ASA5505 - How to configure ASA with dynamic IP from ISP
I would like to implement my ASA5505 into my network and take my verizon fios handoff into my outside interface but I don't have a static IP and using dynamic from the provider.
Currently I'm running a crappy actiontec from FIOS with DDNS and a Linksys wireles-N.
My goal is to have my provider handoff to the outside ASA interface and setup a dhcp pool on an inside interface into one network and another inside interface with a different dhcp pool into my Cisco lab. My Cisco lab consists of 2x2950 switches & 3x2621 routers. I am wanting to setup a vpn tunnel from off my network, but am unsure how to do that considering I don't have a static IP. I'm sure that question will get answered on whether or not I can do a dynamic config with ddns on the outside interface from the provider.
I'm obviously a newb to the ASA and Security in general so looking for the best ideas and practices.
on ASA outside interface set it to dhcp with a setroute parameter to optain IP from ISP provider and have asa define default route. As for optaining DNS from outside interface to pass to inside I belive you use dhcp outo_config outside but Im not %100 sure - have not faced this particular scenario , perhaps someone can confirm or just give it a try.
For your other request in creating an Ipsec tunnel between a dynamic ASA to another PIX or IOS router sure you can do it, as long the other end of the tunnel uses static. Have a look at this link for Dynamic to static L2L tunnel.
I've ran into this issue several time and it seems I keep forgetting the answer. Everytime I research it I find dozens of dead ends and that Ars article about the guy who had this issue, couldn't figure it out so he dropped his ASA off his balcony. This is the first hit on google and it hasn't been completely answered so I will leave these instructions here for anyone else that needs it (including me next time this happens).
Your cable / FiOS / DSL modem most likely only has 1 public IP to hand out. Almost all of these devices marry the first device they meet. It identifies the device it meets by it's MAC address. The problem with this is that your eth0/0 has a MAC address and your OUTSIDE vlan has another (diffrent) MAC address. If the first person it's going to meet is
eth0/0. Then along comes your OUTSIDE vlan and wants that IP and it won't even talk to it. You fix this issue by setting your OUTSIDE vlan MAC to be the same as your eth0/0 MAC.
show int eth0/0 BLAH BLAH MAC address -> 0023.5exx.xxxx <-
int vlan2 (or whatever the number of your OUTSIDE vlan is)
ip address dhcp setroute shut
Power cycle your cable / FiOS / DSL modem and once it's back up
This is absolutely the answer. I've been fighting this thing for a couple days now, this instantly got me going. Comcast modem > ASA 5505 > 24 port switch > endpoints. Comcast modem is in bridge mode but ASA wouldn't pick up an IP. After looking at this, I changed Vlan 2 outside MAC to the same as E0/0. Bam!
Community Live Event Video
Are you ready to level up your security? Learn more about how Cisco SecureX can help you simplify your security and maximize operational efficiency.
This event talks about Cisco SecureX, its benefits, features, and usage. Th...
Hi all,I cannot understand why is something working very well they create a way to complicate things in Cisco ASA OS. I have a rule :object network LOCAL_ADRESS1 host 192.168.20.12 nat (VLAN20,outside) source static LOCAL_ADRESS1 interface&...
It is our pleasure to officially announce the finalists in the 2021 IT Blog Awards. We are now looking to our amazing tech community to check out the amazing line up of bloggers, vloggers and podcasters. Make sure to vote for your favorites...
Community Live Event Slides
This event talks about Cisco SecureX, its benefits, features, and usage. The session includes sample use cases and live demonstrations.
Cisco expert Luis Silva talks about how this solution can integrate Cisco technology and ...
Hello All, Recently I got an opportunity to perform POC with Cisco ISE (2.7 Patch 4) and Aruba Wireless AP (IAP) to perform 802.1x EAP-FAST (machine + user) authentication followed by Posture Assessment on Windows 10 Machines (installed with AnyConnect 4....