Now, you need to the configuration so that users on the Internet can access our web server on TCP port 80 and port 443
port 80 and port 443
Use Object NAT for this task, and the ASA will translate TCP port 80 on the web server to look like TCP port 80 on the outside
Next, the ASA will translate TCP port 443 on the web server to look like TCP port 443 on the outside
Remember, on an ASA, traffic that goes from a lower security interface is denied when it goes to a higher security interface
For that reason , hosts on the outside with security level 0 cannot connect to hosts on the DMZ with security level 50
Because traffic from the outside to the DMZ network is denied by the ASA with its current configuration,
users on the Internet cannot reach the web server despite the NAT configuration
You need to explicitly permit this traffic
This means the configuration needs to permit traffic destined to 10.10.10.10 on port 80 and port 443
Next, Configure NAT to Allow Hosts from inside segment to Go Out to the Internet
You created that rule that allows hosts on inside segment to connect to the internet
Because these hosts use private IP addresses
you need to translate them to ASA's outside interface IP address that is routable on the Internet
Next you configure the DHCP server for the inside segment
In this session I will cover how to enable icmp inspection to allow ping traffic passing Asa
You can now browse the internet using any computer that connects to the inside interface
As always if you found this post useful then subscribe to my YouTube channel
Help me 500 thousand subscribers