Cisco ASA5505 firewall outside connection ?

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Cisco ASA5505 firewall outside connection ?

fran1942

82 posts

Master Geek

Trusted

#141061 28-Feb-2014 11:30

Hi, I am trying to set up the outside interface of an ASA5505 to connect via my TPLink TD-W8960N ADSL router to the internet.

There are three options in the ASA5505 for the outside interface:
-use static ip
-obtain address via dhcp
-use pppoE

The only option I could get working was 'obtain address via dhcp'. That was by leaving my ADSL router in non bridge mode, still providing NAT, with a LAN address and DHCP server. The ASA5505 then obtains an IP from the ADSL router and uses the ADSL router as it's default gateway. Then if I wanted to set up VPNs I would port forward the ADSL router towards the ASA5500.

Do any of you guys use either of the other two options i.e "use static IP" or "use pppoE" ?
It seems most NZ connections are "pppoA" so the option "use pppoE" would not work ?

So are any of you connecting up your outside interfaces differently (cleaner) than what I have described above ?

Thanks for any help.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#996250 28-Feb-2014 11:40

You really need to use the correct hardware for the job otherwise you'll simply end up with double NAT.

Buy a modem such as the Draytek 120 that offers a bridge mode and then configure PPPoE in the ASA.

Trend Micro

Affiliate link

Affiliate link: Trend Micro provides enhanced protection against viruses, malware, ransomware and spyware and more for your connected devices.

chevrolux

4962 posts

Uber Geek
Inactive user

#996334 28-Feb-2014 13:01

If you must use your TP-Link you want to set it up in half bridge.

You put in your PPPoA details in to the TP-Link and it sends out the public address on the LAN interface via DHCP - it is really just bastardized DHCP.

Then you will set your Cisco WAN to DHCP and will be sweet as.

Half bridge is fine but for a "proper" set up a DV120 (or DV130) will do full PPPoA-PPPoE translation meaning the WAN on the Cisco can be set up as a PPPoE interface.