I have a simple setup where I have a 2911 router with three interfaces, Inside, Outside and a second "Inside" interface which is labelled as a DMZ. The Zone Firewall applied to the "DMZ" is actually Inside (until I can work through problems). I need to be able to access a device on the DMZ via its external IP so I have designed NAT to use IP Nat Enable commands. This is now working for me fine. However, since utilising IP Nat Enable, my zone firewall now denies return TCP / UDP traffic and consequently I no longer have any internet access. Looking at the syslog messages, the reason for this is that the router is denying these return flows not because they are matching the outside-to-inside policy, but rather they are matching the outside-to-SELF policy. The router seems the detect that the internet traffic is being returned to SELF, when in reality the NAT rule should pick this up and forward it to inside. I can understand why this is happening, because I am NATting all private / inside traffic behind the external IP of the router, which is assigned to the Gi0/0 interface. [code]
I have an issue where my customer is only using the ASA as their firewall. When their internal users try to connect to a partner's site using a 3rd party IPSec solution it seems as if the return NAT-T traffic is being dropped. However when looking at the traffic the udp500 communication goes through, but the 4500 traffic hits the outside interface and then gets dropped.
I used the packet tracer command and the output is set to Allow. Also after initiating the vpn connection I see two udp connections (one for 500 and the other for 4500.
I cleared the asp table drop, and didnt see to see anything, I am waiting on the running config, and the customer is running ASA 8.4.
I used the capture tool on both interfaces (inside using the client ip, outside using the interface ip, both destined to the 3rd party vpn Headend). Here are the screeshots for this.
I went ahead and color coded the ip address. Green is the pre-nat inside Red is the destination for the VPN headend, and Blue is the PAT ip going out.
Two Vlans (ID1 and 100)are on a Cat 4500, which connects to an ASA, interface DMZ. On 4500, there is default route point to the ASA DMZ interface Issue, server on vlan 100 cannot ping a server on Vlan 1, vice verse. When I enable the realtime log, it gives me a “Translation creation failed” message, please see the attached files.
We have Cisco 4500 device having GRE tunnel and next HOP is ASA is doing the IPSEC VPN over WAN.So this type of Network is called as GRE over IPSEC right? Also when i do on 4500 sh int tu0
Need to understand this shows Data transmitted over GRE tunnel which is not encrypted right? To check data transmitted by ipsec ASA which is encrypted we can do sh crypto isakmp sa right? Where we apply crypto MAP here on ASA physical interface?
How to enable the VPN-3DES-AES and another ASA Box.Mate's license (VPN-3DES-AES Enabled) is not compatible with my license (VPN-3DES-AES Disabled). Failover will be disabled.The license on secondary is not compatible for secondary ASA for the failover. [code]
my windows is no longer connecting to the internet.i I ran a diagnostic and it said to check firewall settings for the http port(80), https prt(443) and the ftp port(21). I haven't change anything in my settings and dont know why all of sudden i hvae to check firewall settings.
I am trying to enable Ftp traffic through our firewall at work. We have a Cisco 5505 ASA and we cannot access any Ftp servers outside our network. We are running 8.3(2). Any have commands I can run to allow us to connect to ftp sites?
I have a pair of brand new 5520s I am in the middle of commission. After carving out all the DMZs etc I needed I realized that I really neede another physical NIC, not just another VLAN off a configured nic. [code]I am running 8.3(2). How can I turn these "Not used" interfaces into useable ones?
I'm replacing a new ASA 5505 due to a corrupted flash. On the original unit, I had the ability to SSH into the device using TeraTerm with no problems. While configuring the new device, I entered commands to enable SSH into the unit.
We would like to enable our HelpDesk and Network team the ability to connect to Laptops using our ASA 5510 VPN device using Secure VNC application. Not sure if this is possible or how to enable this option.
We recently purchases the Cisco ASA 5505 to get familiar with it, possibly buying more appliances for our branch offices. However, since the appliance is installed, our SIP telephones no longer register with our SIP service provider.
The SIP phones are all on 10.0.1.0/24 while the SIP provider is external via the outside network. I copied our configuration below. how to enable SIP for all 10.0.1.0/24 hosts and ports 5060, 5160, 5260, 5360?
gcxfw# show running-config : Saved : ASA Version 8.4(3)
I am trying to enable access to use RealVNC on our Cisco ASA 5505 without using VPN. RealVNC uses port 5900. Users should be able to vnc to 126.96.36.199 and reach our internal server 192.168.1.4. So far they are receiving connection refused.
I see netmask as an option, but the ASA states "invalid option netmask." The ASA is running 8.2(2). OKC-PIX(config)# static (inside,outside) 192.168.99.0 access-l OKC2DAL ?
configure mode commands/options:
<0-65535> The maximum number of simultaneous tcp connections the local IP hosts are to allow, default is 0 which means unlimited connections. Idle connections are closed after the time specified by the timeout conn command
I have a problem with an ASA5510 (8.0.4) firewall in South Africa (I'm in the UK).It's a replacement firewall that I am trying to configure remotely through a serial device with an internet facing connection, but the enable password is not working.I can connect to the device OK, type 'en' and when propted for the password whatever I use (blank, cisco, Cisco etc.) I get an 'invalid password' message.
I have configured dhcpd in an ASA 5505 and every thing is working. I am testing it to give me a warning when the address pool is about to be finished or it is empty. But don't konw how to do it. if I run the "debug dhcpd packet", i get that the address pool is empty.
We are runing PIX 535 with software version 8.02. In ASDM, I see anti-spoofing is diable in all interfaces. If I enable it, is there any negative effect? Can I enable it in DMZ, inside, and outside interfaces?
I am currently troubleshooting a firewall policy on a ASA 5505. What command can enter in the CLI to enable live view of traffic been block and which traffic is been allow?In my experiences with other firewall vendors, other firewalls allow me to narrow down the source and destination, too. is there such thing on the ASA 5505?
I have ASA5505 as my main router (192.168.15.1) and it currently it also serves as DHCP server. I have a WNDR3700 (192.168.15.2) which work as an access point and it provide wireless access for wireless devices. I have few dhcp clients where i can't setup static IP, and i want to restrict them to use static IP through MAC reservation.
1. Make ASA5505 to do the MAC reservation f, which will be easy setup for me. But as per my search its not possible.
2. Disable dhcp on ASA and enable dhcp on my WNDR3700. i tired this and dhcp clients are getting IP from wndr3700, but the problem is dhcp clients gateway defaults to 192.168.15.2 (as well as dns) and therefore no internet connection.
How can i enable Netflow for each Vlan Or interface indvidually in Cisco ASA? currently i have setup Netflow and only 2 interfaces are shwoing traffic for Netflow which are not even as my physical or Vlan interfaces . (see screen shot )
EscapeASA# sh interface ip brief Interface IP-Address OK? Method Status Protocol Internal-Data0/0 unassigned YES unset up up
Today I upgraded my Cisco ASA 5505 ASDM from version 6.34 to 6.41 cause of some problems on old version with NetFlow. But now when I switch to dashboard i can not see "Top Usage" tab. That was quite usefull for me. It simply disappeared.
Can i somehow configure which tabs are displayed on dashboard ? I really need that one and I do not want to downgrade :/
i'' ve one appliance ASA 5510, v8.X and asdm 6X here u have my configuration :
interface Ethernet0/0 description Link To WAN nameif outside security-level 0 ip address 188.8.131.52 255.255.255.252!interface Ethernet0/1 description Link to LAN(forefront) nameif inside security-level 100 ip address 10.20.80.1 255.255.255.252!interface Ethernet0/2 description Link to CoreSW (DMZ) nameif DMZ security-level 50 ip address 10.70.70.254 255.255.255.0
i have on server ssh (10.70.70.10) on my DMZ .
I wan to enable my external user, i mean outside user to be able to access to this server which is in my DMZ for this port ( ssh)
I have a IOS firewall on a 2921 router, zone-based config. The remote and main sites have Cisco WAAS , running 4.4.1 software. I am using WCCP redirection on the WAAS/router combination. If I leave it off the firewall passes SSH correctly to the devices on the other side of the firewall. If I enable WCCP the SSH connections fail. The SSH to the router itself is fine, I am not using the self zone for router protection. I had seen a few posts on WAAS but the only one mentioning a config statement in the firewall was on 4.0 WAAS and the command is no longer on the IOS firewall. Is this supposed to work transparently or am I missing a config?