I need to allow traceroute traffic through ASA running version 8.0.2.This traffic is natted. what configuration is required on ASA to allow this natted traceroute traffic.Traffic is coming from inside and going outside.Also can we capture this traceroute traffic on asa using capture feature.
View 12 RepliesWe all know that MS traceroute and *nix traceroute work a bit differently. *nix works by sending UDP packets with low ttls to random high UDP ports.
Of course this creates a problem when trying to create an ip6tables rule where I want to allow traceroute. Anyone got something clean that will make this work? This is an example of current drops in my firewall log:
I've got an annoying problem with my ASA 5520.I have traffic going from the inside interface (security level 100) to the outside interface (security level 0) with a global PAT applied to the outside interface address for all inside traffic - and I can't seem to traceroute through the firewall.The ruleset is simple - basically, allow any IP from inside to outside. The NAT is simple - PAT all traffic unless exempted to the IP address of the outside interface.If I do the trace from my internet edge router it works fine - so I know it's not soemthing my uplinks are filtering - but if I do it through the firewall, I get perfect responses until the hop where it hits the firewall interface - then nothing.Is there something I am missing that I need to do to allow traceroute to just work with all the rest of the traffic?
View 2 Replies View RelatedLet me start by saying that I'm just starting to study for CCNA, so the ASA seems to be a bit above me yet. The ASA's we are using is for VPN to our corporate office and only allowing access to our Citrix environment, so no direct internet allowed. We have a person who works in the remote office who has need for a caption telephone that requires direct access to the internet. The phone only supports DHCP, and getting the ASA to do an ARP reservations is proving difficult. For now I wrote an access list to allow it's DHCP address out but it still isn't working. The access list I wrote is:
access-list 101 extended permit ip host xxx.xxx.xxx.124 any log
access-list 101 extended permit ip any any
access-group 101 out interface outside
When I do a show access-list I'm seeing that traffic is hitting the access list as the hit counter has increased. When I do a show conn I'm seeing one of the IP's that the phone should have access to, however the flags are: saA, so I'm assuming they are not getting a response. According to the manufacturer, only outbound connections are needed, no incoming ports required. All traffic is TCP.
I am trying to switch out a cisco pix 501 firewall with a cisco ASA 5505 firewall. I am not very familiar with all of the commands for the firewalls and have always relied on a standard command line script that I use when building a new one. Unfortunately, my script is not working with the 5505. What I am doing wrong with the following script? I've masked public IP info with xxx.xxx.xxx and I run it right after restoring the firewall to the factory defaults. I am able to get out to the internet if I browse directly from one of the servers, but cannot access a web page when trying to browse to it from an outside network. [code]
View 7 Replies View RelatedI ' m not able to configure the asa 5510 to allow the multicast traffic to pass through ASA.The multicast traffic have to pass from inside interface to outside interface.Can I configure the multicast traffic to pass through asa with a static nat ?
View 1 Replies View RelatedI have a nac guest server 3315 appliance with 4 NICs. I want to connect each NIC to 4 different networks without allowing traffic between them. So RADIUS interface will be different from sponsor/admin interface to the NGS. how to achieve this. I have created and assigned a static IP address using system-config-network, but when i do ifconfig i dont see the remaining 3 NICs and the web interface doesnt seem to have provision to create this interfaces.
View 3 Replies View RelatedI'm usually not working with this product, but this is what I'm trying to do.I have 2 internal networks setup on our Cisco ASA 5505 firewall. (not done by me, I'm a new to this product)I'm trying to access a server on one network from a PC located on the other internal network. (preferable through the web gui)When I try "Packet Tracer" from interface "Trust4" it fails on the NAT phase.(Source ip: 10.0.4.99, Destination ip: 10.0.6.99)
When I check the NAT rule, it says:
Type Source Interface AddressDynamic any outside outside.
I am trying to allow PPTP traffic through my Linksys WRT320n to a PPTP VPN server on my home network.The Linksys WRT320n is running firmware 1.0.05 build 002Mar 31, 2011.I have created a Port Forwarding rule on the Linksys to allow TCP & UDP port 1723 through to my internal IP of the PPTP VPN server,but everytime I try to connect with a PPTP client from outside of my network I get a connection error on the client.Checking the PPTP VPN servers logs I see the following errors (Please note all IP's have been masked) Mar 2 11:15:07 ap-01 pptpd[5300]: CTRL: Client x.x.x.x control connection startedMar 2 11:15:07 ap-01 pptpd[5300]: CTRL: Starting call (launching pppd, opening GRE)Mar 2 11:15:07 ap-01 pppd[5301]: pppd 2.4.4 started by root, uid 0Mar 2 11:15:37 ap-01 pppd[5301]: Exit.Mar 2 11:15:37 ap-01 pptpd[5300]: GRE: read(fd=8,buffer=41fe30,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logsMar 2 11:15:37 ap-01 pptpd[5300]: CTRL: PTY read or GRE write failed (pty,gre)=(8,9)Mar 2 11:15:37 ap-01 pptpd[5300]: CTRL: Reaping child PPP[5301]Mar 2 11:15:37 ap-01 pptpd[5300]: CTRL: Client x.x.x.x control connection finished
From looking at the above errors, it seems as if the Linksys isn't forwarding GRE through to my PPTP server.I have tried various settings, including enabling and disabling the PPTP Passthrough option on the Linksysbut still can't get PPTP to work.What is the correct way to get GRE traffic forwarded through the Linksys?
I posted my complaint on Amazon.com recently. My E4200 router stopped allowing traffic through ports completely. I was able to unplug the power and allow the router to cool, and the router would work for a while then stop after about 10 minutes. I assume that the unit was overheating, but I do not have the equipment of a test facility.I bought a Belkin AC 1200 router which is a bit of an upgrade from Amazon.com. I do not think that there is anything that Linksys can do for me as my warranty expired. I just thought that when I spent what was to me a lot of money the router should have lasted longer.
View 5 Replies View RelatedI have been searching to find out how to allow traceroute from an inside host to an outside IP address. I have found a few articles for IOS versions prior to 8.4 but nothing for 8.4. I can traceroute from the CLI of the 5510 just fine but from a windows host on the inside network all I get is Request timed out
View 1 Replies View RelatedMy setup is :
Source--- Router 1 ( ip 1.1.1.1) --ACE---router---cloud---customer---router--destination( ip 99.99.99.99).
Traceroute from client to destination shows the following:
traceroute 99.99.99.99
traceroute to 99.99.99.99 (99.99.99.99), 30 hops max, 40 byte packets
1 1.1.1.1 (1.1.1.1) 1.10 ms 1.78 ms
2 99.99.99.99 (99.99.99.99) 1.01 ms 1.97 ms 2.511 ms
3 99.99.99.99 (99.99.99.99) 2.01 ms * 99.99.99.99 (99.99.99.99) 2.330 ms
[code]....
So on this, the destination is 99.99.99.99.The first hop is the default gateway, which is 1.1.1.1.After that, the next step is the Cisco ACE.After that there are several hops to the destination.Looks like for some reason the Cisco ACE is not recording his ip.( For any destination traceroute result is the saame.ICMP is allowed in the access list and also ther is ICMP inspect in my config. access-list ICMP line 10 extended permit icmp any
class-map type management match-any abc
201 match protocol ssh source-address X.X.0.0 x.x.0.0
class-map match-all ICMP_allow
2 match access-list ICMP
[code]....
Version running on ACE is Version A2(3.3)
there is an issue with tracroute from ASA 5505 with 9.0(2) - here is the running configuration [code] with this running configuration - from the LAN tracerouet to public IP, it is working fine. but once I traceroute from the LAN 192.168.225.x to the corporate networks via the IPSec l2l tunnel - it does not show any hop at all - even the inside interface of the ASA does not show in the traceroute.
View 4 Replies View RelatedWe have a ASA 5505 and a 5510, that we are using site to site..I need to traceroute from the 5505-5510.. From the outside interfaces.. Don't want to do this through the site-to-site.I have temporarily added a few acl on the outside interfaces..
-access-list outside_in extended permit icmp any any unreachable
-access-list outside_in extended permit icmp any any time-exceeded
-access-list outside_in extended permit icmp any any echo-reply
when i traceroute it only goes one hop.. Maybe thats the way it suppose to be? I need to know all the hops between the outside interfaces on the 5505 to the outside interface on the 5510.
I've read through netpro and found everyone points to this doc.
[url]....
However that still doesnt allow traceroute through for us. We still see syslogs with deny's on high level random UDP ports to different Internet destinations.
[code]....
Here are two traceroutes both to 82.195.128.132. One results in the name ns1.hosting 365.ie and the other in the name mail.hosting365.ie. Why the difference? [code]
View 2 Replies View RelatedI'm working as a network engineer for a service provider, and we had just gone through a pretty large scale upgrade throughout our network and service.But not long after the upgrade (or maybe ever since the upgrade, we can't confirm this because we probably missed it out due to many other links to be tested), we met a peculiar problem.Everything seems to be running fine most of the time, but there has been some weird 'ghost-like' activity which have been causing inconsistent network disruptions. At times, certain portions of the network can't communicate with other subnets.And most obviously is the problem with a continuous ping and a traceroute simultaneously. Ping is usually normal, but until a traceroute is attempted, it times out at the same time as tracert fails to obtain the route.Besides, performing a ping from the 2nd closest hop address, 10.250.253.251, which is a cisco layer 3 switch also has problems, the results shown are as belowType escape sequence to abort[CODE]
View 1 Replies View RelatedI am encountering an issue with IPv6 trace route both from within LAN as well as on the Cisco router is unable to function beyond the WAN interface of my Cisco 1941 router with IOS v15.x.
Below is the IPv6 Access List:
[code]
sequence 410 remark Allow Specific Inbound ICMP Types
permit icmp any 2001:D98:XXXX::/64 1 3
permit icmp any 2001:D98:XXXX::/64 packet-too-big
[Code].....
To show up the ASA as a hop in a traceroute, one can use the 'set connection decrement-ttl' feature in a policy map.During my tests I recognized, that this behaviour only affects IPv4 traffic.
An IPv6 traceroute still does not show the ASA as a hop.How can I configure the ASA to show up as a hop in an IPv6 traceroute?The ASA is a 5520 with v8.4(1) installed.
=>Routing Protocol in Question EIGRP.
=>Two equal metric routes for destination A(through R1 and R2-SVIs on two upstream 6500s)
Traceroute Output, is the output that alternates between 1.1=>10.1=>1.1 normal granted the two routes are "equal metric routes for the same routing procotol in use" or is that "round robin behavior" indicative of a routing problem?
Why does the sx300 series only displays ping and traceroute results in 20ms intervals (see below)? The example in the CLI manual shows "regular" results. These 20ms intervals are not useful for troubleshooting. This is version 1.1.0.73 on an sf300-24. [code]
View 2 Replies View RelatedI'm new to this site, fully Microsoft certified but only just getting in cisco and looking to pass my CCNA later this year. Actual commands and general use on Cisco's im quite good at but general networking knowledge on networking (subnetting and network layers) I kinda suck at so will be studying a lot on this side of things[CODE]
View 5 Replies View RelatedI've recently had to move an AS400 system behind an internal ASA firewall and now users are unable to browse to it.The ASA is running Version 8.2(5)? I get these messages: Sep 11 2012 17:09:59: %ASA-7-710005: UDP request discarded from 172.19.241.35/137 to outside:172.19.241.255/137?Is there a way to enable these ports without enabling NAT?No VPN's involved, just an inside and outside eth interfaces?
View 12 Replies View RelatedI have a DI-604 Version E3 D Link router and I'm trying to allow VPN through the router but I'm not exactly sure how. I have the VPN set up through my PC's but I need to configure the router aswell. Trying to set up the VPN so multiple locations can access it,
View 1 Replies View RelatedI've got an 1841 router acting as the firewall for a LAN. It also does NAT and acts as the dialer for a PPPoE DSL line to the internet.
All is working fine, except now I need to allow a Tivo device to connect to certain ports on the Tivo servers on the internet. I want only the Tivo to be able to do this. The problem is that NAT is happening before my outbound ACL is checked, so even though I've got rules to allow the Tivo's LAN address out on all ports, it never works. I've verified this using a syslog server, and can see my external DSL IP trying to connect to the Tivo servers and being denied.
I've done things like this at work by NATting the appropriate internal host to its own external static IP address, which allows me to write rules allowing only that external address to do stuff. But I don't have multiple external addresses to work with here.
I tried applying my outbound ACL to the LAN interface of the router in the "in" direction (and removing the same ACL from the Dialer interface in the "out" direction), but that broke other things like the router's own ability to ping out to the LAN or to see a TFTP server on the LAN. I could maybe fix all of that with rule changes and inspect statements on traffic going out toward the LAN (not sure of this, think so), but I'm wondering:
Is there a better way to let just the Tivo makes outgoing connections to certain ports?
Config pasted below:
!
! Last configuration change at 17:15:10 CDT Sun Jul 15 2012
! NVRAM config last updated at 16:27:14 CDT Sun Jul 15 2012 by someguy
!
[Code].....
This is actually on my home television network.... Uverse which uses one of those dumb 2wire modem, router, wifi, 4 port 10/100 switch combo devices. it is NOT my internet source. It is just for IPTV services from ATT. Short of replacing the 2wire gateway with a new one from ATT I have a good learning experience question to ask.
I have two switches available at my home to work with on this issue. A EHWIC-8 port Gig Switch in my router and a 24 port 3750E gig switch.
When ever I plug, any port, any cable, both crossover and straight, on the 2wire uverse device into either Cisco switch there are masses of CRC errors generated by the cheapy 2wire thing.
CRC being a layer1 issue in nature I have tried everything short of replacing the 2wire and that is next. There is one caveat.
When the CRC errors are generated and logged on the 3750 it just seems to continue to forward those frames to whereever they need to go regardless albeit a ton of errors.
On the EHWIC 8 port in my 1921 router it seesm to stop forwarding after about 10 secs of encountering CRC errors. What gives? Is there something special command wise that tells a switch to forward frames regardless of CRC errors? Is the 3750 able to deal with them and just forward away and the EHWIC card not able too?
We have a cisco 2800 router and are now required to allow users to be able to connect to another company's extranet. Having tried this it wont allow this connection so I have added this to the access-list 101
access-list 101 remark SDM_ACL Category=0
access-list 101 permit ip any host 192.168.0.246
access-list 101 permit ip any host 192.168.0.247
[Code].....
I dont think the gre is being allowed back in. I have attached a cut down copy of the config. I have just general experience of cisco routers and not cisco qualified.
I have got my ccna voice lab configured and is up and running, my switch is configured with 2 differents Vlans (Data & Voice) and the fa 0/1 is configured as trunk port connecting to the CME router. I can telnet or ssh to all the devices on the network but only the switch in not accepting the request the only message I am getting is "request timeout".
View 12 Replies View RelatedWe have a customer that is looking to allow only static IP addresses onto the wireless network via the new 5508 we are putting into place. I can see where to require DHCP but not the opposite.
View 4 Replies View RelatedThere is a problem with my WLC, it is not allowing an specific client to connect. It gives an 802.1x failure log but I am not using it, anyways the WLC puts this client in the excluded clients list and I didn't add it manually, in fact is a new laptop.
I attached a couple of screens from my WLC.
IOS is 7.0.98.0
I have a 7100 router that has some servers behind it. I need to translate each server to a public IP. The only thing is that between the outside world and the router is an ASA. We have a small data center where the ASA is connected to a core switch on the inside and the ISP on the outside. How would I do the NAT/PAT translations on the 7100 and then have them pass through the ASA? for example:
View 6 Replies View RelatedI am trying to configure Zone Based Firewall (IOS 15.2T) on Cisco 881 router for IPv6. Current setup is simple:
Zone:
LAN --> WAN zone security LAN
zone security WAN
!
class-map type inspect match-any Internet-cmap
match protocol dns
match protocol http
match protocol https
[ code ] ........
Current configuration behaves as expected for IPv4, but blocks all IPv6 traffic. If zone-security is removed from WAN interface IPv6 works normally (connected to Internet). As soon as zone-security is enabled on WAN interface all IPV6 traffic is discarded when connecting to Internet from local LAN.
Error messages on console: Half-open Sessions source destination tcp SIS_OPENING/TCP_SYNSENT
Are there any special settings for ZBF which should be turned on for IPv6 protocol?
I am trying to allow RDP through my 891w.I have tried a few different yjing to no avail. [code]
View 23 Replies View Related