Re: Switching my static IP to Dynamic on my ASA 5506-x?

AmmarHermiz14196 · ‎07-23-2021

Hi all,

I am switching my Static ip address to Dynamic ip address. what is the procedure to that using CLI on my ASA 5506-x

Below is my configurations.....Thank you!!

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 10.0.0.1 255.255.255.0
no shut
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.10.254 255.255.255.0
no shut
!
interface GigabitEthernet1/3
nameif camera
security-level 95
ip address 192.168.20.254 255.255.255.0
no shut
!
interface GigabitEthernet1/4
nameif security
security-level 90
ip address 192.168.30.254 255.255.255.0
no shut
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo
access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo-reply
pager lines 24
logging enable
logging buffered informational
mtu outside 1500
mtu inside 1500
mtu camera 1500
mtu security 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-782.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
nat (any,outside) dynamic interface
access-group OUTSIDE_ACCESS_IN in interface outside
route outside 0.0.0.0 0.0.0.0 10.0.0.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 60
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside
!

dhcpd dns 8.8.8.8 8.8.4.4
!
dhcpd address 192.168.10.10-192.168.10.100 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
policy-map type inspect dns migrated_dns_map_2
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily

!

To enable ASDM on Cisco ASA, the HTTPS server needs to be enabled, and allow HTTPS connections to the ASA.

To configure ASDM (HTTP) access to Cisco ASA on particular interfaces, where core and management are the nameifs use following commands:

ASA(config)#aaa authentication http console LOCAL
ASA(config)#http server enable
ASA(config)#http 0.0.0.0 0.0.0.0 core

Remember to create username, password to be able to authenticate to asdm:

ASA(config)#username admin password secretpassword

balaji.bandi · ‎07-23-2021

I am switching my Static ip address to Dynamic ip address. what is the procedure to that using CLI on my ASA 5506-x

interface GigabitEthernet1/1

nameif outside

security-level0

ip address dhcp setroute

any static route added remove from config.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

AmmarHermiz14196 · ‎07-23-2021

Hi Balaji

By saying ip address dhcp setroute ? Means entering the dynamic IP and subnet mask followed by dhcp setroute ?
Thanks Ammar

balaji.bandi · ‎07-24-2021

It gets the IP address from the DHCP server and adds the route also. (i would suggest to shut down the port and configure this on ASA, and bring up, if any device it was connected to before, there may be ARP entry, depends on ARP time out it will clear, so you can do manually clear that ARP before you bring up ASA Interface ).

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Richard Burts · ‎07-24-2021

The other thing that you should do is to change/remove the existing static default route

route outside 0.0.0.0 0.0.0.0 10.0.0.1 1

I note that the next hop specified here is actually the configured IP address of the ASA itself.

HTH

Rick

AmmarHermiz14196 · ‎07-24-2021

So what I understood from both you and thank you both you.

All I need to change are below with different font and should work?

1- interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 10.0.0.1 255.255.255.0
no shut

2- route outside 0.0.0.0 0.0.0.0 10.0.0.1 1

Thank you,

Ammar

Richard Burts · ‎07-25-2021

Ammar

Yes those are the 2 things you need to change.

HTH

Rick

AmmarHermiz14196 · ‎07-25-2021

Thank you so much Richard!

Richard Burts · ‎07-25-2021

Ammar

You are welcome. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

HTH

Rick

AmmarHermiz14196 · ‎08-03-2021

Hi Richard,

I have the ASA 5506-x hooked it to the G3100 Verizon router as outside 192.168.1.254 and it’s working fine.

But what I want to do, is eliminate the Verizon router and connect the ethernet from the ONT directly to the ASA using dynamic IP address provided from Verizon.

It is not working that way .

Below is my config:

interface GigabitEthernet1/1

nameif outside

security-level 0

ip address 10.0.0.2 255.255.255.0

route outside 0.0.0.0 0.0.0.0 10.0.0.1 1

Do I need to do something else?

Thank you,

Ammar

balaji.bandi · ‎08-04-2021

interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address 10.0.0.2 255.255.255.0
!
route outside 0.0.0.0 0.0.0.0 10.0.0.1 1

G3100 Verizon router - is the same IP address configured on this router ? if then above config should work for you.

test from ASA are you able to ping 10.0.0.1 first ? and able to reach 8.8.8.8 from ASA, before going inside.

Hope your internal IP address do not overlap with 10.x.x.x. range

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Richard Burts · ‎08-04-2021

Ammar has clarified what he wants to accomplish "But what I want to do, is eliminate the Verizon router and connect the ethernet from the ONT directly to the ASA using dynamic IP address". @balaji.bandi has supplied very good suggestions about the changes to make. Ammar says it does not work and supplies the config but it looks like the original config and not the changes that were suggested.

If the changes are made and it is not working then we need to look further for issues. Perhaps as a starting point you could post the content of the routing table for the ASA and the content of the arp table.

HTH

Rick

AmmarHermiz14196 · ‎08-05-2021

Hi all,

Below the config I have right now and its working fine. which is I have the verizon route before the ASA. but when I configure the dynamic ip address as an outside in ASA, which is taking Verizon router out the picture won't work. why? maybe because it is a dynamic ip not static. before it was configured with static ip and the ONT was connected directly to the ASA but that time i had static ip from Verizon, now i have dynamic ip..

Thanks

!

interface GigabitEthernet1/1

nameif outside

security-level 0

ip address 192.168.1.254 255.255.255.0

!

interface GigabitEthernet1/2

nameif inside

security-level 100

ip address 192.168.10.254 255.255.255.0

!

interface GigabitEthernet1/3

nameif camera

security-level 95

ip address 192.168.20.254 255.255.255.0

!

interface GigabitEthernet1/4

nameif security

security-level 90

ip address 192.168.30.254 255.255.255.0

!

interface GigabitEthernet1/5

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/6

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/7

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/8

shutdown

no nameif

no security-level

no ip address

!

interface Management1/1

management-only

shutdown

no nameif

no security-level

no ip address

!

ftp mode passive

dns server-group DefaultDNS

domain-name no

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network obj_any

subnet 0.0.0.0 0.0.0.0

access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo

access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo-reply

pager lines 24

logging enable

logging buffered informational

mtu outside 1500

mtu inside 1500

mtu camera 1500

mtu security 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-782.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

arp rate-limit 16384

!

object network obj_any

nat (any,outside) dynamic interface

access-group OUTSIDE_ACCESS_IN in interface outside

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

timeout conn-holddown 0:00:15

timeout igp stale-route 0:01:10

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

aaa authentication login-history

http server enable

http 0.0.0.0 0.0.0.0 inside

no snmp-server location

no snmp-server contact

service sw-reset-button

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh stricthostkeycheck

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 60

ssh key-exchange group dh-group1-sha1

console timeout 0

management-access inside

dhcpd dns 8.8.8.8 8.8.4.4

!

dhcpd address 192.168.10.10-192.168.10.100 inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

dynamic-access-policy-record DfltAccessPolicy

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum client auto

message-length maximum 512

no tcp-inspection

policy-map global_policy

class inspection_default

inspect dns migrated_dns_map_1

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

policy-map type inspect dns migrated_dns_map_2

parameters

message-length maximum client auto

message-length maximum 512

no tcp-inspection

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:dd7a7017b7bd90d70a704f5bf1a49a9e

: end

balaji.bandi · ‎08-05-2021

The basic question still stand the same. we all know this config working, when you connect back to verizon router. and varizon router have 192.168.1.X network IP address.

The questions not addressed :

1. is the verizon support with ASA as client directly ?

2. when you make outside interface as DHCP, did you get IP address from ISP ?

3. some ISP do not like Static IP to configure, they get authenticated and allocate the IP (this is not happening your case i guess)

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Richard Burts · ‎08-05-2021

I am confused about this statement " before it was configured with static ip and the ONT was connected directly to the ASA but that time i had static ip from Verizon". Am I understanding correctly that at one time the ASA was connected directly to the ONT, using a static IP, and things worked correctly? If that is the case it might explain why attempting to connect with a dynamic IP is having problems. If the ONT is expecting a static IP it may not support having a dynamic IP.

Showing us the running config where the ASA has a static IP and is connected to Verizon is not very helpful. If the intent is to have the ASA connect to the ONT with a dynamic IP then what we need to see are results when the ASA is connected to the ONT and the configuration running at that time. The question from @balaji.bandi about whether the ASA get an address from ONT is an important question. And I would repeat my request that in that new environment we see the content of the routing table and of the arp table.

HTH

Rick