I have a problem configuring a Cisco ASA 5505 in that client workstations from our inside LAN can't access the internet through the ASA. I'm trying to implement it within a business network behind a Cisco WAG320N router:

ISP >> WAG320N >> ASA5505 >> Switch >> LAN Network.

I've configured the ASA like this:

vLan2 - outside - 
ip address xx.xxx.xxx.23 (this is our static IP) net mask
security-level 0.

vLan1 - inside  - 
ip address net mask
security-level 100.

dhcpd address inside

global (outside) 1 interface
nat (inside) 1

route outside 81.xx.xx.xx 1 (ISP gateway).

I'm guessing that I have to set my router (WAG320N) into bridge mode, or do a static NAT on the router to point to the ASA; but I'm not sure.

Any help would be greatly appreciated as I'm not even sure that my ASA config is correct.

migrated from superuser.com Dec 14 '12 at 0:12

This question came from our site for computer enthusiasts and power users.

  • so this ASA is behind a Cisco WAG320N router, and the WAG320N is connected to the Internet? Maybe the next hop needs to be the Cisco WAG320N interface then? Would the ASA be assigned a public IP if it is the WAG320N that is connected to the Internet? – j_bombay Dec 13 '12 at 19:34
  • Well the outside interface on the ASA has the public ip assigned to it at the mo. – Richard Allsopp Dec 13 '12 at 21:01

As I understand your setup the ASA should have the public IP address and should function as your router ?

If you do so you don't need the WAG320N. you can just directly attach the ISP connection to your ASA I suppose,

Unless your connection is an ADSL / SERIAL connection and your asa doesn't have these ports. you should setup the WAG320N and use a /30 subnet between your ASA and WAG320N.

  • Thanks for your reply - the ASA (or at least mine) doesn't have an RJ11 connection so I need the router as a bridge between the ISP and the ASA - also my connection requires a username and password and as I have a static IP don't think I can get the settings from the ISP via DHCP on the ASA. It has me stumped I must say. – Richard Allsopp Dec 13 '12 at 18:49
  • Ok, I suppose you have 2 options: – MrLightBulp Dec 13 '12 at 18:52
  • I'm guessing you mean: Bridge the router, or NAT within? – Richard Allsopp Dec 13 '12 at 18:58
  • The problem with that is, there is no section for adding your username and password in bridged mode, and I'm unsure on the NAT command on the router. – Richard Allsopp Dec 13 '12 at 19:00
  • I'm not so sure if bridging is possible on the WAN side, some provider (like mine) somehow do not allow switching on wan level – MrLightBulp Dec 13 '12 at 19:06

I suppose you have 2 options:

option 1: port forwarding:

you could setup the WAG320N as your WAN router, and just forward a range of ports or specific ports (extra security level) here's a link! with an example

option 2: Directly Connect ASA buy card

Directly connect your ASA to the internet by buying a ADSL / Serial port card to put in your asa system.

  • Don't forget to put a /30 network subnet between your router and asa – MrLightBulp Dec 13 '12 at 19:06
  • I think I understand what you're saying, could you just explain how that would fix the issue? I'm not sure on the correct port range that would fix my problem. – Richard Allsopp Dec 13 '12 at 19:16
  • So: public ip goes on wan side of your WAG320N, you create a /30 ip range (this gives you 2 configurable IP addresses nothing more) you put these between asa and WAG320N and on your asa you'll put a default route back to WAG320N, on the WAG320N you'll have to port forward all the ports you want to be forwarded (for example for a webserver inside your network to be accessible from the outside with the public ip addres you'll have to forward port 80 ) – MrLightBulp Dec 13 '12 at 19:23
  • Ok I see what you're saying, the only problem I can see is that I don't think my router allows me to create IP ranges; or at least I don't now how to do it (or is that NATing). The public ip is on the router and forwarding the correct ports is fine, I'm just not sure on the ip range creation (within the router that is). – Richard Allsopp Dec 13 '12 at 19:32
  • You realy should be able to as it should be a private ip address. could you post a screenshot of your setup page ? I could assist you – MrLightBulp Dec 13 '12 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.