replace 1811 router with ASA 5505

[lcaruso]

Hi,

Please see the attachments.

I'm trying to come up with the config that would allow me to replace an 1811 router with a ASA 5505.The ASA has a Security Plus license. 

While there are many unfortunate features of the current network design that could be vastly improved, I'm currently constrained to simply replacing the 1811 with the 5505.

The first issue is the 1811 has an ip local pool that hands out dhcp addresses to clients behind the 851 router over a site-to-site vpn. This is an issue because when try to define the dhcpd server and use interface outside, it complains that cannot be done with this error message

dhcpd address 172.x.x.1-172.x.x.32 outside

Address range subnet 172.x.x.1 or 172.x.x.32 is not the same as outside interface subnet 68.x.x.18

How do I work around this and create the same functionality?

[lcaruso]

here's the sanitized config of the 1811. I appreciate your input. Please let me know what other issues you notice with this conversion.

[lcaruso]

Another issue I have is there is a helper-address on the 1811 vlan1 interface.

I understand the ASA 5505 series cannot provide helper addresses. How do I deal with this?

[Maykol Rojas · Accepted solution]

Hi

Unfortunately the DHCP capacity of the ASA firewall is very limited. It is intended for SOHO. As you can see on the document below, the ASA cannot handle Addresses to host that are not directly connected to it.

"DHCP clients must be directly connected to the interface on which the server is enabled."

The ASA firewall does support DHCP relay (Helper address) However, it does have some limitations. I suggest you to please read the following document.

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/dhcp.html#wp1059065

Hope it helps

Mike

[lcaruso]

so the solution is to use another ASA 5505 where the 851 router sits. Would you agree?

[lcaruso]

Thanks for the link and your discussion.

Unfortunately the DHCP capacity of the ASA firewall is very limited. It is intended for SOHO.

I assume you mean the ASA 5505 offers these limitations instead of the ASA platform in general. Would a 5510 have the capability to hand out addresses to a subnet not directly connected?

This site does not have more than 100 users which fits the SOHO criteria.

[Federico Coto Fajardo · Accepted solution]

Hi,

According to this document:
http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/dhcp.html

DHCP clients must be directly connected to the interface on which the server is enabled.
I believe this is why the ASA complains about the pool not being on the same range as the outside IP.

The ASA has a DHCP relay functionality that I believe could be used for ''ip-helper'' (explained on the above link as well).

Hope it helps.

Federico.

[lcaruso]

Thanks for all of your great posts which are very timely as well.

[Federico Coto Fajardo]

You're very welcome :-)

I guess it depends what was the motivation behind the idea of replacing the 1811 witht the ASA 5505.

As it was mentioned, the ASA lacks the ability to deliver DHCP to non-directly connected users, so you might want to stick with the 1811.

But, staying with the 1811 is an option for you? Do you need any features particulary to the 5505?

Federico.

[lcaruso]

Do you need any features particulary to the 5505?

The site has been unmanaged for a couple of years and has security issues. It has become a target for hackers and internally it is unknown what security issues may exist. Need to intervene with a manageable firewall to easily see what is getting in/out, save and review logs, create and manage policies, provide alerts, defeat denial of service attacks, shun attackers, etc.

The 1811 only has two static routes and runs no routing protocols. I know the IOS Firewall is effective, but not as manageable in my estimation.

[lcaruso]

Remote access vpn with anyconnect was another requirement

[Federico Coto Fajardo]

I would not argue with you about moving to a 5505 but for you to know the ZWF (Zone-based Firewall) that can be configured on the router along with security measures can make the router really secure.

Also, the remote AnyConnect can be configured on the router as well.

Federico.