topic Re: ASA static routing via DNS updates for mobile hosts in Network Security

ASA static routing via DNS updates for mobile hosts

fsebera — Mon, 11 Mar 2019 19:23:18 GMT

I need to setup our ASA firewall to route traffic to a DNS name of the remote host instead of its IP address.

The mobile host is mobile (always moving around) and using cellular broadband for data communications back to the HQ sites.

The mobile host very often enters a "Dead Zone" (yes they still exist) and looses signal. Upon returning to a good signal, the mobile host now has a new IP address. The mobile host does automatically update the HQ DNS of its new IP address but the ASA firewall sees this new address as a hack attempt. The ASA is not reading the DNS server updates for mobile host names to IP addresses. We CANNOT use static addressing on the mobile host, too costly and a vilotation of rules.

.......................

I have enabled the following on the ASA:

names

name 192.168.0.1 mobile-host1

. . .

name 192.168.1.235 mobile-host510

route outside mobile-host1 10.0.0.1

. . .

route outside mobile-host510 10.0.0.1

.............................

10.0.0.1 is the ASA firewall default gateway.

.....................

This all works well as long as the mobile-host# IP does not change.

Is there a way to make the ASA "static route" command get the mobile-host# update IP addrsses from DNS dynamically?

Is there a better way to accomplish this task?

We have several thousand mobile-hosts?

Thanks again!!!

Frank

Re: ASA static routing via DNS updates for mobile hosts

Kureli Sankar — Thu, 16 Dec 2010 18:03:40 GMT

Frank,

Can't think of a way. Let me ask around.

-KS

Re: ASA static routing via DNS updates for mobile hosts

fsebera — Thu, 16 Dec 2010 18:36:58 GMT

I have discovered this document, ASA 5500 series that speaks to the subject of mobile clients and the ASA.

This document title is "Configuring DHCP, DDNS and WCCP Services"

If you don't want to click on the link, do a google search for the title and you'll get the same doc as listed below.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/dhcp.html

Since this is a new topic for me, hopefully someone with more experience will offer some guidance.

Thanks again

Frank

Re: ASA static routing via DNS updates for mobile hosts

Kureli Sankar — Thu, 16 Dec 2010 19:43:02 GMT

Do you need this just so both mobile clients can find each other? If so you can try this DDNS.

But you are asking static routes on the ASA based on the names that may have their IP association changed.

-KS

Re: ASA static routing via DNS updates for mobile hosts

fsebera — Fri, 17 Dec 2010 14:02:26 GMT

No we do not need the spokes (mobile clients) to communicate with each other.

Clarification:

Mobile Mobile Mobile, Dynamic IP static static static static

laptop - INE - cellular modem - telecom - border router - border firewall - INE - Internal HQ network

IPsec VPN <-----------------------------> IPsec VPN

VPN <------------------------------------------------------------> VPN

The IPsec VPN configured on the cellular modem and terminates on the border firewall, will encapsulate the INE VPN.

The cellular modem is using dynamic DHCP, a new IP address each time it connects to the telecom.

After the initial connections are made and all remote connections have been authenticated, all works well, the problem is when the cellular modem looses cellular signal and then recovers, the cellular modem receives a new IP address while the current (original) VPN tunnels are up and operational with the original IP addresses, the border firewall cannot use the original route to the mobile client as the mobile client now has a new IP address. So the border firewall does not have a route to the mobile cellular modem/INE/laptop.

Tks

Frank