I have a 851 that I'm trying to apply CBAC on. However, it seems that new sessions are stuck in SIS_OPENING. I'm guessing maybe because packets are not returned,I can't understand why - everything works just fine up-until I add ip inspect INBOUND out' on the WAN-interface.
View 19 RepliesI'm playing around with CBAC, trying to get a feel for it so I can manage it on some of our routers. I think I have the basics down, but for some reason I'm still having these issues with a 2801 running the attached config:- I had to add the "router-traffic" option to my ICMP inspect line to be able to ping anything at all on the 10.10.2.0 side from the router. We have a router doing firewall duty which is using CBAC but does not have the "router-traffic" option on its ICMP inspect line, but pings from it still work. What gives? I've read that by default (without the "router-traffic" option) traffic originating from within a router will not be inspected by CBAC, so it looks like my lab router is working as expected, I just can't figure out why pings work from the production firewall router.
- I can not copy a config via TFTP to 10.10.2.97. Other network devices can access the TFTP server on .97, so it's my lab router that has the problem. I can ping .97, it can ping this router (.5). It looks to me like I have TFTP allowed through this router, but it doesn't work. When I do a copy command, my TFTP server on .97 sees PUTs coming in, but then says it's not getting responses from the router, so it looks like traffic is only flowing out from the router but not back in. I thought the TFTP inspect would fix that. There doesn't seem to be a "router-traffic" option for the TFTP inspect[CODE]
im in the progress of Configuring a Cisco 881 Router, for a branch office.Behind this Router they have an PBX, is it prossible to inspect SIP packet using CBAC, and thereby open for RSTP pinholes.i only have 1 Public ip adresser, and im not fond of configuring thousands of PAT to the PBX.i have with success, Accomplished this with Global Inspection on ASA Firewalls, but i dont know if this can be done with IOS as well.
View 5 Replies View RelatedI have a 857 doing NAT for the internal vlan1 interface (192.168.20.0/24) attached traffic.ip nat source static tcp 192.168.20.5 3389 interface dialer0 3389 ip nat inside source list aclAllowNAT interface dialer0 overload I would like to turn CBAC (packet inspection) off, but still maintain an ACL on the ingress to Dialer0 (traffic in from the Web) to protect access to some sensitive material (doctor's surgery) and only allow RDP from designated sites. I realise there are other ways to publish the access to the terminal servers but this way has advantages we need, and is in place.
ip access-list extended aclAllowNAT
permit ip 192.168.16.20.0 0.0.0.255
ip access-list extended aclIngressFromInternet
permit tcp host xx.xx.xx.xx any eq 3389
...
But of course when i do this and apply the access list to dialer0 all NAT traffic stops as it doesn't have CBAC there telling to allow the inspected traffic.
What do i need to put in the aclIngressFromInternet ACL to allow the NAT traffic with CBAC off?
I need to configure the access list on the outbound internet port to accept the following:
ip access list 10
access-list 10 permit PPTP vpn any xxx.xxx.xxx.xxx
access-list 10 permit RDP any xxx.xxx.xxx.xxx
access-list 10 permit FTP any xxx.xxx.xxx.xxx
access-list 10 permit Postgresql any xxx.xxx.xxx.xxx
access-list 10 permit MacARD any xxx.xxx.xxx.xxx
This method does not work on the Cisco 2921 router with FW
I am running CBAC on a 1811 running IOS 15.1 and can't figure out how to configure it so that I can preform TFTP upgrades with CBAC enabled. It appears that CBAC doesn't catch self-generated traffic and put in a reverse rule in the ACL. I am trying to upgrade the image on this router using a public-addressed TFTP server on the F0 interface. If I drop the ACL the traffic will work, so why isn't CBAC cacthing the TFTP outbound? [code]
The tftp rule above is for TFTP upgrades on other equipment, using a server behind this router. I tried defining an outbound ACL as well on F0 to get the traffic be "caught" by CBAC but that didn't work. I also tried adding "ip inspect name trust tftp" but that didn't work.
Since upgrading some of computers in my LAN to Windows 7 they all experience upload issues. I have narrowed it down to CBAC inspection on my Cisco 1711 router, I am running IOS 12.3 I have a simple CBAC inspection set for TCP/UDP only without any application-specific inspects. Download works fine however upload does not seem to work atl all- unless I disable the ip inspection. It is all working fine for any Windows XP but not for Windows 7 machines. Is this a known issue, I am not sure how I can go about this - I don't want to build ACLs now for outside interface and disable stateful inspection mechanisms because CBAC has been working fine for me until recently.
View 7 Replies View RelatedI have seen this a couple of times on two different routers. One is a 3745 and another a 1811 running 12.4(15)T4 and 12.4(6)T11, respectively.
When we have IOS firewall running (either IP inspect or ZFW), we will experience intermittent slow HTTP connections.
Symptoms include page timeouts, CSS not loading and just overall slow performance. Disabling the inspection cures the issues.
I have a cisco 2811 router set up as a nat/firewall gateway for my network. I've configured it for CBAC on using ip inspect and an access list.What I want is to use audit-trail to record network traffic (which means sending syslog messages to a server) concerning established sessions from my own network to locations in the outside. If i configure this using ip inspect audit-trail and no ip inspect alert-off, the configuration looks like this: [code] which works just fine, but there is the matter of icmp packets.
Since i use polling software that needs to check some machines in the outside part of the network, it is only natural that several icmp sessions are established through the Inspection Rule per minute. The problem is that since these sessions are recorded along with everything else, my syslogs are flooded with these (since i am using logging trap informational) to the point that more messages are generated about icmp than all other traffic combined, especially in non-working hours.What I am asking is a way for the audit-trail to be selecively disabled for icmp, so that the outgoing (echo) &incoming (echo reply) sessions can be established without generating syslog messages.
I need to receive a 15GB file from a friend, we are using xlight to transfer the file,I dont know much about all this but i am unable to open his ftp server which is(ftp://10.10.xxx .xxx:21).I havent yet installed xlight, i paste this site on my address bar and nothing happens, it gets timed out, i am only facing the problem others are able to access the site........AMD Phenom II 955 Black Edition | 4 gb ddr3 | 1 TB segate | Nvidia 9500GT(O.C)
View 4 Replies View RelatedThere is about 5 devices in my house that uses the same network. Two of them are Xbox's (One uses wireless, other uses wired). I've tried many times to open the NAT for the 2 Xbox's, but have never succeeded.I've read that enabling UPnP, will fix the problem; however I have tried that, and it does not work. If I want to open the NAT for just one Xbox, it will let me - I just port forwarded the required ports for the one Xbox. In my case, this isn't want I want.
View 1 Replies View Relatedi am trying to open a website in UAE [URL] . its opening in india very well but here its not working. it says connecting and after few minutes page displays network error or server busy.
View 4 Replies View RelatedWe have a DVR here at work that has a web interface on port 100. From our internal network we just use http:192.168.100.40:100. What is the best way to set that up on cisco 5510 firewall. I have cisco asdm and set a access rule: enabled=checked ; source=any ; destination= 192.168.100.40 ; service= tcp 100 ; action=permit. It shows a couple of hits when I go to [URL]
View 7 Replies View RelatedI have a ASA 5540 on which VPN is configured (Both SSL through Browser and Anyconnect) , everything was working fine but suddenly the webpage has stopped working and gives the page cannot be displayed error , moreover anyconnect client also fails to connect to the ip.
View 7 Replies View RelatedI'm having an issue on my Pix 501- ver. 6.3(5) firewall when host 192.168.1.2 accessing any website, no website is opening and when i issue command sh xlate so don't see anything and i think i must enable natting on this firewall as same as on ASA nat-control
[code]....
WEBSITE DOES NOT OPEN
View 1 Replies View RelatedI want to open a certain port on my router and I know it shouldn�t be a problem, just go inside of your router settings and add the port manually. But somehow I was enough smart to forget my routers username and password, now my question is my only option a hard reset of the router and deleting all the work I put in to connecting the two computers with my router (believe me I had my share of troubles connecting them with the router) or is there a way to open the port on the router from my computer without accessing my router settings.
View 3 Replies View Relatedmy problem is net show its connected but cant open any psge. I have tried somany thinng as bellow.[CODE]
View 5 Replies View RelatedI openened my desktop, and now usb wireless adapter keeps dropping connection every minute for about 5 seconds?usb wireless adapter was working correctly before i oppened desktop.it doesnt have to do anything with software.is there something that i could have moved inside??
View 2 Replies View Relatedi can open all other web pages other than [URL]
View 1 Replies View RelatedI need opening up a particular website. The website name is [url].... Apparently, using various web based ping tools to ping the website doesn't work as they all get packet loss, so maybe the website is unpingable. However, upon using a proxy server or VPN, the website does open.
Here are the steps I've tried.Used a different OS (ubuntu)- didn't work.Tried on another system, different network, same ISP and it opened. It was an office connection.I did a traceroute on this and this stopped on the 3rd hop.Used various different DNS from google, to opendns, to my ISPs dns (airtel India).Tried different browsers, didn't work. My ISP gives out dynamic IPs. Is it possible to specify routing on this website through my router?
[code]....
my friend was against a wall trying to update her office's system, and it seems like every Cisco person in the region has gone on vacation.For some sort of new system her office is getting, she was told that she needed to enable NAT with external IP xxx.xxx.xxx.14 (The ASA's IP is xxx.xxx.xxx.11) and internal IP xxx.xxx.xxx.58 and that port 8222 needs to be open. I know this is sort of vague, but it's what she was given, and I know the 8222 port is very specific in function,?
At any rate, the best I could come up with was to run:
static (inside,outside) xxx.xxx.xxx.58 xxx.xxx.xxx.14 netmask 255.255.255.255
access-list inbound extended permit tcp any host xxx.xxx.xxx.11 eq www
access-list inbound extended permit tcp any host xxx.xxx.xxx.11 eq https
access-list inbound extended permit tcp any host xxx.xxx.xxx.11 eq 8222
access-list inbound extended permit udp any host xxx.xxx.xxx.11 eq 8222
access-group inbound in interface outside
But after I inserted this, she did what she was supposed to be able to do (went home and tried to run some sort of remote installation file) and it didn't work...
I have been asked to open some ports in order for a CCTV company to connect to an internal CCTV server on our LAN.
We have a Pix running PIX Version 6.3(5) I am ok configuring an ASA for the above but not a Pix.
I am trying to configure a new 5505 but I am having difficulties opening ports that allow traffic in from the outside. My setup is Comcast Business Modem (w/ single static IP) -> ASA (10.0.0.1) -> (dumb) Switch -> NAS (10.0.0.10). I am attemping to open port 5001 to the NAS. I am very new to IOS so I have mostly been working in ASDM. Not sure if I am overcomplicating this for myself or what but I am stuck.
My running config is -
ASA Version 8.2(5)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
[Code].....
What I'm trying to do is to get my Xbox connected to the internet through my router (wired connection), but I want to have my NAT open also. But when I put in a static IP into the Xbox manually and open the ports in my router, it makes it so my Xbox can't connect to Xbox Live at all. Although, if I just leave it to the automatic setting on my Xboxs network options, I can connect just fine. But, I end up having a strict NAT type, unless I restore to factory defaults in the networking options on the Xbox.
View 2 Replies View Relatedthe cursor on my laptop started jumping all over on its own accord and I am struggling to gain control of it and various programs & windows are opening of their own accord. I assumed I had some form of Malware (I know very little about computers) so ran various removal scans and a few things were picked up but it continues to do this. My brother brought his laptop round so I could at least use the internet and after 5 mins of being connected to my internet his laptop started to do exactly the same cursor going all over and programs opening - his laptop was perfectly fine until he connected to my internet. Once he took his laptop back home on his own network it was working perfectly normal again.
View 2 Replies View Relatedhow can I open my port 80, 5000, and 22 in my modem.
View 1 Replies View RelatedSite is not opening in any of my systems in the local network. but if i change ip to a real ip or if i use some other internet source like netsetter then it gets opened.
View 1 Replies View RelatedFindout what is the Reason for does not Opening a bin Extension File?
View 1 Replies View RelatedI am not abel to open yahoo home page I tried all security option and also formate system but still not able to open yahoo all other web site like gmail rediff etc are working properly?
View 1 Replies View RelatedI have a LAN with Cisco 1941 as the only router with NAT that connects it to the internet, with a single public IP. There are many gamer users, and they complain that Call of Duty Modern Warfare 2 sees our network as "strict NAT", while for full gaming experience it needs "open NAT". After a small research I have found out that CoD needs certain port ranges to be forwarded to LAN IPs. Well, I know how to forward a range of ports to a single IP, but how is it possible to forward a port range for all the IPs in the LAN?
View 1 Replies View RelatedI have problem with ACS 5.0 on reporting. On "Monitoring and Report" page in Faverite Reports when i clicking on "Authentications - RADIUS - Today", My browser displays error "Error while reading skin-access.config. Please make sure the file exists and conforms to the schema specified"
I must also mention that I never upgraded the version of ACS from 5.0 also from command line all the acs services are running. It is running on CISCO 1120 Secure Access Controll Server apliance.
My second question is can I upgrade the version of ACS to 5.4 with Cisco Secure ACS 5 Base License?
I am trying to configure two AP-management interfaces to accept CAPWAP on different ports using the option "Enable Dynamic AP Management". One of them uses public ip address. However, I getting the message "Ignoring discovery request received on non-management interface ..." on this.
The controller is 5508.