How to connect the ASA5505 behind ISP Netgear DG834 ADSL Router with Dynamic IP address

Unanswered Question
Jan 31st, 2010

I am a beginner to ASA. I am trying to connect the ASA 5505 behind the netgear ADSL router which is getting dynamic IP address from the ISP. How to configure the ASA5505 outside interface for SSL VPN connectivity?

Could anyone help me on this? Your help is highy appreciated.

Thanks and regards,

Kris

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
krishnan_hp Sun, 01/31/2010 - 17:12

Hi KS,

Thanks for your reply. But my question is not on SSL VPN configuration. I am not able to assign the IP address or getting the IP address on outside interface of ASA. Because in front of ASA 5505 , the netgear Nated ADSL firewall router is sitting and facing the ISP. From ISP Netgear router is getting the dynamic IP address through PPPoE. My question is what should I do on ASA for the PPPoE config and Netgear router to get an dynamic IP on ASA outside interface?

My ASA config is as follows:

int vlan2

pppoe client vpdn group pppoe_group

ip address pppoe setroute

In global confg mode:

vpdn group pppoe_group request dialout pppoe

vpdn group pppoe_group local name [email protected]

vpdn group pppoe_group ppp authentication chap

vpdn username [email protected] password *********

Thanks in advance

kris

Kureli Sankar Sun, 01/31/2010 - 17:51

Sorry didn't read your question right. Did your ISP ask you to use chap?

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/uz.html#wp1570439

F1(config)# vpdn group telecommuters request dialout pppoe
F1(config)# vpdn group telecommuters localname user1
F1(config)# vpdn group telecommuters ppp authentication pap
F1(config)# vpdn username user1 password test1
F1(config)# interface GigabitEthernet 0/1
F1(config-subif)# ip address pppoe setroute

Do you see anything in the logs?

conf t

logging enable

logging buffered debug

issue "sh logg"

What code is the asa running? What does "sh vpdn" show?

-KS

krishnan_hp Tue, 02/02/2010 - 14:45

Hi KS,

Thanks for your support. Its PAP authentication and the ASA outside interface is getting the dynamic IP address now. I have added the route outside 0.0.0.0 0.0.0.0 dynamic ip address command for the internal network to access the internet. Working fine.

Will the ASA supports dyndns which is mapping IP address to DNS name? If so how do I change the route outside command to dns name instead of dynamic ip address?

The reason I want to assign the dns name to the route outside command is that always the dynamic IP will change in case power failure or ISP issues

I would appreciate If you can help on this.

Regards,

Kris

tcording Tue, 02/02/2010 - 18:35

/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin-top:0cm; mso-para-margin-right:0cm; mso-para-margin-bottom:10.0pt; mso-para-margin-left:0cm; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;}

Hi Krishnan

I think your problem is that the ADSL router in front of the firewall is NAT’ing

What you need to do is configure the Netgear router for bridging mode therefore basically turning it into a media convertor.

This will allow you to assign the public address (DHCP or static) to the outside interface of the ASA and allow it to terminate the SSL tunnel directly on it.

Troy

krishnan_hp Tue, 02/02/2010 - 18:44

Hi KS and Troy,

Thanks for your replies.

As KS suggested I read through the link for the ddns mapping. In that they describe for dhcp client for dyndns and not for PPPoE client. Can I use the same config for PPP0E client? Please advise

Hi Troy,

Already I switched the router into bridge mode and its working fine with dynamic ip address. But I want to map the dynamic IP to dyndns name and so that I no need to change the route outside 0.0.0.0 0.0.0.0 dynamic Ip address command frequently and also good for SSL VPN

Regrads,

Kris

David_Luo Fri, 11/25/2011 - 14:42

Hi Kris,

I have the same problem as you had, I was just  wondering how you switched the router into bridge mode with your DG834  router? My router is DG834G with PPPoA, I followed this link http://192.168.0.1/setup.cgi?next_file=mode.htm
to swith my router to modem mode, having done that,  my Router ADSL Port  doesn't get any ip address at all, is there something  I've missed? 

Any advice will be appriciated.

Best regards,

David

Actions

This Discussion