Go Premium for a chance to win a PS4. Enter to Win


Cisco ASA 5505 with Verizon Fios

Posted on 2016-08-05
Medium Priority
Last Modified: 2016-08-09
Hello guys...

I'm having a hard time figuring out why I can't connect to my ASA 5505 from outside ( I don't have a static IP), but I know that with Comcast it works I've done it before.
This is my setup:
ONT to Verizon then to ASA 5505 on Port 0/0
Verizon FIOS box with DMZ enabled (ASA IP add) I can go to the internet, but if I try to connect to that external IP from the outside it doesn't reach the ASA...
If I enable management on the Verizon box I can get to it, but still the idea is to be able to reach the ASA.

Thank you everyone...
Question by:Katrach0
  • 5
  • 4
LVL 23

Expert Comment

by:Thomas Grassi
ID: 41745070
Post your asa5505 config for our review

Author Comment

ID: 41745550
Hello Thomas

This is the config.

ASA Version 8.4(7)
hostname MyASA
domain-name MyDomain
enable password 8Ry2YjIyt7R45679 encrypted
passwd 2K7KnFDIdI.2KYOU encrypted
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif OutsideToVerizon
 security-level 0
 ip address
boot system disk0:/asa847-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name MyDomain
object network obj_any
object network NETWORK_OBJ_10.1.10.0_24
object network NETWORK_OBJ_192.168.1.0_27
access-list Inside_access_in extended permit ip
access-list Inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip
access-list XXXX_splitTunnelAcl standard permit
pager lines 24
mtu inside 1500
mtu OutsideToVerizon 1500
ip local pool Katrach0 mask
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-731.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,OutsideToVerizon) source static NETWORK_OBJ_10.1.10.0_24 NETWORK_OBJ_10.1.10.0_24 destination static NETWORK_OBJ_192.168.1.0_27 NETWORK_OBJ_192.168.1.0_27 no-proxy-arp route-lookup
object network obj_any
 nat (inside,OutsideToVerizon) dynamic interface
access-group inside_access_in in interface inside
route OutsideToVerizon 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http inside
http inside
http inside
http OutsideToVerizon
http inside
http inside
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-DES-SHA ESP-DES-MD5
crypto map OutsideToVerizon_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map OutsideToVerizon_map interface OutsideToVerizon
crypto ikev1 enable OutsideToVerizon
crypto ikev1 policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet inside
telnet timeout 5
ssh inside
ssh OutsideToVerizon
ssh timeout 30
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd address inside
dhcpd dns interface inside
dhcpd lease 350 interface inside
dhcpd ping_timeout 750 interface inside
dhcpd domain MyDomain interface inside
dhcpd update dns interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
 enable OutsideToVerizon
 anyconnect enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
group-policy Policy internal
group-policy Policy attributes
 dns-server value
 vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value MyNetwork_splitTunnelAcl
 default-domain value MyDomain
username BlaBlah password 2K7KnFDIdI.2KYOUKXt8f2 encrypted privilege 15
username vpnuser attributes
 vpn-group-policy MyPolicy
 service-type remote-access
tunnel-group tunnelname type remote-access
tunnel-group VPN general-attributes
 address-pool MyIPPool
 default-group-policy XXXXXX
tunnel-group XXXXX ipsec-attributes
 ikev1 pre-shared-key **************
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
: end
LVL 23

Accepted Solution

Thomas Grassi earned 2000 total points
ID: 41745601

I had the exact same problem several years ago

Installed Verizon Fios  had the ONT connected to the ASA5505 I had at that time and the actiontech router

This causes many problems
1. Phone functions do not appear on the TV Caller ID as an example
2. Access to the internet incoming or outgoing with the ASA 5505 does not work all the time
3. The TVs stat top box do not receive an ip address so the will not receive the TV Guide

After working with High level Version Support I finally convinced them to try and fix this
They had to make several changes on there network side They called it setting up the ONT in Bridge mode which is not supported by them This method worked for several days until it stopped working all together.

I switched to a Business Verizon ONT for a static IP Address but had the same problem

This was going on for months

Then I came up with the idea of having two ONT's one with Business FIOS with a static IP address that connected to my ASA 5505 and all was great
I now have two Verizon FIOS ONT Business FIOS Internet Service Only static IP Address  and Home FIOS with triple play Internet TV and Phone I have since switched routers and my new one has ability to hand two internet connections

So what it boils down to it is very difficult to have another router on the FIOS network

If you search google you may find one but it was very old.
I found some of my original dos that may help you see the attached

If you need I can send yo my ASA5505 config too

Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  


Author Comment

ID: 41747221
Hello Thomas.

So basically ASA won't work at all. Any other alternatives to have VPN access?

I can't access these files:
LVL 23

Expert Comment

by:Thomas Grassi
ID: 41748175
I sent you a message with the files

Hope you can read them

Author Comment

ID: 41748870

I want to thank you for your time. I have decided to move to Comcast. There's less drama with them. I will never ever consider Verizon for nothing even if they were the last ISP on the planet.

Thanks so much again for your time.
LVL 23

Expert Comment

by:Thomas Grassi
ID: 41748963
Assign me the points and then close this out


Author Comment

ID: 41748983
Guess have to cancel the close request to assign points, something I have not problem doing.

Author Closing Comment

ID: 41748987
Found out what can be done.

Featured Post

Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As managed cloud service providers, we often get asked to intervene when cloud deployments go awry. Attracted by apparent ease-of-use, flexibility and low computing costs, companies quickly adopt leading public cloud platforms such as Amazon Web Ser…
How to fix a SonicWall Gateway Anti-Virus firewall blocking automatic updates to apps like Windows, Adobe, Symantec, etc.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question