I've configured my internal VLAN using the most basic settings where ports 1-7 are assigned from a pool of addresses in the range -> These hosts are given access to the internet and it works great.

What I'm trying to set up now is allowing users who are connected to the device and specify their IP (say I connect and request are given internet access and can still work alongside DHCP hosts. Those with a DHCP assigned address are blocked from the internet.

Mostly the issue resides in that I am very new to working with the device. I feel that the solution is easy but I'm not looking in the right spots and don't have the correct terminology down to google it. Do I need to define access control lists? Group policies? a new VLAN? The rules that are set up seem to be specific to the entire /24 subnet but when I request a static IP outside of the DHCP range I get blocked from other hosts and the internet.

As requested:

interface Vlan1
 description VLAN to inside hosts
 nameif inside
 security-level 100
 ip address
access-list outside_access_in extended permit icmp any any
access-list semc_splitTunnelAcl standard permit
access-list inside_nat0_outbound extended permit ip
access-list inside_nat0_outbound extended permit ip
access-list inside_access_in extended permit ip any any
access-list inside_access_out extended permit ip any any
access-list outside_access_out extended permit ip interface inside any
access-list ACL_OUT extended permit tcp any any
access-list ANY extended permit ip any any
access-list OUT extended permit ip any any

ip local pool VPN_Pool mask

nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1
nat (inside) 1

access-group ANY in interface inside
access-group inside_access_out out interface inside
access-group ACL_OUT in interface outside
access-group OUT out interface outside

dhcpd address inside
dhcpd enable inside
  • 1
    Can you provide the relevant parts of your configuration from show running-config? – Shane Madden Nov 23 '12 at 7:30
  • 1
    What subnet mask are you using on the clients? is it the same mask length used in the NAT and access rules? – GerryEgan Nov 23 '12 at 10:06
  • My apologies Shane, what sections would be relevant? I've posted some stuff above but please let me know if there are more you need. Gerry, everything I'm working with right now is for /24. I am still learning and used the commands in this guide: cisco.com/en/US/docs/security/asa/asa72/configuration/guide/… as a starting point. – Grambot Nov 26 '12 at 15:00

The question was answered by a user at the Cisco support forums. I apologize for the awkwardness of my question as I'm still working on learning much of the terminology on networking equipment and Cisco in particular. I've included a link to the discussion here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.