DEV Community

Shakhzhakhan Maxudbek
Shakhzhakhan Maxudbek

Posted on • Originally published at args.tech

Configuring network access with Cisco ASA via minicom utility

#cisco #firewall #linux #minicom

Configuring Cisco ASA 5500-series as network gateway and share internet access to users through local area network (LAN) with DHCP and DNS.

CIsco devices have three mode in command line interface:

  • First mode after you connected to device is unprivileged mode. This mode allows only monitoring and you can't modify running configurations.
  • Second mode - privileged, allows change device's running configurations. This mode activate after enable command in CLI and entering password (if configured).
  • Third mode is Global Configuration mode. Here you may configure entire device's configurations and network interfaces, create and change users, passwords, etc...

Enter in configure terminal mode:

cisco> enable
cisco# configure terminal
cisco(config)#
Enter fullscreen mode Exit fullscreen mode

Configure outside interface - GigabitEthernet 0/0. It must be connected to internet provider's side. Set IP address and network mask:

interface GigabitEthernet 0/0
    description "Outside interface to ISP router from internet provider"
    nameif outside
    security-level 0
    ip address X.X.X.X 255.255.255.252
Enter fullscreen mode Exit fullscreen mode

You should receive IP address, gateway and subnet mask from your internet provider.

Second interface - inside - GigabitEthernet 0/1. This interface looks in your local area network (LAN):

interface GigabitEthernet 0/1
    description "Inside interface to LAN network"
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
Enter fullscreen mode Exit fullscreen mode

Here ip address instruction means - you should set gateway for subnet. Subnet may be 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16. See reserved IP addresses for help.

Set DNS for your LAN clients. In this example I used Google's DNS servers. But you may use other public DNS nameservers:

dns domain-lookup outside
dns server-group DefaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
Enter fullscreen mode Exit fullscreen mode

This step require setup route from local area network in internet through provider's gateway. Set traffic route:

route outside 0.0.0.0 0.0.0.0 X.X.X.X
Enter fullscreen mode Exit fullscreen mode

Try ping any source from your LAN network in inernet and see result:

ciscoasa(config)# ping google.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 173.194.73.113, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 80/86/90 ms
Enter fullscreen mode Exit fullscreen mode

Create new object for new subnet:

object network LAN_NETWORK
    subnet  192.168.1.0 255.255.255.0
Enter fullscreen mode Exit fullscreen mode

Setup NAT:

nat (inside,outside) after-auto source dynamic any interface
Enter fullscreen mode Exit fullscreen mode

Allow ping from local network to WAN:

policy-map global_policy
class inspection_default
inspect icmp
Enter fullscreen mode Exit fullscreen mode

Setup DHCP:

dhcpd address 192.168.1.2-192.168.1.254 inside
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
dhcpd dns 8.8.8.8 8.8.4.4
Enter fullscreen mode Exit fullscreen mode

Top comments (0)

Read next

mihika profile image

Linux Log Analysis | Hammered Lab | CyberDefenders

Mihika -

jmuehlig profile image

Profiling Specific Code Segments of Applications

Jan Mühlig -

nlankwei5 profile image

Comprehensive Bash System Monitoring Script: Technical Breakdown

Ebenezer Lamptey -

dumboprogrammer profile image

Mseal in Linux: An un-hackable solution?

Tawhid -