Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured my internal VLAN using the most basic settings where ports 1-7 are assigned from a pool of addresses in the range 192.168.15.5 -> 192.168.15.36. These hosts are given access to the internet and it works great.

What I'm trying to set up now is allowing users who are connected to the device and specify their IP (say I connect and request 192.168.15.45) are given internet access and can still work alongside DHCP hosts. Those with a DHCP assigned address are blocked from the internet.

Mostly the issue resides in that I am very new to working with the device. I feel that the solution is easy but I'm not looking in the right spots and don't have the correct terminology down to google it. Do I need to define access control lists? Group policies? a new VLAN? The rules that are set up seem to be specific to the entire /24 subnet but when I request a static IP outside of the DHCP range I get blocked from other hosts and the internet.

As requested:

interface Vlan1
 description VLAN to inside hosts
 nameif inside
 security-level 100
 ip address 10.100.31.1 255.255.255.0
!
access-list outside_access_in extended permit icmp any any
access-list semc_splitTunnelAcl standard permit 10.100.31.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.100.31.0 255.255.255.0 10.100.31.192 255.255.255.192
access-list inside_nat0_outbound extended permit ip 10.100.31.0 255.255.255.0 10.100.31.0 255.255.255.192
access-list inside_access_in extended permit ip any any
access-list inside_access_out extended permit ip any any
access-list outside_access_out extended permit ip interface inside any
access-list ACL_OUT extended permit tcp any any
access-list ANY extended permit ip any any
access-list OUT extended permit ip any any

ip local pool VPN_Pool 10.100.31.220-10.100.31.250 mask 255.255.255.0

nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.100.31.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0

access-group ANY in interface inside
access-group inside_access_out out interface inside
access-group ACL_OUT in interface outside
access-group OUT out interface outside

dhcpd address 10.100.31.64-10.100.31.95 inside
dhcpd enable inside
share|improve this question
1  
Can you provide the relevant parts of your configuration from show running-config? –  Shane Madden Nov 23 '12 at 7:30
1  
What subnet mask are you using on the clients? is it the same mask length used in the NAT and access rules? –  GerryEgan Nov 23 '12 at 10:06
    
My apologies Shane, what sections would be relevant? I've posted some stuff above but please let me know if there are more you need. Gerry, everything I'm working with right now is for /24. I am still learning and used the commands in this guide: cisco.com/en/US/docs/security/asa/asa72/configuration/guide/… as a starting point. –  TheCapn Nov 26 '12 at 15:00
add comment

1 Answer

up vote 0 down vote accepted

The question was answered by a user at the Cisco support forums. I apologize for the awkwardness of my question as I'm still working on learning much of the terminology on networking equipment and Cisco in particular. I've included a link to the discussion here:

https://supportforums.cisco.com/message/3793093#3793093

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.