Cisco Firewall :: 5510 - How To Allow Access From LAN To Server Using External FQDN

Feb 20, 2012

I may have phrased the topic not too clearly, but I have an external domain name of mail.company.com , I want my users INSIDE the company be able to also get to url..., currently they cannot (nothing loads, looks to me as if firewall simply drops it) and I'm drawing a blank on how to get this done. Externally this works fine so if you're outside the company you can load up OWA just fine since my NAT rule translates the external IP to internal IP, but something is blocking this from the inside.
 
I have an ASA 5510. If you can just sent me on the right path with theory I'll figure it out on my own, I don't need exact steps, but I must be thinking of this wrong as I'm not getting anywhere.

View 10 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5510 - Enable External Access To Server On DMZ

Apr 5, 2011

i'' ve one appliance ASA 5510, v8.X and asdm 6X here u have my configuration :
 
interface Ethernet0/0 description Link To WAN nameif outside security-level 0 ip address 212.96.23.186 255.255.255.252!interface Ethernet0/1 description Link to LAN(forefront) nameif inside security-level 100 ip address 10.20.80.1 255.255.255.252!interface Ethernet0/2 description Link to CoreSW (DMZ) nameif DMZ security-level 50 ip address 10.70.70.254 255.255.255.0
  
i have on server ssh (10.70.70.10) on my DMZ .
 
I wan to enable my external user, i mean outside user to be able to access to this server which is in my DMZ for this port ( ssh)

View 4 Replies View Related

Cisco Firewall :: Inside Access Using FQDN To Web Server On DMZ 571

Aug 21, 2011

What I have is 3 interfaces on my PIX.- Outside: 216.116.87.0/24 (security level 0)

- 469: 172.16.6.0 /24 (security level 10)
- 571: 192.168.255.0 /24 (security level 1)
 
My users on 571 need to access a web server on the 469 interface. However, the requirements are that the 571 users can only access the Website using the public FQDN which there is a static NAT from outside to 469. [code] Here is also the Packet-Tracer and it shows what I expect that the traffic is source from 571 and exits 469. However, the users are not able to access the website.[code]

View 4 Replies View Related

Cisco Firewall :: ASA 5510 - Connecting To External IP Of Internal Server

Sep 25, 2012

I was just wondering if it's possible with an ASA 5510 to connect to the external IP address of an internal server from inside the network.  I have already set up dns doctoring for dns lookups, and everything is working fine there.  We have an application inside the network that tries to connect straight to the external Ip of another internal server.  where to look in the ASDM 6.4?

View 2 Replies View Related

Cisco Firewall :: 5510 - Can’t Access External IP From Within LAN

Oct 20, 2010

Basically we have different customers using the same 5510 firewall. We have created one sub interface for every customer on the inside interface. There are differed NAT rules for every customer all using the same block of public IP addresses on the outside interface. They do not have access to each other’s network so I cannot make any exemption rules between two sub interfaces. The problem is for all our customers that they cannot communicate with each other over Internet, Email, Applications etc. using the external IP address. A work around is to use a proxy server, but they do not agree with that. I cannot make exemption rules between sub interfaces for security reasons.

View 8 Replies View Related

Cisco Firewall :: 5510 Security Plus To Terminate Client VPN Access For External Support Team

Aug 7, 2012

I have a customer that wants to purchase an ASA 5510 security plus to terminate client VPN access for an external support team. The customer claims to want URL content filtering/proxy which leads me to suggest a CSC SSM 20 plus module. But upon further conversation, he mentioned wanting IPS. In this case, the customer does not seem to know the difference between the URL content filter/proxy and the IPS and uses both terms interchangably.
 
1. What would you suggest in your expert opinion would be the best module to get for this customer? IPS or CSC
 
2. If I go with the CSC module, where can I find good documentation on how to configure it and get it up to date?
 
3. does the CSC module provide any web proxy functionality?

View 3 Replies View Related

Cisco Firewall :: ASA 5520 - Access Current Server Using External SNAT IP

Dec 8, 2012

I have an ASA 5520 with a DMZ with private addresses that I SNAT to my outside network. From inside the DMZ I can reach servers by both the internal private IP and the public IP, except if the IP is from the server trying to connect. So, say I have server1 and server2. I can connect from server1 to server 2 with both public and private, but can't connect from server1 to server1' using the public IP. ASA logs show that packets are being denied due to land attack. DNS doctoring is not an option for me.

View 1 Replies View Related

Cisco Firewall :: 5540 - Extended Access-list Error Using FQDN

Nov 7, 2011

I'm trying to add an access-list rule to allow internal servers to connect an outside host on a asa 5540. The hostname translates to multiple ip's. Normally I just lookup the ip address or one of the ip's the hostname translates too and use that in the access-list as the host. For some reason the actual ip's, which are a few, are not always available so using a specific ip sometimes does not work, thus the reason I have to use the hostname instead of the ip. I have 2 hostnames. www.hostname.com and subdomain.hostname.com.
 
This is how I normally add these rules (the ip addresses are fictive): access-list internet_access extended permit tcp host 192.168.50.5 host 84.115.57.121 eq www log
 
When I try to add this using the hostname on our asa I get an error: access-list internet_access extended permit tcp host 192.168.50.5 host www.hostname.com  ?ERROR: % Unrecognized command
 
I've tried it without the 'www', so hostname.com but same error.

View 4 Replies View Related

Cisco Firewall :: ASA 5510 - Cannot Access Web Server

Mar 23, 2013

I bought ASA 5510 about a week ago, very basic configuration and my priority was and still to get access list inbound the outside “Security Level 0 “so I can access my web server from the cloud but unfortunately I could not make it work (((TCP access denied by ACL from 92.40.X.X/52511 to outside:81.108.X.X/80))). ••à>> 92.40.X.X is a pc from the cloud that I used to access my web server and the 81.108.X.X is my public ip address My recent Conf is as follow:

Nat Section:
==================================================================================
Dynamic:
nat (inside,outside) source dynamic any interface <<<To have the PCs that inside the Network to have access to Internet>>>>

[Code].....

View 4 Replies View Related

Cisco Firewall :: ASA 5510 - Can't Access Server On Different Subnet

Sep 7, 2011

First off, let me preface this by saying that I'm a novice when it comes to firewalls and more specifically, the ASA.  I do however, have an above average understanding of switches/routers.
 
We have an ASA 5510 running 8.3 and recently I've decided to clean up the last admin's mess.  All hosts and servers are on the same subnet, multiple subnets on the same VLAN... and a slew of other problems.  Anyway, I recently placed the IT department on another subnet to test some things out before I migrated other departments to different networks.  Everything seems to be working as it should be with the exception of one of our servers.  The IT subnet is 192.168.150.0/24 and the problem server is on the 192.168.10.xxx network.  I'm guessing the issue lies somewhere in the fact this server does have a static NAT and is accessible from the public.  Let me give you an overview of what our network looks like:
 
ISP ---->ASA----->3750----->2960
 
My workstation is directly plugged into the 3750 switch, and the server is plugged into the 2960.  I'm able to ping this server by both IP and hostname.  However, I cannot access port 80 by IP or hostname.  The users that are on the 192.168.10 and 192.168.11 (sadly both of those are on the same VLAN) network are able to access this server without a problem.  Thinking logically, I thought I would send a packet from my workstation, it would head to the layer 3 switch's VLAN interface corresponding to my subnet, realize the .10 network is directly connected and then forward the packet straight to the server.  However, it doesn't seem to be working that way.  It look like it's being routed to the ASA then being dropped.  I guess there's an access rule or firewall rule preventing me from getting to the server.  Is there a specific part of my config you will need to see...

View 15 Replies View Related

Cisco Firewall :: 3750 / ASA 5510 - Allow Access To Server On Inside Interface From DMZ?

Feb 28, 2013

My internal network consists of Catalyst 3750 switches segmented into different VLANs.  There is a default route on the layer 3 Catalyst switch sending all unknown traffice to the inside Internet of the ASA 5510.  However, I'd like to have a separate VLAN for wifi guest access and send all of that traffic through one of the DMZ interfaces on the ASA 5510.  I don't think you can have separate default routes based on VLANs on the 3750 switches so my only option is to make the ip address of the DMZ port the default gateway for all hosts on the wifi guest VLAN. 
 
The problem I have is that I have a couple servers behind the inside interface that have services available to the public Internet via a NAT address on the outside interface.  I want the guests on the wifi VLAN to have the ability to access the servers on the inside interface using the public address as well, but have not been able to come up with a solution yet. 
 
Here is my config that pertains to this setup:
 
interface Ethernet0/0description Outside Interfacenameif Outsidesecurity-level 0ip address 76.47.10.x 255.255.255.224 rip send version 1rip receive version 1!interface Ethernet0/1description Inside Interfacenameif Insidesecurity-level 100ip address 192.168.17.1 255.255.255.0 rip send version 1rip receive version 1!interface Ethernet0/3description Wifi Guest Accessnameif DMZ2security-level 50ip address 192.168.60.1 255.255.255.0
 
global (Outside) 1 interface
nat (Inside) 0 access-list nonat
nat (Inside) 1 0.0.0.0 0.0.0.0
nat (DMZ2) 1 0.0.0.0 0.0.0.0
static (Inside,Outside) 76.47.10.x 192.168.17.88 netmask 255.255.255.255
 
I've tried the following commands below but no dice. 

same-security-traffic permit intra-interface
static (inside, inside) 76.47.10.x 192.168.17.88 netmask 255.255.255.255

View 3 Replies View Related

Cisco Firewall :: Securely Access Exchange Server 2007 Through ASA 5510?

Dec 27, 2011

Is there any way to access a MS Exchange Server 2007 on Windows server 2008 through an ASA 5510 running 8.4 with a full MS Outlook client (not using OWA - web browser)?  OWA is currently working fine but I was wondering if access via the full Outlook client is possible and more importantly...is it opening up too many ports on my 5510? 

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / Outbound Internet Access Not Allowed When Syslog Server Is Rebooted

Jun 27, 2011

I have recently setup Splunk to receive my syslog messages from my ASA 5510.  In the past I used kiwi without observing this issue, but I needed more features than kiwi had available.  Anyway, anytime I stop the splunk service my asa does not allow any outbound connections to be established. 

View 2 Replies View Related

Cisco Firewall :: Allow One External IP To Use NAT On ASA 5510 Sec Plus

May 2, 2012

I keep struggling with Cisco ASA. How I can make a certain NAT (RDP, SSL or whatever) and securing it by allowing just one external client with fixed internet IP to make use of this NAT?

View 3 Replies View Related

Registering A FQDN And DNS For Home Use To Connect To Server?

Mar 26, 2011

I have a video hosting server on vmware and I need to be able to connect to it through it's domain name. It needs a FQDN. On it's network config it has spaces to enter in FQDN, IP, Subnet, and two DNS. It must use FQDN to connect through http.I was told I can just open up the system32/driver/etc/host file and edit in the info, ex: 1.1.1.2 [URL] I tried to ping 1.1.1.2 and it does ping, and I even tried to ping [URL] and it pings (not connected to the web). But I can't get the web interface to connect when i put in server.com:8080 (needs 8080) into my web browser. FYI, I have no idea about the DNS space on the server, I just put in some random number. Why does this server need a DNS anyways?This computer is not connected to the web or any other computer. It's just this computer and the vmware server on it.

View 4 Replies View Related

Cisco Firewall :: ISP Migration With ASA 5510 And External Router?

Nov 26, 2012

My company (in Healthcare) is going to be changing ISPs for our internet connectivity, and with this change comes a new external IP block.  So I need a scheme to migrate over all of my existing VPN tunnels and other items over to new IP addresses.  We do have an external router which I plan on doing a route-map to handle which traffic the ISP should go to based on IP.  My big concern is for the ASA 5510.  Can I setup a second outside interface on the new IP range?  Then migrate my VPN tunnels over one-by-one?  A drop-dead cutover date is just not possible with all of the external companies that I have to contact to get VPN tunnels updated with.  If it's not possible, we have in our budget to get another 5510 next year as a redundant unit.  I may be able to get that early and just migrate from one firewall to another.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - Two External Subnets On The Same Interface

Oct 21, 2012

I have two ASA 5510 in an active-standby cluster, not that I think that the fact that they are clustered will be of any importance here so feel free to think of it as a single 5510. The internet connection is delivered in a single RJ45 connection. To be able to use it with the cluster there is a simple unmanaged switch connected between the ISP and the ASA's. I have two subnets with public addresses, for simplicity lets call them 1.1.1.0/24 and 2.2.2.0/24. Default routers are 1.1.1.1 and 2.2.2.1 respectively.
 
Can I somehow use both these subnets in the ASA's? Im currently using the first subnet and use PAT to direct traffic to internal servers. But if I want to use adresses from the second subnet wont that mess up the routing, since there is no way I can specify the default router for the second subnet? I have as of yet not tried anything, Im just trying to plan ahead and I cant seem to wrap my head around how this could possibly be done.

View 5 Replies View Related

Cisco VPN :: 5510 - Remote Access With / Without Split Tunneling Using External DNS

May 6, 2013

I've set up a remote access group for Anyconnect on a 5510 running 8.4.5.  Our company security policy prohibits split tunneling, but this particular location has no internal DNS (so I have to use a public DNS like google or something).   How do I get this to work, I'm assuming I need to do a NAT exemption but I'm not sure how this would look, especially under 8.4.5.

View 1 Replies View Related

Cisco Firewall :: Assign Several IP Addresses To External Interface ASA 5510?

Oct 13, 2011

How do i tell my firewall to start listen also on another outside ipadress assigned by my ISP? I have it used on other firewall right now. So my steps would be shutting down ip address assignment off old firewall interface. Assign that ip address to ASA5510 outside interface and configure NAT.

View 13 Replies View Related

Cisco Firewall :: ASA 5510 Preventing External SNMP Response

May 13, 2010

I have the following setup:
 
R--H1
|
F
|
H2
 
R: 3840
F: ASA 5510
H: Hosts 1 and 2
 
I am trying to get SNMP info from the router to H2 but snmpwalk errors with no response from router. I can get info from H1 and neither interface on router is preventing SNMP traffic from coming or going.Is there something that needs to be configured to allow SNMP traffic (orginating from INSIDE) to reply? (Also note that there is no Inspect Maps blocking and SNMP versions).

View 4 Replies View Related

Cisco Firewall :: How To Add External Server To ASA 5505

Feb 24, 2013

I have a Cisco ASA5505 and windows DHCP server, how do I add this external server to ASA so my PC clients can get DHCP from this server?

View 3 Replies View Related

Cisco Firewall :: Statically PAT Multiple Internal Hosts To One External Host 5510

Feb 20, 2012

I am working on replacing our Checkpoint Firewalls with ASA's, and am running into the following NAT problem. On some of our Checkpoints, there are external NAT's that are mapped to multiple internal hosts based on ports.Is there any way to translate that to the ASA? I'm not sure the ASA will let you have multiple internal hosts mapped to one external IP using static NATs. The main issue, is these are alarm panels that receive data from external hosts (the traffic is initiated externally on the Internet) so I can't use dynamic PAT with this.

View 1 Replies View Related

Cisco Firewall :: 3.2 (18) - URL Filtering In FWSM Without External Server

May 18, 2011

I have an FWSM running in multiple context mode running 3.2(18) code.  I have 3 urls that I would like to block so I can't justify the cost of an external URL filtering server.  I have found a way to filter individual URLs on the ASA but the same configuration does not seem to be available on the FWSM.  At least not on my code. Any way to do this other than resolving the hostnames and blocking the current IP addresses?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / Add A Mail Server In The LAN And A Webmail Using Port 3000 On The Server?

Jul 24, 2011

I'am using ASA 5510 and I try to understand how PAT is working.I want to add a Mail Server in the LAN and a webmail using port 3000 on the server. ( webmail must be reachable from the WAN)This is my Configuration :actually LAN users access internet using NAT with one global IP ( 194.x.x.69) which is the ASA WAN interface.

WAN ----- ISP Router ----------     FW     ---------- LAN -------- Mail Server + Webmail
|             (25) | (3000)
194.x.x.69    192.168.1.254                     192.168.1.6
 
I need to forward port 3000 and port 25 from outside to inside.For example, from the WAN : [URL] must be redirect toward 192.168.1.6:3000 . What is the Correct Configuration ? And what about the Inside/Outside Traffic,Is there any configuration to add ?

View 2 Replies View Related

Cisco VPN :: ASA5502 - Remote Access VPN Configuration Using FQDN

Apr 29, 2013

We have dns server(only Internal IP) inside our network, right now we have configured Remote Access VPN using Public IP and we connect it using the same Public IP. I need to use FQDN instead using Public IP.
 
Device : ASA 5520
Configuration Type : IPSec

View 2 Replies View Related

Cisco VPN :: 5520 Remote Access VPN (IPSec) Configuration Using FQDN

Apr 29, 2013

We have dns server(only Internal IP) inside our network, right now we have configured Remote Access VPN using Public IP and we connect it using the same Public IP. I need to use FQDN instead using Public IP. What is the configuration for this.
 
-Device : ASA 5520
-Configuration Type : IPSec

View 1 Replies View Related

Cisco Firewall :: 6500 Separate Internal Server / HQ Network From 3 / 4 Different External Connections

May 21, 2012

I am using a 6500 with FWSM. I need to separate an internal server/HQ network from 3 or 4 different external connections. The external networks do not necessarily need to be isolated from each other.I have the option of using a 3 layer model: L2 Access layer to SVIs on the Distribution layer and then L3 to the 6500.L2 Access, connecting directly to the 6500s, with the SVIs on the FWSM.Is it better to have the FWSM outside the MSFC or Inside? Am i correct in thinking that "inside" vs "outside" is determined by whether the SVI's are configured on the FWSM or the MSFC? is there any performance impact from having the FWSM doing the routing instead of the MSFC.If the vlans are all configured on the FWSM, what is the 6500 doing, other than providing switch ports?

View 1 Replies View Related

Cabling / Cards :: Network Of Wifi Access Points With External Server Authentication

Apr 6, 2013

I'm planning to create a network of wifi access points all in different locations. Those locations all have different wifi routers and networks. I'm looking for a easy solution that let easily setup those networks to ask authentication credentials (in a browser page, once a user is inside the wifi and wants access the internet) by an external server possibly without overloading too much that server.

View 1 Replies View Related

TP-Link Dual-Band Wireless :: WDR3600 Restrict External Access To A Ftp Server

Feb 25, 2013

Region : UnitedKingdom
Model : TL-WDR3600
Hardware Version : V1

I am trying to restrict external access to a ftp server I have running, to a single external IP address. Is this possible? It can be done for the Remote Management IP Address page, where you can enter a single address or 255.255.255.255 to allow all external hosts. But the set up of a virtual server does not appear to have that option.

View 1 Replies View Related

Linksys Wireless Router :: Access Media Server And External USB Drive On E4200 From An IPad?

Aug 21, 2011

How to access the media server and/or external USB drive on an E4200 from an iPad?

View 1 Replies View Related

Cisco Firewall :: 2801 Cannot Access External Websites That Use FTP

Dec 26, 2012

I am having an issue where I cannot access certain files on websites. It looks as though the files are accessed via ftp. Could my router be blocking it. I have a Cisco 2801 router acting as a firewall.

View 13 Replies View Related

Cisco Firewall :: 8023 / External Access To Internal Router Via ASA

Dec 31, 2012

I am aware that we can allow external admins to telnet over a custom port to the internal router. Even i was allowed to connect to a remote router via the remote firewall. The way i was accessing the router is by telnet to the remote ASA address on port 8023.I am not sure how exactly we can configure this on a ASA.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 / Allow External Traffic To Access Internal Computers

Mar 22, 2012

We have an ASA 5505 running version 8.4. We are having problems allowing external traffic to access computers behind the firewall. Our current config is:
 
ASA Version 8.4(3)!hostname ciscoasadomain-name default.domain.invalidnames!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!interface Vlan1nameif insidesecurity-level 100ip address 10.2.1.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address 152.18.75.132 255.255.255.240!boot system disk0:/asa843-k8.binftp mode passivedns server-group DefaultDNSdomain-name default.domain.invalidobject network a-152.18.75.133host 152.18.75.133object network a-10.2.1.2host 10.2.1.2object-group network ext-serversnetwork-object host 142.21.53.249network-object host 142.21.53.251network-object host 142.21.53.195object-group network ecomm_serversnetwork-object

[code]....

View 10 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved