static ip address ASA 5505 v 8.4

[par13]

I just upgraded my firewall to ASA 5505. Now, my original static ip address cofiguration is gone. Apperantly, Cisco went away from static ip address to something like nat (inside,outside) dynamic interface.

Can anyone share how to create a static ip address under version 8.4? By the way, I am sharing what my configuration used to look before upgrading.

!

hostname cisco-asa

domain-name default.domain.invalid

names

!

interface Vlan1

nameif inside

security-level 100

ip address 10.2.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 152.18.75.132 255.255.255.240

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

dns server-group DefaultDNS

domain-name default.domain.invalid

object-group network dts-servers

network-object host 152.31.53.251

network-object host 152.31.53.195

object-group network frs_servers

network-object 152.111.5.22 255.255.255.255

access-list extended extended permit ip any any

access-list extended extended permit icmp any any

access-list extended extended permit ip any object-group dts-servers

access-list acl_out extended permit tcp any object-group frs_servers eq https
access-list outside_access_in extended permit ip any host 152.18.75.133

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any echo-reply inside

icmp permit 10.2.1.0 255.255.255.0 inside

icmp permit any echo-reply outside

icmp permit 152.31.53.0 255.255.255.0 outside

icmp permit 152.31.185.0 255.255.255.0 outside

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 152.18.75.133 10.2.1.2 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 152.18.75.129 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

http 10.2.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet timeout 5

ssh 10.2.1.2 255.255.255.255 inside

ssh 152.31.53.0 255.255.255.0 outside

ssh 152.18.1.128 152.18.75.132 outside

ssh timeout 30

console timeout 0

dhcpd auto_config outside

!

dhcpd address 10.2.1.2-10.2.1.254 inside

dhcpd enable inside

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect icmp

!

service-policy global_policy global

prompt hostname context

Thanks

[Julio Carvajal]

Hello Sr,

You want to know how to make this work on 8.4

static (inside,outside) 152.18.75.133 10.2.1.2 netmask 255.255.255.255

would be

object network a-152.18.75.133

host 152.18.75.133

object network a-10.2.1.2

host 10.2.1.2

nat (inside,outside) source static network a-10.2.1.2 a-152.18.75.133

access-list outside_access_in extended permit ip any host 10.2.1.2

Regards,

Do rate all the helpful posts

Julio

[par13]

Thanks

However, when I entered the command nat (inside,outside) source static network a-10.2.1.2 a-152.18.75.133, the ASA 5505 responds Error: % Invalid input detected at '^' marker.

[Julio Carvajal]

Hello,

My bad...

nat (inside,outside) source static a-10.2.1.2 a-152.18.75.133

access-list outside_access_in extended permit ip any host 10.2.1.2

[par13]

it went in without any issues. however, still does not allow me to ping the external static 152.18.75.133 or to access the computers behind the firewall using the static rule.

[par13]

Hello,

I am looking at the sh nat detail, and there is an indication that traffic is trying to reach the external interface. however, I am not able to ping the external interface 152.18.75.133 or can't access the internal computer from one of my servers. Can you please provide additional help?

[Dan-Ciprian Cicioiu]

Hi ,

Please post

sh run nat

sh run global

sh run static

Regards

Dan

[par13]

sh run nat works: the results came back as nat (inside,outside) source static a-10.2.1.2 a-152.18.75.133. As far the other two commands, sh global and sh run static did not return any results. For both command, the asa 5505 v. 8.4 returned saying input detected at '^' marker.

However, my current config is:

hostname ciscoasa
domain-name default.domain.invalid
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 10.2.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 152.18.75.132 255.255.255.240
!
boot system disk0:/asa843-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
object network a-152.18.75.133
host 152.18.75.133
object network a-10.2.1.2
host 10.2.1.2
object-group network ext-servers
network-object host 152.31.53.251
network-object host 152.31.53.195
object-group network ecomm_servers
network-object 152.111.5.22 255.255.255.255

object-group network internal_subnet
network-object 10.2.1.0 255.255.255.0
access-list extended extended permit ip any any
access-list extended extended permit icmp any any
access-list extended extended permit ip any object-group ext-servers
access-list acl_out extended permit tcp any object-group ecomm_servers eq https
access-list outside_access_in extended permit ip any host 10.2.1.2
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo-reply inside
icmp permit 10.2.1.0 255.255.255.0 inside
icmp permit any echo-reply outside
icmp permit any outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static a-10.2.1.2 a-152.18.75.133
route outside 0.0.0.0 0.0.0.0 152.18.75.129 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 10.2.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh 10.2.1.2 255.255.255.255 inside
ssh 152.18.75.128 255.255.255.240 outside
ssh timeout 30
console timeout 0

dhcpd auto_config outside
!
dhcpd address 10.2.1.2-10.2.1.254 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:c337a7de8029b5cf591a96fba3289944
: end
ciscoasa(config)#