ASA 5505-ISP providing DHCP and separate IP block

[jeremy.lebeau]

I have a ASA 5505 that I have been using for a while, but a new ISP is trying to configure my service so that the outside interface has to be configured as DHCP to receive a reserved IP address, and then they will route a separate, non-contiguous block of addresses to that address.

Essentially, they have a DHCP reservation for 1.2.3.4 for my ASA, and then they have 10.2.3.16/28 as a separate block routed to me.

Obviously, I can do my static NAT translations using outside as the address, but I cannot get the separate block of addresses to route through the ASA. Is there a way to do this and get them to work? My ASA is running 7.2(2)

Thanks to anybody for any help you can give.

[Jennifer Halim]

You should be able to use the routed address range from your ISP for NAT translation on your ASA, as long as the ISP has routed that block towards the ASA outside interface.

Just make sure that the ISP has routed that block to your ASA outside interface.

Have you configured any static NAT for that new ip range yet? If you have, you can test accessing it from the outside (assuming that you have access-list on your outside interface to allow it too), and run packet capture on the ASA outside interface and see if the traffic is even coming into the ASA.

The access-list on the outside interface can also help determine that (assuming the ACL is specific to that new ip range), and if traffic is hitting the ASA outside interface when you test it, you should see a hit count on the access-list.

[jeremy.lebeau]

The only static NAT statments that I can get to work are in the format of:

          static (inside,outside) tcp outside smtp 192.168.1.1 smtp netmask 255.255.255.255

If I change it to use one of the IP addresses, either the DHCP address or an assigned one, it does not make it through the ASA.

[Jennifer Halim]

If you have checked the hitcount and also packet capture on the ASA outside interface, and seeing no traffic towards those IP range, then it's definitely not an ASA issue. You will need to speak to your ISP and confirm that they have definitely route those block to the ASA.

If the ASA never receives the traffic, it won't be able to do anything.

Also, did you perform "clear xlate" and "clear arp" after configuring the static translation?

Lastly, just confirming that "no sysopt noproxyarp outside" is configured, this is to ensure that ASA proxy arp on its outside interface.