Cisco Firewall :: 2911 - NAT Any Source Address From Internet

Mar 21, 2011

I'm using a 2911 as our Public Internet Edge Router. I have 2 public sub net blocks from Sprint, we are in the process of migrating. What i need to do is NAT any source address from the Internet from an address on one of our public blocks to the other.
 
Example:
 
Source Address 11.10.10.10 ==> Destination 64.165.123.10 (nat this to 64.165.54.10) inbound.
 
So if from the internet tries to hit 64.165.123.10 we want to nat that to 64.165.54.10 both of which sit on our public space.

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 8.4.3 - Does It Check DNS Source IP Address

Oct 29, 2012

Does ASA 8.4.3 check the source IP address of  a DNS reply and drop it if the reply address is different to that in the query?
 
Customers DNS server does this due to a recent change, their server now has a virtual address, but replies are sent from its physcial address. This is temporary. Their PIX is happy with this.
 
Replace the PIX with the ASA, DNS fails, the only reason I can see is due to the way their internal DNS operates.

View 1 Replies View Related

Cisco Firewall :: ASA 8.4 With NAT Source Address Translation?

Dec 5, 2012

I have a server in a DMZ of my 8.4 ASA with nat:
 
object network FTP-SERVER
host 192.168.1.102
nat (dmz,outside) static interface tcp ftp ftp
 
And that's working well. However, I now need to translate the source address of connections from the outside to the FTP server as well. The aim is that the source address of packets when they reach the FTP server is an address on the DMZ subnet (as the default route for the FTP server now needs to be something else, not the ASA) as well as this outside-dmz NAT. I thought overloading the DMZ interface of the ASA? Or another IP in that range?

View 2 Replies View Related

Cisco Firewall :: 5512 - NAT Random Source Address

Jul 4, 2012

I have a problem with random host's geting the wrong source address on a ASA 5512-X  8.6(1). Right now there is a host, 192.168.25.108, showing up with 6.6.6.6 (fake) on whatsmyip.org, should be 5.5.5.5 like the rest of 192.168.25.0/24. In the xlate tabel  I cant find anything wrong. Same yesterday with two host, that are using the right NAT address today.
 
nat (any,outside) dynamic interface.     (5.5.5.5)
object network H-192.168.25.10
nat (inside,outside) static H-6.6.6.6X(code)

View 1 Replies View Related

Cisco Firewall :: ASA5580 One Inside Source Address Static Nat To Two Outside Interface

May 10, 2012

customer has a server which located in inside interace.    and an outside interface connected to ISPA.    cu config a static nat map inside server address to ISPA address, one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.

View 3 Replies View Related

Cisco Firewall :: ASA5580 / One Inside Source Address Static Nat To Two Outside Interface?

Jul 13, 2011

i have a problem  customer has a server which located in inside interace.  and an outside interface connected to ISPA.  cu config a static nat map inside server address to ISPA address one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address.    the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580.  i want use route-map on static nat, but it will not satisfy customer's request.

View 6 Replies View Related

Cisco WAN :: 2911 - IP Nat Inside Source Static

May 6, 2012

I need to open a port in a Cisco 2911 router to permit the conexion to an equipment that is inside the LAN, but I my configuration doesn't workt.
I have 3 interfaces configured: two WAN interfaces (one is a backup of the other) and a LAN interface. The configuration is this (public IPs are changed):
 
track 1 ip sla 1 reachability
!
!
interface GigabitEthernet0/0
description backup
ip address 176.55.25.25 255.255.255.252
ip nat outside(code )

View 16 Replies View Related

Cisco Application :: ACE 4710 Source Ip Address In Logging

Mar 21, 2013

I've configured the ACE4710 to bring the logging to a syslog server! Here's the configuration

[...]
logging enable
logging fastpath

[Code]....
 
I saw to log with connection on the syslog server but It would be interesting to know the "source ip address" and my question is : It may be possible to configure for the logging a kind of "transparent pass through"?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 / TACACS Proxy - No Source NAS IP Address

Aug 1, 2012

i would like to use the ACS 5.3 as TACACS Proxy. Basically it works. But when checking the logs on the destination TACACS Server (ACS 4.2) i see that all requests (Source-NAs) came from the IP of the TACACS-Proxy. Not from the original source IP.
 
This is useless for my scenario, because on the destination TACACS Server the policies are built on the NetworkDevices Groups and AAA Clients = source IPs.

View 2 Replies View Related

Cisco WAN :: NAT Rewrite Source Address 800 Series Router

Aug 23, 2011

I'm stuck with some NAT issues. I've got an 800-series router wich connects to the internet via a PPP connection (dialer0). On the inside the router has 192.168.0.253/24 as IP address, the outside is negotiated with the ISP
 
My mailserver has the ip address of 192.168.0.1 but with default gateway of 192.168.0.254 (primary internet connection). If I use plain NAT (ip nat inside source static tcp 192.168.0.1 25 interface Dialer0 80) the packets arriving on the mailserver do have a public  IP address as source address.

Would it be possible to rewrite those packets (source address) so they have 192.168.0.253 as source address. This way the mailserver won't send the replies to it's default gateway but back to the cisco router.

View 8 Replies View Related

Cisco Infrastructure :: 5513 - Invalid Traffic From Multicast Source Address

Feb 8, 2006

One of our Cat5513 has been displaying a lot of the error message below:
 
%SYS-4-P2_WARN: 8/Invalid traffic from multicast source address 01:00:5a:52:4c:4d on port 8/58
 
The frequency of this is quite disturbing. What this error is about? Module no.8 is our Gigabit Ethernet WS-X5410. Can that multicast address be mapped to an IP address or unicast mac-addresS? How can i go about resolving this?

View 5 Replies View Related

Cisco Switching/Routing :: 4500 / Packet Received With Invalid Source MAC Address

Sep 3, 2012

Most of the 4500 Switches in our network are giving the similar error for so many ports
 
%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on p  t Gi2/6 in vlan 100
 
Its impossible to do a wireshark packet tracing for all the ports. 

View 2 Replies View Related

Cisco Switching/Routing :: 4507 - Packet Received With Invalid Source MAC Address

Feb 14, 2012

Issue I am having with a Cisco 4507? Below is the error i am receiving.
  
Feb 14 10:06:09 EST: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 508 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Po10 in vlan 112
Feb 14 18:44:06 EST: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 119 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Po10 in vlan 112
Feb 15 00:51:06 EST: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 366 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Po10 in vlan 112

[Code]...

View 9 Replies View Related

Cisco Switching/Routing :: Unicast Flood On 3750 - How To Determine Source MAC Address

Feb 27, 2013

There is a unicast flood on 3750 killing slow modem links. How to determine source MAC address of flooder? Is there a rate limit feature for it?
 
I know how to block it completely on port-level, but it breaks normal network operation. (when port goes down for some reason, it's learned MACs got flushed and since other hosts know MACs, they keep flooding untill their arp caches expire).

View 11 Replies View Related

Cisco Application :: 4710 ACE Source-address Matching In Nested Class-maps Not Working

Sep 6, 2012

Im having a (from google-fu) seemingly unique issue with load balancing. So for background, I am running the ACE 4710 device in "on a stick" mode, so I am using NAT and all that good stuff. I am also utilizing class maps and host header matching so I can save on IP space. [code]

Basically, as soon as I add that ACL_CLASS_beta.mainsite.com class map, all I get back from the ACE is RST packets and it comes back with an L7 LB Policy Miss.
 
It SEEMS like it should work, but it doesnt seem to like matching on those source addresses at all.

View 1 Replies View Related

Cisco WAN :: 2911 Can't Ping WAN Direct Ip Address After A While

Jan 31, 2013

After I changed customer router to CISCO 2911 from H3C firewall, the WAN interface can not ping its gateway after about 10 minites, I do not know why. it works well before I change the device. [code]

View 10 Replies View Related

Cisco Firewall :: How To Translate Both Source And Destination In ASA 8.2

Apr 16, 2012

I have a internal subnet 192.168.3.0/24 sitting behind an ASA firewal 8.2 and would behind accessing to web server 192.168.11.54 which sits behind the outside interface of the ASA firewall.The access would be like this:
 
1) 192.168.3.0/24 will be accesing to the web server http://192.168.11.54
2) We would like to translate the source 192.168.3.0/24 to the firewall outside IP address
3) We would like to translate the destination web server 192.168.11.54 to 202.90.197.146 as well

How to perform this simultaneous source and destnation address translation in ASA firewall 8.2? Could this be done in ASA firewall 8.2?

View 1 Replies View Related

Cisco Firewall :: Source-PAT Outside Traffic Through PIX525?

Feb 22, 2013

I have been tasked with building a vpn tunnel with a partner company between our company's PIX firewall and the other company's ASA's firewall.  The traffic flow will be Partner A company users will be accessing my company's Citrix server.  I want to source-pat the partner company user traffic to my company's PIX inside interface as it enters my LAN to access my company's Citrix server.  The partner company will be PAT'ing their user traffic to a single ip address - let's say for discussion purpose it is 68.108.244.25.  So there will be site-to-site vpn configuration and nat configuration required to be performed to enable this traffic flow according to the above requirements.  I am comfortable with the site-to-site vpn configuration tunnel so I don't think it is necessary to post this portion of the configuration to be reviewed by this form.  What I do need is NAT portion of the configuration.
 
{My Company's Citrix Server} ---------<inside ifc>-[PIX525]-<outside ifc>--------(internet)------{Partner Company A host PC's}          
   10.100.12.103                                                                                          68.108.244.25
 
My proposed configuration to enable nat'ing (or pat'ing) Partner A user traffic to my PIX firewall's inside interface is the following:
 
global (inside) 9 interface
nat (outside) 9 access-list PartnerA_source_nat
 
access-list extended PartnerA_source_nat permit host 68.108.244.25 host 10.100.12.103

View 3 Replies View Related

Cisco VPN :: 2911 / Port Address Translation For Remote Network?

Aug 4, 2012

I have site to site vpn between cisco asa and cisco 2911 router.asa is static ip and cisco 2911 side is dynamic ip. my site to site vpn is working fine. I am just trying to make PAT over the vpn means i want forward one ip in my public pool to one of my local ip in the cisco 2911 side.

View 2 Replies View Related

Cisco Firewall :: ASA 5550 - Source IP Connection Limits?

Jul 1, 2012

I am running a Cisco ASA 5550 in active/standby mode.  We are currently running ASA OS v8.2(3)5.  I am wondering if there is a way I could limit source IP concurrent connections coming in my outside interface.  Does the ASA have a feature/ACL syntax that supports this?

View 2 Replies View Related

Cisco Firewall :: Log Shows Wrong Source / Destination ASA 8.3

May 25, 2011

The Cisco ASDM or the event manager show wrong source/destination for teardown tcp messages:In this example the communication is an ssh session;from 1.1.1.1 -> 2.2.2.2 ssh and the connection is reseted by 2.2.2.2
 
The message build outbound is correct, i.e. source is 1.1.1.1 (message id is 302013)
 
But the teardown is incorrect, i.e. source for the connection is 2.2.2.2 which is definitely not true (message id is 302014)
 
Also there seems to be a documentation bug in syslog messages for ASA 8.4 since the message for the teardown 302014 is gone!

View 3 Replies View Related

Cisco Switching/Routing :: Router 2911 Blocking Single IP Address

Jan 29, 2013

We have a Cisco 2911 router in our company. I didn't set it up myself nor I was involved. I only started working here recently, bit over 3 months ago. I have been given ongoing task which other IT Technicians been struggling for almost a year with a idea that maybe because I'm fresh person in the company I will find a original idea why could this thing not work.
 
Our router have a problem with blocking a single IP address, but not completely  It's hard to explain but I will try my best. Company is hosting their website externally and accessing the host and FTP on the host on daily bases. It is important for the website to work on the internal network in company. It does work sometimes, but from time-to-time the website showing time-out error 118 on any point before Cisco router using both http and https, have tried putting just the IP address( doesn't matter is it on the general network or last ISA server on DMZ ). I am able to connect to the website using any of proxy gates but not directly to the website. I have also tested the connection past the router and I was able to connect to the website without any problems. I am also able to ping the host's address from the router and internal network.

I have eliminated the possibility of not correctly setup proxy or firewall on the network as problem also occur on the DMZ. I have also checked access-lists on the router and firewall rules for Any possibilities and I can't really see a way why would the router do this.

View 2 Replies View Related

Cisco Firewall :: NAT Source And Destination Addresses On ASA5520 Running 7.2(5)?

Apr 22, 2013

Is it possible to NAT source & destination addresses (twice nat) on an ASA5520 running 7.2(5)?

View 4 Replies View Related

Cisco Firewall :: ASA Version 7.22 Email Logging Source Interface?

Jan 10, 2012

I've got email logging for a few specific syslog messages working and sending to an email server on the inside network.  However, the source IP ends up being the DMZ interface.  Is there a way to force it to use the inside IP instead?
 
ASA Code Version 7.22
 Inside Interface IP:  10.104.36.4  Mask:255.255.255.0
DMZ IP: 10.100.20.1  Mask:255.255.255.0
SMTP Server IP: 10.100.10.100 
 
Logging commands in config:

logging enable
logging list email-alerts message 106100
logging mail email-alerts
logging from-address ASA@xyz.com
logging recipient-address tgw@xyz.com level debugging

View 3 Replies View Related

Cisco Firewall :: Source Routing Work Around Needed With ASA5515

Jun 10, 2013

I am setting up an ASA5515 to replace an existing Linux based firewall. Unfortunately the ASA5515 does not support source based routing.I have two internet connections currently used for specific connections - the second connection is NOT a failover connection.I have the default route to Internet connection 1.I want to route smtp out the second Internet connection.The routers connecting to the internet are a 877 and an 878The options I am considering is a layer 3 switch between the firewall and the routers to enable source based routing or replacing the 2 routers with a single router and the appropriate wic interfaces.

View 2 Replies View Related

Cisco Switching/Routing :: Telnet Can't Login 2911 Router With Private Address

Jan 7, 2013

We have a cisco 2911 router configured with password for telnet login, but I always failed to login use telnet, does any one know any place need to be modify?

View 6 Replies View Related

Cisco Firewall :: 5510 NAT Port Forward Based On Public Source IP?

Dec 27, 2011

I have one public IP address but multiple local servers that run on the same port. I cannot change the port the clients use to connect to this server, so I can't do a port map in my NAT router. The solution I had in mind, is to filter on source address. If a client from public IP X.X.X.X connects to port Z, I want it to go to internal server 10.10.10.10 and if a client from public IP Y.Y.Y.Y connects to port Z, I want it to go to internal server 10.20.20.20. Is this possible? I'm using an ASA5510 but I could also switch to a 5505 for this.

View 3 Replies View Related

Cisco Firewall :: ASA5510-BUN-K9 / Find Out Rate-limit Drop Source Ip?

Nov 22, 2011

I have two ASA5510-BUN-K9 Fws and I am planning to buy 2 x L-ASA5510-SEC-PL= to put them in HA.I was wondering if the support contract that I curently have for the two ASAs is still valid or do I have to buy any support upgrade?

View 1 Replies View Related

Cisco VPN :: ASA 5505 - Remote Firewall Does Not Receive Single Packet From Source IP

Jun 3, 2012

I have setup an asa 5505 with multiple sub nets (plus license) and a vpn tunnel (ipsec) between this and an other asa on a second branch office (multiple vlans) . Now I need to route only two vlans from the first site to reach some of the second branch networks
 
let's call them: 1 branch
A-172.16.4.0/24
B-172.16.2.0/24
 
2 branch 
C- 10.10.10.0/24
D- 10.20.10.0/24
E- 10.66.10.0/24
 
the tunnelis ok From A to CDE . but from B to CDE won't come up. pinging is unsuccessful as well as all other traffic. the connection profile is setup to have both A and B as local networks and A and B by the moment share the same access rules configuration.
 
logs show firewall 1 let pass and build connections, without denies, but remote firewall does not receive a single packet from the source ip from network B.

View 2 Replies View Related

Building Open Source Firewall In Linux Environment From Scratch?

Jul 10, 2011

I have decided build an open source firewall in linux environment. I have exactly one year to complete this project. The firewall will be a stateful packet filtering firewall working at network, transport and application layers. I would also be provided log analysis features. What I want to know is whether this is a good enough project or put in other words, is it a worthwhile project to undertake?

View 13 Replies View Related

Cisco Firewall :: 2911 Router Zone Firewall And IP NAT Enable

Mar 20, 2013

I have a simple setup where I have a 2911 router with three interfaces, Inside, Outside and a second "Inside" interface which is labelled as a DMZ. The Zone Firewall applied to the "DMZ" is actually Inside (until I can work through problems). I need to be able to access a device on the DMZ via its external IP so I have designed NAT to use IP Nat Enable commands. This is now working for me fine. However, since utilising IP Nat Enable, my zone firewall now denies return TCP / UDP traffic and consequently I no longer have any internet access. Looking at the syslog messages, the reason for this is that the router is denying these return flows not because they are matching the outside-to-inside policy, but rather they are matching the outside-to-SELF policy. The router seems the detect that the internet traffic is being returned to SELF, when in reality the NAT rule should pick this up and forward it to inside. I can understand why this is happening, because I am NATting all private / inside traffic behind the external IP of the router, which is assigned to the Gi0/0 interface. [code]

View 1 Replies View Related

Cisco Firewall :: 5520 - Inside Server To See Actual Outside Host Source IP In Udp Packet

Mar 3, 2013

I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server.   The server can get to outside hosts OK, and the traffic is being NATed  properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send  'announcement' UDP packets to the inside server.  I thought this might be an  outside-NAT-required issue to get the traffic routed, but I need the inside server to see the  actual outside host source IP in the UDP packet, so I basically set the  outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the  destination (inside server) subnet, and its gateway is the outside  interface of the ASA, the same way the inside server is able to get to  hosts outside.  The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
 
I have the appropriate ACL's set up, and when I do 'show access-list' I  see policy hits for the 'permit' statements where the outside host is  generating the announcement and it's hitting the ACL.  I even duplicated  the ACL into list 101 and 102, and applied 101 for inbound traffic on  the outside int, and applied 102 for outbound traffic on the inside int,  and I'm seeing policy hits on both permit statements outside and  inside, so it looks like the traffic is being passed on to the inside  interface and permitted, but the server isn't seeing the packets.
 
I can ping the outside interface from the outside, but cannot ping the  inside interface or any inside hosts from the outside, even though I  have 'permit icmp any any' enabled on the ACL on both ints. When I  remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
 
I set up the same scenario in my lab with an ASA 5505, with the same results.  Below is the running config from the 5505 in the lab.  The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
 
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
description Inside LAN Interface
nameif inside(code)

View 6 Replies View Related

Cisco Firewall :: 2911 Difference Between The Firewall Areas

Oct 4, 2011

I recently inherited a Cisco 2911, that appears to have had Firewall rules imported into Externally Defined Rules. ACL's are currently allowing/disallowing traffic. However, there are no firewall rules configured. To meet compliance we need to have Packet Lavel Inspection (Firewalled) rules. There are two areas in the router, under ACL area, and under Security. What is the difference between these two Firewall areas?Are both areas providing packet level inspection?Can I build Firewall rules (within the Security area) to replace the ACL's?

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved