Cisco Firewall :: 5510 - Create Network Object For IP To NAT Through? 

Jan 30, 2012

I have recently upgraded my ASA 5510 to 8.3 code and honestly I am confused on the best and most efficient way to do many nat translations through it.  I have a group of about 100 IP's that need http/https/and sqlnet allowed through for our web farm.
 
I have a text file with the real and translated IP addresses and in 8.2 I could simply modify it and dump the thing in and make the NAT rules and access-lists.  Now with the new object based model I am having a hard time wrapping my brain around how to do this using as few lines of code as possible.
 
Do I have to create an network object for each and every IP i want to nat through? 

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5520 - Create Network Object For Range Of Hosts?

Oct 25, 2011

I'm migrating our network objects from our current firewall to a new ASA 5520 configuration. I'm using ASDM 6.4 for configuration.
 
We have a range of IP addresses for hosts that we need to add to a firewall rule/ACL. In the previous FW software I could create an object that was a range of IP address. For example there is an object called emailservers that is defined as 192.168.2.25-192.168.2.50.
 
Is there a way to do a similar thing on the ASA 5520?
 
I can see how to create subnets, but in this case I only have a range of IP addresses, no subnet mask.

View 1 Replies View Related

Cisco Firewall :: Object Group Network Limit With Asa 5510

Oct 29, 2012

We have Cisco ASA 5510, I am about to add another 2 Objectgroup network  groups on the firewall to our already growing list. Under this Object-group Network xxxx , we are planning to add about about 500 network-object host xxx.xxx.xxx.xxx . This objectgroup will then be applied to an ACL. Just wanted to know if thats possible - meaning addnig 500 hosts? If it is whats the limit?
 
Also are there any other things to keep in mind before i go-ahead with this huge object group?

View 3 Replies View Related

Cisco Firewall :: 5520 - Object-group With Network-object Containing IP Address Range

Apr 7, 2013

Does the ASA treat an object-group with a network-object containing a range of IP addresses as a netmask? For example, I can apply this configuration without the ASA throwing any errors though the configuration calls for a 'net mask':
 
object-group network test
network-object 192.168.0.0 192.168.63.255
?
network-object-group mode commands/options:
A.B.C.D  Enter an IPv4 network mask
sh run ob id test
object-group network test
network-object 192.168.0.0 192.168.63.255
 
I found that in the documentation it requires a netmask as oppose to a range. Is this a bug in the code? I am running code version 8.0(5)23 on a 5520. If this is not a bug how does the ASA treat this type of configuration when applied to an access list? When I ran a quick packet trace and denied access from that range it looks like the ASA doesn't read that configuration properly.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 Object Groups / Creating New ACL

Jul 20, 2011

I have an ASA5510 where I have defined object-groups and then associated them with a specific ACL.  Our ISP is pulling their point of presence from where I live and I am force to move to a new ISP.  I am in the process of setting up another interface for the ASA5510 to connect to the new ISP.
 
My questions is can I create a new ACL lets call it new_access_in and use it with the same object groups that I have already defined?  I know that I can only have one ACL bound to an interface, and will bind this new ACL to the new interface I am setting up, but I wasn't sure if I could use the same object groups and connect them to a different ACL.  I really don't want to have to create new object groups if I don't have to.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 Object-Groups Not Working

May 9, 2012

I have an ASA 5510 and have just started using object-groups which are super handy in theory, but not working in reality. I have a service object-group with a mix of tcp, icmp, and udp ports. Let's call it Sample_Port_Group. I'm trying to apply it to my dmz_access_in ACL. Here's the line giving me problems:
 
access-list dmz_access_in extended permit object-group Sample_Port_Group 192.168.1.1 any
 
The asa throws up an error between 192.168.1.1 and any. When I put up a ? after Sample_Port_Group, it gives me the option of putting in an IP address, any, etc. When I put in a ? after 192.168.1.1, it only gives me the option of putting in an IP address.URL

Those posts gave me the impression my line was possible, especially the "access-list outsideacl extended permit object-group myaclog interface inside any" line, which is at the end of the 2nd article linked.

View 2 Replies View Related

Cisco Switching/Routing :: 2911 - How To Create Object-group With ACL

Jan 2, 2012

In cisco router 2911 how to creat a network object with port permission on ACL. herz what i have done but couldnt succeed in port 22 and 24 should be denied and rest all port services are allowed to outside interface. [code]

View 3 Replies View Related

Cisco Firewall :: ASA 8.4 Network Object NAT Ordering

Aug 19, 2012

There is something wrong with the ordering of our NAT-rules.We are running ASA Version 8.4(2)8 and the nat config is pasted below.
 
I want outgoing smtp-traffic to be translated to xxx.yyy.zzz.18, but instead it's translated to xxx.yyy.zzz.20 (the outside-interface address).The same goes for ftp-traffic, according to packettracer this is also translated to the xxx.yyy.zzz.20.
 
Ciscos manual states that static nat rules takes precedence over dynamic nat but that doesn't seem to work for us. [code]

View 7 Replies View Related

Cisco Firewall :: ASA 5510 / Ip Service Object And Service Group

May 16, 2011

When I create a service object or group and add the object to a new rule it never works.I mean the traffic match not the rule. I see not hits.I placed the rule on top of my access list to check if I do somethink wrong but it is not working. When I place only a service for example tcp/23 it is working.
 
my ip service object
object-group service g-as400 description access client 2 as400 machine service-object tcp-udp destination eq 397 service-object tcp destination eq 137 service-object tcp destination eq 2001 service-object tcp destination eq 3000 service-object tcp destination eq 445 service-object tcp destination range 446 447 service-object tcp destination eq 449 service-object tcp destination eq 5010 service-object tcp destination eq 5544 service-object tcp destination eq 5555 service-object tcp destination range 8470 8476 service-object tcp destination eq 8480 service-object tcp destination eq

[code]...

View 8 Replies View Related

Cisco Firewall :: Command Authorization In ASA 8.4 For Object Network

Apr 28, 2012

I just tried to do a quick privilege level setup for a user to limit access to asa. User should be able to add nat's to configuration.ASA 8.4 is in question and trying the following does not seem to work:

privilege configure level 3 command object,gives me ,ERROR: specified command 'object' not found in any mode.It looks like localy this cannot be done or I am doing something wrong?

View 1 Replies View Related

Cisco Firewall :: ASDM 5.0.7 Creates Duplicate Network Object Groups

Aug 5, 2011

We are facing the problem in ASDM 5.x creates duplicate network object groups in the configuration when PIX with software 7.0.7 is used.
Audit report its showing below commands :
 
asdm group SALES_ref dmz2 reference SALES object-group network SALES_ref network-object 172.20.7.8 network-object 172.20.10.3 network-object 172.20.11.2
 
no access-list dmz2_access_in extended permit tcp object-group Network_10.10.1.0 object-group SALES object-group SALES_Ports access-list dmz2_access_in line 200 extended permit tcp object-group Network_10.10.1.0 object-group SALES_ref object-group SALES_Ports
 
i was created SALES object group 2 month back after that ASDM Automatically created the duplicate object with SALES_ref name and changed the old ACL.

View 3 Replies View Related

Cisco Firewall :: Create Vlans In ASA 5510?

Oct 25, 2011

I need to be able to create vlans in my ASA 5510.
 
I can'T find anywhere to do this.
 
I've tried the "routers command" I know, like vlan databse and it does'nt work
 
Is there a way to "enable" vlan on a ASA 5510 ?

View 3 Replies View Related

Cisco Firewall :: Create VLan On ASA 5510 (8.2)?

Feb 25, 2013

User want to create on 5 network , 100.x , 200.x , 210.x , 250.x , 220.x .at the ASA5510, no enough port for 5 network.So I want to create 4 vlans on eth 0/3. I can create vlan but i cannot run this command " switchport mode trunk"   " "switchport trunk allowed vlan list" how can be done for that?

Actually i want to use like thisASA5510-----4 vlans on eth 0/3------switch----vlan200,vlan210,vlan250,vlan220.

View 1 Replies View Related

Cisco Firewall :: Internet Access Through ASA 5540 For Specific Network Object Group

May 2, 2011

I have a 5540, and i am trying to allow access to internet for an specific network object group, who has inside a bunch of users, who needs direct internet access without any restrictions, i have tried with dynamic NAT, but that configuration ask for a specific IP o a Network range, and is not permitted to configure an  object group as a source
 
The group is located in LAN zone, so a permission from one zone to another zone is needed i think, but i can allow the internet acess to that group Is there another way to get that , different from NAT ?

View 5 Replies View Related

Cisco Firewall :: ASA5520 / How To Use Network Object NAT To Perform Regular Dynamic PAT And Identity NAT

Jun 19, 2011

this is ASA5520 associate with 8.4(1). very simple scenario , three ports: inside . outside . DMZ my problem is how to use network object NAT to perform Regular Dynamic PAT and Identity NAT.

for example, this is my configuration

**** first i configured Regular Dynamic PAT****
 
object network myinside
subnet 10.200.11.0 255.255.255.0
nat (inside,outside) dynamic interface 
**** then , i met problem when i want to make identity NAT between inside and DMZ****
**** if i add below CLI , the first nat line will be replaced ****
**** SO IF I ADD THIS****

[code]......

View 4 Replies View Related

Cisco Firewall :: ASA 5510 Cannot Create A Interface VLAN

Mar 23, 2013

May I know the reason why we cannot create interface vlan on Cisco ASA 5510?

View 2 Replies View Related

Cisco Firewall :: How To Create Port Forward In ASA 5510

Sep 8, 2010

Successfully creating a port-forward in ASA5510, ASA version 8.3(1) ASDM6.3(1)?I have spend hours now trying, but I'm still unsuccessful.What I want is a simple: "if this particular ip-adress hits the wan interface on this tcp-port redirect to this inside ip-address on this tcp-port.I have never had any trouble on any other firewall creating something like this, but the ASA is killing me.

View 10 Replies View Related

Cisco Firewall :: 5510 ASA Cannot Create Sub Interfaces For Intervlan Routing

Apr 8, 2013

I am trying to setup intervlan routing with a Cisco ASA 5510 and two 2960-S switches. The 5510 currently is using ASA Version 7.0(2) and has a base license. I tried to create a sub interface today based on some info I found regarding the routing piece and it didn't recognize the command. I'm thinking I may need to update the IOS code or the license on the firewall. I know the syntax was correct because I looked it up and found it in a Cisco document.

View 15 Replies View Related

Cisco Firewall :: Create Dhcp Server Pool On ASA 5510

Jul 16, 2012

I'd like to create dhcp server pool on ASA 5510. I was wondering how big is the DHCP scope that Cisco ASA 5510 can support? Are there any ASA models which can support up to subnet mask 22 for DHCP scope?

View 7 Replies View Related

Cisco Firewall :: Unable To Create VLAN Interfaces In ASA 5510

Nov 13, 2011

Unable to create VLAN interfaces in ASA 5510

View 1 Replies View Related

Cisco Security :: ASA 5510 Object-group And Range Option

Feb 6, 2013

I have 3 ASA 5510s; two of which are in production and the 3rd one is new. I inherited the two in production and was trying to configure that 3rd one using some of the existing object-group network statements.  The problem is that when I try to create a range of IPs in one of the object-groups; the range command is not available. Here is one of the statements extracted from one of the production ASAs:  object network REMOTE range 62.77.130.14 62.77.130.208.Both ASAs have the same image ver (asa842-k8).  Is there something that I am missing to be able to enable the range option on the new ASA?

View 2 Replies View Related

Cisco Firewall :: Can't Create Network Objects On ASA 5505

May 17, 2011

I have a customer an exisiting 5505 which connects to multiple sites for a site-to-site VPN.  This firewall was not installed by myself originally I have just been asked to take a look now.The situation is that we now need to edit one of the existing site-to-site VPNs to include the remote sites expanded network.  I have tried doing this through the ASDM and have found that I cannot add new network objects.  I have tried creating a new network object group and then added the new networks from there but I am completely unable to add the new objects.I believe a picture tells a thousand words in this case so I have attached some images which show the problem.  I have also tried going through the VPN wizard, this also does not allow me to add new network objects. 

View 2 Replies View Related

Cisco Firewall :: 2600 - Create Simple ACL For Home Network

Aug 2, 2012

I have a home network using a 2600 and PIX515E, and unfortunetly I don't know how to set up ACLs. I read a few Cisco documentation but unfortunetly I am unable to grasp the concept of how to define them. Would anyone be able to give me a crash course on setting up ACLs?

View 3 Replies View Related

Cisco Firewall :: ASA 8.4 DNS Names In Object-groups

Jun 8, 2011

Is it possible somehow to define externally administred DNS namese in ASA 8.4 in within object groups?i know that we can use name XXX, but some idea popped up using this kind of configuration.

View 3 Replies View Related

Cisco Firewall :: Object To Twice NAT Configuration ASA5505 8.4?

Dec 18, 2011

We have an ASA5505 that we need to enable hairpinning on.... In the old firmware versions, we used to be able to configure a public to private static mapping along with hairpinning by using
 
static (inside,outside) outside_ip inside_ip netmask 255.255.255.255
static (inside,inside) outside_ip inside_ip netmask 255.255.255.255
 
In 8.4, if I use object nat, the hairpin functionality works perfectly,
 
object network obj-insideip
  nat (inside,inside) static publicip
 
however, since object nat only allows a single nat statement, I was attempting to use a twice nat to enable the hairpin functionality, but have been unsuccessful in coming up with the right combination of parameters for the functionality.
 
nat (inside,inside) source static private_object public_object destination static public_object private_object
 
allows hairpinning to successully work from the same machine.  Meaning on any given host, I can ping itself using the private or public ip, but I can't get the right combination for hairpinning from any private host to another private host via the public ip.  Other combinations have yielded icmp responses, however, they specify the private IP as the source of the reply instead of the public ip.

View 1 Replies View Related

Cisco Firewall :: Create Static PAT To Allow Host Address To Access Network Through ASA5510

Aug 23, 2012

The old syntax that I am much more familiar with has been deprecated.  On older IOS it would have been something like static (inside,outside) tcp 209.114.146.122 14033 192.168.30.69 1433 netmask 255.255.255.255  Plus an extended ACL to allow the traffic.I am trying to create a Static PAT to allow a host address to access our Network through an ASA.  I have external address 209.114.146.122 that I want to hit the external interface on an obscure port (say 14033) and translate that traffic to an internal host address on  port 1433.

View 11 Replies View Related

Cisco Firewall :: ASA 5520 - Traffic From DMZ And WAN Forwarded To Object Production

Sep 26, 2011

i have an ASA 5520 8.4(1) with following config
 
interface GigabitEthernet0/0
nameif WAN
security-level 0
ip address 216.52.185.33 255.255.255.240 standby 216.52.185.34
!

i need traffic (port 9350) from DMZ and WAN forwarded to object Production_23 port 3389, how do i achieve this ?

View 1 Replies View Related

Cisco Firewall :: 6509 - FWSM To ASASM Object Conversion

Nov 4, 2012

We are in the process of migrating to the ASA service modules on both our 6509E switches from our current FWSM. We have used the Cisco conversion tool and applied that to the service module. When viewing the context in ASDM we are unable to view the object names in the right hand pane.
 
On the FWSM I would see the following under Network Objects:
 
Network Objects
- JQ-Test
- JQ-Test2
- JQ-Test3
 
Network Object Group
+ JQ Group
      - JQ-Test
      - JQ-Test2
      - JQ-Test3
 
Now I have run the conversion tool and applied that to the ASA's I now get the following results.
 
Network Objects
- 10.1.1.1
- 10.2.2.2
- 10.3.3.3
 
Network Object Group
+ JQ Group
     - 10.1.1.1
     - 10.2.2.2
     - 10.3.3.3
 
I am aware that the naming convention on the ASA's are different to the FWSM as you can no longer use the "name 1.1.1.1 JQ-Test1" format but I was hoping that the conversion tool would do this for me.
 
Is there any way I can get the names of the object back without having to script something that takes the old FWSM format and convert it into an ASA format?

View 1 Replies View Related

Cisco Firewall :: Access List Object Name Substitution ISR871 And ASA5520

May 10, 2011

I am troubleshooting a s2s vpn between an ISR871 and my ASA5520 and I suspect a problem with my crypto-maps.
 
Is there a way I can display an access-list on the ASA and have the object names substituted with their IP addresses?

View 5 Replies View Related

Cisco Firewall :: Using Object-Groups For Easy Maintain ASA 5520 Configurations

Sep 19, 2011

After reading the post titled "ASA 5520 nat access-list query for internet access" I realized the object-group command could and should be used to make a more efficient and cleaner configuration. My current environment is very small and straight forward consisting of one FTP server in the DMZ. Though the guide: [URL] is straight forward, my inexperience hinders me from seeing how to use the commands effectively. A summary of the configuration is at the bottom of this post
 
Question: How can I clean up my current configuration? I have two references to the same server, dmz-rdp and dmz-ftp, created for port forwarding ports 3389 and ftp through the outside interface. I can combine them into one object statement, right? for each port I want to forward through the outside interface?
 
object network dmz-rdp
host 10.10.10.4
nat (DMZ,outside) static interface service tcp 3389 3389

[Code]....

View 1 Replies View Related

Cisco VPN :: ASA 5510 - Create Another VPN L2L

Jul 19, 2011

I have an ASA5510 with VPN L2L two operand normally. I need to create another VPN L2L. When you add the 3rd VPN always drop one of those that were operating. What can be?

View 2 Replies View Related

Cisco VPN :: 5510 - How To Create ASA / VPN Tunnel

Jun 11, 2013

We currently run dual ASA 5510's in A/S config on our main campus. We would like to create a VPN tunnel to a branch campus. Trying to decide between a 5505/5510/5512x, We would like to extend many of the capabilities of our network to the branch campus which will be 20-50 users on a 50mb/10mb internet connection.
 
Domain login
System Center workstation management
Cisco WCS
Shoretel voip
(Cisco NAC?)
 
Several different VLANs for wireless guest, student traffic, staff traffic, voip traffic, etc. Which device would be best and should we get the security plus license with it?

View 4 Replies View Related

Cisco VPN :: ASA 5510 / Create Different Group With VPN Remote Access

Apr 7, 2011

Last time, i´ve implemented a Remote Access VPN to my network with ASA 5510 I´ve allowed to my VPN an acces to all my Internal LAn But i want to configure a group of vpn  in the CLI for have different group of user which can access to different server or different network on my LAN.
 
Example : informatique group------access to 10.70.5.X   Network
                Consultor group -------- access to 10.70.10.X Network
 
I need to know how can i do that , and if you can give me some eg script for complete this Here is my configuration :
 
ASA Version 8.0(2)!hostname ASA-Vidruldomain-name vidrul-ao.comenable password 8Ry2YjIyt7RRXU24 encryptednamesdns-guard!interface Ethernet0/0 nameif outside security-level 0 ip address X.X.X.X 255.255.255.X!interface Ethernet0/1 nameif inside security-level 100 ip address  X.X.X.X 255.255.255.X!interface Ethernet0/2 shutdown no nameif no security-level no ip address!interface Ethernet0/3 shutdown no nameif no security-level no ip address!interface Management0/0 description Port_Device_Management nameif Management security-level 99 ip address  X.X.X.X 255.255.255.X management-only!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passivedns server-group DefaultDNS domain-name vidrul-ao.comaccess-list 100 extended

[code]....

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved