Cisco Firewall :: 5520 - SSH Socks Tunnel Set Up On Server

Jul 18, 2012

I have the following setup 
|| Socks Server || >> Switch1 >> ||Cisco 5520 ASA || -->> | Switch 2| -->> Clients
 
I have a SSH SOCKS tunnel set up on the socks server which is a Linux box. When I connect my machine to the switch 2, I am NOT able to receive and mail by setting up a mail client and it seems SOCKS traffic does not reach the socks server. I can however run a telnet command on port 1080 (socks port) which connects  which shows that the port was going through and open. However there was no SOCKS traffic. When I connected the machine to Switch 1, SOCKS traffic worked as expected and I was able to receive mail.

This suggests to me that the ASA has some inherent rule that does not allow SOCKS traffic. IS this true and if so how can I bypass this?

View 4 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5520 VPN Tunnel Up But Not Traffic

Nov 1, 2012

We just migrated from a single 5510 to a dual (failover)  5520, It seems that everything is working except the remote VPN. We can establish a tunnel and authenticate as local users, (going to LDAP when all is working) but no traffic is passing. I know I am overlooking something but cant see it. [code]

View 12 Replies View Related

Cisco Firewall :: ASA 5520 8.3 VPN Tunnel Drops Traffic

Aug 23, 2011

We have a 100 Mbps WAN circuit, we have configured an IPsec tunnel between ASA 5520 and Cisco 3845 Router for our DR site replication via Veeam Backup and Replication, it was working fine before, when we established the 3DES tunnel the traffic for certain subnets is dropped after an hour and it stops the replication, although tunnel remains up and we can access the other subnets, as soon as we clear the crypto SA and ISAKMP sessions on the firewall the traffic starts flowing again and then after an hour the traffic is dropped again.So far the testing and differnet configurations we tried are as under.
 
Tried with a different MTU size both on firewall and ESXi servers but nothing happened.Their is no QOS configuration.Checked the utilization on both ends its Noram although their are subsequent 100% spikes on Cisco 3845 but on average it remians at 30-40%.

View 6 Replies View Related

Cisco Firewall :: 5520 - VPN Tunnel Not Working Properly?

Jan 11, 2012

I am getting the below  messages in my cisco asa 5520, during this time tunnel is down. just what to check whether the problem is at remote FW or with asa

[code]...

View 4 Replies View Related

Cisco Firewall :: 5520 - Remote Access VPN Through A Tunnel?

Oct 17, 2011

I have a site to site VPN between SiteA to SiteB which is working fine. SiteA has an ASA5520 and SiteB Pix501. The ASA5520 is running version 804 with split tunneling. Users connect to SiteA using remote access VPN. Is it possible to setup SiteA ASA5520 so that when users connect to SiteA they can access servers located on SiteB through the tunnel? I know i can setup the Pix501 for remote access VPN but it is located in another country and i don't want to take a chance just incase i lose connectivity.

View 7 Replies View Related

Cisco VPN :: Monitor Tunnel That Has End Devices ASA 5520 And NetScreen Firewall?

Dec 27, 2011

Monitor a VPN tunnel that has as end devices a Cisco ASA 5520 and a NetScreen Firewall. I'll like to be receive an alert when the VPN is down.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - IPSec Tunnel Without Private Network

Apr 11, 2013

I'm trying to achieve a site-to-site ipsec tunnel to a Cisco ASA 5520.  Most examples feature the ASA with a public interface that terminates the tuennel and a private network on another interface that the tunnel interacts with.  Where my scenario differs is that the interface that accepts the tunnel is part of a public /29 network where I want the remaining hosts on that subnet to be able to route thrugh to the other end of the tunnel.  My tunnel gets established, but any attempts to route via the IP assigned to that one interface result in the ASA rejecting traffic. If so, what configuration options should I consider?

View 5 Replies View Related

Cisco Firewall :: Command To Check IPSEC Tunnel On ASA 5520?

Jan 7, 2013

Need to check how many tunnels IPSEC are running over ASA 5520.Tried commands which we use on Routers no luck?

View 6 Replies View Related

Cisco Firewall :: ASA 5520 - NTP Server For Firewall Clock Setting

May 22, 2013

I have ASA 5520 installed. I want to use ntp server for firewall clock setting. I found one open-access ntp server (stratum 2) in Los Angeles:
 
[URL] 209.151.225.100
  
Can I use the following command to set ntp server?
 
ntp server 209.151.225.100 source outside.

View 3 Replies View Related

Cisco Firewall :: Can't Access Web-server Behind ASA 5520 8.4(2)

Dec 13, 2012

How can I access my webserver (on my private LAN) from the internet? INTERNET------------(53.X.X.1 )ASA(192.X.X.X)DMZ-----------(192.X.X.80)HTTP SERVER. I can ping my public address on the ASA outside interface 53.X.X.1 form the internet, but I'm not sure how to do this. I tried to NAT, but I'm failing.

View 3 Replies View Related

Cisco Firewall :: Web Server (linux) Sits In The DMZ (asa 5520)

Jun 28, 2012

I Have web server (linux) sits in the DMZ (asa 5520) segment and this server should be accessible form the internet,
 
1)how to make this server  https based access over SSL
 
2)how to protect this server form network and security standpoint?

View 6 Replies View Related

Cisco Firewall :: ASA 5520 Versus ISA Server 2006

Mar 28, 2011

currently my firewall is Microsoft ISA Server 2006 and im using it very nicely but based on some security treats im changing my firewall from isa to ASA 5520 but im facing a problem that my i had installed on software name Soft Perfect Bandwdith Manager and i was limiting each users based on their MAC address to prevent using of full bandwidth in my internet so thats why i had a very relialble internet useage in my network.
 
after many search and searching i didnt find a good software or hardware that should support with Cisco ASA Apliances to support bandwidth management for endpoint users and etc and this is very troubel i dont want all users to use full badnwidth in my company becouse i have only 2MB internet badnwith taken via VSAT connection

View 3 Replies View Related

Cisco Firewall :: 5520 Can't Access Internal Web Server From Outside Network

Aug 23, 2011

I am using ASA 5520 with 8.2.4 IOS. I'm new to ASA/Firewall. I need to do access webserver from outside network.From Laptop (192.168.2.51), If I connect to url... it should open page from 10.10.10.50.I also need to ssh to webserver from laptop. If I ssh to 192.168.2.50 from laptop, it should connect to 10. 10. 10.50. [code]I can't get to webserver from outside network, so now, I connected laptop to directly ASA 5520 outside port with crossover cable.ASA Inside port connects to L3 switch. Webserver also connects to L3 switch. But still doesn't work.

View 9 Replies View Related

Cisco Firewall :: 5520 L2TP Pass Through To Windows Server

Oct 2, 2012

We have a Cisco ASA 5520
 
We are attempting to setup RRAS on Windows 2008R2 using L2TP. Server is on the inside of the network at 10.10.10.20 our ASA is 10.10.10.1 its outside interface is 68.0.0.0.3/28.
 
I set a static NAT rule to allow all traffic pointed at 68.0.0.4 to be directed to 10.10.10.20 and have ACLs allowing the following.
esp, ah, udp/500, udp/4500, udp/1701
 
Mac Clients have no issues with but windows clients seem to hang and never connect. I know the ASA configuration is somehow to blame, if I attempt to connect to LAN IP (10.10.10.20) from withn the same network every thing works fine (making sure all the Windows Issues are covered).We have 2 other IPSEC tunnels established to teh ASA from our COLO and a Satalite office, not sure if this makes it any harder.

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Access Current Server Using External SNAT IP

Dec 8, 2012

I have an ASA 5520 with a DMZ with private addresses that I SNAT to my outside network. From inside the DMZ I can reach servers by both the internal private IP and the public IP, except if the IP is from the server trying to connect. So, say I have server1 and server2. I can connect from server1 to server 2 with both public and private, but can't connect from server1 to server1' using the public IP. ASA logs show that packets are being denied due to land attack. DNS doctoring is not an option for me.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - User Lose Session With Server While VPN Still Established

Jul 7, 2012

i have user connected to office using Cisco vpn client , Cisco asa 5520 acts as vpn gateway, frequently the users got disconnected from the server while the VPN still established and not disconnected!
 
what is the cause of the issue , where the fault is located ? how to start the troubleshooting to figure out the issue?

View 1 Replies View Related

Cisco Firewall :: 5520 - Inside Server To See Actual Outside Host Source IP In Udp Packet

Mar 3, 2013

I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server.   The server can get to outside hosts OK, and the traffic is being NATed  properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send  'announcement' UDP packets to the inside server.  I thought this might be an  outside-NAT-required issue to get the traffic routed, but I need the inside server to see the  actual outside host source IP in the UDP packet, so I basically set the  outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the  destination (inside server) subnet, and its gateway is the outside  interface of the ASA, the same way the inside server is able to get to  hosts outside.  The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
 
I have the appropriate ACL's set up, and when I do 'show access-list' I  see policy hits for the 'permit' statements where the outside host is  generating the announcement and it's hitting the ACL.  I even duplicated  the ACL into list 101 and 102, and applied 101 for inbound traffic on  the outside int, and applied 102 for outbound traffic on the inside int,  and I'm seeing policy hits on both permit statements outside and  inside, so it looks like the traffic is being passed on to the inside  interface and permitted, but the server isn't seeing the packets.
 
I can ping the outside interface from the outside, but cannot ping the  inside interface or any inside hosts from the outside, even though I  have 'permit icmp any any' enabled on the ACL on both ints. When I  remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
 
I set up the same scenario in my lab with an ASA 5505, with the same results.  Below is the running config from the 5505 in the lab.  The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
 
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
description Inside LAN Interface
nameif inside(code)

View 6 Replies View Related

Cisco Firewall :: ASA 5520 CIFS Doesn't Work For Share Folder On Windows Server 2008 R2

Jun 26, 2010

I am using ASA5520 with webvpn for file sharing. But recently we just upgraded the OS that accommodate file shared folder from win2003 R2 32bit to windows server 2008 R2 64bit. Now I have a problem with accessing file share by ASA webvpn, it appears error contacting host, we have tested the file shared of webvpn on the other OS windows 2003 and windows 2008, they are working on these OS except win2008 R2. Current the ASA OS version is 8.0(2). And the windows firewall has been disabed.

View 3 Replies View Related

Configure VMworkstation To Use Socks?

Oct 30, 2012

I'm looking for to step-by-step guide on how to tunnel all traffic through a local socks client.I'm Widows 7.I just wanna point Vmware to 127.0.0.1 just as I would any other app.

View 5 Replies View Related

Can't Connect To SOCKS Proxy

Mar 23, 2012

I've been trying to use BTguard whith vuze but no matter what I try I keep getting this error.Connection Error (Socket Exception:Can't connect to SOCKS proxy:Connection refused : connect(t) I can't really tell where the problem is, with Vuze, Router, BTgaurd.I've been digging through old posts and Google for well over 4+ hours straight, haven't even got out of this chair yet trying to fix this.

View 3 Replies View Related

Cisco VPN :: VTI Tunnel Using ASA 5520

Mar 4, 2013

Can i use at one site  ASA 5520 and another site Router to configure VTI tunnel with OSPF routing?

View 1 Replies View Related

Possible To Make A Socks Proxy Which Dumps All Outgoing Connection / Packets To File

Apr 11, 2012

Would it be possible to make a socks proxy (not normal http) which dumps all outgoing connection/packets to a file then can change the file then re-send it?

View 1 Replies View Related

Cisco VPN :: ASA 5520 How To Assure About Having IKEv2 Tunnel Instead Of SSL

Mar 18, 2012

I've ASA 5520 with 8.4(3) running.I want to set up VPN remote access using following document url...I managed to get a connection running, but when I check the connection on the ASA, it shows as a SSL-tunnel, not an IKEv2 tunnel.How can I assure I have an IKEv2 tunnel instead of a SSL tunnel ?Can I do with annyconnect same kind of connections I used to do with the Cisco VPN client for IPSEC?

View 4 Replies View Related

Cisco VPN :: Establish Tunnel From Client To ASA 5520

Oct 2, 2012

I have remote branches that connect to the corporate office as a site-to-site VPN. Now the clients at the branch are getting an application that is using an unsecured port (tcp/23). I would like to use a set of ASA 5520's that I have at the corporate office, with the AnyConnect license on them. I want the client machines to establish a tunnel from the client to one of these ASA's. The ASA' then would have a connection to the VLAN that the receiving server is housed on. The trick is to just establish the tunnel from the client to the ASA that will allow the IP of the client to not be translated. So I would use the ASA as a security 'pass-through' for the clients that use this new application.

View 1 Replies View Related

Cisco VPN :: ASA 5520 - Tunnel Up But Can't Access LAN For Each Side

Nov 1, 2012

i have configured site to site VPN between asa 5520.

Site A (192.168.56.0/24)------ASA5520------Internet--------- ASA5520-------Site B ( 192.168.255.0/24)
 
VPN tunnel is up but i cant access LAN for each side. config Site A 

host name CCASA 
name 192.168.255.0 CCNetwork
dns-guard interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 41.41.38.156 255.255.255.248
[code]...

View 5 Replies View Related

Cisco VPN :: 5520 - Tunnel Up But Not Passing Traffic

Jan 15, 2012

I have a site to site tunnel between two 5520 ASAs.  Tunnel is up but when I try to talk to the other side, the implicit deny on the inside interface of the local ASA blocks the traffic.  When I ping, the tunnel comes up but in the logs it says it is blocking icmp from inside to outside.  I have tried the sys opt connection permit-vpn but it is not working.  The traffic is from 5 specific machines within the local sub net that I put in a network object group called Celerra_Replication.

I want to them to be able to talk to 5 machines on the far end of the tunnel in a seperate sub net.  They are in a net wrok object group called GP_Celerra_Replication The ACLs I created for this appear to be created correctly allowing IP from Celerra_replication to GP_Celerra_Replication and the opposite on the other side. 

View 1 Replies View Related

Cisco WAN :: 871 / 5520 - L2L IPSec Tunnel Between Two Routers

Apr 4, 2011

Here is the situation: A CISCO871 router is configured to establish an IP SEC tunnel with a CISCO ASA5520. The configuration is OK about that. I wish to configure the same CISCO871 in order to establish a LAN-to-LAN IP sec Tunnel with another CISCO871 at the same time in order to reach private network. So, I have followed the Cisco procedure Document ID: 71462 "LAN-to-LAN IP sec Tunnel Between Two Routers Configuration Example"; it works, I can reach the peer private network BUT ONLY when the IP SEC tunnel with ASA is not established.
 
It seems to be a routing problem...I don't find how to configure to make both tunnels up and functional at the same time.

View 1 Replies View Related

Cisco VPN :: ASA 5520 - Monitor / Trace VPN To VPN Tunnel Traffic?

Sep 7, 2011

I have a two ASA 5520's  and I want to be able to see or monitor the traffic between each tunnel. I am using external addresses but for the sake of this question I will use the following: 1.1.1.1  to 2.2.2.2 .   How can I montior the traffic? 

View 3 Replies View Related

Cisco VPN :: Crypto ACL Asa 5520 Direct All Traffic To Go Over Vpn Tunnel

Feb 14, 2013

we have a L2L-VPN-Tunnel beetween our Headquarter (ASA5520 with Network 10.100.1.0) and a branch office (Cisco1841 with network 10.100.10.0 ). This works fine for years, but now we wish to change the configuration so that ALL traffic from the branch office goes over the vpn-tunnel. My question: How I have to change the crypto acl to reach this. Below the relevant parts of the branch route.

View 6 Replies View Related

Cisco VPN :: ASA 5520 8.4(3) Tunnel Default Gateway And Various Subnets

Apr 9, 2012

I am struggling on a problem for over 2 weeks despite of various researches.
 
We have a Cisco router, then an ASA 5520 8.4(3).
The private interface of the ASA is connected to a switch, and so on connected to one interface of the router.
The private interface is as following : 129.88.63.253 255.255.248.0 (/21) =>
It is in the 129.88.56.0/21 subnet
 
Here is the part of the router config we are interested in  :
!
interface Vlan32
ip address 129.88.63.254 255.255.248.0 (this is the tunnel default gateway configured on the ASA - 129.88.56.0/21 subnet)
ip address 129.88.71.254 255.255.255.0 secondary
ip address 129.88.75.254 255.255.252.0 secondary
ip access-group CVPN-depuis-129.88.56 in
ip access-group CVPN-vers-129.88.56 out
ip verify unicast source reachable-via rx allow-default
no ip redirects
mls rp ip
!
 
On the ASA, there is currently one default route for the tunneled traffic :
route Private 0.0.0.0 0.0.0.0 129.88.63.254 tunneled
As you can see, it's on the same subnet as the primary IP address of interface Vlan32 on the router.
 
The scenario is as following :
- we can connect to the VPN with the appropriate alias (LDAP connection), then we get an IP address in the defined range (it's a local ASA pool)
- the pool is : 129.88.71.0/24
- but, once we are connected, we can't do anything, because it seems like we don't have any network access

View 9 Replies View Related

Cisco VPN :: VPN Tunnel Between ASA 5520 And Juniper Tears Down Intermittently

Feb 13, 2013

VPN tunnel between ASA 5520 ver 8.0(4) and a remote Juniper firewall keep tearing down during Phase 1 rekeying.  After the rekeying process fails, manually pinging one of the remote hosts that are proteced behind the Juniper firewall,initates the tunnel renegoation and rebuilds the tunnel successfully.
 
When the tunnel is down,  sh crypto isakmp sa shows no active SA for the remote peer.  That indicates the PHASE 1 negotation had indeed failed.When the tunnel is working, sh crypto isakmp sa indicates an IKE role of Responder - always.Clearly that also means Phase 1 negotation works only one way, i.e. negotation initated by the remote Juniper unit only.
  
Interestingly, the Syslog server logged the following SNMP trap messages at the time rekeying Phase1.Note, Line#2 and #7 and wrapped to the next line for easy of reading.
  
Line#1:   IP = Remote-Peer-IP-#, Starting phase 1 rekey
Line#2:   IP = Remote-Peer-IP-#, IKE Initiator: Rekeying Phase 1, Intf outside,
IKE Peer Remote-Peer-IP-# local Proxy Address N/A, remote Proxy Address N/A,  Crypto map (N/A)
Line#3:   IP = Remote-Peer-IP-#, constructing ISAKMP SA payload

[code]...
 
As I understand from the above syslog trap, the Responder ( the ASA unit this time) started Phase 1 rekey (Line #1).  It prepare a message to be sent to IKE Initiator, that it is about to start rekeying Phase 1 (Line #2). Down on the next line, it indicated that the local Proxy, remote Proxy and Crypto map as N/A ( not avaiable).Why would the ASA unit send N/A message as shown in Line#2, is that normal?

View 3 Replies View Related

Cisco VPN :: 5520 Feature That Allow To Have Backup VPN Tunnel On At Secondary ISP

Oct 8, 2011

My question is very simple is there any way or feature that could allow us to have a backup VPN tunnel on at the secondary ISP at the asa 5520? Lets assume if the primary isp goes down is there any way for  the VPN tunnel come online at the backup isp ? [code]

View 2 Replies View Related

Cisco VPN :: 5520 - Monitoring IPSec Tunnel Bandwidth Utilization

Sep 8, 2011

We have a Cisco ASA 5520 supporting multiple VPNs - both remote-access  and Lan-to-Lan.  We would like to monitor the bandwidth utilization of the IPSec Lan-to-Lan tunnels.

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved