Cisco Firewall :: 5545x - Create NAT From Outside To Inside Using Services?
Nov 21, 2012Do you know how to create a static nat from outside to inside and using services, this is a firewall 5545x
View 9 Replies
ADVERTISEMENT
Cisco Firewall :: How To Configure PAT On ASA 5545x
Nov 15, 2012Do you know how to configure PAT on Cisco ASA 5545x?
View 2 Replies View RelatedCisco Firewall :: How To Upgrade From ASA 5520 (8.2.5) To ASA 5545x
Feb 11, 2013Due to increase of demands on our ASA cluster, we need to upgrade to a new cluster of 5545x. Our current config contains a lot of S2S & NAT
View 1 Replies View RelatedCisco Firewall :: ASA 5545X And Two ISP Load Balancing
Mar 2, 2013I have two Internet connections which are connected to two ISR 2951s. Also I have two ASAs 5545-Xs, which I want to use in Active/Active failover mode with multicontext. The question is: how can I configure ASAs to perform ISP load-balancing as well?
View 4 Replies View RelatedCisco Firewall :: ASA 5545X OSPF Failover?
Jan 21, 2013I have two switches and two ASA in active/standby as connected below. These devices are running OSPF 128 in one area (Area 0).I'm pinging from both laptops to each other both ways. The ASA has the latest "8.6.1-5" image. I've configured the firewall failover polltime to 1s with holdtime of 4s. Pings both ways OK.
<LAPTOP> IP:10.112.132.10/24
| [ACCESS PORT VLAN10]
/ <SWITCH> [SVI VLAN10: IP:10.112.132.1/24]
/ [SVI VLAN20: IP:10.113.128.11/28]
.12 / [ACCESS PORT VLAN20] .13
[code]....
I fail the primary firewall (ASA-ACTIVE). I get a 4 seconds ping loss which is expected (holdtime) however after 10 seconds of pings I get another outage which last anywhere between 5 and 15 seconds. I've done a fair amount of debugging and I did notice that the second outage occurs with the OSPF neighbor goes from "loading" to "full". This doesn't make any sense because the routing table is fully populated when going to “full”.
When perfoming a manual fail back (type failover active on ASA-ACTIVE), pings goes on for approximately 10seconds and then an outage between 5 to 15 seconds. Agsin this outage occurs when OSPF neighbor goes from "loading" to "full".I've tried debugging on the switches and found nothing.
Cisco Switching/Routing :: 3560 Possible To Create Vlan Inside Transport Vlan?
Jan 10, 2012Between our hosting and a customer we have an extended vlan, traveling on a fiber, between two cisco 3560 switches.The thing is, that we want to create one or more vlans inside that extended vlan, in some way if possible?
View 3 Replies View RelatedCisco Firewall :: ASA 5505 / Dual WAN For Different Services?
Sep 18, 2012I have ASA 5505 ver, 8.4(1) I have configured 2 WAN links to
1. Outside1 - distance metric 50
2. Outside2 - distance metric 20
Currentry all traffic is passing thru Outside2 and it's correct, also s2s and ra VPN is also running on Outside2 ?My current case is to use Outside1 for webvpn services only. I can't use Outside2 becouse on 443 port other services are running, also I cant change webvpn port to other.
How can I match packets incoming to interface Internet1 from Interner side nad route them back thru Internet1 interface.
IPSLA is not a good solution becouse I need to have both WAN links used Now in routing table I have only onre record
S* 0.0.0.0 0.0.0.0 [20/0] via x.x.x.x, INTERNET2
for link with lower metric, but after some problems with provider for link Internet2 routing has changed for Internet1 and didn't change it back after resolving problem? how to create it for all traffic incoming for Internet1 interface from outside?
Cisco Firewall :: Consolidating Services On ASA5520
Jun 23, 2012I have 3 ASA5520, 2 of them running as remote access VPN, 1 of the ASA as site to site VPN. There are 2 different ISP's which are used between them. Can I consolidate all these services in 1 ASA5520, relating to configuration and whether the ASA could handle these services together without performance degradation. I forgot to mention even e-mail service and Internet browsing is also though one of the ASA. I was just wondering whether the configuration will get messy or is there a different approach to go about it. The OS on ASA's is 8.3.
View 1 Replies View RelatedCisco Firewall :: ASA 5505 And Public Dynamic DNS Services
Feb 18, 2013How to get DynDNS or some other public dynamic DNS services on the Internet working on ASA 5505?
View 2 Replies View RelatedCisco Firewall :: Does ASA Services Module 9.x Is Compatible With CAT6500
Jan 3, 2013I am trying to figure out if the new code for ASA SM 9.0(x) or 9.1 is compatible with CAT6500 but I could not find any document that explicity confirms the the INCOMPATIBILITY. This table from the Release notes is not quite clear.
[URL]
It says that code 8.5 is compatible with Cat6500 and version 9.X is compatible with R7600.So are the two different trains now, one for Cat6500 and one for R7600?
My real goal is to find the correct software versions (not interim) that provides compatilibity with Catalyst 6500 with Supervisor 2T and ASASM.
Cisco Firewall :: Add IP Address For SMTP Services ASA 5510
Nov 28, 2012We have hosted spam filter service with 3rd party vendor. My vendor is switching to different spamming services and I need to add ip address lets say 44.33.454.32 to the list of allowed system that can connect to my smtp service. I am going over my firewall 5510 configs and I think I need add the entry like this: “access-list outside-to-inside extended permit tcp object-group obj-44.33.454.32 interface outside eq smtp”. [code]
View 2 Replies View RelatedCisco Firewall :: Catalyst 6509E - Web Services Not Working
Mar 11, 2013we have installed and implemented a FWSM on cisco catalyst 6509E and defined two virtual contexts.one of contexts work as datacenter firewall. initially it is configured to allow all traffic to datacenter VLAN. (permit any any) on test, it worked fine, except for one problem: all web services had degradation in performance, all server-client (non web) services worked very fine. additionally all https servies worked well.
Users connect to the web server bypassing the proxy, web services are expected to act just like other ones.
Cisco Firewall :: PIX To ASA5520 Migration Some Services Aren't Working
May 20, 2013I've recently migrated a PIX 525 to ASA 5520, but for some reason (through ASA) the users from OUTSIDE aren't able access services published in DMZ as well as some DMZ servers aren't able to communicate to some OUTSIDE services.
-INSIDE to DMZ is working fine. (through ASA)
-INSIDE to OUTSIDE is working fine. (through ASA)
Below is the configuration from my PIX (where everything works just fine) as well as the one on the ASA (where there is a problem), what could be the cause?In the below case the DMZ hosts from 11.1.10.0 aren't able to access SMTP services (through ASA) and the OUTSIDE users aren't able to access DMZ web server (11.1.10.40) through ASA, this all just works fine with PIX.
object-group network inside_subnet_all network-object object inside_subnet_a network-object object inside_subnet_b network-object object inside_subnet_c network-object object inside_subnet_d network-object object inside_subnet_e network-object object inside_subnet_f network-object object inside_subnet_g network-object object inside_subnet_.access-list OUTSIDE extended permit tcp any object host-11.1.10.40 object- group WWW-HTTPS access-list DMZ extended permit object SMTP object dmz_subnet any access-list INSIDE extended permit ip
Cisco Firewall :: Allow / Block Any Type Of Services From ASA 5510 Extended
Jul 25, 2012I have created Different extended access-list which allow/block some specific services like IP,TCP,UDP ,ICMP etc for certain source and destination . But now I have to allow/Block all/any type of services to a certain host from a extended access-list . How can I do it ?
View 4 Replies View RelatedCisco Firewall :: ASA5510 - Unable To Ping From User Desktop To Firewall Inside IP
Jun 11, 2012I am able to ping from Switch to firewall inside ip and user desktop ip but unable to ping from user desktop to FW Inside ip.. config is below for both switch and FW Cisco ASA5510....
TechCore-SW#ping 172.22.15.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.22.15.10, timeout is 2 seconds:
[Code].....
Cisco Firewall :: Failover ASA 5505 - Setup Second Inside Interface On Firewall?
Feb 19, 2012I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?
View 1 Replies View RelatedCisco Firewall :: ASA5505 Can't Ping New Firewall On Inside Interface
Jul 14, 2011I've recently upgraded my old firewall from a PIX to an ASA5505 and have been trying to match up the configuration settings to no avail. I have is that I can't ping the new firewall on it's inside interface, despite having "icmp permit any inside" in the running config. Secondly, the server I have on there ("Sar") can't connect out to the internet.I've included the ASA's running config incase anybody can see if something stands out. I have a feeling it's either not letting anything onto the inside interface, or there is no nat going on. Lastly (and possibly relevant), the firewall is actually going at the end of a vlan, which is different to the firewall's inside vlan number. I don't know if this is actually the problem because the server can't connect out even if connected directly into the firewall.
View 32 Replies View RelatedCisco Firewall :: ASA 5505 - Can't Reach FTP Site While Inside Firewall?
Feb 26, 2011I am trying to configure our ASA 5505 so that our users can access our ftp site using [URL] while inside the firewall. Our ftp site is setup so that you can reach it by either browsing to the above url or by browsing to ftp://99.23.119.78 but we are unable to access our ftp site from either route while inside the firewall. We can access our ftp site using the internal ip address of 192.168.1.3.
Here is our current confguration:
Result of the command: "show running-config"
: Saved:ASA Version 8.2(1) !hostname ciscoasaenable password qVQaNBP31RadYDLM encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0 !interface Vlan2nameif ATTsecurity-level 0pppoe client vpdn group ATTip address pppoe setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!ftp mode passiveobject-group service DM_INLINE_TCP_1 tcpport-object eq ftpport-object eq ftp-dataport-object eq wwwaccess-list ATT_access_in extended permit tcp any host 99.23.119.78 object-group DM_INLINE_TCP_1 access-list ATT_access_in extended permit tcp any interface ATT eq ftp access-list ATT_access_in extended permit tcp any interface ATT eq ftp-data access-list ATT_access_in extended permit tcp any interface ATT eq www access-list 100 extended permit tcp any interface ATT eq ftp
[code]....
Cisco Firewall :: ASA 8.4 SYN ACK Missing Related With Firewall Inside DMZ
Aug 20, 2012I have two control point, two firewall the second one is linked inside one DMZ from the first firewall route is good and inside the DMZ from first firewall I have servers too.so to be more clear we could call as IP for the DMZ from first firewall, Interface IP 1.1.1.1 that generate this DMZ with first firewall (netmask 255.255.0.0)
inside the DMZ I have an interface from second firewall with IP 1.1.1.5 and inside DMZ 1.1/16 I have servers too keep one test server with IP 1.1.1.3.The LAN passing the second firewall is 2.2.2.1 ever 16 bits of netmask (255.255.0.0) inside the DMZ generated from second firewall I have a machine with IP 2.2.2.9 that need to access in TCP services on machine 1.1.1.3
TCP packets from 2.2.2.9 pass the second firewall and arrive inside DMZ with net 1.1/16 and arrive to server with IP 1.1.1.3 defaul gateway (to answer to originating machine with IP 2.2.2.9) is 1.1.1.1 ASA interface 1.1.1.1 claim a missing related as it haven't mapped the connection that has passed on first firewall. I need only that 1.1.1.1 route packets to second firewall (who own net 2.2/16) avoiding to be trappen in missing related check
at start it was working! around 1 year ago we upgraded IOS to 8.4 and ever so late (one year) doing maintenance to a machine I discovered it was no longer talking with these server on net 1.1/16
I have found on cisco docs chapter 51 and TCP State Bypass before was working, is something that has changed inside ASA IOS 8.4 ?
Cisco Firewall :: PIX 525 - Inside / Outside IP Same?
Feb 21, 2013I have inherited a PIX 525 environment and I need to document a lot of stuff to catch-up on what is going on. I was gathering IP address information and ran "show interface outside" and "show interface inside" and noticed the same IP assigned to both. I checked the MAC address and they are different. This IP is also listed as the Management IP. So I am sort of confused. What condition would warrant both the inside interface and outside interface along with the Management IP having the same IP?
The PIX and the hosts it comms it monitors do live in a VLAN controlled by a Brocade switch which also is our gateway out.
Cisco WAN :: 2811 - Cannot Ping Inside Global IP From Inside Network
Dec 18, 2010I have 2 questions.Om my cisco 2811 (IOS 12.4(15) T9 IPBASE W/O Crypto) i am using 3 interfaces.And i have a pool of Global addresses: 200.x.z.97-200.x.z.126 255.255.255.0
FastEthernet 0/1 description WAN interfaceip nat outsideip address 200.x.y.253 255.255.255.0
GigabitInterface 0/2/0description DMZ interfaceip nat insideip address 10.0.0.1 255.255.255.0
GigabitInterface 0/3/0description LAN interfaceip nat insideip address 192.168.0.251 255.255.255.0
[Code]....
Cisco Firewall :: ASA5510 Cannot Seem To Get From Inside To Outside
Oct 20, 2011I have a ASA 5510 with asa8.4(2) and asdm6.4(5)205. Have a new basic config, nothing special at this time. I just cannot seem to get from the inside to the outside. From the outside interface I can ping, so I have a good Internet connection. [code]
View 3 Replies View RelatedCisco Firewall :: ASA 5550 Two ACL From Outside To Inside
May 13, 2011I have ASA5550 ruuning Version 8.3(1) with inside and outside interfaces as below [code] On the inside : I have a server (10.20.10.36) that need to be accessed from an outside host (Y.Y.131.34) , so I have the below NAT/ACL rules. [code] is it right that I have to add two ACL entry for outside host to the NATed IP of the inside server , then again add another ACL entry from the same outside host to the private IP of my inside server o get this communication done?
View 7 Replies View RelatedCisco Firewall :: DMZ To Inside On ASA 5510
May 9, 2011I have deployed a read only domain controller in our DMZ as part of a domain-related project. That machine needs to be able to reach domain controllers on our internal network. To do so, it should traverse our ASA 5510, going from the DMZ Interface (security level set to 60) to the Inside Interface (security level set to 99).
I've created an ACL as following (alerting hostnames in the example):
access-list dmz_access_in extended permit ip host dmz.rodc.domain.local object-group int-domain-controllers
I've read in various spots that you have to create a NAT when traversing security levels, going from a less trusted interface (DMZ) to a more trusted one (internal.) Since this link will carry domain traffic, we do not want to create a real translation. Thus, I created a stand-in NAT that points to its own IP as follows:
static (dmz,inside) dmz.rodc.domain.local dmz.rodc.domain.local netmask 255.255.255.255
Long story short, the connection fails. I'm able to access other hosts in the DMZ and on another interface configured with the same security level (which I've explicitly allowed), but trying to go from the less-trusted DMZ to the more-trusted internal fails.
Cisco Firewall :: ASA 8.2.5 - DMZ To Inside Access?
Oct 18, 2012A Cisco ASA running 8.2.5 with 3 interfaces: Outside (Sec lvl 0)/-nternet IP / DMZ (Sec lvl 2)-192.168.8.0/24 / Inside (Sec level 100)-192.168.1.0/24
An ACL on the DMZ which looks like this:
access list DMZ_IN permit ip 192.168.8.0 255.255.255.0 any
access list DMZ_IN deny ip any any
access-group DMZ_IN in interface DMZ
global (outside) 1 interface
nat (DMZ) 1 192.168.8.0 255.255.255.0
Nat Control is not enabled (by default) There is no nat exemption, static identity nat or any nat of any kind set up between the Inside and DMZ.The question is: Will the DMZ network be able to initiate connections to the Inside network or will only outside (internet) access be permitted?
A) No, inside access will not be permitted, only Interenet access will be permitted, because there is no NAT exemption or Static Identity NAT between the lower level security interface (DMZ) and the Higher level security interface (Inside), regardless of the DMZ ACL rule with a destination of ANY.
B) Yes, access to the Internet and the Inside can be initiated because NAT control is disabled and there is an ACL that permits DMZ traffic to 'ANY' destination.
Cisco Firewall :: ASA 9.1 Inside To DMZ Access
Feb 26, 2013I recently upgraded my asa from 8.2 to 9.1 (reconfigured from scratch - didnot convert old config) and everything seems to be working fine except for communication between my INTERNAL network and my DMZ. Here's my config below -
ASA Version 9.1(1)
!
hostname ZEPPELIN
domain-name MIWEBPORTAL.com
enable password XXXXX
[Code]...
Cisco Firewall :: 5505 DNS Does Not Resolve Inside DMZ
May 14, 2012I have a 5505 that currently has inside/outside interfaces and everything is working just fine. I am trying to create a DMZ that will essentially be just for vendors/guests. the DMZ will have full access to the outside (Internet) but no access to the inside. I am using the FW for DHCP, and 8.8.8.8 and 4.2.2.2 for DNS. I currently have 1 laptop in the DMZ vlan, and it is getting a correct IP, and it is showing 8.8.8.8 and 4.2.2.2 in ipconfig. I can ping/tracert 8.8.8.8/ 4.2. 2.2/74.125.137.147(what url... resolved to on a laptop connected to the inside vlan), but I cannot ping nor browse to url.... [code]
View 1 Replies View RelatedCisco Firewall :: Outside To Inside Not Work ASA5505
May 8, 2013I am very new to Cisco ASA and I am trying many days to implement the design below but still cannot get it done. The situation I am facing is
- a host (e.g. 192.168.5.10) under Inside interface can contact to outside without any problem.
- however a host outside (e.g. in VLAN1 or outside this network) cannot contact host under Inside interface. I am using PING test and always get Request Time Out. [code]
Cisco Firewall :: Cannot Ping To Inside Hosts From ASA-8.2
Jun 8, 2013I am struggling to get successfull pings beween asa and inside hosts but couldn't succeed. Done packet tracer result is acl-drop
Here is the running config
Prem-ASA(config)# sh run
: Saved
:
[Code].....
Cisco Firewall :: 5520 / Add NAT For Outside X.x.x.77 Going Inside X.x.x.22 Port 80?
Oct 3, 2012I have an ASA 5520 Cisco Adaptive Security Appliance Software Version 8.4(2)8 Device Manager Version 6.4(5)206. I am trying to add a nat for outside x.x.x.77 port going inside x.x.x.22 port 80 . the wan interface is .74 with subnet of 255.255.255.248 the rule will add but traffic wont pass in.
View 14 Replies View RelatedCisco Firewall :: 3560x Cannot Communicate From Inside To DMZ
Aug 7, 2012I have an existing ASA Firewall that is configured with an inside interface and an outside interface - communications is working fine in this configuration.I am trying to add a DMZ interface that will be connected to a 3560x switch - the new ASA and Switch configuration are below. [code] I cannot ping from a computer on the LAN (10.10.10.3) to the IP address of the DMZ Switch on VLAN 510 (10.50.10.1).I can, however, ping from the DMZ Switch (10.50.10.1) to the workstation on the LAN (10.10.10.3)
View 11 Replies View RelatedCisco Firewall :: 7.2.3 / Upgrade ASA Over VPN Via Inside Interface?
Jan 17, 2013I am trying to upgrade a Cisco ASA over an IPSEC VPN tunnel. My FTP server is on the remote side of the VPN tunnel but I am initiating connections from the inside interface of the firewall. I am currently managing the Firewall over the VPN via it's inside interface (using the management-access inside) command. When I try and update via FTP, the connection is going straight out the outside interface (and not across the VPN tunnel) I have tried upgrading via TFTP but it keeps stopping randomly with (unspecified error) I normally upgrade via FTP though but it's not working in this instance. Essentially what I am asking, is is there an equivalent command for FTP that there is for TFTP: tftp-server interface ip anyconnect I need the connections to originate from the inside interface so they traverse the VPN. I am running 7.2.3?
View 2 Replies View RelatedCisco Firewall :: 5520 Can't Access From DMZ To INSIDE
Mar 13, 2012I have a cisco asa 5520 ios 8.2. This is my configuration [code] But i can not access from DMZ to INSIDE.
View 3 Replies View Related
