Cisco Firewall :: 5505 - Block Everything Except A Few Ports

Apr 15, 2013

We have a client that is running a PC on a internet over satellite. To avoid any unessecery traffic over the satellite link (data traffic is quite expensive), we've suggested to use a 5505, as we had one handy already.
 
So basically what we wanted was to block everything outgoing and everything ingoing, except for example port 22 (ssh).
 
But I'm struggling a bit, since this is my first cisco router to be configured.
 
My interfaces are as follows.
Outside - DHCP
Inside (port 1) - 192.168.1.1
 
I'm only running ipv4.
 
in ASDM I made a static NAT rule for port 22, being forwarded to 192.168.1.5 (the computer)
 
in Access rules I made under outside (incomming rules) source=any destination=outside service=ssh action=permit
 
But when I try to add further rules to block everything else, it takes the SSH on port 22 with it. How should I do this the easiest way?
 
the hardware setup is pretty straight forward.
 
sat-terminal(with IP 192.168.0.1 running DHCP)   ->  5505 (outside IP=DHCP - inside IP=192.168.1.1)   ->    computer (IP=192.168.1.5)

View 24 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5505 / Use The Ethernet Ports As Pure Physical Layer 3 Ports

Jun 9, 2013

We have an ASA 5505. 5505 comes with two default vlans 1&2 with each of them marked as inside & outside respectively.My query is , if i do not want to use vlans on 5505 and only want to use the Ethernet ports as pure physical layer 3 ports, is it possible?i.e. i want to assign a layer 3 ip address on eth0/0 and eth0/1 and make them as the inside & outside interfaces rather than vlans. is it possible to do away with vlans in 5505 & will it work otherwise?

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Block Certain URL On Certain Users

May 20, 2013

I am using ASA5505 and I would like to block certain websites such as facebook.com on some users only

View 3 Replies View Related

Cisco Firewall :: Block Website Or Ip Address From ASA 5505?

Apr 27, 2011

if it is possible to block a website or ip address from an ASA 5505? if it is possible, can you give me an example of the commands to get it done?

View 2 Replies View Related

Cisco Firewall :: Block Pings On Outside Interface Of ASA 5505?

May 2, 2013

I was asked to block pings from the internet to the outside interface of our ASA-5505 firewall.  I found a post that said to enter "icmp deny any outside", however that does not do it.
 
I created an ACL to try and do the trick, also to no avail:
 
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in in interface outside 
access-group outside_in in interface outside

View 8 Replies View Related

Cisco Firewall :: ASA 5505-ISP Providing DHCP And Separate IP Block

Mar 12, 2011

I have a ASA 5505 that I have been using for a while, but a new ISP is trying to configure my service so that the outside interface has to be configured as DHCP to receive a reserved IP address, and then they will route a separate, non-contiguous block of addresses to that address.
 
Essentially, they have a DHCP reservation for 1.2.3.4 for my ASA, and then they have 10.2.3.16/28 as a separate block routed to me.
 
Obviously, I can do my static NAT translations using outside as the address, but I cannot get the separate block of addresses to route through the ASA. Is there a way to do this and get them to work? My ASA is running 7.2(2)

View 3 Replies View Related

Cisco Firewall :: How To Block ARES With ASA 5505 Base License

Sep 1, 2011

Well, I tried using the cisco configuration for ASA 5505 for blocking P2P: url...but this configuration only is usefull with programs like Kazaa, so I try this configuration to block ARES but the problem is that ARES try to make downloads from different ports, ¿How do I block ARES if there are sereveral ports ?

View 1 Replies View Related

Cisco Firewall :: 5505 Block Port 80 On A Specific Host In LAN

Apr 22, 2012

I'm using an ASA5505 (8.4(1)) and would like to block port 80 on a specific host in the LAN so machines in other remote LANs connected via VPN can't access this port on the host. Devices in the local LAN should have access to this port on the host. Here are the commands I'm using:
 
-access-list block_port extended deny tcp any host 10.20.10.20 eq 80
-access-list block_port extended permit ip any any
-access-group block_port out interface inside
 
These commands are not working as I would expect them to. When I browse to http://10.20.10.20 from a remote machine over the VPN tunnel I am able to access the host web server.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 / Block Internal LAN And Internet Traffic Except LogMeIn Site?

Sep 12, 2011

I have configure Cisco 5505 as layer 2 firewall mode. I have vendor machine connected  to Cisco ASA 5505 on port 2 as VLAN2 inside then VLAN1 outside connected to my internal network on layer 2 cisco 2960 switch. This machine needs access only to LOGMEIN then block all internal/internet traffic. 
 
vendor machine on vlan 2 inside >> Cisco ASA 5505 vlan1 outside  >> layer2 switch >> internal LAN >> Cisco 5520 main FW >>> INTERNET

View 1 Replies View Related

Cisco Firewall :: ASA 5505 / Block Website With Regular Expressions Affecting All Internet?

Dec 27, 2011

We have an ASA 5505 and I want to block www.facebook.com for all users on the inside network.  I followed the instructions laid out in Cisco support document ID 100513 using regular expressions with MPF but am running into some problems.
 
[URL]
 
Once the configuration has been changed based on these instruction www.facebook.com is blocked.  However I can't access any other websites except my Google News home page comes up just fine for some reason. 

ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 4nJloDG8uYd8w4D3 encrypted
names
!
interface Vlan1

[code]....

View 18 Replies View Related

Cisco Firewall :: ASA 5505 - PAT Range Of Ports

May 31, 2011

I've an ASA 5505 as my gateway for my internet at home. I've one public IP, so I use Port Address translatetion for my internal clients.
 
Now i wanna setup a FTP server, on a internal client. I will use Filezilla FTP server. I'm running the FTP server in passive mode, since the FTP server would be behind my ASA firewall/nat device.
 
I need 50 ports for the passive mode to be running.
 
I will use port range 50000-50050. I can easy make a firewall rule (access-list) that permit that port range.
 
But how do I PAT(NAT) a port-range on the ASA device? I can only figure out how to NAT one port at the time.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Open Ports For DVR?

May 9, 2013

I have an ASA 5505 with ASA version 7.2(2) and ASDM version 5.2(2) and I am attempting to open ports 88 and 5445 and forward them to the IP address of my DVR.  This is all new for me.  I see several posts for other software version to do this same thing but my version appears to be older?

View 1 Replies View Related

Cisco Firewall :: Forward Some Ports On ASA 5505 8.2?

Nov 7, 2011

I need to forward some ports for remote desktop and remote outlook which I host on an internal server. I have looked all over the web and got close, but no hints on how to do it in the asa 8.2. there is an 8.3 guide, but it is just different enough to not work. I am new to this device and cli.

View 3 Replies View Related

Cisco Firewall :: Opening Ports On 5505?

Jan 2, 2013

I am trying to configure a new 5505 but I am having difficulties opening ports that allow traffic in from the outside. My setup is Comcast Business Modem (w/ single static IP) -> ASA (10.0.0.1) -> (dumb) Switch -> NAS (10.0.0.10). I am attemping to open port 5001 to the NAS. I am very new to IOS so I have mostly been working in ASDM. Not sure if I am overcomplicating this for myself or what but I am stuck.
 
My running config is -
 
ASA Version 8.2(5)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted

[Code].....

View 4 Replies View Related

Cisco Firewall :: Open Ports On ASA 5505 For VoIP?

May 5, 2013

I'm working on setting up a PBX server in our office, and I'm having trouble getting a port opened for SIP on my ASA 5505.I created static NAT rule for SIP traffic from internal server to the outside IP address.I created access rules on outside interface to forward port 5060 to internal PBX server (192.168.1.8)I also disabled sip packet inspection on the ASA.I'm still receiving a message from the PBX that the firewall is configured incorrectly. 
 
[code]....

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Appears To Be Listening On All TCP Ports?

Aug 7, 2011

When I do an NMAP scan against my ASA 5505 on it's internal interface's IP address, it appears to be listening on all TCP ports.  If I do it from across a VPN tunnel, the ports show as open according to NMAP, if I do the scan from the local subnet they show up as unknown. I'm running 8.0.4 code on this ASA.

View 1 Replies View Related

Cisco Firewall :: Allow SIP On Multiple Ports Not Only 5060 (ASA 5505)

May 14, 2012

We've read everything about inspecting SIP packets and allowing them to pass through on port 5060, the default SIP port. However, our setup requires the ASA 5505 to allow SIP on ports 5060, 5160 and 5260.
 
Is this possible with the ASA 5505? If it's not, it would be a blocking issue for us to move forward with ASA appliances. We are currently investigating in a lab environment and really having difficulties configuring it to facilitate full SIP functionality.

View 1 Replies View Related

Cisco Firewall :: 5505 - Forward Range Of Ports In 8.4?

Mar 11, 2011

I have an ASA 5505 running 8.4(1), and I'm configuring it with ASDM 6.4(1).  The outside interface is configured with a single static address.  I have a few services port forwarded sucessfully to three different servers on the inside network.
 
I need to make a media proxy on a SIP server available to the outside.  It requires a large range of forwarded UDP ports for the media channels.
 
I tried adding a network object NAT rule like the others I'm already using to forward HTTP and RDP.  I entered a range of ports for the real port and the mapped port using the syntax 60000-60999.  ASDM accepted it, but the NAT rule list displays "Any" in the service column.  When I apply the change, I get the following error:
 
nat (inside,outside) static interface service tcp 60000-60999 60000-60999
                                      ^
ERROR: % Invalid input detected at '^' marker.
 
How do I forward a large range of UDP ports from the outside interface to a single server on my inside network?  I'd like to use ASDM, but I can switch to the CLI if that works better.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Ports Available For Traffic Flow In Router

Oct 21, 2011

I am in search of a new routers. I don't have any special task to do. Just the flow of maximum 2mb/sec data and some times video conference. However I need the Voip solution as well. I just got excited on the cisco ASA 5505 product. Can this fulfill my requirements. Can this work as the router 1841. Does this support DMVPN, SSL VPN and dynamic routing. Can I upgrade the IOS for dynamic routing purpose. Do you recommend to purchase this produe act or not instead of router ? What are the limitations of this product. If I purchase this I can use this as an router as well as strong security solution. How many ports are available for traffic flow in ASA 5505. Are all routed mode or some of them switch port.

View 1 Replies View Related

Cisco Firewall :: 5505 - Opening TCP Ports In ASDM Launcher

Jun 20, 2011

I am trying to open up 3 TCP ports in Cisco ASDM Launcher:
 
16000
16001
8098
 
And have a Cisco ASA 5505 Router.  I need these ports open in order for a software that I have installed on the server to communicate with my local client computers for my business,  The software is installed on Windows 2008 Server Standard Edition and was installed with MicrosoftSQL 2005.  The software and Microsft SQL 2005 is pretty much installed and just requires this last step in order for the server to be connected to the local  computers.  In order to resolve this, I have gone to.

View 1 Replies View Related

Cisco Firewall :: List Ports Open On ASA 5505 Appliance?

Oct 12, 2011

How to list ports open on Cisco ASA 5505 appliance? I have tried to see using Cisco ASDM launcher, but no luck.

View 1 Replies View Related

Cisco Firewall :: 5505 - Opening Ports On DHCP Outside ASA Interface

Feb 25, 2011

I am used to setting up access-lists on outside interfaces with ip addresses that are static. I have recently been given a site that is using a dyndns.org client for name to ip address resolution on an outside interface that is dhcp assigned. I created an access-list to open up ports 41794 and 41795 to an engineering application but everytime I try to connect from the outside I get a syn timeout. The application works when inside the lan. Basically I want to allow outside connections from anywhere on the outside to go to ports 41794 and 41795. I am running a Cisco ASA 5505 on version 7.2(4) Below is my conifg. what I may have misconfigured?
  
: Saved:ASA Version 7.2(4)!names!interface Vlan1 nameif inside security-level 100 ip address 172.31.2.1 255.255.255.0!interface Vlan2 nameif outside security-level 0 ip address dhcp setroute!interface Ethernet0/0 switchport access vlan 2!interface

[Code].....

View 5 Replies View Related

Cisco Firewall :: ASA 5505 8.4(1) - Map Multiple Inside Hosts Ports To One Public IP?

Jun 22, 2011

I'm stuck at asa 5505 nat, port forwarding configuration Here is what i need:

host1: 192.168.1.1 service tcp/100 >>>>> public ip 1.1.1.1 service tcp/100
host2: 192.168.1.2 service tcp/200 >>>>> public ip 1.1.1.1 service tcp/200
host3: 192.168.1.3 service tcp/300 >>>>> public ip 1.1.1.1 service tcp/300
 
So people from remote just need to use 1.1.1.1 public ip to access all the ports on three different inside server.I can do this on my old ASA 5505 with 8.0(4). Looks like there're lots of change from 8.0 to 8.4.

View 7 Replies View Related

Cisco Firewall :: ASA 5505 - Unable To Access Certain Ports Over Site To Site VPN

Jan 16, 2013

We have a client that has a Cisco 1801W Firewall that is setup as a site to site VPN terminating to a Cisco ASA 5505. The tunnel is up and established, I can ping from both sides of the tunnel.
 
The problem is the clients behind the Cisco ASA (192.168.2.x) cannot reach certain ports behind the Router (192.168.1.x). The main thing we're trying to do is browse via UNC path (ex: \192.168.1.120 from a 192.168.2.x machine).
 
I got 3389 working after I changed the - ip nat inside source static tcp 192.168.1.120 3389 y.y.x.x 3389 route-map DM_RMAP_1 extendable Modified the command to include the public IP instead of interface FastEthernet0
 
I believe it has something to do with the way NAT and route-maps are setup currently but I'm not familar enough with them to make the changes. I worked with Cisco to ensure the VPN tunnel was fine and it's something security related on the Router.
 
Here is the configuration (removed a few lines not necessary. y.y.x.x = WAN IP of Router x.x.y.y = WAN IP of ASA).
  
Building configuration...
  
Current configuration : 23648 bytes
!
version 12.4
no service pad

[Code].....

View 1 Replies View Related

Cisco Switches :: How To Block SG300 10 Ports

Sep 30, 2012

I just recently purchased an SG300 10 port switch. After reading through many of the threads here, I was finally able to get the different VLANs to route properly. However, I'm having a unique issue that I'm not sure if it's related to the switch or not. I currently have 2 VLANs configured on the switch.ports 1-4 are native vlan 1 (192.168.1.X) ports 5-7 are VLAN 10 192.168.10.X (Trunk Port with VLAN 1 tagged and VLAN 10 untagged)I have a Hyper-V server connected to both of these networks. The VMs are running on both VLANs on port 5. I have the following problem:When I have a domain controller VM on VLAN 10, I notice that many of the DC communications failed. I took a network trace and noticed that many of the RPC port ranges were failing. I am able to ping all of the hosts on VLAN1 and vice versa. My question is as follows:Does this switch have some type of security option that blocks high range ports? I can't seem to find the menu option indicating that this is the case. I have already set-up a NETBIOS UDP proxy, but this hasn't worked much. I still have problems connecting to machines on this VLAN range.

View 5 Replies View Related

Cisco Switches :: SGE2010 Does Not Block Ports Even With STP Enabled

Jul 28, 2011

We are experiencing bridge storms and network slow downs and we believe we have traced the issue down to users plugging a cat 5/6 cable between 2 ports on the wall both wired back to a SGE2010 switch.
 
So we did a test - we plugged a single short cat 6 cable between 2 ports on a SGE2010, our access switch. Suprisingly, even with STP enabled, the switch DID NOT block one of the ports and in a few minutes the ENTIRE NETWORK was down, as CDP, STP, and ARP traffic became a multi-gigabit storm throughout the network.
 
Why on earth does this switch not block a port that is obviosly looped?
 
Every other cisco switch since I started on 1900XL's did this in 1999.

View 1 Replies View Related

Routers / Switches :: Block Multiple Ports On Only One Ip?

Oct 4, 2011

how can I block multiple ports on only 1 IP Address while not blocking those ports on other IP Addresses. I am using a Netgear WNR2000v1 which assigns the IP Addresses to each device.

View 1 Replies View Related

D-Link DIR-655 :: Unable To Successfully Block Ports

May 25, 2011

I have been trying to block access to Steam and Left 4 Dead 2 on a specific computer, using the correct listed ports and using the port forwarding section of the router (setting the access to deny) however they seem to still be able to access both steam and L4D2 on their computer.how I can still block the access?

View 1 Replies View Related

Cisco VPN :: Adaptive Security Appliance Asa 5540 Unable To Block Server Ports

Aug 10, 2011

I was configure IPSEC vpn on ASA5540 and i have problem with port blocked.  I am unable to block server ports to remote users.See below configuration.  I need to configure vpn filter list but don't know how to configure vpn filter list.

View 5 Replies View Related

Cisco Firewall :: ASA5555-X - Spare Ports Into Access Ports?

May 14, 2013

Is there a way to associate spare firewall ports with another port that is being used..For example...int gi 0/2 is being used currently for my web dmz. Its ip is 192.168.10.1..Is there a way for me to associate gi 0/3 with the same layer 2 as gi 0/2 ?
 
In my webdmz I use 2 ACE 4710 proxys in FT mode. I used a layer 2 switch to connect firewall and proxys together.
 
I would like to eliminate this switch if possible..and connect both 4710's (layer 2) direct to firewall.If I could make gi0/2 - 4 part of the same vlan, then I would be good to go.

View 2 Replies View Related

Cisco :: Block Pings From Outside To ASA 5505

May 1, 2013

I was asked to block pings from the internet to the outside interface of our ASA-5505 firewall.  I found a post that said to enter "icmp deny any outside", however that does not do it.
 
I created an ACL to try and do the trick, also to no avail:
 
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in in interface outside 
access-group outside_in in interface outside

View 1 Replies View Related

Block Internet Access For An IP On ASA 5505?

Mar 15, 2011

How do I configure Cisco ASA 5505 (using ASDM 5.2) to block a workstation (IP address) from accessing internet completely? I was trying to set up a new incoming access rule for outside interface to deny any IP traffic to that workstation but it doesn't work from some reason - the workstation can still access the internet. The ASA has no special settings, only a few ports opened for servers?

View 1 Replies View Related

Cisco Switching/Routing :: Implement ASA 5510 / 5505 For Existing IP Block

Jun 5, 2012

some recommendations for product selection and overall infrastructure setup for our datacenter:  We have an old, legacy setup, and are looking to replace equipment, improve performance, enhance security, and implement hardware redundancy (if cost effective).
 
1)  We now have (2) IP blocks from our provider, and need to support both (because we have mailers on older IPs with a good reputation rating).
2)  We have (2) aged Sonicwalls, one for each IP block, each connects to multiple internal subnets (some internal subnets need connectivity to eachother, some don't).
3)  We have (mostly) public facing web servers (Linux/Apache), as well as database servers (with no external access).
 
Questions-

1)  Should we implement a Cisco ASA 5520 w/ or w/o SSM modules for the new IP block (for webservers)?
1a)  Should we implement a Cisco ASA 5510 or 5505 for the existing IP block (for mailers)?
1b)  Or, can we have multiple public IP blocks connected to a single ASA 5520 (or 2 ASA's w/ failover)?
2)  Can we connect both firewalls (5520 and 5510/5505) to a single Catalyst 3550 (or similar) using VLANs, and have 6 - 10 VLANs for webserver subnets, with ACLs controlling which subnets/servers can connect to eachother?
2a)  Should we implement a second Catalyst 3550 (or similar) for redundancy (webservers have multiple network cards).
3)  From our provider, we only have (1) dmark which both IP blocks connect through.  Currently we have a switch connected to the dmark in order to 'splice' the connection, and have both existing firewalls connected.  Is there a better approach to this?
4)  We would like to implement SSL-VPN, and possibly site to site IPSec VPN, but only if there will not be significant performance degredation.
5)  Other thoughts/recommendations for new features, enhanced security, or redundancy?

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved