I'm pretty decent in the world of Cisco but I'm having trouble getting traffic to flow out with a ASA 5505 on Verizon DSL. I have a static IP with Verizon and I'm using their Westfall 7500 modem/router as a routed bridge into my network.

The data flow goes likes this: Westfall 7500 > Cisco Catalyst Switch > ASA 5505

The switch has a inside and outside VLAN. The router and the outside interface on the ASA reside in the outside VLAN, everything else is on the inside VLAN.

At this point I have a very basic configuration, I think the issue may reside in one of two areas:

1) The outside interface is set to the static IP that Verizon gave me 2) I'm routing the outside interface to the Verizon gateway, basically my static IP but it ends in .1 (route outside xxx.xxx.xxx.1)

Should I be routing the outside interface elsewhere? Are there any other issues that anyone can think of?

Just as a side note, all the speed/duplex settings seem to match, I've had trouble with that in the past...


  • @Randy - Have you found the problem yet? – Kevin Garber Nov 10 '09 at 16:18
  • Would you be willing to post a sanitized copy of your running config? – Zypher Dec 8 '09 at 19:48
  • Can you ping the Westfall gateway address from the ASA? – ITGuy24 Jan 12 '10 at 3:04

Did you check your NAT config? I've been bitten in the past with incorrect NATing which basically meant my traffic left the firewall with private IPs and never to be heard of again. From the ASA, did you try to ping and traceroute any IPs? If successful, I would say it's very likely a NAT issue.

Though I don't think it should cause any routing or issues as you describe but did you check your MTU settings since this is a DSL line?

As for the switch, it's not a L3 switch is it? And if so, perhaps you have incorrect routes on it? Also, make sure there are no L2 ACLs in place that might prevent the ASA and DSL modem from talking.

BTW, I would use a crossover cable instead of using an "outside" VLAN on a shared switch with an internal VLAN.

  • I agree, most times NAT is the problem – ITGuy24 Jan 12 '10 at 15:49

I think you have to add a static route - if I remember, the wizard does not add that...

in the UI, go to Device Setup --> Routing --> Static Routes

add Interface: outside IP: Mask: Gateway IP: your gateway Metric: 1

  • I have this line in with the gateway being the same gateway the Verizon router uses to pass traffic to the outside world – Randy Allen Nov 8 '09 at 15:36

If your routing is set properly, I would verify that the Westfall modem allows multiple MAC addresses for the inside interface. Most likely, it will only talk to 1 MAC address at a time, which it is probably picking up the MAC of your switch and not your ASA. I would plug the ASA directly in to the Westfall and check connectivity that way.

  • Not having much luck with that either Kevin – Randy Allen Nov 8 '09 at 15:36
  • Did you reboot the modem after connecting the ASA? You need to get things working with the modem and ASA and then add your switch back in to the picture. – Kevin Garber Nov 8 '09 at 18:13

There's no such thing as a "routed bridge". The modem is either a router or a transparent bridge. You must make sure it is in bridge mode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy