Cisco – Route Specific Traffic To Another Firewall

ciscocisco-asaroutingswitchingvpn

I'm looking for a way to setup a route from my internal LAN to another router.

Here's the current situation:
I have an ASA5512-X where all servers are connected and all the employees are connected to, so they can access the internal network. Another company has a Checkpoint Appliance on its LAN. When you are connected to this LAN you can open a Website (hosted at their building) where you can login to their VPN. This website (for example: 192.168.168.100) is only reachable through their CheckPoint Firewall. I don't have access to the Firewall yet. It wasn't configured by me. At the moment, when an employee wants to connect to their network he needs to change the LAN Cable and get the IP of a NOT-SO-SECURE-LAN (192.168.10.0/24), which isn't a good solution.

Both Firewalls have their own outside interface with static IP connected to an unmanaged switch as our modem only has one interface.

I'm looking for a route, where I can reach the website 192.168.168.100 from the internal LAN. When a package is addressed for 192.168.168.100 and sent to the CheckPoint Firewall. But the Checkpoint Firewall should never be allowed to access something in my internal network. It should be like a DMZ.

Is it possible to configure an Interface as part of the "not so secure LAN" ?

NOT-SO-SECURE-LAN: 192.168.10.0/24. GATEWAY: 192.168.10.1

IP ADDRESS OF INTERFACE ON ASA: 192.168.10.10

And then a route like (in linux it would be something like this):

ip route add 192.168.168.100 via 192.168.10.1 dev GigabitEthernet 0/X ?

enter image description here

Best Answer

Yes, this is possible. Just configure the ASA as you would a client (with a static, not a DHCP address unless it is reserved), configure routing and firewall rules and connect it.

Caveats:

  1. When you add a route to (at least) 192.168.168.100/32 through your ASA you also need to add a route back to your network in the Checkpoint (and possibly beyond). There can be no ambiguous IP ranges on both sides (that are routed across).
  2. Failing transparent routing, you need to use source NAT, hiding the real IP address in your network behind 192.168.10.10
  3. The connections you allow have to be explicitly permitted on the ASA. Just allow connections from the clients you want to be able to connect out and no connections back in.
Related Topic