Cisco :: Can't Ping WebServer Of DMZ Zone Using Public IP
Feb 28, 2013
I have my webserver (184.108.40.206) located at DMZ zone. The public IP of my webserver is (220.127.116.11). From outside i can ping my webserver using public IP thats fine.The issue out here is, if i want to ping my webserver using public IP from Internal LAN then i cannot ping but i can ping my webserver using private IP.I am using ASA5520. [code]
I have a sg300-10 switch. i update the firmware with the last one. Things are complicated when i create 2 VLAN. ( really 1 VLAN cause the first is native ).So i have the first VLAN with the interface 192.168.1.254 ans the VLAN 2 wich IP is 192.168.2.254
I'm connected with my workstation ( ip : 192.168.1.2/24 with GW 192.168.1.254 ) and i try to ping a web server on VLAN 2 ( ip : 192.168.2.2/24 GW 192.168.2.254 )
Ping is OK ! But when i try to reach any ports of the webserver : Nothing.
I'm trying to setup a zone behind my firewall with complete publicly routeable IP addresses for 3 servers. The reason I'm doing this is I am in the network setup stage of an OCS implementation, and OCS connections don't behave well with NAT.
My device is a ASA5520. I have an internal zone, and a dmz zone. These are done via standard NAT configurations.
My question is this:
Is it possible to setup connectivity to the outside with internal servers that have Public IP's directly on their NIC's? Another little detail of interest is that this ip space is seperate than the one that's on current Outside interface facing our ISP. However we own both address space.
I have a Cisco 2901 which terminates a Class C address pool. I have split the Class C address pool into 3 sub-nets and 2 zones and created a non-addressable pool (private pool):
dmz-zone : x.x.x.0 TO x.x.x.127 (x.x.x.0/25) in-zone: x.x.x.128 TO x.x.x.159 (x.x.x.128/27) & x.x.x.160 TO x.x.x.191 (x.x.x.160/27) private-zone: 192.168.x.0 TO 192.168.x.255 (192.168.x.0/24)
I have configured private-zone NAT to use address pool x.x.x.161 TO x.x.x.189 within the in-zone.
dmz-zone - are servers for : DNS, Syslog, SIP & HTTP/HTTPS in-zone - is a SMTP mail server which is behind VPN Gateway/NAT, TomCat (Application Server) and PostgreSQL Server private-zone - is where all standard users are operating from and they can access the SIP & HTTP/HTTPS servers within dmz-zone My problem is that I cannot seem to configure the ZBFW to allow the dmz-zone HTTP/HTTP server to redirect to in-zone TomCat server.
I do not want to make the TomCat server generally visible and am instead using the Apache proxy/ajp13 to connect from dmz-zone server to in-zone server.However I cannot seem to get anything (including icmp) to work from dmz-zone to in-zone.
I have Policy:
POLICY-DMZ-IN (dmz-zone to in-zone) which has: any any udp/tcp inspect any any icmp inspect unmatched traffic DROP/LOG
But I still cannot get anything from dmz-zone to in-zone...Could the POLICY-DMZ-IN be being overridden by other dmz-zone to out-zone policies?
NOTE: I have routing rules for each of various sub-nets and all out-zone to dmz-zone, out-zone to in-zone and private-zone to out-zone, in-zone and dmz-zone routing works ok, so it appears problem is with ZBFW not routing table.
I have setup Cisco Asa 8.4 Lab in GNS3 to understand new Nat changes in asa 8.4 because im new to asa.
I have configured one of my internal webserver to static NAT with one public ip. Im able to access hosted webpage from static public ip 192.168.1.4 means NAT is working fine, the problem here Im facing i'm not able to ping to Mapped public IP 192.168.1.4 from outside interface sitting on pc (ip 192.168.1.100) which is also connected to same outside network and neither from ASA console but Im able to ping outside interface ip address which is 192.168.1.3 from pc (192.168.1.100) and from asa console.
This how my network topology
Inside Network 192.168.72.0/24 outside Network 192.168.1.0 inside ip 192.168.72.2/24---------------ASA8.4-----------------------outside ip 192.168.1.3/24 (connected to ADSL router 192.168.1.1)
We have ciso asa 5505 and we are using one public ip of 18.104.22.168 , so i wanna disable to ping from outside this ip , but not effect our site to site and remote vpn connections ,the only thing i need is to disable the public ip to ping from outside.
I have just setup the 3G Wifi Router (Huawei 3G21WE) for my company at remote site for temporary use.Now we want to monitor the DVR and cameras installed on the site from head office but i am unable to do it.I have done the port forwarding on the router and using Dyn DNS and configured it correctly, but i cannot browse it from internet.I have also noticed that i am unable to ping the public IP/DynDNS from internet. also i cannot find any option to disable the firewall on my router.
configuring an ACL for a 857 Cisco router for web-server traffic. I've configured a NAT for the inside network and added ACL entries for port 80 access but dont seem to have any luck accessing the website remotely. I suspect there's an ACL rule blocking access.
Setup Internet === Router === Webserver Router address: 10.0.10.1 Web-server address: 10.0.10.77IP from ISP address: XXX.XXX.XXX.XXX (masked for security)
The remote office is connected to hq via site to site vpn. I have 1 static IP (on the remote site)that I use for the site to site. I need to publish a web server at the remote site. My question is can I use the same IP for VPN and web server publishing, I am having trouble getting the web server to publish
We're running three networks (inside, outside and dmz). Inside is 10.0.1.0/24, dmz is 10.0.2.0/24, outside is a static ip allocated by our ISP. We'd like to configure the following:All traffic from the outside to [static provider ip] on port 80 should go to 10.0.2.200 port 8080.
I have one webserver which open for public via http and https. The server sit behind Cisco ASA 5510. Today our webserver have been hacked by someone. The index.html has been replaced by hacker own index.html file. Is it anyway to detect who did (by IP) this? is my Cisco ASA can give any clue about it? How to prevent from this happening in Cisco ASA? FYI, my ASA only allow HTTP and HTTPS port from outside to internal. This ASA is solely dedicated to protect the webserver.
ASA 5510I'm trying to add a static NAT for to allow access to an internal webserver on my DMZ. I've added the config, however i'm still unable to get to it from the outside. I'm able to ping and browse the server from the LAN and I'm also able to ping the external interafce from the outside, but just unable to browse.I've turned on logging and the error I'm getting is "Inbound TCP connection denied...flags SYN on interface outside"
Im currently working on setting up a small network at home. I have a Dell 2716 and a dell 2650 server running windows server 2003. Ive already setup the dns and domain controller on my server. I have 3 desktops that will connect to the server. so far I have the following setup. ISP---> Dell 2716 --->dell 2650/ computers. I set the computers prefered dns to the servers ip. Im able to join the domain and log in but is there a better way to set it up. Also the server and computers are set to static ip.
I am running a webserver locally and I am unable to resolve it by domain name (e.g. mydomain.com) when I am inside my network. However, I am able to hit it internally (e.g. 192.168.0.10) just fine. When I try to access mydomain.com from inside my network it comes up with my Actiontec router's admin page on 192.168.1.1.Here is my configuration:Actiontec FIOS router 192.168.1.1 (connected to internet)DHCP disabled Netgear Router 192.168.1.2 is in the DMZHas cable running from Actiontec's LAN port to Netgear's WAN port[CODE]
I've tried to get my head around this but beeing used to Juniper and Watchguard devices I just can't get my home webserver published to the outside interface.I have a ASA5505 with ASA version 8.4 and ASDM version 6.4 and the basic license.
Outside interface is X.X.X.32/255.255.255.248 so I have 5 static IP:s on my external interface, .34 is in use for the outside interface.
Inside 10.10.10.0/25 DMZ 10.0.0.0/24
I have a webserver in DMZ located at 10.0.0.253 and would like to publish it to the external IP X.X.X.35.I've tried to make the static NAT but every time I do either nothing goes in or out of the DMZ zone or you can't access the webserver from the outside interface.Right now I deleted all trials since none of them work so only the basic config is applied. Everything get's NAT:ed to the external interface .34 IP.
I have the syntax correct and thought process down right on a solution to allowing guest wireless users access to an internal webserver. (DMZ discussion aside)
We have an ASA5510 with interfaces setup as: outside - 65.x.x.x address inside - 172.20.1.2 guest_inet - 10.2.1.1
Internally clients resolve our website to 192.168.40.40 and that part works as it should. Clients outside of our network resolve our website to the correct external address (lets just call it 22.214.171.124). We have a NAT statement static (inside, outside) 126.96.36.199 192.168.40.40 netmask 255.255.255.255 and an ACL to permit tcp any host 188.8.131.52 eq www
Clients on our guest_int use an external DNS server and hence resolve our website to 184.108.40.206. However it seems traffic goes out and back in our outside interface and this connection never occurs.
What I'm wondering is the correct NAT statement / ACL to add that would allow our internal clients on the 10.2.1.x network to access our internal website. Would that be: static (inside,guest_inet) 220.127.116.11 192.168.40.40 netmask 255.255.255.255 ? Since there is already an ACL permitting port 80 traffic to 18.104.22.168 we should be taken care of on the ACL side of things, right?
One of our vendors requires using a public ip address to setup a site-to-site IPSEC vpn. We only have one public ip address and that will be used for the vpn endpoint and for internet access for the local network. I've setup policy NAT from our local network to the outside interface. I'm also using the outside ip address for the crypto map. The tunnel setups successfully and the Tx count increases anytime I try to ping the remote network, but the ping fails and the Rx count does not increase. According to our vendor, we should be able to ping the remote network and connect using port 443. When trying to connect using port 443, I see a SYN timeout in the logs. I'm not sure if the problem is on their end and they're rejecting our traffic, or if something is misconfigured on our end. I'd like to make sure that I have everything configured correctly before I go and point fingers at them.
Local Network - 10.10.9.0/24 Remote Network - 22.214.171.124/24 Remote Peer - 126.96.36.199 .ASA Version 8.2(5) ! hostname ciscoasa
My HP Microserver (Ubuntu +Samba+Apache) is connected via LAN. I have notebook (Windows 7). To my server (FILE+WEB) I have access only when I connected via LAN cable. In windows 7 i see my server and have access to the files. Webserver works also properly: access with the name of the server in web browser.
But by WiFI connection, there is no access ! The server has the reserved local IP-address, like 192.168.1.200.
What should I do to solve it? By typing "192.168.1.200" i see the localhost page, but nothing more!
i need to allow https traffic to a server in the DMZ that will have a routable IP address will just an ACL suffice ?which interface do i apply it to ? wan or dmz ?i dont need a NAT since the DMZ is a routable space?
im having a problem on my DIR-655, i just recently updated my DIR 655 2.03NA(which is no problem at all) to 2.10NA, & im having problem on my GUEST ZONE wireless network everytime i connect my Iphone 4 to it every second 10 seconds it goes on & off & i try to connect to the main wireless network it was working fine any causes to this?
I'm having a few problems at the moment with a zone based firewall setup. The more I looked into the problems the more I question whether I need the ZBF or not.My network is pretty simple. 1 Internet connection and 1 LAN interface and a few site to site vpns to the router.So what do people think to having this kind of set up and not using a ZBF?
some of my switches (3750s) are on the right time and some are not. i have them all pointed to the same DC for NTP and they all say they are synchronized. is it possible to have the switches pole the DC for the right time and update?
I'm sure this is simple to resolve. I just bought a new Cisco 2901 ISR Router. How do I configure the Cisco 2901 ISR Router for Zone Firewall? The "zone" command is not recognized and does not show up in the "?" list in config or user modes -
I have a 2800 router connecting a small office to the Internet. I am using zone-based firewall to provide protection. The small office also needs to connect to another office. The 2800 is at the small office and an ASA at HQ. I successfully established the VPN connection and have allowed Internet access for the small office. The purpose of this post is my zone-base fw policy doesn't appear to be as secure as it could be.
2800 - I have defined two zones (inside and outside). Traffic from the inside to the outside is inspected expect for the traffic to the other office. I allow traffic to the other office to "pass" zbfw. Because the traffic "passes" zbfw, I have to "pass" the same traffic for the outside to in policy. The ASA has "sysopt" to allow VPN traffic to bypass the outside_acl. Do routers and zone-based firewall have a similar feature?
I have a 3845 ISR that I have been managing for a couple years that has a traditional ACL based config. We just purchased a new 3845 for redundancy and it arrived with the zone based config from Cisco. Any opinions on whether I should take the existing router to a zone based config or should I configure the new router with traditional ACL config that I am more comforatable with?
I have a Cisco 1811 router running the 15.1(3)T IOS. I am having some difficulty with the current zone based firewall and the SSL VPN.
When a user connects, they are put into Virtual-Template 1 which has a zone based assignment of "sslvpn". However the traffic report for the users is listed as being blocked by the zone based firewall in the outbound direction(office out to the wan zone).
Id like to seek expertise on validating a simple firewall setup.
Do i trunk core switch traffic to the cisco ASA OR assign L3 link instead? It is basic understanding that the Cisco ASA is usually use for protection from our internet zone.A typical Cisco ASA setup would consist of outside, inside, dmz zone.
L3 core switch consist of 20 VLANS20 vlan needs to be blocked from each other. Eg Wireless Vlan does not have access to Server Vlan etc etc.
what is the best practise to filter ip address within vlan from reaching each other.Should i trunk all my vlan to the Cisco firewall? (For easy vlan restrictions: but is that best practise?)Or do ACL on the core switch itself? but what if i have tons of servers ip that needs specific ports blocking or etc.How would i be able to manage all my ACL on the core switch.