Cisco Firewall :: 5520 - Inside Server To See Actual Outside Host Source IP In Udp Packet

Mar 3, 2013

I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server.   The server can get to outside hosts OK, and the traffic is being NATed  properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send  'announcement' UDP packets to the inside server.  I thought this might be an  outside-NAT-required issue to get the traffic routed, but I need the inside server to see the  actual outside host source IP in the UDP packet, so I basically set the  outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the  destination (inside server) subnet, and its gateway is the outside  interface of the ASA, the same way the inside server is able to get to  hosts outside.  The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
 
I have the appropriate ACL's set up, and when I do 'show access-list' I  see policy hits for the 'permit' statements where the outside host is  generating the announcement and it's hitting the ACL.  I even duplicated  the ACL into list 101 and 102, and applied 101 for inbound traffic on  the outside int, and applied 102 for outbound traffic on the inside int,  and I'm seeing policy hits on both permit statements outside and  inside, so it looks like the traffic is being passed on to the inside  interface and permitted, but the server isn't seeing the packets.
 
I can ping the outside interface from the outside, but cannot ping the  inside interface or any inside hosts from the outside, even though I  have 'permit icmp any any' enabled on the ACL on both ints. When I  remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
 
I set up the same scenario in my lab with an ASA 5505, with the same results.  Below is the running config from the 5505 in the lab.  The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
 
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
description Inside LAN Interface
nameif inside(code)

View 6 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5520 - PING From Outside Into Inside Host

May 13, 2013

I have ASA 5520. I cannot ping the host(192.168.1.20) which is inside firewall from outside hosts. Inside host (192.168.1.20) is translated into (198.24.210.226) using static NAT.From outside host, I used "PING 198.24.210.226".  Is it because I used dynamic PAT for inside hosts?

interface GigabitEthernet0/0nameif outsidesecurity-level 0ip address 198.24.210.230 255.255.255.248!interface GigabitEthernet0/1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0

[Code].....

View 3 Replies View Related

Cisco Firewall :: ASA 8.4 - Connection Fails When Host On Inside Tries To Connect To Server On Outside

Mar 9, 2011

We are using an ASA with 8.4 in transparent mode. Connection fails when a host on inside tries to connect to a server on outside. This server uses mac-address 0100.5E00.0000 to load balance but replies with real mac-address.Firewall logs "Deny TCP".ARP inspection is disabled.

View 2 Replies View Related

Cisco VPN :: ASA 5505 - Remote Firewall Does Not Receive Single Packet From Source IP

Jun 3, 2012

I have setup an asa 5505 with multiple sub nets (plus license) and a vpn tunnel (ipsec) between this and an other asa on a second branch office (multiple vlans) . Now I need to route only two vlans from the first site to reach some of the second branch networks
 
let's call them: 1 branch
A-172.16.4.0/24
B-172.16.2.0/24
 
2 branch 
C- 10.10.10.0/24
D- 10.20.10.0/24
E- 10.66.10.0/24
 
the tunnelis ok From A to CDE . but from B to CDE won't come up. pinging is unsuccessful as well as all other traffic. the connection profile is setup to have both A and B as local networks and A and B by the moment share the same access rules configuration.
 
logs show firewall 1 let pass and build connections, without denies, but remote firewall does not receive a single packet from the source ip from network B.

View 2 Replies View Related

Cisco Firewall :: ASA5580 One Inside Source Address Static Nat To Two Outside Interface

May 10, 2012

customer has a server which located in inside interace.    and an outside interface connected to ISPA.    cu config a static nat map inside server address to ISPA address, one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.

View 3 Replies View Related

Cisco Firewall :: ASA5580 / One Inside Source Address Static Nat To Two Outside Interface?

Jul 13, 2011

i have a problem  customer has a server which located in inside interace.  and an outside interface connected to ISPA.  cu config a static nat map inside server address to ISPA address one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address.    the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580.  i want use route-map on static nat, but it will not satisfy customer's request.

View 6 Replies View Related

Cisco Firewall :: ASA 5505 - Allow (outside) Host To (inside)

May 20, 2011

I have a ASA 5505 Sec Plus. I would like to allow outside hosts to our mail server and also our FTP server. So i would like to allow only SMTP, HTTP (for Outlook Web Access) and FTP.

View 10 Replies View Related

Cisco Firewall :: ASA5505 - Can't Ping Inside Host

Sep 29, 2012

I just try to ping a internal Host but it want to go.
 
Laptop<===>ASA5505
 
Connected is the Laptop at Ethernet 0/2 Inside
 
My running-config is a clear config, only VLAN 1 has a IP and Ethernet 0/2 is up.
 
But If I try to ping to the Laptop I get the followed:
 
asa5505# ping 192.168.1.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
asa5505#
 
From the Laptop to the ASA5505 I can Ping successfully.

View 6 Replies View Related

Cisco Firewall :: ASA (8.4) / Redirect Outside IP Request To Inside Host

Mar 27, 2012

Wondering if on the ASA (8.4) its possible to do something like what DNS rewrite does, but with IP requests.  Scenario.  Mobile phone accesses a web app inside our network fine over cellular.  Once it comes inside on to wifi it still has the public IP address cached so the ASA doesn't allow its request to loop around and the app appears broken.  We're considering lowering the TTL on the DNS host entry but I think we are battling phones/mobile OS's that don't have a strict adherence to name resolution standards.  A lot just seem  to refresh their caches every 10-15 minutes.

View 4 Replies View Related

Cisco Firewall :: ASA5505 Cannot Ping Inside Host

Aug 2, 2011

I have Cisco ASA 5505  installed  and use as default gateway. I go to Internet through the ASA5505 Here is my Problem.I can not ping from ASA prompt(ASA#) to my Laptop connected to the ASA, but i can ping the ASA inside interface from laptop i can not use ASDM  and the VPN Tunnel is not working between the sie
  
ASA# ping 10.10.10.12
???????????
100% lost 
Laptop c
C:/ping 10.10.10.1
!!!!!!!!!!!!!!!!
 
Here is the Topology
 
INTERNET .<=========================>ASA<===============================> LAPTOP
  
I disabled window firewall on the Laptop , but no goof result.

View 3 Replies View Related

Cisco Firewall :: Unable To Ping Host From Inside Interface From PIX525

Feb 3, 2012

When I tried to upgrading PIX525  6.3 to  7.0 , Not able to Ping the host from the PIX 525 Inside interface  which is on the same subnet,  Also from the host to Inside Interface ,  Tried with Directly connected  laptop with Cross cable and using Straight cable via switch, But the  results end with fail.

View 2 Replies View Related

Cisco :: Configure NAT For Inside SMTP Server In ASA 5520

Sep 20, 2012

I need to configure my ASA 5520 version 7.3 firewall to translate our SMTP server residing in local LAN to use different IP address from the outside interface which is used by all other computers to access Internet.

Under NAT section, i have NATted this internal SMTP server with different IP address(eg x.x.x.1) and also translated the remaining IP addresses in the LAN to the outside interface(eg x.x.x.2)

my problem is, Whenever i check the header for message coming from the smtp server it shows that, the SMTP server is also translated by using the same outside interface public ip address(i.e x.x.x.2) which is used by other client machine to access internet instead of the x.x.x.1.

how i can get my SMTP server to use separate IP and avoid to be blacklisted by some domain.

View 3 Replies View Related

Cisco Firewall :: ASA5585X - Packet Rate On Inside And Outside Interface Doesn't Match

Oct 24, 2012

I am doing some per-deployment testing with a ASA5585X and noticed that when I feed it a stream of SYN packets on the outside interface the measured traffic rate on the inside interface going out is about 10x the rate of the outside interface going in.
 
laptop ---  ASA --- PC
 
I send 6k TCP SYN pkt at interface rate from the laptop targeted at PC. No packets are dropped by Ac Ls or policies and can be sniffed at the PC.
 
Show interface commands show:
sh int inside:
... ...
  Traffic Statistics for "inside":
...
1 minute input rate 23 pkt/sec,  1303 bytes/sec
1 minute output rate 4454 pkt/sec, 820757 bytes/sec
  
sh int outside:
... ...
Traffic Statistics for "outside":
...
1 minute input rate 885 pkt/sec,  70847 bytes/sec
1 minute output rate 7 pkt/sec,  425 bytes/sec
 
I would expect that if 885 pkt/sec enter the firewall on the outside interface the same amount or less would exit it on the inside...? Why this is not the case? The packet rate is about 5x and the data rate is about 10x greater.

View 6 Replies View Related

Cisco Switching/Routing :: 5520 To Redirect An External Address To An Inside Server

Mar 21, 2012

I am desperate to make some kind of translation which convert an outside IP Address of our web server to its inside ip address so that requests can be routed internally to the server.
 
This is what we have:  A wireless network with an SSID to serve visitors.  We also have an in-house web server which can be accessed internally and externally.  We have a ASA 5520 that protects the internal network, including the Web server, and also routes all traffic from the all visitors connected to the public SSID to the outside.  The DHCP server for the wireless network for visitors is configured to give the 8.8.8.8 as dns server.  The problem with that is that the www.ourwebserver.com is resolved by Google's dns server to the public IP Address of our web server!  The traffic then is sent to the outside interface of the ASA 5520.  The visitor who wants to access our web server cannot connect!
 
How can I configure the ASA to route that traffic to our web server with the public ip address to the inside ip address of the web server?

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - SSH From Internal To DMZ Host

May 13, 2012

I am not very familiar with ASA 5520 yet.I have been able to allow the OUTSIDE world to connect via SSH to the intermal host 172.17.2.50 on my DMZ network. I've created a NAT rule and an ACL as written on the configuration below.
 
Now I need the INTERNAL network to ssh 172.17.2.50 but ASA stops me with the following error: [code]

View 2 Replies View Related

Cisco Firewall :: Host Cannot Browse And Allowed With Asa 5520

Apr 20, 2013

Port forwarding done to a DMZ located server on the cisco ASA 5520. Now this host cannot browse but allowed outside to inside access is possible Is there anyway i can give this system to browse internet? may be through the natted IP ( 94.20.*.*)

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Creating Host Objects Via CLI

Nov 3, 2011

I am trying to create host objects that I'll then add to network-object groups for use in ACL/ACEs.When I try to create a host I am having trouble adding the IP address.I then get an error saying the host name must start and end with letters or numbers and only contain letters or numbers. What do I need to do to create hosts from CLI?

View 2 Replies View Related

Cisco Firewall :: 5520 / Add NAT For Outside X.x.x.77 Going Inside X.x.x.22 Port 80?

Oct 3, 2012

I have an ASA 5520 Cisco Adaptive Security Appliance Software Version 8.4(2)8 Device Manager Version 6.4(5)206. I am trying to add a nat for outside x.x.x.77 port going inside x.x.x.22 port 80 . the wan interface is .74 with subnet of 255.255.255.248 the rule will add but traffic wont pass in.

View 14 Replies View Related

Cisco Firewall :: 5520 Can't Access From DMZ To INSIDE

Mar 13, 2012

I have a cisco asa 5520 ios 8.2. This is my configuration [code] But i can not access from DMZ to INSIDE.

View 3 Replies View Related

Cisco Firewall :: 5520 - Traffic From Inside To Outside

Mar 2, 2011

I am setting up a pair of 5520 in A/S mode but the traffic from inside to outside seems blocked somehow.

asa01# sh run : Saved
ASA Version 8.3(1)
host name asa01
enable password LFJ8dTG1HExu/pWQ encrypted
password 2KFQnbNIdI.2KYOU encrypted
names
[code]......

Base on the above configuration, I still cannot ping or HTTP.

View 10 Replies View Related

Cisco Firewall :: ASA 5520 NAT And DMZ / Inside Network Configuration?

Jan 27, 2013

I am trying to configure a server(192.168.5.50) in DMZ(192.168.5.0/24) to be able to communicate with a domain controller(10.5.44.220) in the inside network(10.5.44.0/24). I made some configuration using ASDM(not familiar with the CLI) but not working and it caused existing NAT not to work, for example RDP(TCP 3389) connection to 38.96.179.220
 
The things I am trying to achieve are
 
1. two way commucation between 192.168.5.50 in DMZ and 10.5.44.220 in Inside for SecureAuthPorts and SecureAuthOutbound service groups

2. NAT for 192.168.5.50 mapping 38.96.179.50 for the service groups mentioned above

3. NAT for other hosts already existing

View 2 Replies View Related

Cisco Firewall :: 5520 Can't Get Traffic From Inside To Internet

Nov 27, 2011

I am trying to make a basic config on my 5520. The first goal is to make trafic from inside to outside.The internet address is 64.28.29.200 and the default internet gw is 64.28.20.193What am I missing since I can not get trafic from inside to the internet? [code]

View 10 Replies View Related

Cisco Firewall ::5520 - NAT SIP Registration From Outside To Inside Interface On ASA?

Mar 7, 2012

I'm trying to NAT SIP registration from OUTSIDE interface to Inside interface on ASA

View 1 Replies View Related

Cisco Firewall :: DMZ Access To Internet And See Inside On ASA 5520

Sep 23, 2012

I am new in ASA, I have the DMZ (10.1.1.0/24) configured on ASA 5520 and I achieve the reach Internet from DMZ (10.1.1.0/24), but now need reach DMZ from inside (172.16.12.0/24) and inside (172.16.12.0/24) from DMZ  (10.1.1.0/24), in other words round trip.

View 6 Replies View Related

Cisco Firewall :: ASA 5520 - Host 300+ Secure Websites Using Couple Of Public IPs

Jun 22, 2011

How can we host 300+ secure (https) websites using a couple of public IP's on an ASA5520 with AIP SSM-20 and with as few certificates as possible?
 
Summary of set-up:
We currently host a number of websites using an ASA5520 and use host headers, so have 6 servers with around 40 hosted URL's. The number of websites is due to double very soon and we will need to use more of our public IP's. We can see that we will will run out of public IP's very soon especially as there is a project in the pipeline that has a likely requirement to host an additional 200+ websites.

Each of these websites are required to use https and therefore each must have a certificate which will be very expensive. PCI DSS (payment card industry data security standard) is causing us issues because we had hoped to post the certificates on the firewall (one for each physical server) and then run the data UN-encrypted from the firewall to the relevant web servers, so that we could use one certificate for lots of websites and therefore reduce our certificate costs, however is not best practice to do this due to the data being unencrypted within the firewall and on the DMZ network and therefore potentially open to compromise. I doubt that we could install 200+ certificates on a 5520 and then re-encrypt the data to the web servers especially seeing as we also have an IPS card that is already running at around 70-80% util due to the performance overhead.
 
BTW - We also have an in-line Breach WAF which will be required to inspect the packets (certificates to be installed on the WAF to allow this).

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - Static Route To Inside Interface

Mar 29, 2011

I have inherited an ASA 5520.  In doing some auditing of the setup, I have noticed a Static Route that has the inside interface of the ASA as the Gateway IP.  I am trying to understand the purpose of this route or why a route would be setup this way.

Example Static Route:
Inside 10.xx.31.0 255.255.255.0 10.xx.xx.10 (10.xx.xx.10 is the inside interface of ASA)

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Permit Traffic To Inside Via MAC - Address?

Apr 6, 2011

I have a handheld device that will be used for inventory outside of our office. It has 3g capabilities. Is there anyway I can permit traffic from this device from the outside world coming into my network?  I need to open a couple of ports so it can hit the server. But I have no intention to open these ports up to the entire world.  I use an ASA 5520 with a managed router from our provider. I looked around on the Cisco site and the only information I found was for permitting and denying traffic from devices that are within the network.

View 2 Replies View Related

Cisco Firewall :: Configure Secondary IP On Inside Interface Of ASA 5520?

Nov 24, 2012

We already have a subnet defined to inside interface and is in produciton. the default gateway is this interface ip. In that setup now I have to add one more subnet and as the first subnet is been defined in ASA indside interface, I have to assign secondary Ip to the inside interface so that new subnet users can easily reach here and go outside.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 / Deny IP Spoof On Interface Inside

Jun 17, 2012

I'm trying to attach tacacs server (ACS Version 5.2) in server group on ASA 5520 (Version 8.4). When I test connection in ASDM (Version 6.4) between ASA and ACS it fails. The log message on ASA is:
 
%ASA-2-106016: Deny IP spoof from (10.8.27.126) to 10.8.48.10 on interface inside.
 
Packet-tracer from ASA is:
 
InternetASA# packet-tracer input inside tcp 10.8.27.126 4444 10.8.48.10 49
 Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

[code]....
 
What access-list or implicit rule may be the reason of denying these packets?

View 2 Replies View Related

Cisco Firewall :: ASA 5520 With 9.0.1 IOS - Capture To Inside Interface Not Supported

Dec 9, 2012

I recently upgraded my 5520 to 9.0.1 IOS.  Today I tried to apply a capture to my inside interface referencing a simple ACL and I get this error.
 
ERROR: Capture doesn't support access-list <capin> containing mixed policies
 
I also created a capture for the outside interface with a similar ACL and it worked just fine.  I can't seem to find anything on the web that gives me a clue to resolving the error above. 

View 7 Replies View Related

Cisco Firewall :: Unable To Ping Inter Interface (inside To Outside) Of ASA 5520

Jul 26, 2011

I am unable to ping inside interface (Rin) to outside interface (Rout) of my Cisco ASA 5520 runing on ASA Version 8.4(1). 
 
ASA Version 8.4(1)
!
hostname FW5520

[Code].....

View 10 Replies View Related

Cisco WAN :: 2911 - IP Nat Inside Source Static

May 6, 2012

I need to open a port in a Cisco 2911 router to permit the conexion to an equipment that is inside the LAN, but I my configuration doesn't workt.
I have 3 interfaces configured: two WAN interfaces (one is a backup of the other) and a LAN interface. The configuration is this (public IPs are changed):
 
track 1 ip sla 1 reachability
!
!
interface GigabitEthernet0/0
description backup
ip address 176.55.25.25 255.255.255.252
ip nat outside(code )

View 16 Replies View Related

Cisco Firewall :: Asa 5520 / Configure Two Static Nat Statements From Inside To Outside And Backup Interface?

Oct 16, 2011

I have a asa 5520 with an outside and backup interface. I am trying to configure two static nat statements from the inside to the outside and backup interface. Here is what I have configured so far.

object network obj-10.1.1.254
host 10.1.1.254
object network obj-10.1.1.254
nat (inside,outside) static 172.25.10.3
 
I want to also use nat (inside,backup) static 172.25.10.3

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved