Cisco ASA 5505 with Verizon Fios

Katrach0 used Ask the Experts™
Hello guys...

I'm having a hard time figuring out why I can't connect to my ASA 5505 from outside ( I don't have a static IP), but I know that with Comcast it works I've done it before.
This is my setup:
ONT to Verizon then to ASA 5505 on Port 0/0
Verizon FIOS box with DMZ enabled (ASA IP add) I can go to the internet, but if I try to connect to that external IP from the outside it doesn't reach the ASA...
If I enable management on the Verizon box I can get to it, but still the idea is to be able to reach the ASA.

Thank you everyone...
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Thomas GrassiSystems Administrator

Post your asa5505 config for our review
Katrach0System Admin


Hello Thomas

This is the config.

ASA Version 8.4(7)
hostname MyASA
domain-name MyDomain
enable password 8Ry2YjIyt7R45679 encrypted
passwd 2K7KnFDIdI.2KYOU encrypted
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif OutsideToVerizon
 security-level 0
 ip address
boot system disk0:/asa847-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name MyDomain
object network obj_any
object network NETWORK_OBJ_10.1.10.0_24
object network NETWORK_OBJ_192.168.1.0_27
access-list Inside_access_in extended permit ip
access-list Inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip
access-list XXXX_splitTunnelAcl standard permit
pager lines 24
mtu inside 1500
mtu OutsideToVerizon 1500
ip local pool Katrach0 mask
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-731.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,OutsideToVerizon) source static NETWORK_OBJ_10.1.10.0_24 NETWORK_OBJ_10.1.10.0_24 destination static NETWORK_OBJ_192.168.1.0_27 NETWORK_OBJ_192.168.1.0_27 no-proxy-arp route-lookup
object network obj_any
 nat (inside,OutsideToVerizon) dynamic interface
access-group inside_access_in in interface inside
route OutsideToVerizon 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http inside
http inside
http inside
http OutsideToVerizon
http inside
http inside
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-DES-SHA ESP-DES-MD5
crypto map OutsideToVerizon_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map OutsideToVerizon_map interface OutsideToVerizon
crypto ikev1 enable OutsideToVerizon
crypto ikev1 policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet inside
telnet timeout 5
ssh inside
ssh OutsideToVerizon
ssh timeout 30
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd address inside
dhcpd dns interface inside
dhcpd lease 350 interface inside
dhcpd ping_timeout 750 interface inside
dhcpd domain MyDomain interface inside
dhcpd update dns interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
 enable OutsideToVerizon
 anyconnect enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
group-policy Policy internal
group-policy Policy attributes
 dns-server value
 vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value MyNetwork_splitTunnelAcl
 default-domain value MyDomain
username BlaBlah password 2K7KnFDIdI.2KYOUKXt8f2 encrypted privilege 15
username vpnuser attributes
 vpn-group-policy MyPolicy
 service-type remote-access
tunnel-group tunnelname type remote-access
tunnel-group VPN general-attributes
 address-pool MyIPPool
 default-group-policy XXXXXX
tunnel-group XXXXX ipsec-attributes
 ikev1 pre-shared-key **************
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
 profile CiscoTAC-1
  no active
  destination address http
  destination address email
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
: end
Systems Administrator

I had the exact same problem several years ago

Installed Verizon Fios  had the ONT connected to the ASA5505 I had at that time and the actiontech router

This causes many problems
1. Phone functions do not appear on the TV Caller ID as an example
2. Access to the internet incoming or outgoing with the ASA 5505 does not work all the time
3. The TVs stat top box do not receive an ip address so the will not receive the TV Guide

After working with High level Version Support I finally convinced them to try and fix this
They had to make several changes on there network side They called it setting up the ONT in Bridge mode which is not supported by them This method worked for several days until it stopped working all together.

I switched to a Business Verizon ONT for a static IP Address but had the same problem

This was going on for months

Then I came up with the idea of having two ONT's one with Business FIOS with a static IP address that connected to my ASA 5505 and all was great
I now have two Verizon FIOS ONT Business FIOS Internet Service Only static IP Address  and Home FIOS with triple play Internet TV and Phone I have since switched routers and my new one has ability to hand two internet connections

So what it boils down to it is very difficult to have another router on the FIOS network

If you search google you may find one but it was very old.
I found some of my original dos that may help you see the attached

If you need I can send yo my ASA5505 config too

Starting with Angular 5

Learn the essential features and functions of the popular JavaScript framework for building mobile, desktop and web applications.

Katrach0System Admin


Hello Thomas.

So basically ASA won't work at all. Any other alternatives to have VPN access?

I can't access these files:
Thomas GrassiSystems Administrator

I sent you a message with the files

Hope you can read them
Katrach0System Admin



I want to thank you for your time. I have decided to move to Comcast. There's less drama with them. I will never ever consider Verizon for nothing even if they were the last ISP on the planet.

Thanks so much again for your time.
Thomas GrassiSystems Administrator

Assign me the points and then close this out

Katrach0System Admin


Guess have to cancel the close request to assign points, something I have not problem doing.
Katrach0System Admin


Found out what can be done.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial