Solved

Cisco ASA 5505 with Verizon Fios

Posted on 2016-08-05
10
104 Views
Last Modified: 2016-08-09
Hello guys...

I'm having a hard time figuring out why I can't connect to my ASA 5505 from outside ( I don't have a static IP), but I know that with Comcast it works I've done it before.
This is my setup:
ONT to Verizon then to ASA 5505 on Port 0/0
Verizon FIOS box 172.16.1.1 with DMZ enabled 172.16.1.2 (ASA IP add) I can go to the internet, but if I try to connect to that external IP from the outside it doesn't reach the ASA...
If I enable management on the Verizon box I can get to it, but still the idea is to be able to reach the ASA.

Ideas?
Thank you everyone...
0
Comment
Question by:Katrach0
  • 5
  • 4
10 Comments
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 41745070
Post your asa5505 config for our review
0
 

Author Comment

by:Katrach0
ID: 41745550
Hello Thomas

This is the config.

ASA Version 8.4(7)
!
hostname MyASA
domain-name MyDomain
enable password 8Ry2YjIyt7R45679 encrypted
passwd 2K7KnFDIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.1.10.1 255.255.255.0
!
interface Vlan2
 nameif OutsideToVerizon
 security-level 0
 ip address 172.16.1.2 255.255.255.0
!
boot system disk0:/asa847-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name MyDomain
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_10.1.10.0_24
 subnet 10.1.10.0 255.255.255.0
object network NETWORK_OBJ_192.168.1.0_27
 subnet 192.168.1.0 255.255.255.224
access-list Inside_access_in extended permit ip 10.1.10.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list Inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip 10.1.10.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list XXXX_splitTunnelAcl standard permit 10.1.10.0 255.255.255.0
pager lines 24
mtu inside 1500
mtu OutsideToVerizon 1500
ip local pool Katrach0 192.168.1.10-192.168.1.24 mask 255.255.255.240
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-731.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,OutsideToVerizon) source static NETWORK_OBJ_10.1.10.0_24 NETWORK_OBJ_10.1.10.0_24 destination static NETWORK_OBJ_192.168.1.0_27 NETWORK_OBJ_192.168.1.0_27 no-proxy-arp route-lookup
!
object network obj_any
 nat (inside,OutsideToVerizon) dynamic interface
access-group inside_access_in in interface inside
route OutsideToVerizon 0.0.0.0 0.0.0.0 172.16.1.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 10.1.10.1 255.255.255.255 inside
http 0.0.0.0 255.255.255.255 inside
http 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 OutsideToVerizon
http 10.1.10.0 255.255.255.255 inside
http 255.255.255.255 255.255.255.255 inside
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-DES-SHA ESP-DES-MD5
crypto map OutsideToVerizon_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map OutsideToVerizon_map interface OutsideToVerizon
crypto ikev1 enable OutsideToVerizon
crypto ikev1 policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 OutsideToVerizon
ssh timeout 30
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd address 10.1.10.25-10.1.10.56 inside
dhcpd dns 8.8.8.8 75.75.76.76 interface inside
dhcpd lease 350 interface inside
dhcpd ping_timeout 750 interface inside
dhcpd domain MyDomain interface inside
dhcpd update dns interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable OutsideToVerizon
 anyconnect enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
group-policy Policy internal
group-policy Policy attributes
 dns-server value 8.8.8.8 4.2.2.1
 vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value MyNetwork_splitTunnelAcl
 default-domain value MyDomain
username BlaBlah password 2K7KnFDIdI.2KYOUKXt8f2 encrypted privilege 15
username vpnuser attributes
 vpn-group-policy MyPolicy
 service-type remote-access
tunnel-group tunnelname type remote-access
tunnel-group VPN general-attributes
 address-pool MyIPPool
 default-group-policy XXXXXX
tunnel-group XXXXX ipsec-attributes
 ikev1 pre-shared-key **************
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:8ece490203d70552de388c39924c4526
: end
MyFirewall#
0
 
LVL 23

Accepted Solution

by:
Thomas Grassi earned 500 total points
ID: 41745601
Katrach0


I had the exact same problem several years ago

Installed Verizon Fios  had the ONT connected to the ASA5505 I had at that time and the actiontech router

This causes many problems
1. Phone functions do not appear on the TV Caller ID as an example
2. Access to the internet incoming or outgoing with the ASA 5505 does not work all the time
3. The TVs stat top box do not receive an ip address so the will not receive the TV Guide

After working with High level Version Support I finally convinced them to try and fix this
They had to make several changes on there network side They called it setting up the ONT in Bridge mode which is not supported by them This method worked for several days until it stopped working all together.

I switched to a Business Verizon ONT for a static IP Address but had the same problem

This was going on for months

Then I came up with the idea of having two ONT's one with Business FIOS with a static IP address that connected to my ASA 5505 and all was great
I now have two Verizon FIOS ONT Business FIOS Internet Service Only static IP Address  and Home FIOS with triple play Internet TV and Phone I have since switched routers and my new one has ability to hand two internet connections

So what it boils down to it is very difficult to have another router on the FIOS network

If you search google you may find one but it was very old.
I found some of my original dos that may help you see the attached

If you need I can send yo my ASA5505 config too

HTH
FIOS-FAQ.pdf
ONT-Backend-Router-Setup.pdf
0
 

Author Comment

by:Katrach0
ID: 41747221
Hello Thomas.

So basically ASA won't work at all. Any other alternatives to have VPN access?

I can't access these files:
"FIOS-FAQ.pdf
ONT-Backend-Router-Setup.pdf"
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 41748175
I sent you a message with the files

Hope you can read them
0
 

Author Comment

by:Katrach0
ID: 41748870
Thomas.

I want to thank you for your time. I have decided to move to Comcast. There's less drama with them. I will never ever consider Verizon for nothing even if they were the last ISP on the planet.

Thanks so much again for your time.
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 41748963
Assign me the points and then close this out

Thanks
1
 

Author Comment

by:Katrach0
ID: 41748983
Guess have to cancel the close request to assign points, something I have not problem doing.
0
 

Author Closing Comment

by:Katrach0
ID: 41748987
Found out what can be done.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now