user is connected to ASA interface X and he need to reach a server which has connection via Z interface of ASA.We need to open port say 22 and 1123 should we config the ACL on interface X?
View 3 RepliesWe have two internet connections with 2mbps each. I would like to go for Wireless Dual WAN Router. know the +ve and -ve of this usage. know the best modals. We have 30 macs in my company.
View 3 Replies View Relatedchoosing Ios for a funcionality.
We need to upgrade Ios in a 6509, the reason for we need to upgrade IOs is that we need implement the command xconnect in a interface. The current version of Ios not suport this comand.
How do we select the new IOS that suport this command?, ..we see a long list of IOS in the software download section of 6509, but not sure which one to choose..
I need to upgrade IOS on my 6509 MSFC2. Below is the software version I have on the Sup2 and msfc2. The reason I need to upgrade the msfc2 IOS is that I need to implement ip sla/object tracking and it is not supported by the current version of IOS on msfc2. How do I select the new IOS that I should upgrade the msfc2, in order to achieve object tracking...I see a long list of IOS in the software download section of 6509 msfc2, but not sure which one to choose..
WS-X6K-SUP2-2GE: Sw : 8.6(4)
WS-F6K-MSFC2: Sw : 12.1(19)E1
The Belkin N600 DB N+ Router. It has 2 seperate networks for optimum performance, how do i go about choosing which band I want to use? Under the Belkin desktop I can clearly see 2 SSID's. One shows 2.4 GHz SSID & network name and the other 5GHz SSID & network name. media. But when I pull up my wireless connections I only see 1 network.
View 1 Replies View RelatedMy inherited network has a Cisco Catalyst 4506 with a WS-X4124FX–MT fiber card that connects to twelve Cisco 2950 switches over 62.5 micron multimode fiber at 100 Mbps. I do not know my run lengths (or even where the conduits run), but the furthest switches are well over a thousand feet from the server room. Any appropriate test equipment to provide this information soon.
We are looking at upgrading the main switch to a Catalyst WS-C4507+E with two WS-X4712-SFP+E cards and the closets to Cisco 2960S-48TD-L switches. Assuming this is a reasonable move, my question is about choosing the appropriate SFP’s for our current and future needs.
I am aware that 62.5 micron multimode fiber is the least favorable for extended lengths, but I will not be in a position to replace it for at least a year. If I purchase 10 Gbps modules, like the SFP-10G-SR or SFP-10G-LRM, can they “throttle down”, either automatically or by setting a parameter, to communicate at slower speeds over distances that exceed their 10 Gbps maximum link lengths on multimode fiber?
I have 3 Data centres which I am linking up via Single Mode Single Strand Fibre.The switches at each data centre are WS-C4948-E
-Distance between Data Centre 1 and Data Centre 2 is 60km single mode single strand
-Distance between Data Centre 2 and Data Centre 3 is 70km single mode single strand
What type of SFP do I need to use in each Data Centre for the WS-C4948-E switches for these distances.
I have two Cisco 1200AP.
I have it configured with two SSIDs, one corporate (802.1x) one using WPA2 Personal.
I have no issues on the corporate, but I have found that Apple devices appear to detect it as a WPA2 Enterprise, and request a username and password.
If I enter the network manualy as WPA2Personal the devices joins the network ok. Then ocasionaly the device looses its link to the network and fails to pass traffic.
Building configuration...
Current configuration : 5134 bytes
!
version 12.2
no service pad
[Code]....
We are having Cisco ASA 5540 having Cisco Adaptive Security Appliance Software Version 8.0(5)23 at certain time of moment daily wer are facing latency and packetdrop wherin when I checked for ASA Interface which gives me " Input Errors" on outside interface ,so can any one tell me what are the causes to get input errors on cisco asa outisde interface.
View 2 Replies View RelatedI have Pix 501 firewall and I'm just configuring the device for "Email Server" to allowing POP/SMTP.
Inside Interface Address: 132.147.162.14/255.255.0.0
Outside Interface Address: ISP provided IP address
My question is can my traffic goes from inside interface to outside interface? (because the inside interface address not from 10.0/172./192.168 private address)Also I'm allowing internet from this email server (132.147.162.14) so what my access list to be configured? and what my subnet mask shoud be there?
Pix(config)#access-list outbound permit tcp 132.147.162.14 255.255.0.0 any eq 80
Pix(config)#access-list outbound permit udp 132.147.162.14 255.255.0.0 any eq 53
Pix(config)#access-group outbound in interface inside
I've got a ASA 5550 firewall interface failover issue. (File attached).
when I shut down the inside interface Gi 1/1 of the left firewall(Active firewall), It failed to failover. but when I shut down the Gi 1/12 of the Core 1 switch, The firewall failover very well.
I followed this guide but I was not able to failover. [URL]
how can I configure so that when the Gi 1/1 or Gi 1/0 interface goes down, it can failover ? Code...
is it possible for a client to choose a WAN to use when being routed through a Multi-WAN router? Something that could be configured as default route in linux or default gateway in winxp ?Or is this decision totally up to the router itself ? [code] Could now a client on the subnet 192.168.0.0/24 choose 1.1.1.1 as a default route for example? And if not, could this be possible if the router hat some secondary internal IPs for both WAN interfaces.
View 3 Replies View RelatedI have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?
View 1 Replies View RelatedI have an asa 5520. How would I configure my dedicated management interface to be able to route off subnet while the firewall is in transparent mode?
View 1 Replies View RelatedI am getting ready to deploy a 3945 ISR to serve as an internet and core router for and remote site. I will be terminating a site-to-site VPN tunnel on it and also configuring a zone based firewall config between my "outside" (internet link) and "inside" (all internal nets). My question is about how to approach securing the WAN interface with the Zone based FW in place?what kind of ACL do I need beyond those allowing and restricting remote access to the outside ip?
View 3 Replies View RelatedI've recently upgraded my old firewall from a PIX to an ASA5505 and have been trying to match up the configuration settings to no avail. I have is that I can't ping the new firewall on it's inside interface, despite having "icmp permit any inside" in the running config. Secondly, the server I have on there ("Sar") can't connect out to the internet.I've included the ASA's running config incase anybody can see if something stands out. I have a feeling it's either not letting anything onto the inside interface, or there is no nat going on. Lastly (and possibly relevant), the firewall is actually going at the end of a vlan, which is different to the firewall's inside vlan number. I don't know if this is actually the problem because the server can't connect out even if connected directly into the firewall.
View 32 Replies View RelatedI have been working with ASA 5510,20,40,80 but not with 5505 this vlan and its interfaces are quite confusing.Just want to know how it works and its connectivity to Cisco Switch.Do i have to put the interface of the switch in the same vlan as i am creating the interface vlan in firewall ?Now the switch port connecting to this Eth1 interface should also be in the same vlan ? i.e vlan3 ?? or it will be in trunk ? The default configuration shows the eth0 with no access vlan and interface eth1 with access vlan 2... does it mean the eth0 is in vlan1 ? (Nativ Vlan ) ???
View 4 Replies View Relatedtwo 6509 chassis with VSS configuration.One of those chassis have one FWSM installed and the configuration is like this:
Switch: firewall multiple-vlan-interfacesfirewall switch 1 module 3 vlan-group 1firewall vlan-group 1 3-5,7,8,10,200 interface Vlan200 ip address 10.50.50.1 255.255.255.252end
I am not receiving icmp replays from the fswm interfaces if i try to ping 172.20.80.1 from 10.50.50.2.I do not see any debuging info in the logsI successfully ping 10.50.50.2 from the inside networks int the cat6500, but int the network 172.20.80.0, can not ping 10.50.50.2.
I have a ASA5510 and I have a question about the speed the ports can handle, here is one port:
-interface Ethernet0/2
- speed 100
-shutdown
- no nameif
-no security-level
-no ip address
it's ethernet and not fastethernet so I figure it will only go to 10Mbps, but at the same time I can hard code the speed to 100.
I am unable to see 4th interface on my firewall i.e fastether0/3 on my firewall ASA 5510.
Below is the output.
ciscoasa# sh int ip br Interface IP-Address OK? Method Status Protocol Ethernet0/0 x.x.x.x YES CONFIG up up Ethernet0/1 x.x.x.x YES CONFIG up up Ethernet0/2 unassigned YES unset administratively down down Internal-Control0/0 127.0.1.1 YES unset up up Internal-Data0/0 unassigned YES unset up up Management0/0 192.168.1.1 YES CONFIG up up
I want to creat sub int on ASA 5505 but when I am trying below command it show error.
------------------------------------
config t
int f0/0.3400
------------------------------------
My ASA software version is 8.2(5).
Can we make sub interface on Cisco ASA 5505 model and if its possible then do that interface need to be upgraded into Trunk Port.
View 8 Replies View RelatedWe are in the process of adding second isp for webhosting purposes .Is there any issue if we are making outside 2 interface on the pix .i need to host some websites through this new link ie isp2 .
PIX Version 7.0(7)
We have a block of addresses assigned to us by our ISP. We need to assign one of these addresses to a vendor we use for traffic to one of their internal devices. Lets say the address we gave them out of that block of addresses is 1.2.3.4
How do I add that address to the outside interface so that when traffic s sent to it that the traffic actually gets to the ASA as right now when we send traffic to that address it doean't make it to the ASA.
Have an ASA 5510. Setting up a new DMZ zone for wireless and it will only have Internet access. What are the steps so that users on this new DMZ subnet can VPN into the Outside interface on the same ASA?
View 4 Replies View RelatedI am trying to figure out how to use a Cisco 1841 IOS router to take traffic from one interface and source NAT it out towards the Internet on one interface and at the same time NOT perform NAT when sending the traffic towards a different routed interface.
Here the RemoteSite has connectivity back to the MainCampus, but there is no need to NAT traffic from the one site to the other. They share the same umbrella of address space. However, the RemoteSite needs to have its Internet-bound traffic NAT'ed out to the Public Internet via a third interface. I know that I could just NAT everything out from the Remote Site and map the traffic back onto the same address space for intra-campus communication, but I'd rather avoid that and just NAT where I need to NAT it to the Internet.
I do have a caveat here: in the event that either the MainCampus or the Public Internet interfaces go down, I would like to failover traffic from the downed link to other good link. For example, I want to NAT all traffic (including "intra-campus" traffic) out via the Public Internet if the direct link to the MainCampus is down. For the other example, if the Public Internet direct link is down, I would just send out all traffic without NAT towards the MainCampus.
I have a trouble with Cisco ASA 5510. I configured an SSL VPN with bookmarks to some application. When the users make access to the Web Portal they have to login twice: one for enter in the SSL and one for enter in the application.
How to bypass double authentication?
I setup a site-to-site VPN tunnel at the remote ASA5505. I am able to asdm to the outside interface but not ssh. I switch to telnet and still not allow me to access. I added an ACL to allow telnet any to the outside interface but still not working. In ASDM I see the log Here is the second issue. When I want to change the telnet back to ssh using ASDM I got the following error.
View 2 Replies View RelatedWe have ASA FW 5010 in our organization and we have 4 DMZ's under the DMZ interface on ASA and all DMZ's are created on sub interfaces and assigned different VLANS on each DMZ's.
View 7 Replies View RelatedI am trying to upgrade a Cisco ASA over an IPSEC VPN tunnel. My FTP server is on the remote side of the VPN tunnel but I am initiating connections from the inside interface of the firewall. I am currently managing the Firewall over the VPN via it's inside interface (using the management-access inside) command. When I try and update via FTP, the connection is going straight out the outside interface (and not across the VPN tunnel) I have tried upgrading via TFTP but it keeps stopping randomly with (unspecified error) I normally upgrade via FTP though but it's not working in this instance. Essentially what I am asking, is is there an equivalent command for FTP that there is for TFTP: tftp-server interface ip anyconnect I need the connections to originate from the inside interface so they traverse the VPN. I am running 7.2.3?
View 2 Replies View RelatedI have a problem where my outside interface stops passing traffic and the only way to resolve the issue is to reload the ASA, the interface never is down it just stops passing traffic. The inside interface never stops allowing traffic to pass as I can get to all my internal servers and shared drives.
The firmware is:
asa821-k8.bin
Running Config
: Saved:ASA Version 8.2(1) !hostname f1domain-name somedomain.co.ukenable password w1Y.GBKFyC5NqO3M encryptedpasswd 2KFQnbNIdI.2KYOU
[Code].....
I attached the complete config. The earlier discussion, I cannot select reply. Looks like ACL is denying it. But I am not sure which one or how to permit it.
sh run
: Saved
:
ASA Version 8.0(4)
[Code].....
I would like to route traffic that are coming in and going out to the same interface on ASA. I am using inside interface with security-level 100. In this URL, [URL], ASA is able to do that.
View 5 Replies View Related