ASA 5545 virtual interface configuration

[manish_daryani]

HI,

EXISTING SETUP : i have configured SSL VPN on ASA 5545 firewall. The ASA is connected to internet router. ASA external interface is having public ip address.  I have done DNS entry of ASA external ip address in public domain. User connect to SSL VPN from home.

REQUIREMENT : I need to change external IP address of ASA to a different public subnet. I have to change the DNS entry of new ip address in public domain which generally takes around 24-48 hours. So users will not be able to connect VPN till public DNS will resolve new ip address. I cannot afford so much downtime.

I have one solution but not sure, whether it will work or not.

SOLUTION : Create two virtual interface on external interface of firewall. One virtual interface will have old ip address with old gateway of internet router. Second virtual interface will have new ip address with new gateway configured in internet router. As public DNS will take 24-48 hours for reflecting new ip address, till that time, users will be able to access VPN with old ip address. Once public DNS starts resolving new ip address, then vpn will connect with new ip address.

Can someone help me in understanding, whether this solution will work or not. If anyone is having any other solution, then please let me know.

Thanks,

Manish Daryani

[Mohammed al Baqari]

It won't take 24 - 48 hrs if you lower the TTL. Just make TTL as 1 and it
should replicate DNS record instantly.

[manish_daryani]

HI,

Thanks for your reply. 

Our public DNS is managed by service provider. They told me, it might take 24-48 hours to replicate the changes globally.

Regards,

Manish Daryani

[Mohammed al Baqari]

Ask them to lower it during the change. That is only because they are
keeping default TTL which is 86400