Set a Static IP for your Cisco ASA5505 Firewall

I kind of hate you Cisco.

I have a firewall. It’s good practice to set that device to have a static IP. If you do this using the ASDM, systems behind the firewall will suddenly not be able to connect to the internet. At all. This is because you don’t have a route to the outside world. Follow the steps below to go from DHCP on your 5505 to a static IP.

  1. Open the ASDM and log into your device.
  2. Under Configuration, Interfaces, select the Outside interface and hit Edit
  3. In the ‘IP Address’ box, click the radio for ‘Use Static IP’
  4. Select an IP address, and use ‘255.255.255.0’ for the mask.
  5. Hit ok, then apply. Your boxes probably lose their connection right about now.
  6. Click ‘Routing’ on the left, Make sure ‘Static Routes’ is selected.
  7. This box is probably empty. Click ‘Add’.
  8. For the interface name, select ‘Outside’ (or whatever the outside interface is named)
  9. In the IP Address field, type: ‘0.0.0.0’
  10. In the Mask field, type: ‘0.0.0.0’
  11. In the Gateway IP field, type the gateway outside of your asa5505. Like, whatever it’s gateway is. If you have a box on the same subnet as the cisco box, do an ipconfig /all and use the gateway listed there.
  12. Metric should be ‘1’
  13. Hit ok, then apply. Now your boxes can get out from behind the firewall, but we need to give them DNS servers and such, if you are using DHCP to assign IP’s to boxes behind the firewall.
  14. Click ‘Properties’ on the left.
  15. Click ‘DHCP Services’
  16. Click ‘DHCP Server’
  17. Select interface inside, and hit edit. Enter your DNS Servers and WINS Server
  18. Hit OK, Apply
  19. Optional: If you know the host name and dns domain for this Cisco unit, you can set it. Click “Properties” on the left, then select “Device” under “Device Administration.” Enter the Host Name and Domain Name and hit apply.
  20. Now to save and reload the box, click ‘Tools/System reload’
  21. Select ‘Save the running configuration at time of reload’
  22. Click ‘Schedule Relod’
  23. The Cisco asa5505 will take a couple minutes to reset, but when it comes up the device should have a static ip, and boxes behind the firewall will get IP’s from DHCP, and they should be able to get out from behind the firewall!

10 thoughts on “Set a Static IP for your Cisco ASA5505 Firewall

  1. Waheed Sami

    I have setup Cisco ASA 5516 with 2 WAN ports for Internet failover. It was working fine till my both WAN ports are on DHCP and I have added static route for failover but since I have changed my WAN1 from DHCP to static IP I am having issue that all my traffic is going out from WAN2 instead of WAN1.

    In Static route WAN1 Matrices Distance is 1 and setup as tracked and WAN2 distance is 10.

    In monitoring WAN2 is showing as default route instead of WAN1. Please help me to resolve this. Thanks

    Waheed Sami.

    Reply
  2. Jason

    Worked like a charm! I changed step 17 for my setup. I used my Outside Interface instead of my Inside Interface (SBS 2003 doesn’t like additional DHCP or DNS Servers running on the network). All boxes behind the Firewall can connect to the Internet.

    My goal is to setup a Site-to-Site VPN connection to link our Main office to a remote one. I needed my Public IP Address programmed into the ASA. Haven’t tried the VPN yet, but I’ll post back my results when I do. I’ll be using the same ASA and with a Public IP Address too.

    Thanks again for taking the time to help. I went to Cisco’s Support page and couldn’t get any help. Maybe they should hire you.

    Jason

    Reply
  3. Kallol Sarker

    It was very helpful for me to understand the new device easily.My office recently bought one to get connection from other location( from national office to my divisional office) , I’m still having some problem but hope to come up.
    THANKS
    KALLOL

    Reply
  4. Oscar

    Grande, mi mancavo quel maledetto ’Tools/System reload’, altro che nat su nat che proponevano su altri siti.

    Ciao.

    Reply
  5. brian

    ok his all makes since but massively confused the more i read and follow ASDM.

    i had to use your guild to reset to factory.

    still need to get outside connection working then let the server ( win 03smb) assign ips through the switch. internal connection (static IP from ISP) is made and holding fine. now its adding this ASA as my router for , a in and out on the server, also access from a AP.

    setup >modem>asa5505> server >switch>

    after that set up a second ASA5505 for a site to site vpn

    great site and very helpful

    Reply
  6. Jay

    Excellent post Anthony. The ASDM wizard doesn’t ask for the gateway when setting a Static IP, so i was lost…until i found your post. followed the directions and got my T1 up and running in 5 minutes! You’re the man. Thanks

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *