Cisco Firewall :: 5505 Remote VPN Clients Cannot Access Inside LAN

Apr 15, 2012

I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable. [code]

View 1 Replies


ADVERTISEMENT

Cisco Switching/Routing :: ASA 5505 - Exchange Remote Clients Cannot Access

Sep 6, 2012

Just installed ASA -5505 replaced cisco 851
 
My exchange server hosts remote outlook clients and remote web access
 
no one on the remote side can access my exchange server
 
internal mail flows in bound and out bound.
 
My iphone can not access the exchange server either.
 
When the Cisco 851 was online all the above worked great. Nothing changed on the remote client side just put the ASA 5505 in service.
 
I am new to the ASSA 5505 family. Had a reseller configure the router but unable to get them at this hour. Called Cisco support but they are closed at this time also.

View 5 Replies View Related

Cisco Firewall :: ASA 5550 / Basic NAT From Outside Remote-access IPSec VPN To Inside?

Mar 16, 2012

I cannot get this to work properly and I've even had a Cisco engineer from TAC set-this up... and it literally broke my inside network.  I have a VPN range of addresses..x.x.x.x on the Outside that needs access to a server on the Inside at y.y.y.y.  HTTPS/443 connectivity.  I need to NAT my VPN subnet/pool in order to talk to the inside host, as that host will not accept traffic from my VPN subnet, but obviously, will accept traffic from Inside my private network.
 
The Cisco tech entered the following static NAT statement to "fix" the problem - nat (outside,inside) source static VPN Inside-Network destination static Host-y.y.y.y Host-y.y.y.y For whatever reason, whenever this is configured on my ASA 5550 v8.3(2)25 the Inside interface starts proxy arping and assigns all IP addresses on my private network with the MAC address of the Inside interface. 
 
The y.y.y.y is on a remote, routed network within my private, corporate MPLS network.  My Inside private network (Inside-network shown in the static NAT above) is x.x.x.x.  Not sure why this happens, but it kills my entire network and I have to jump through hoops to quiesce the network and get everything back to normal.I've tried to Dynamic-PAT/hide the VPN range behind the Inside interface through ASDM and that seems to do nothing.The NAT statement above will break my network. How to NAT this connection without killing my Inside network?  Or, on how to properly hide my VPN subnet/pool behind my Inside interface and back to the VPN subnet/pool.

View 1 Replies View Related

Cisco Firewall :: HTTPs Access From DMZ To Inside On ASA 5505

Jan 5, 2012

We have an ASA5505 UL bundel, updated with this license "L-ASA5505-SEC-PL=" to enable traffic from DMZ to Inside. No NAT or rules deployed for that yet.

On the Inside we have Exchange 2007 in a single server installation. The public url for smtp, ActiveSync, OWA and Outlook Anywhere is mail.company.se. There is a static NAT for outside traffic to access above mentioned services on inside. Now, on DMZ there is the WLAN for guests to access the Internet. How ever, our Smart Phones with WLAN turned on, cannot sync to the Exchange Server on the Inside! The DMZ gets IP-addressen from ASA on DMZ Interface with external DNS configured. How can I configure the ASA to achieve the function of ActiveSync from DMZ to Inside with the public URL from the phones?

View 15 Replies View Related

Cisco Firewall :: Access And Ping Inside Interface Of ASA5505 From Remote Network?

Sep 13, 2012

I am trying to access and ping the inside interface of a ASA5505 from a remote network.  From the remote network, I am able to access anything on the local network, but the ASA5505 inside interface.The 2 networks linked by a fiber link which have a transport network on another interface.  From the remote network, I am able to ping the transport network interface IP, but I would like to be able to ping the inside interface IP.  When I do a packet tracer, I get a deny from an implicit rule.How can I achieve that?
 
Here are the subnets involved and the ASA5505 config.
 
Remote network : 10.10.2.0/24
Local network : 10.10.1.0/24
Transport network : 10.10.99.0/24

[code]....

View 1 Replies View Related

Cisco Firewall :: Cannot Access To DMZ From Vpn Clients ASA 5505 V 9.1(1)

Dec 31, 2012

ASA Version 9.1(1)
!
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6

[Code]....

View 9 Replies View Related

Cisco Firewall :: ASA 5505 / Cannot Access Internet Or Ping From Inside Interface?

Jul 26, 2011

I am having a problem configuring my ASA 5505 for NAT.

View 3 Replies View Related

Cisco Firewall :: Setup ASA 5505 Access Or NAT Rules To Inside Server / IP Cam

Oct 25, 2012

I'm having trouble setting up the correct rules on an ASA 5505 I'm using in my home office.  I have a couple of IP Cams I need to access remotely.
 
I've tried setting up simple NAT(PAT) and/or Access Rules, but it hasn't worked.  I have a single dynamic IP for the Outside interface.  Call it 77.76.88.10 and I am using PAT.  The CAM is setup to connect on port 80, but could be configured if necessary.  I've tried setting up NAT Rules using ASDM as follows:
 
Match Criteria: Original Packet
Source Intf = outside
Dest Intf = inside

[Code]....

I'm afraid to use CLI only because I am not confident I'll know how to remove changes if I make a mistake.

View 9 Replies View Related

Cisco Firewall :: ASA 5505 Anyconnect Clients Cannot Access Slingbox

Mar 27, 2012

I'm trying to configure an ASA 5505 to view my Slingbox from my iPhone/iPad from an outside or 3G network.  I can't ping my internal networks while connected via AnyConnect.  I know that I need to free up port 5001, but I can't seem to get it to work. 

View 0 Replies View Related

Cisco Firewall :: Remote Management Access Through VPN On ASA 5505

May 21, 2012

I have a remote ASA5505 running 8.4(3) with a working site 2 site VPN tunnel to my main office. (The main office is running an ASA 5510 with OS 8.4.3 as well). The encryption domain is all private IP on main site vs. 172.16.10.0/23 on remote site.
 
Relevant config of the remote ASA:
 
interface Vlan1
nameif inside
security-level 100

[Code].....
 
I can manage the ASA on the outside interface (outside of the site 2 site VPN) using the TACACS credentials I can also ping my management station from the ASA using the inside interface, but as stated, the other way around does not work. I have not yet tested if management from the local 172.16.10.0/23 subnet works, but I will try this next.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Remote Access To ASDM?

Jan 5, 2012

How do I enable remote access to ASDM from outside of the network on the ASA 5505?  This would be used for remote access to the firewall at a site that is not utilizing VPN.

View 5 Replies View Related

Cisco Firewall :: ASA5510 DNS For Inside Clients?

Aug 3, 2012

We got an ASA5510 (8.2x) with an inside, guest and outside interface.On the guest interface, we have DHCP function on the ASA.On the outside, there is web-ssl vpn (dns hostname on a public isp-dns server) configured.
 
When an user on the guest net tries to get connected with the web-ssl dns-name, it resolves the public, outside interface-ip , the ASA dropps it.
I know, with static NAT it can be resolved url...but on this scenario, we are trying to build a connection from a guest inside IP to the public-ip form the outside ASA interface.If the guest users try an web-ssl connection on the guest-ASA IP, it works with a certificate error ( because there is no internal DNS on the guest net to resolve the dns name to the guest-interface IP).
 
So how can this be achieved? Can the ASA provide DNS server function? Can a NAT static entry (outside ip to interface guest) solve it? It's the only solution an inhouse DNS server in the guest-net?

View 2 Replies View Related

Cisco VPN :: Allow Remote Access To Windows Server Through ASA (5505) Firewall

Jul 13, 2011

I would like to allow remote access to a windows server through a ASA  (5505) firewall. Users will use the vpn connection in order to connect to a private network. Is there any link  that describes the steps for ASDM?

View 3 Replies View Related

Cisco Firewall :: ASA 8.3(2) 5505 / Remote Access Vpn Default Gateway?

Jun 28, 2011

ASA 8.3(2) 5505
 
I've configured a number of remote access vpns on ASAs, but I don't recall having a default gateway setting assigned after logging in.
 
Is there a way to disable the assignment of a default gateway upon login?
 
The value assigned is meaningless. It's just the next available address in the local pool. 

View 2 Replies View Related

Cisco Firewall :: 5505 / How To Give Access To Remote Subnet

Mar 23, 2011

I want to give access to remote subnet on firewall 5505.

Remote subnet is 16x.15X.56.0

Here is my access list

access-list outside_5_cryptomap extended permit ip 192.168.12.0 255.255.254.0 16x.15X.56.0 255.255.254.0

View 7 Replies View Related

Cisco Firewall :: Design Remote Access VPN With IPS Module On ASA 5505

Aug 13, 2011

I am proposing Remote access VPN solution to my client as per the attached diagram. However they are required IPS solution as well.
 
So in this case i dont think i can implement the IPS with outside interface in inline mode because of the encrypted traffic. Is it feasible if i enable IPS with inside interfce ?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 - Limit Access To Remote Desktop To Range Of Outside IPs

Jan 7, 2013

After getting hacked I want to limit terminal server/ remote desktop to only my computer. (although I may need to let other net in later)
 
In other words I want only computers from my home ip range (lets say my ISP gives me at  home something in  28.28.XX.0)  to be let in to the router at work and then to port 3389. 
 
In the work ASA 5505 softwareVersion  7.2(4)    I now have:
  
access-list outside_in extended permit tcp any interface outside eq 3389
 
static (inside, outside) tcp interface 3389 192.168.1.2 3389 netmask 255.255.255.255
 
acces-group outside_in in interface outside

View 3 Replies View Related

Cisco Firewall :: Unable To Access Remote Network After Connecting ASA 5510 And 5505

Sep 24, 2011

I am using two firewalls to connect two different offices. Firewall 5510 is running ASDM 6.3 and 5505 is running ASDM 6.2, Problem is that even after connecting two sites, i am unable to ping remote network from either side. I am mentioned static route as tunneled.

View 1 Replies View Related

Cisco Firewall :: Pix 515E Cannot Ping Or Assign DHCP Addresses To Inside Clients

May 6, 2011

I have a PIX 515E that I want to use to as a border between my internet connection and my Cisco AIR1131AG.  I have configured the PIX to have the outside interface as a dhcp client which gets its dynamic IP address from the cable modem. the AP is connected to the E1 inside interface. Now I could see the E1 interface from the arp table from the AP but I cannot ping it. From the firewall I don't see the ARP  table  from the firewall. and i cannot ping the AP. what is wrong with the configuration? side note, i am able to connect to the AIR1131AG from my laptop I was not able to retrieve an IP address. 
 
FW1 - CONFIGURATION
 
interface Ethernet0 description uplink towards the techsavvy modem speed 100 nameif outside security-level 0 ip address dhcp setroute !interface Ethernet1 description >>> WIFI LAN ACCESS <<< nameif inside security-level 100 ip address 10.0.0.1 255.255.255.0

[Code].....

View 3 Replies View Related

Cisco VPN :: ASA5505 Access Remote Devices From Inside LAN

Jan 23, 2013

I have the following config below on my ASA5505, where I want to be able to access remote computers who are VPN'd into the inside network, for support purposes.I want to be able to ping the VPN ip from the LAN, and be able to connect to these computers via the VPN ip. [code]

View 4 Replies View Related

Cisco WAN :: 5510 - Remote Vpn Cannot Access Inside User

Oct 20, 2011

ip local pool VPNPOOL 192.168.200.1-192.168.200.100.
 
i can access servers with remote vpn which they located at dmz zone at asa(write nonat access-lsit) but i can not 192.168.193.0 subnet at asa.i configurated proxy server. my proxy server inside interface get ip address my dmz zone(172.16.10.254) and outside is ip adddress asa outside interface (10.0.0.254).the users (192.168.193.0/24) go internet from proxy server.
 
[code]....

View 4 Replies View Related

Cisco Firewall :: Failover ASA 5505 - Setup Second Inside Interface On Firewall?

Feb 19, 2012

I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 - Can't Reach FTP Site While Inside Firewall?

Feb 26, 2011

I am trying to configure our ASA 5505 so that our users can access our ftp site using [URL] while inside the firewall. Our ftp site is setup so that you can reach it by either browsing to the above url or by browsing to ftp://99.23.119.78 but we are unable to access our ftp site from either route while inside the firewall. We can access our ftp site using the internal ip address of 192.168.1.3.
 
Here is our current confguration:
 
Result of the command: "show running-config"
: Saved:ASA Version 8.2(1) !hostname ciscoasaenable password qVQaNBP31RadYDLM encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0 !interface Vlan2nameif ATTsecurity-level 0pppoe client vpdn group ATTip address pppoe setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!ftp mode passiveobject-group service DM_INLINE_TCP_1 tcpport-object eq ftpport-object eq ftp-dataport-object eq wwwaccess-list ATT_access_in extended permit tcp any host 99.23.119.78 object-group DM_INLINE_TCP_1 access-list ATT_access_in extended permit tcp any interface ATT eq ftp access-list ATT_access_in extended permit tcp any interface ATT eq ftp-data access-list ATT_access_in extended permit tcp any interface ATT eq www access-list 100 extended permit tcp any interface ATT eq ftp

[code]....

View 6 Replies View Related

Cisco VPN :: ASA5510 Remote Access / LAN Not Accessible Inside Network

Jan 6, 2013

I am facing a problem with Cisco ASA remote access VPN, the remote client is connected to VPN and receiving IP address but the client is not able to ping or telnet any internal network.I have attached running configuration for your reference.
 
-FW : ASA5510

-Version : 8.0
 
Site to Site VPN is working without any issues

View 10 Replies View Related

Cisco VPN :: 891 - Clients Cannot Access Remote Site

Dec 12, 2012

I have 2 site here:
 
site A
 
Cisco 891
external IP: 195.xxx.yyy.zzz
VPN Gateway for Remote users

[Code]....

View 1 Replies View Related

Cisco Firewall :: IOS Firewall Versus ASA (5505 / 5510) For Smaller Clients (less Than 50)?

Apr 24, 2012

We were having a discussion of ios firewall vs. asa for smaller clients(less than 50). On using ios firewall(zbf or cbac)and an asa 5505/5510.  One of the arguments brought up on using ios firewall on the router is that a router will do an ip sla failover.  I have configured a number of isr's for this and i know it works good. 

View 1 Replies View Related

Cisco VPN :: ASA 5510 - Clients Cannot Access Remote Site

Dec 12, 2011

I have 2 sites :

site A :
ASA 5510
VPN gateway for remote users
LAN 192.168.192.0/22
 site B :
ASA 5505
LAN 192.168.208.0/22
 
Both sites are connected through a site to site VPN.Remote clients (AnyConnect/VPN client) can connect to Site A LAN  and see machines on LAN A but cannot see Site B LAN.

Here is a part of my configuration :
 
On Site A (ASA 5510)
--------------------------------
name 192.168.192.0 SiteA_Internal_Network
name 192.168.208.0 SiteB_Internal_Network
name 192.168.133.0 VPNPool_AnyConnect
name 192.168.133.32 VPNPool_VpnClient

[code]....

View 9 Replies View Related

Cisco VPN :: ASA 5520 8.2(3) - Allow Remote Clients To Access Other Networks

Oct 24, 2012

I have an ASA 5520 8.2(3) and allowing my remote client-to-site-vpn clients to access resources directly connected to my ASA on separate lower security interfaces (not the outside) besides just clients on my internal networks.  Someone mentioned to me configuring 'VPN on a stick' however from what I've read this seems to be only applicable when it comes to split-tunneling back out the outside interface (could be off on that).  Is this possible on other lower security interfaces as well, and if so what would a mock config that accomplishes that look like (acl's, nat, etc)?  Also, if I want internal users to be able to connect to these remote clients once they are active, are there any nat statements necessary (such as nonatting them) or are the vpn clients just seen as internal clients from the rest of the internal network's standpoint by default?

View 5 Replies View Related

Cisco VPN :: 5505 - AnyConnect Access To Inside IPs

Sep 13, 2011

I'm having problems getting AnyConnect clients to reach a server (192.168.139.3) on the Inside interface of my ASA 5505.  Ideally, this would be accessible from the DfltAccessPolicy or another dedicated policy, but right now I'm happy with any access.  Everything else seems to be working as expected.  I've rebuilt this config a number of times without success.  I can ping the IP from the ASA itself.

View 2 Replies View Related

Cisco Firewall :: 5505 DNS Does Not Resolve Inside DMZ

May 14, 2012

I have a 5505 that currently has inside/outside interfaces and everything is working just fine. I am trying to create a DMZ that will essentially be just for vendors/guests. the DMZ will have full access to the outside (Internet) but no access to the inside. I am using the FW for DHCP, and 8.8.8.8 and 4.2.2.2 for DNS. I currently have 1 laptop in the DMZ vlan, and it is getting a correct IP, and it is showing 8.8.8.8 and 4.2.2.2 in ipconfig. I can ping/tracert 8.8.8.8/ 4.2. 2.2/74.125.137.147(what url... resolved to on a laptop connected to the inside vlan), but I cannot ping nor browse to url.... [code]

View 1 Replies View Related

Cisco Firewall :: Enable SIP From Outside To Inside (ASA 5505)

May 14, 2012

We recently purchases the Cisco ASA 5505 to get familiar with it, possibly buying more appliances for our branch offices. However, since the appliance is installed, our SIP telephones no longer register with our SIP service provider.
 
The SIP phones are all on 10.0.1.0/24 while the SIP provider is external via the outside network. I copied our configuration below. how to enable SIP for all 10.0.1.0/24 hosts and ports 5060, 5160, 5260, 5360?
 
gcxfw# show running-config
: Saved
:
ASA Version 8.4(3)

[Code].....

View 2 Replies View Related

Cisco Firewall :: 5505 DMZ To Inside ASA 8.4 / ASDM 6.4

May 21, 2012

I have a standard ASA 5505 with inside, dmz and outside with the default security levels, 100/50/0. we have an email server inside which has been NATed and is working fine. However users accessing the wireless on the dmz are unable to access their emails on https (443). How do I allow SSL access ONLY to users on the dmz using ASA 8.4 commands or ADSM 6.4?

View 10 Replies View Related

Cisco Firewall :: ASA 5505 Ping Inside To Outside Don't Go

Sep 29, 2012

I have 2 ASA and would like to build a Side-to-Side VPN between these ASA. So I can learn something about configure a ASA for different thinks. But now I don`t can Ping from a Client to the Internet-Router.My Configuration is:
 
Client IP 192.168.1.100 <===> ASA Inside 192.168.1.1 /Outside 192.168.178.254 <===> Router 192.168.178.1
 
Is there something wrong at my config? or do I need inside private Adresses and at the Outside Global IP`s.
 
At the Router I have a Static Route that the 192.168.1.0 / 24 ist to find over Gateway 192.168.178.254

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved