Case Study of a Small Business
This section uses Company-A as an example. Company-A is a small web development company based in Raleigh, North Carolina. Its office in Raleigh hosts 35 employees. The user population is composed of sales, marketing, finance personnel, and several web developers. Figure 12-1 illustrates the network architecture and topology of the Raleigh office of Company-A.
The Raleigh office has a simple network architecture. Client workstations are connected to an access switch and then connected to the Cisco Adaptive Security Appliance (ASA) inside interface. The Cisco ASA outside interface connects directly to a router provided by the Internet service provider (ISP) of Company-A. The ISP completely manages this router; Company-A has no control over it. A third interface on the Cisco ASA hosts a demilitarized zone (DMZ) hosting several servers. These servers include web, e-mail, and FTP applications.
Figure 12-1 Raleigh Office of Company-A
Figure 12-1 Raleigh Office of Company-A
Because this is a simple topology, all security policies are enforced in the Cisco ASA. The goal is to protect the internal and DMZ hosts from external threats, while allowing the following:
• Client workstations must be able to access the web server at the DMZ (10.10.20.10) over HTTP and HTTPS. Clients should also be able to put and get files via FTP to the same server at 10.10.20.10.
• Client workstations must be able to access the Internet over HTTP and HTTPS. No other protocol access is allowed to the Internet.
• Client workstations must be able to check their e-mail on the e-mail server at the DMZ (10.10.20.20).
• The web server should be reachable from outside Internet clients over HTTP and HTTPS only. The Cisco ASA should do static Network Address Translation (NAT) for the web server to be reachable via a public IP address from the Internet.
• The e-mail server should be able to receive e-mail from external hosts over the Simple Mail Transfer Protocol (SMTP). The Cisco ASA should do static NAT for the e-mail server to be reachable via a public IP address from the Internet.
• The client workstations will be translated to the external public IP address of the Cisco ASA using Port Address Translation (PAT).
Continue reading here: Raleigh Office Cisco ASA Configuration
Was this article helpful?
