Nice guide with clear cut explanation. However, it didn't work for me.
Today I was playing with my ASA 5505 and above configuration could not allow ping to any host on outside interface. I debugged and found out that it was denying the returning ICMP reply.
Good step by step, however you glossed over the part I need. I want to have a fixed IP on the outside. If I have it set to DHCP everything is fine but when I switch to a fixed IP I can no longer get out of the firewall. I am assuming it is a DNS or Routing problem but I can't figure out what to fix.
I am new to firewalls and everything I know I learned by trial and error.
Thanks in advance for any help.
When you had DHCP set route on the outside, the default route is obtained from the DHCP server (ISP), thus you don't need to specify a static default route. However, when you have static IP on outside, you must specify a static default route:
ExampleASA(config)# interface vlan 2
ExampleASA(config-if)# ip address 126.96.36.199 255.255.255.248
ExampleASA(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ExampleASA(config)# route outside 0.0.0.0 0.0.0.0 188.8.131.52
Must the IP address be the next hop? My router ip address is 192.168.0.1 - so is this what I should use?
The route outside - what are the three parts of it? If I have a router with ip address 192.168.0.1 what ip address should I be using for route outside? are the three parts of route outside the hops? so should I have route ip and outside ip?
With global (outside) 10 interface and nat (inside) 10 192.168.1.0 255.255.255.0 does it matter if you use the number 10 or the number 1? Can you use any number? NAT inside should that be done by my firewall or my router, i.e. should the ip address be the router or firewall?
Re: HowTo: Basic ASA 5505 configuration
10 years 1 month ago #34978
ip route 0.0.0.0 0.0.0.0 184.108.40.206 (Here we tell our router to create a default route where any packet -defined by the first 0.0.0.0- no matter what subnetmask -defined by the second 0.0.0.0- is to be sent to ip 220.127.116.11 which would be the router we are connecting to)
should I just change 18.104.22.168 to my router ip - 192.168.0.1 ?
I have noticed that on vlan2 the ip address is different to the route outside address