ASA 5505 als Firewall bzw. Layer Switch

[mickey 10]

hi alle!

ich habe versucht eine ASA 5505 mit OS 7.2 nicht als Router sondern als "firewall transparent" um zu funktionieren.

 

mein Problem: die Ports können untereinander nicht - kein pingen möglich. und über ETH0 hinein pingen auf andere auch nicht. die FW selbst kann überall hin pingen.

 

weiteres, habe ich nach einigen Upgrade etc. es geschafft dass die ASDM nicht mehr läuft - ist aber sekundär. Beide Images liegen sowohl als auf flash: wie auch auf disk0: auf.

 

hier die config:

 

 

fwmp3# show configuration
: Saved
: Written by enable_15 at 20:01:18.320 UTC Thu Oct 15 2009
!
ASA Version 7.2(1)
!
firewall transparent
hostname fwmp3
domain-name xxxxxx.intern
names
name 192.168.103.0 LAN
!
interface Vlan1
nameif inside
security-level 100
!
interface Vlan2
nameif outside
security-level 0
!
interface Ethernet0/0
switchport access vlan 2
no nameif
no security-level
!
interface Ethernet0/1
no nameif
no security-level
!
interface Ethernet0/2
no nameif
no security-level
!
interface Ethernet0/3
no nameif
no security-level
!
interface Ethernet0/4
no nameif
no security-level
!
interface Ethernet0/5
no nameif
no security-level
!
interface Ethernet0/6
no nameif
no security-level
!
interface Ethernet0/7
no nameif
no security-level
!
boot system disk0:/asa721-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name schramms.intern
object-group network LAN
network-object LAN 255.255.255.0
access-list outside_access_in extended permit tcp LAN 255.255.255.0 any eq telnet
access-list outside_access_in extended permit tcp LAN 255.255.255.0 any range 41794 41795
access-list outside_access_in extended permit tcp LAN 255.255.255.0 any eq www
access-list outside_access_in extended permit icmp any any
pager lines 24
logging enable
logging buffered debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
ip address 192.168.103.253 255.255.255.0
asdm image disk0:/asdm521.bin
no asdm history enable
arp timeout 14400
route outside 0.0.0.0 0.0.0.0 192.168.103.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http LAN 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
!
!
client-update enable
prompt hostname context

 

 

bitte um hilfe ;-)

 

vielen dank!

[MYOEY 10]

Hi,

Hier ist ein Config Beispiel:

 

ASA Version 7.2(3)

!

firewall transparent

hostname ciscoasa

domain-name default.domain.invalid

enable password /YwupGehUaXHL2SV encrypted

names

!

interface Vlan1

nameif inside

security-level 100

!

interface Vlan2

nameif outside

security-level 0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

dns server-group DefaultDNS

domain-name cisco.com

access-list outlist extended permit icmp any any

access-list outlist extended permit ip any any

pager lines 24

mtu inside 1500

mtu outside 1500

ip address 192.168.1.1 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

access-group outlist in interface outside

access-group outlist out interface outside

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

http server enable

http 0.0.0.0 0.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

!

service-policy global_policy global

username cisco password ffIRPGpDSOJh9YLq encrypted privilege 15

prompt hostname context

Cryptochecksum:bbce2b9a932b129aa9c8c5c4ce7a945b

: end