Yes, the question was asked and I remember asking the guy to send them to me. He supplied these two His name is Ge Moua, btw Thanks to Ge again! Ziv
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Geyer, Nick Sent: Monday, October 20, 2008 12:30 AM To: [email protected] Subject: [c-nsp] Transparent ASA on dot1q trunk Hi All, A few months back I remember there was a discussion regarding the configuration of an ASA in transparent mode sitting in the middle of a dot1q trunk. I believe a few example configurations were passed around, but I cant find any of these using public archives. I'm just wondering if anyone has such configuration examples they could pass on to me? Any assistance would be greatly appreciated. Cheers, Nick _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ************************************************************************************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************************ ************************************************************************************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************************
asa5580# sh run : Saved : ASA Version 8.1(0)147 <system> ! firewall transparent hostname asa5580 enable password blah encrypted no mac-address auto ! interface Management0/0 description ## Connect to Gi1/0/24 on Infotech-AN-01 * "outside" Mgmt Vlan 1000 for "admin" context on Cisco ASA-5580 ## ! interface Management0/1 shutdown ! interface GigabitEthernet3/0 description ## 802.1Q Trunk * Connect to Gi1/0/13 on Infotech-AN-01 ## ! interface GigabitEthernet3/0.200 description ## Vlan 200 * "inside" Vlan for Firewall Context "TEST-ASA5580-FW001" ## vlan 200 ! interface GigabitEthernet3/1 description ## 802.1Q Trunk * Connect to Gi1/0/14 on Infotech-AN-01 ## ! interface GigabitEthernet3/1.201 description ## Vlan 201 * "outside" Vlan for Firewall Context "TEST-ASA5580-FW001" ## vlan 201 ! interface GigabitEthernet3/2 description ## 802.1Q Trunk * Connect to Gi1/0/15 on Infotech-AN-01 ## ! interface GigabitEthernet3/2.202 description ## Vlan 202 * "inside" Vlan for Firewall Context "TEST-ASA5580-FW002" ## vlan 202 ! interface GigabitEthernet3/3 description ## 802.1Q Trunk * Connect to Gi1/0/16 on Infotech-AN-01 ## ! interface GigabitEthernet3/3.203 description ## Vlan 203 * "outside" Vlan for Firewall Context "TEST-ASA5580-FW002" ## vlan 203 ! interface GigabitEthernet4/0 shutdown ! interface GigabitEthernet4/1 shutdown ! interface GigabitEthernet4/2 shutdown ! interface GigabitEthernet4/3 shutdown ! interface TenGigabitEthernet5/0 description ## 802.1Q Trunk * Connect to TenGi2/4 on Infotech-BR-01 ## ! interface TenGigabitEthernet5/0.3708 description ## Vlan 3708 * "inside" Vlan for Firewall Context "CSERV-FW001" ## vlan 3708 ! interface TenGigabitEthernet5/0.3709 description ## Vlan 3709 * "outside" Vlan for Firewall Context "CSERV-FW001" ## vlan 3709 ! interface TenGigabitEthernet5/1 shutdown ! class default limit-resource All 0 limit-resource Mac-addresses 65535 limit-resource ASDM 5 limit-resource SSH 5 limit-resource Telnet 5 ! boot system disk0:/smp810-147-k8.bin ftp mode passive pager lines 24 no failover asdm image disk0:/asdm-61028.bin no asdm history enable arp timeout 14400 console timeout 0 admin-context admin context admin allocate-interface Management0/0 config-url disk0:/admin.cfg ! context TEST-ASA5580-FW001 allocate-interface GigabitEthernet3/0.200 allocate-interface GigabitEthernet3/1.201 config-url disk0:/TEST-ASA5580-FW001.cfg ! context TEST-ASA5580-FW002 allocate-interface GigabitEthernet3/2.202 allocate-interface GigabitEthernet3/3.203 config-url disk0:/TEST-ASA5580-FW002.cfg ! context CSERV-FW001 allocate-interface TenGigabitEthernet5/0.3708-TenGigabitEthernet5/0.3709 config-url disk0:/CSERV-FW001.cfg ! prompt hostname context Cryptochecksum:6dc963ea184ab1e2eceeeddcdda3211f : end
asa5580/CSERV-FW001# sh run : Saved : ASA Version 8.1(0)147 <context> ! firewall transparent hostname CSERV-FW001 domain-name ggnet.umn.edu enable password blah names ! interface TenGigabitEthernet5/0.3708 nameif inside security-level 100 ! interface TenGigabitEthernet5/0.3709 nameif outside security-level 0 ! passwd blah encrypted dns server-group DefaultDNS domain-name ggnet.umn.edu access-list PERMIT-ALL remark ## [START] PERMIT-ALL ## access-list PERMIT-ALL remark ## Reserve for Debugging or Emergency Use ## access-list PERMIT-ALL extended permit ip any any access-list PERMIT-ALL remark ## [END] PERMIT-ALL ## pager lines 24 logging enable logging timestamp logging monitor debugging logging buffered debugging logging trap debugging logging facility 23 logging host outside 192.168.249.59 mtu inside 1500 mtu outside 1500 ip address 128.101.58.134 255.255.255.240 icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside icmp permit any outside no asdm history enable arp timeout 14400 access-group PERMIT-ALL in interface inside access-group PERMIT-ALL in interface outside route outside 0.0.0.0 0.0.0.0 128.101.58.132 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ (outside) host 192.168.249.21 key blah aaa-server TACACS+ (outside) host 192.168.249.22 key blah aaa authentication ssh console TACACS+ aaa authentication telnet console TACACS+ aaa authentication enable console TACACS+ no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart telnet 160.94.221.0 255.255.255.248 inside telnet 192.168.224.0 255.255.224.0 outside telnet 134.84.20.0 255.255.255.0 outside telnet timeout 5 ssh 192.168.224.0 255.255.224.0 outside ssh 134.84.20.0 255.255.255.0 outside ssh timeout 5 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp ! service-policy global_policy global Cryptochecksum:8ec6a416d4238fbe77fa8493dc2a3ea4 : end
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
