Avatar of Lizandro Diaz
Lizandro Diaz
Flag for United States of America asked on

Cisco ASA 5505 with Verizon Fios

Hello guys...

I'm having a hard time figuring out why I can't connect to my ASA 5505 from outside ( I don't have a static IP), but I know that with Comcast it works I've done it before.
This is my setup:
ONT to Verizon then to ASA 5505 on Port 0/0
Verizon FIOS box with DMZ enabled (ASA IP add) I can go to the internet, but if I try to connect to that external IP from the outside it doesn't reach the ASA...
If I enable management on the Verizon box I can get to it, but still the idea is to be able to reach the ASA.

Thank you everyone...
CiscoHardware FirewallsBroadband

Avatar of undefined
Last Comment
Lizandro Diaz

8/22/2022 - Mon

Post your asa5505 config for our review
Lizandro Diaz

Hello Thomas

This is the config.

ASA Version 8.4(7)
hostname MyASA
domain-name MyDomain
enable password 8Ry2YjIyt7R45679 encrypted
passwd 2K7KnFDIdI.2KYOU encrypted
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif OutsideToVerizon
 security-level 0
 ip address
boot system disk0:/asa847-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name MyDomain
object network obj_any
object network NETWORK_OBJ_10.1.10.0_24
object network NETWORK_OBJ_192.168.1.0_27
access-list Inside_access_in extended permit ip
access-list Inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip
access-list XXXX_splitTunnelAcl standard permit
pager lines 24
mtu inside 1500
mtu OutsideToVerizon 1500
ip local pool Katrach0 mask
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-731.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,OutsideToVerizon) source static NETWORK_OBJ_10.1.10.0_24 NETWORK_OBJ_10.1.10.0_24 destination static NETWORK_OBJ_192.168.1.0_27 NETWORK_OBJ_192.168.1.0_27 no-proxy-arp route-lookup
object network obj_any
 nat (inside,OutsideToVerizon) dynamic interface
access-group inside_access_in in interface inside
route OutsideToVerizon 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http inside
http inside
http inside
http OutsideToVerizon
http inside
http inside
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-DES-SHA ESP-DES-MD5
crypto map OutsideToVerizon_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map OutsideToVerizon_map interface OutsideToVerizon
crypto ikev1 enable OutsideToVerizon
crypto ikev1 policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet inside
telnet timeout 5
ssh inside
ssh OutsideToVerizon
ssh timeout 30
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd address inside
dhcpd dns interface inside
dhcpd lease 350 interface inside
dhcpd ping_timeout 750 interface inside
dhcpd domain MyDomain interface inside
dhcpd update dns interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
 enable OutsideToVerizon
 anyconnect enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
group-policy Policy internal
group-policy Policy attributes
 dns-server value
 vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value MyNetwork_splitTunnelAcl
 default-domain value MyDomain
username BlaBlah password 2K7KnFDIdI.2KYOUKXt8f2 encrypted privilege 15
username vpnuser attributes
 vpn-group-policy MyPolicy
 service-type remote-access
tunnel-group tunnelname type remote-access
tunnel-group VPN general-attributes
 address-pool MyIPPool
 default-group-policy XXXXXX
tunnel-group XXXXX ipsec-attributes
 ikev1 pre-shared-key **************
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
: end

View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Lizandro Diaz

Hello Thomas.

So basically ASA won't work at all. Any other alternatives to have VPN access?

I can't access these files:
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck

I sent you a message with the files

Hope you can read them
Lizandro Diaz


I want to thank you for your time. I have decided to move to Comcast. There's less drama with them. I will never ever consider Verizon for nothing even if they were the last ISP on the planet.

Thanks so much again for your time.

Assign me the points and then close this out

Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
Lizandro Diaz

Guess have to cancel the close request to assign points, something I have not problem doing.
Lizandro Diaz

Found out what can be done.