Understanding 5505 firewall-site to site and internet traffic

Hi,
My question is mutli-faceted. I apologize for the lengthy intro here but i think the info is necessary to understand where I am headed in this.
I am new to the cisco 5505. I have had very limited exposure to a 5510 that was preset. I have managed to make modifications to it here and there, but dont completely understand how it was put together. I learn by watching, listening, and gleaning what I can from others. I have had no formal training in CLI, but I have learned some of the commands. I know enough to be dangerous, but I respect my limitations.
That being said, I have been charged with setting up a 5505 at a remote site. I need to accomplish several things.  Our ultimate goal is to use this device as a site to site with the 5510 at the corporate office. However, I need to accomplish this in baby steps, test, test real users and then maybe convert in full. Where I could outsource this in its entirety, that would preclude me from learning so I can address this in the future on my own.
We need to have this in place by the end of February 2013.
Currently the remote site is connected via a very slow (by todays standards) T1 line on a MPLS. Stable. Works, but slow. All internet traffic as well as work traffic is routed through that connection. We have added a 50mb cable connection (with static ips) to the office. First we want to set up the 5505 so that it can be used as follows:
1, Internet traffic can be routed out through this device and all other "work" traffic routed through the MPLS.
2, Test using this connection as a route out to the internet AND use it as a site to site VPN connection to the home office. (or anyconnect vpn)
          I need to be able to have users in both environments. IE, some still using step 1 and some starting to use and test step 2.
3, long term, use this as the main connection per number 2, but add the IP address so that if the cable connection drops, the office can access internet via the VoIP T1 line as a life line.
In all cases, I dont want internet going through the home office as it currently is traveling.
I have done a lot of searching but so far have come up empty with answers.
Question 1:     (This one probalby shows my ignorance the worst) - in using the 5505 firewall, will it segregate normal internet traffic from the VPN traffic when used by the workstation? Using the Gui, I didnt see where this was necessarily happening. Do I need to use CLI language (and what) to make this happen? Or is that a basic function that happens during the setup of the firewall using the GUI. Do I need to do some sort of "split tunneling"?
Question 2:     Do I use this device as the Default gateway for both step 1 and 2/3) for normal use and then change the gateway on the Pcs to the VoIP network during emergency use,(that would bypass the firewall though or is there a way to have it route to that router if there is no connection through the Outside port? Or as long as I have some access to the device, can I make a change remotely to help accomplish this failsafe?
Question 3:     We have 25 Anyconnect VPN licenses. Should we use these and not the Static site to site, if so, why or why not? They dont need to be used at all.
Question 4:     In setting up the VoIP line for backup, would using that on the "DMZ" connection help in making this viable so that the device could still ultimately control the internet traffic?
Question 5:     In setting up the VPN connections, unless i am getting the two methods confused, I will need the 5505 to hand out IP addresses for the vpn connection. I see in using a class c schema that i can use 92.168.0.0 to 192.168.255.0. So for instance, I could use 101.1.20.0 for the inside network Vpn addresses?? I need to stay away from 192.168.0.0 networks as we use that in our normal structure.
Reasons for setting this up:
Slow speeds over the T1.
increasing demand for Skype, Video conferencing etc that the T1 pipe couldnt adequately handle
Lack of backup pathways for downed connections - ie, backhoe chopping through wire at a construction site).
I read through the Getting started guides on both the 5510 and the 5505 and feel I can likely get the site to site setup (I have a list of all the Ip addresses i need for inside networks and outside networks etc.
additional notes:
I have to email ATT anytime I want a change made on the MPLS router, so doing as little to that as possible would be good.
I will be onsite for testing at the end of February  and will have direct access to the home office via other methods to work on the asa5510 if any additional work needs to be done on it once i am onsite.
Thanks for taking the time to read through all of this. please forgive my lack of knowledge...
Dave

Thanks for getting back to me and so quickly!
1) I am not sure if I understand the “ACL” portion of your question, but this is how I want to access info via the VPN tunnel:
192.168.D.0 inside(NJ) to outside 5505 - 12.175.X.X to outside 5510 - 12.200.X.X to inside network (HQ)192.168.X.0. Routes are needed to find subnets 192.168.A.0, 192.168.B.0 and 192.168.C.0. The default gateway to those subnets right now is: 192.168.X.XX4 inside of HQ. This would be so that the NJ office could find resources of the other offices if needed. This will change as we wean off the MPLS. Inside the ASA 5505, the IP addresses are 192.168.D.0 for data, 10.X.X.0 for the Phone system. All other traffic would be sent out through the internet. Phone system uses the XOcomm conection to route phone traffic.
2) I did some reading on SLA. Thanks for pointing that out. For purposes of learning here, I am showing this as 12.175.XXX.XXX for Comcast and 12.200.XXX.XXX for XO comm.
4) I guess I would use an Outside 2 as that makes sense, in description, I would label them “ComCast” for outside 1 and “XOcomm” for outside 2.
5) I am still not sure I understand this part. Are additional IP addresses needed for the Site to site VPN to talk to the local hosts, or will it use the IP addresses assigned by the local server?
Next Steps
1-         Configure the ASA5510 for the 5505 connection
2-         Configure the ASA5505 for the 5510 connection
3-         Configure SLA for Comcast and XOcomm outside connections
4-         For this I need help….I think this is from step 1, but I need help to configure the internet to be segregated via my question from #1. Have I given enough information to do so? Please advise on ACL entries, and route statements needed so that NJ can talk to all the offices when using this connection, not just the Headquarters.
Thanks
dave

Similar Messages

  • AD sites and internet connectivity requirements

    Hi All,
    I am looking on setting up several AD sites on my lab environment. I run 2 physical Hyper-V servers in 2 sites. Per my understanding, 1 (or at least 1) DC in each site must be a bridgehead server to replicate out to other sites (inter).
    For security reasons, my DCs have no internet connection but are on a private IP. They are not multi-homed. So for a >1 site setup to work, does this mean one DC must have an internet connection to talk to DCs in other sites? Is this not a bad practice?
    Likewise, if I give the DC a 2nd NIC for internet connectivity, isn't this a bad idea?
    Any guidance much appreciated.
    Thanks

    As long as you have routing enabled between your sites there is no need to establish internet connection on DC's. Also it is not recommend to have internet connection on DC's from security perspective. In addition I myself, never recommend to have multiple
    NIC's on your DC's, you can configure a gateway between different subnets and use it in order to connect different subnets to each other. 
    Regards.
    Mahdi Tehrani Loves Powershell
    Please kindly click on Propose As Answer or to mark this post as
    and helpfull to other poeple.

  • How to start a loop back proxy in Windows Phone 8 and have all app and internet traffic routed via it

    I want to develop a proxy in windows phone 8 that will handle all data traffic emanating from phone(i.e. browser and Apps). The following procedures were carried out
    a) Edited the Wifi settings http proxy and port to the loop back proxy running in the phone(i.e. 127.0.0.1) and the port in which we brought up the loop back proxy
    b) We browsed pages and no request landed on the loop back proxy in the phone
    Loop back proxy in phone is built using StreamSocketListener 
    Another observation is that:
    If we edit Wifi settings http proxy and port to a http/https proxy running on server then when we browse pages from windows phone we are getting the requests to server. Why is this difference?
    Is there a limitation to run http/https proxy on mobile phone as loop back proxy.
    But there are apps in the market for windows phone that behaves as HTTP proxy like 
    http://www.windowsphone.com/en-us/store/app/smartproxy/75da629b-c0f3-4999-86a3-9559181d1299
    Any help on the same would be appreciated

    Hi,
    Thanks for your reply and we have used StreamSocketListener waiting on a port and ip is given as loopback.The same settings are done for Wifi access point but when we browse any page in IE the requests are not landing on to the loop back proxy.Any idea on
    the same would be highly appreciated

  • Functional difference between Blackberry and Internet Browser on the device

    Hello:
    Based on the following link, I understand the difference between the Blackberry and Internet browser (http://www.blackberryforums.com.au/forums/blackber​ry-general-discussion/2815-difference-between-brow​...
    I was wondering if there are any functional difference between the two, i.e. HTML rendering, images being broken, etc. Under Browser -> Options -> Browser Configuration, If I configure both the Blackberry and Internet browser the same way, will a particular URL behave the same?
    I'm in the process of testing our mobile applications on different devices and would appreciate if you could provide the difference, if any between the 2 browsers.
    Thanks:
    Vishal

    Hey vishalt77,
    Welcome to the BlackBerry Support Community Forums.
    All BlackBerry smartphones will have Internet Browser for browsing the web.
    However if you're on a BlackBerry Enterprise Server, you get the BlackBerry Browser which enables you to access internal websites and secured websites.
    -ViciousFerret
    Come follow your BlackBerry Technical Team on Twitter! @BlackBerryHelp
    Be sure to click Like! for those who have helped you.
    Click  Accept as Solution for posts that have solved your issue(s)!

  • Exchange Server 2010 Mailflow between Internet Facing-Site and No Internet Facing-Site

    Hi all,
    My environment there are two sites, Internet Facing-Site and No Internet Facing-Site.
    The mail flow between them, it isn't working. The messages stuck in the queue.
    Default Receive Connector No internet facing-site is configured, bellow:
    Defaul....
    - Transport layer....
    -Basic Authentication...
    - Exchange Server Authentication.
    - Integrated windows....
    Configuration the Internet Facing-Site, bellow:
    From intenet
    - Transport layer....
    -Basic Authentication...
    - Integrated windows....
    And i configured a new receive connector on the Internet Facing-Site, follow bellow:
    Sites
    - Transport layer....
    -Basic Authentication...
    - Exchange Server Authentication.
    - Integrated windows....
    But, the messages yet stay stuck in the queue.
    Queue error:
    451 4.4.0 Primary target IP address responded with: “421 4.2.1 Unable to connect.” Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts.
    I'm needing help, pls.

    Please check SMTP traffic filtering/scanning enabled on the router/firewall. You can telnet even if the SMTP
    traffic filtering/scanning enabled on the router/firewall. But emails will not pass through if the configuration is incorrect.
    May be speed between sites causing this issue (not sure). Anyway please try changing the Tarpitinterval as a test.
    To see the current setting "Get-ReceiveConnector | Select name,tarpitinterval "To set new value "Set-ReceiveConnector “<Connector-Name>”
    –TarPitInterval:00:00:010"
    Try restarting "MSexchange-Transport-sevice" on both servers as well
    Can you send email one-way or
    both ways not working? 
    MAS

  • Move Internet facing site and remove Exchange site

    Background:
    I am running Exchange 2010 in native mode
    I have multiple AD sites connected via WAN
    I have two sites each with an Exchange CAS, HT, Mailbox server and internet connections
    I have one Edge server in the DMZ at the internet facing site A
    All mail currently flows in/out through site A via connectors
    OWA is currently hosted on the CAS/HT server at site A
    I have installed a new Edge server in the DMZ of site B and cloned the configuration.
    I am planning the move of the internet facing site to the new site where the other Exchange CAS/HT server resides.
    Once the mail flow is occurring correctly in/out site B, I need to move all mailboxes to site B and shut down the Exchange server at site A. 
    Questions:
    When I create the Edge Subscription at the new site, it offers to create a new send connector.  The CAS/HT server at site B already has a send connector to site A.  Will the new send connector cause mail flow problems if it is pointing to
    the new Edge server that is not yet updated on public DNS?  I am trying to do this in stages and I am not ready to change mail flow to site B internet.
    What needs to happen to move OWA to the Exchange server at site B?
    Once site B is handling OWA, all mail flow, and all mailboxes have been moved to that site, can I simply shut down the site A Exchange server?
    Thanks for any input on how best to plan this move.  If there is any documentation for this specific scenario, I work well from instructions but have not seen anything on the internet.

    1.  Sending can happen from both sites, regardless of where your MX records point.  In fact, you don't need an MX record to send email - just to receive.  So the new send connector in Site B won't cause issues with mail flow - messages will
    go out B and come in A until you rehome your MX record.
    2.  In order to move OWA to Site B, your external records for your OWA site need to point to the external IP address that will connect to the Site B CAS (and hopefully, you have it behind a firewall of some sort).
    3.  Not quite - you need to move your OAB generation to the new site, and make sure that all CAS virtual directories in the new site are configured to handle the connections that currently go to Site A.  See the following for what you need to do
    to decommission your Site A Exchange servers - but where it says "Exchange 2013", think "Site A Exchange servers": 
    http://technet.microsoft.com/en-us/library/ee332361(v=exchg.141).aspx

  • I try to log in to password protected sites and nothing happens but works fine on Internet Explorer. Can't get past login page. I even had to use Internet Explorer to login to ask this question!

    I try to log in to password protected sites and nothing happens but works fine on Internet Explorer. Can't get past log in page. I even had to use Internet Explorer to login to ask this question!
    On the page where you enter username and password after entering and pressing "Log in" the page just stays in place. If you look at the error log you see
    "Warning: Unknown property 'border-radius'. Declaration dropped.
    Source File: https://support.mozilla.com/media/css/common-min.css?build=3fabbc0
    Line: 1"

    Make sure that you do not block the referrer.
    * http://kb.mozillazine.org/network.http.sendRefererHeader
    Also make sure that you do not block cookies in Firefox or the firewall.
    * [[Cookies]]
    * [[Enabling and disabling cookies]]

  • Issue with Internet facing site and Intranet sites

    Hello All,
    I have migrated the SP2013 environment using database attach method for our intranet site. We also working on the
    SP2013 Internet facing site using the same content database as Internet site.
    When I extended the web application for Internet facing site, zone to
    Internet and these are the URLs: The Intranet website URL is
    https://intranet.contoso.com/SitePages/home.aspx (Root Site) and
    SP2013 Internet facing site http://contoso.com (not a root site and publishing site template)
    However, I found on the http://contoso.com users can still access the
    http://contoso.com/SitePages/home with same content as Intranet.
    After done some Google search, bloggers mentioned to have move  https://intranet.contoso.com/SitePages/home.aspx to another site collection so that Internet facing site can exist root site.
    Can 2 we have to two root sites in same web application? I need the content database to be same so that managers can check
    Internet facing site and after signing into SP2013, redirects to
    Internet site.  
    Which is the best option to achieve this with same content database.   
    Please advice.
    Regards,
    Aroh 
    Aroh Shukla

    Business Requirement:
    Content Managers want to control internal Internet site (https://intranet.contoso.com) (with default zone, port 443, Root site) and also want to have SP2013 Internet site (with Internet zone
    http://www.contoso.com (not a root site and publishing site template)), Anonymous access at Web Application level. I configured the site architecture
    to have intranet zone as default zone and extended Web Application for Internet facing site with Anonymous site. This the current site architecture
    Because content managers do not want to duplicate public site (Internet facing site) with will be shared with some lists that are stored in intranet site.
    For e.g. a sub site named “News and Events” will be shared with Public site as well as Internet users. Therefore, if a manger wants to update a list in the public site, it should reflect in intranet site as well. Thus, managers
    don’t want to have separate database but same content database.
    Problem:
    I have extended web application to have different Internet zone, the site URL looks this: http://www.contoso.com/sites/public with publishing template and Anonymous access. Managers want to have public site URL to be just
    http://www.contoso.com and not   http://www.contoso.com/SitePages/Home.aspx. As I am using path based site collection for extending site collection, I am
    getting this URL http://www.contoso.com/SitePages/Home.aspx
    We also tried host named site collection, but it does not provide anonymous access and keep on asking for user credentials.
    Q1: We want to have Intranet and Public site with same content database as per business requirements, Shall I following link       http://sharepoint.stackexchange.com/questions/81172/moving-content-db-for-a-site-collection-to-another-db-server?
    Q2: Because I am constrained that I don’t want to have separate web application, (I know, its not regular requirement), how could achieve this requirements?
    Q3: Do have to completely re-design web site architecture, with
    www.contoso.com as main web application, then copy Intranet site collection and move this to
    www.contoso.com/intranet using
    Move-SPSite command 
    Any kind of pointer and help will be highly appreciated as I am struggling for 2 weeks to solve this.
    Regards,
    Aroh  
    Aroh Shukla

  • Why can't I update or load new apps on my iPhone and iPad. It does not ask me for my password. I tried to sync from my laptop now I am unable to connect to any sites from internet explorer. When I try to update or load any app it tells me it is corrupt

    Why can't I update or load new apps on my iPhone and iPad. It does not ask me for my password. I tried to sync from my laptop now I am unable to connect to any sites from internet explorer. When I try to update or load any app it tells me it is corrupt

    You need to ask Apple for assistance with getting back into your old ID. To do this, click here and pick a method; if that page doesn't list one for your country or you're unable to resolve this issue through the Account Security team, fill out and submit this form.
    (118441)

  • How do I revert my iWeb published site (the actual published site in internet is up to date) the one on my repaired computer is old from a time machine back-up and out of date?

    The question is above I repaired my hardrive and the iweb site is from an old time machine back-up. In the web my site is up to date and I want to update my computer stored iWeb site to the site in internet ?

    You need to copy and paste the content from the published files back into iWeb and recreate any missing pages since iWeb has no import facility.

  • I downloaded norton internet security and it says I need firefox 4 to opperate correctly. I went to your site and downloaded lateset version and Norton still doesn't work . How do I get version 4

    I downloaded norton internet security and it says I need firefox 4 to opperate correctly. I went to your site and downloaded lateset version and Norton still doesn't work . How do I get version 4 so that my computer and I are protected?

    How can I go back to version 3? Thanx.

  • Iphone used to connect to internet site when email had reference to the site and I requested it.  iphone stopped doing this. How do I get it to resume doing it?

    iPhone 4 used to connect to internet site when email had reference to the site and I requested it.  iPhone stopped doing this.  How do I get it to resume doing it?

    Have you tried restarting or resetting your iPhone?
    Restart: Press On/Off button until the Slide to Power Off slider appears, select Slide to Power Off and, after It shuts down, press the On/Off button until the Apple logo appears.
    Reset: Press the Home and On/Off buttons at the same time and hold them until the Apple logo appears (about 10-15 seconds). No data will be lost.

  • When the Wifi is connected, the iphone seems to search for some site and if firewall does not allow the access to that site, it disconnects the connection to Wifi. Can anyone help on this?

    When the Wifi is connected, the iphone seems to search for some site and if firewall does not allow the access to that site, it disconnects the connection to Wifi. Can anyone help on this?

    Hi SBEG2015,
    I'm sorry to hear you are having these issues with your iPhone. Based on your description of what has happened and the symptoms you are seeing, you may need to have your iPhone evaluated and/or serviced. You may find the following page helpful:
    Apple - Support - Service Answer Center
    Regards,
    - Brenden

  • I would like to import Security Trusted Sites and Popup Settings from Internet Explorer

    We are setting Firefox up on our Resource Room Computers and do not want to re-enter trusted sites and popup settings. How can I import them?

    Please help me get rid of this Pop up, it is driving me mad.  I tried  to access the forum on your address BUT the Conduit sight would not allow.
    Please can anyone help.
    Lorry M
    Date: Tue, 11 Mar 2014 13:08:12 -0700
    From: [email protected]
    To: <removed personal infomration>
    Subject: Re: I would like to remove an annoying popup from Adobe Flash Player everytime I access the Internet and I would like to remove an annoying popup from Adobe Flash Player everytime I access the Internet and
        Re: I would like to remove an annoying popup from Adobe Flash Player everytime I access the Internet and
        created by m_vargas in Using Flash Player - View the full discussion
    Hello,
    Flash Player does not display pop-ups.  If you are experiencing this behaviour you most likely have malware installed on your system.  You'll want to scan your system with anti-malwareand  anti-virus software.
    Maria
    Please note that the Adobe Forums do not accept email attachments. If you want to embed a screen image in your message please visit the thread in the forum to embed the image at http://forums.adobe.com/message/6200618#6200618
    Replies to this message go to everyone subscribed to this thread, not directly to the person who posted the message. To post a reply, either reply to this email or visit the message page: Re: I would like to remove an annoying popup from Adobe Flash Player everytime I access the Internet and
    To unsubscribe from this thread, please visit the message page at Re: I would like to remove an annoying popup from Adobe Flash Player everytime I access the Internet and. In the Actions box on the right, click the Stop Email Notifications link.
               Start a new discussion in Using Flash Player at Adobe Community
      For more information about maintaining your forum email notifications please go to http://forums.adobe.com/thread/416458?tstart=0.
    removed personal email address

  • What is the best approach to setup intranet and internet sites in SharePoint 2013?

    I am planning to setup a internet and intranet website for one of our client.  What is the best approach to setup this kind of environment?
    Some of the users (registered users) from the internet should be able to access information in the intranet site.  I have created two web applications for intranet and internet.  Is it the right way to go forward?
    Thanks in advance! :)
    LM

    Hi Laemon,
    Creating two separate web applications, one for Internet site and the other for Intranet is the right thing you have done.
    1. To properly plan creation of your web application, site collection and website is of utmost important to ensure you build your site in a professional and most recommended way. Go through this article from Technet that would help you plan your site in
    SharePoint 2013.
    https://technet.microsoft.com/en-us/library/cc263267.aspx
    2. Planning and choosing the right authentication type is also a very important decision. I recommend you to go through the below article if you have not already gone through.
    Plan for user authentication methods in SharePoint 2013
    3. Plan for licensing for your SharePoint 2013 Internet Facing Website.
    Licensing Internet Sites Built on SharePoint 2013
    SharePoint 2013 licensing for Internet facing sites
    4. To grant access to registered users to Intranet site (as you mentioned in question), if you created both web applications in same farm (same domain) then that would be easy to grant access using Site Permission with Windows Authentication enabled for
    both web application. If both web applications are created on different domains then If there is a two-way trust in place, and the SharePoint servers have the necessary port access to the remote domain's Domain Controller, then it is automatic. If it is a
    one-way trust, then you need to follow these directions:
    http://technet.microsoft.com/en-us/library/cc263460(v=office.12).aspx
    If there is no domain trust in place, then you either need to create one, or look at alternative technologies,
    such as ADFS.
    Please remember to upvote if it helps you or
    click 'Mark as Answer' if the reply answers your query.

Maybe you are looking for