Switching my static IP to Dynamic on my ASA 5506-x?

[AmmarHermiz14196]

Hi all,

I am switching my Static ip address to Dynamic ip address. what is the procedure to that using CLI on my ASA 5506-x 

Below is my configurations.....Thank you!!

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 10.0.0.1 255.255.255.0
no shut
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.10.254 255.255.255.0
no shut
!
interface GigabitEthernet1/3
nameif camera
security-level 95
ip address 192.168.20.254 255.255.255.0
no shut
!
interface GigabitEthernet1/4
nameif security
security-level 90
ip address 192.168.30.254 255.255.255.0
no shut
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo
access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo-reply
pager lines 24
logging enable
logging buffered informational
mtu outside 1500
mtu inside 1500
mtu camera 1500
mtu security 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-782.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
nat (any,outside) dynamic interface
access-group OUTSIDE_ACCESS_IN in interface outside
route outside 0.0.0.0 0.0.0.0 10.0.0.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 60
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside
!

dhcpd dns 8.8.8.8 8.8.4.4
!
dhcpd address 192.168.10.10-192.168.10.100 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
policy-map type inspect dns migrated_dns_map_2
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily

!

To enable ASDM on Cisco ASA, the HTTPS server needs to be enabled, and allow HTTPS connections to the ASA.

To configure ASDM (HTTP) access to Cisco ASA on particular interfaces, where core and management are the nameifs use following commands:

ASA(config)#aaa authentication http console LOCAL
ASA(config)#http server enable
ASA(config)#http 0.0.0.0 0.0.0.0 core

Remember to create username, password to be able to authenticate to asdm:

ASA(config)#username admin password secretpassword

[AmmarHermiz14196]

I am confused about this statement " before it was configured with static ip and the ONT was connected directly to the ASA but that time i had static ip from Verizon". Am I understanding correctly that at one time the ASA was connected directly to the ONT, using a static IP, and things worked correctly? Yes .... If that is the case it might explain why attempting to connect with a dynamic IP is having problems. If the ONT is expecting a static IP it may not support having a dynamic IP. I switched my account with Verizon from 1 Static IP address to Dynamic. I dont think is the ONT ( Optical Network Terminal ) something to do with it. I think? 

Because if i take the ethernet coming from the ONT and connected to the ASA port one and change the int g/g 1/1 ip address from ISP ( Verizon ) to  70. 106. XXX.XXX . Also change the route outside on ASA to 70.106.xxx. 1 won't work!! ?

Showing us the running config where the ASA has a static IP and is connected to Verizon is not very helpful. If the intent is to have the ASA connect to the ONT with a dynamic IP then what we need to see are results when the ASA is connected to the ONT and the configuration running at that time. The question from @balaji.bandi about whether the ASA get an address from ONT is an important question. And I would repeat my request that in that new environment we see the content of the routing table and of the arp table. 

[Richard Burts]

Ammar

The clarification that you switched the account is helpful. So what worked before no longer matters.

As I understand the current situation is that your ASA connects to a Verizon router which connects to the ONT. Is that correct? And is that part of the environment with static IP?

And I understand that you want to eliminate the Verizon router and connect your ASA directly to ONT. Is that correct? And this is where the dynamic address comes in.

To do this I believe that the suggestions by @balaji.bandi to replace the IP address and mask on G1/1 with dhcp setroute and to remove the static default route should work. Have you tried that connection with these changes in the configuration?

[AmmarHermiz14196]

Hi Rick,

The clarification that you switched the account is helpful. So what worked before no longer matters.

As I understand the current situation is that your ASA connects to a Verizon router which connects to the ONT. Is that correct? Yes.

And is that part of the environment with static IP?Yes. I have Dynamic IP address coming to Verizon router and from the Verizon router to the ASA I made static IP address going to the ASA with is 192.168.1.254 

And I understand that you want to eliminate the Verizon router and connect your ASA directly to ONT. Is that correct? Correct  And this is where the dynamic address comes in. Yes.

To do this I believe that the suggestions by @balaji.bandi to replace the IP address and mask on G1/1 with dhcp setroute and to remove the static default route should work. Have you tried that connection with these changes in the configuration?

So what I did is the 3 changes and of course plugged the ONT directly to the ASA through port 1 on the ASA Please see below:

ip address 70.106.XXX.XXX 255.255.255.0

route outside 0.0.0.0 0.0.0.0 70.106.XXX.1 1

And I removed route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 

It didn't work. is there another step I have to do, another way to do it or I am missing a step?

Thank you,

Ammar

[Richard Burts]

Ammar

I am somewhat confused. You say that you want to use a dynamic address. We suggest changing the interface to use DHCP instead of configuring a static IP. You keep configuring the interface with an IP address. Even if the new IP address is in the block of addresses for dynamic, configuring an interface with a specific IP address is static and not dynamic. Change the interface to use dhcp and not with a specific IP address.

[AmmarHermiz14196]

Good morning Rick,

To be honest with you. If you tell me how configure the ASA to the ONT. what the steps are using CLI. I will be appreciated.

Ammar

[AmmarHermiz14196]

Hi,

First of all. This is home network. I switched My Verizon internet account from 1 static IP address to new account with 1 dynamic IP address. 

1. is the verizon support with ASA as client directly ? So firewall ASA connected to the Verizon modem/router through inside static ip address with is 192.168.1.254  

2. when you make outside interface as DHCP,  did you get IP address from ISP ? I don't understand the question. Please provide me with an example if you can? 

3. some ISP do not like Static IP to configure, they get authenticated and allocate the IP (this is not happening your case i guess)

Right now my Dynamic IP from Verizon is 70.106.xxx.xxx

Thanks,

Ammar 

[balaji.bandi]

You set up as below working :

ISP -- (WAN)G3100 Verizon router (LAN1)---(Gi1/1)ASA (Gi x/x) ---LAN - works as expected, now you like to remove G3100 Verizon router

So let's confirm this (rather confuse yourself and us also)  - 

ISP ---(Gi1/1)ASA (Gi x/x) ---LAN -users 

Let's start with a simple config - If your provider supports DHCP - make a factory reset of ASA load below config only.

interface GigabitEthernet1/1

 nameif outside

 security-level0

 ip address dhcp setroute

Connect your ethernet from your ISP to G1/1

Let us know what IP address you get here?

post below output :

show run

show interface ip brief

show interface gi 1/1

show ip route

From there we take forward to the next config based on the results.

EDIT - Other suggestions if you know the IP address try as below : ( depends on the requirement ) but try 1 at a time to get outcome correct.

interface GigabitEthernet1/1
description Connection to Verizon FiOS
nameif outside
security-level 0
ip address 70.106.xxx.xxx 255.255.255.0    <--------replace this with the correct information
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.10.254 255.255.255.0
!
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 8.8.8.8
name-server 8.8.4.4
domain-name xxxx.com
object network obj_any
subnet 0.0.0.0 0.0.0.0
!
object network obj_any
nat (any,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 70.106.xxx.YYY 1    <-- change with correct gateway
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
http 192.168.10.0 255.255.0.0 inside   <-- i have added only 1 subnet you can do rest once testing completed on this subnet if required for mgmt

[AmmarHermiz14196]

Here you go:

I did first the ip address dhcp setroutep and then I deleted the route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 

so I am connected to the internet. set up like that ethernet from the ONT to ASA. Verizon totally powered off.  

I pinged from the ASA 8.8.8.8 got 100% success I don't if that was necessary!? 

Thank you!

Below as you asked:

HHome(config)# show run
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.10.254 255.255.255.0
!
interface GigabitEthernet1/3
nameif camera
security-level 95
ip address 192.168.20.254 255.255.255.0
!
interface GigabitEthernet1/4
nameif security
security-level 90
ip address 192.168.30.254 255.255.255.0
!
interface GigabitEthernet1/5
nameif MGMT
security-level 100
ip address 192.168.40.254 255.255.255.0
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
dns server-group DefaultDNS
domain-name no
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo
access-list OUTSIDE_ACCESS_IN extended permit icmp any any echo-reply
pager lines 24
logging enable
logging buffered informational
mtu MGMT 1500
mtu outside 1500
mtu inside 1500
mtu camera 1500
mtu security 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-782.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
nat (any,outside) dynamic interface
access-group OUTSIDE_ACCESS_IN in interface outside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 60
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside

dhcpd dns 8.8.8.8 8.8.4.4
!
dhcpd address 192.168.10.10-192.168.10.100 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
policy-map type inspect dns migrated_dns_map_2
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:c963bfd75084939f481bbb53c60dff43
: end
HHome(config)# show interface ip brief
Interface IP-Address OK? Method Status Protocol
Virtual0 127.1.0.1 YES unset up up
GigabitEthernet1/1 70.106.xxx.11 YES DHCP up up
GigabitEthernet1/2 192.168.10.254 YES manual up up
GigabitEthernet1/3 192.168.20.254 YES manual up up
GigabitEthernet1/4 192.168.30.254 YES manual up up
GigabitEthernet1/5 192.168.40.254 YES manual up up
GigabitEthernet1/6 unassigned YES unset administratively down down
GigabitEthernet1/7 unassigned YES unset administratively down down
GigabitEthernet1/8 unassigned YES unset administratively down down
Internal-Control1/1 127.0.1.1 YES unset up up
Internal-Data1/1 unassigned YES unset down down
Internal-Data1/2 unassigned YES unset down down
Internal-Data1/3 unassigned YES unset up up
Internal-Data1/4 169.254.1.1 YES unset up up
Management1/1 unassigned YES unset administratively down down
HHome(config)# show interface gig 1/1
Interface GigabitEthernet1/1 "outside", is up, line protocol is up
Hardware is Accelerator rev01, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
Input flow control is unsupported, output flow control is off
MAC address a093.51f3.09c0, MTU 1500
IP address 70.106.xxx.11, subnet mask 255.255.255.0
476692127 packets input, 584036741305 bytes, 0 no buffer
Received 2465 broadcasts, 0 runts, 0 giants
9 input errors, 0 CRC, 9 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
206434908 packets output, 62803986950 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 input reset drops, 530 output reset drops
input queue (blocks free curr/low): hardware (952/796)
output queue (blocks free curr/low): hardware (1023/789)
Traffic Statistics for "outside":
475024829 packets input, 574772674002 bytes
206434908 packets output, 59032751296 bytes
323234 packets dropped
1 minute input rate 906 pkts/sec, 960139 bytes/sec
1 minute output rate 304 pkts/sec, 67164 bytes/sec
1 minute drop rate, 1 pkts/sec
5 minute input rate 1343 pkts/sec, 1557467 bytes/sec
5 minute output rate 442 pkts/sec, 89781 bytes/sec
5 minute drop rate, 1 pkts/sec

HHome(config)# sho route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 70.106.xxx.1 to network 0.0.0.0

S* 0.0.0.0 0.0.0.0 [1/0] via 70.106.xxx.1, outside
C 70.106.xxx.0 255.255.255.0 is directly connected, outside
L 70.106.xxx.11 255.255.255.255 is directly connected, outside
C 192.168.10.0 255.255.255.0 is directly connected, inside
L 192.168.10.254 255.255.255.255 is directly connected, inside
C 192.168.20.0 255.255.255.0 is directly connected, camera
L 192.168.20.254 255.255.255.255 is directly connected, camera
C 192.168.30.0 255.255.255.0 is directly connected, security
L 192.168.30.254 255.255.255.255 is directly connected, security
C 192.168.40.0 255.255.255.0 is directly connected, MGMT
L 192.168.40.254 255.255.255.255 is directly connected, MGMT

[Richard Burts]

Ammar

Congratulations. The output that you posted shows what I had hoped it would. It looks to me that the ASA should be working fine and with dynamic IP address. Are you experiencing any issues with network access/Internet access?

[AmmarHermiz14196]

Hi Rick,

So far so good. Thank you for both you. I mean you guys helped me a lot I can’t thank you both enough.

I am afraid to ask for more help

Only one thing it is not working the ASDM. I can’t log in into it and how I can download the certificate for VPN. I don’t have account with Cisco.

Thanks Ammar

[balaji.bandi]

The glad suggestion worked and you are in a good state,

below are 2 issues, let's fix them one by one.

Only one thing it is not working the ASDM. I can’t log in into it 

I can see the http enabled and ASDM image, setup local account - i did not see in the config :

#username admin password secretpassword

and how I can download the certificate for VPN. I don’t have account with Cisco.  ( google you can find many download for labbing you can use it)

-- what certificate, it works with self-signed also, but you get warning you can ignore it.

-- you need Cisco anyconnect client (by default ASA come with 5 user you can use it

[Richard Burts]

Ammar

There are several things that might impact using ASDM. One of those things is where you are attempting ASDM from. I see this in your running config

http 0.0.0.0 0.0.0.0 inside

This says that ASDM should work when the request is from the inside interface but would not work if the request was sourced from any other interface. It might work to specify the network as 0.0.0.0 but I would suggest changing it to 192.168.10.0. Try that and let us know if the behavior changes.

[AmmarHermiz14196]

Hi Rick,

so I did below and took http 0.0.0.0 0.0.0.0 inside off 

http 192.168.10.0 255.255.255.0 inside 

still not working

when I click on the ASDM icon the ip address is 192.168.10.254 put my user name and password i get 

unable to launch the device manager 192.168.10.254 

[AmmarHermiz14196]

Hi Balaij,

I can see the http enabled and ASDM image, setup local account - i did not see in the config :

#username admin password secretpassword

I added but still not working

and how I can download the certificate for VPN. I don’t have account with Cisco.  ( google you can find many download for labbing you can use it)

-- what certificate, it works with self-signed also, but you get warning you can ignore it. Someone did the configuration for me while ago said about an image or certificate need to have ?! 

-- you need Cisco anyconnect client (by default ASA come with 5 user you can use it

[AmmarHermiz14196]

Hi Balaji,

Do I need anyconnect-win-4.7.02036-webdeploy-k9.pkg to download for the VPN to work? of course I will need all the lines to configure in CLI? 

Thanks,

Ammar