Cisco Firewall :: 6500 Separate Internal Server / HQ Network From 3 / 4 Different External Connections

May 21, 2012

I am using a 6500 with FWSM. I need to separate an internal server/HQ network from 3 or 4 different external connections. The external networks do not necessarily need to be isolated from each other.I have the option of using a 3 layer model: L2 Access layer to SVIs on the Distribution layer and then L3 to the 6500.L2 Access, connecting directly to the 6500s, with the SVIs on the FWSM.Is it better to have the FWSM outside the MSFC or Inside? Am i correct in thinking that "inside" vs "outside" is determined by whether the SVI's are configured on the FWSM or the MSFC? is there any performance impact from having the FWSM doing the routing instead of the MSFC.If the vlans are all configured on the FWSM, what is the 6500 doing, other than providing switch ports?

View 1 Replies


Cisco Firewall :: ASA 5510 - Connecting To External IP Of Internal Server

Sep 25, 2012

I was just wondering if it's possible with an ASA 5510 to connect to the external IP address of an internal server from inside the network.  I have already set up dns doctoring for dns lookups, and everything is working fine there.  We have an application inside the network that tries to connect straight to the external Ip of another internal server.  where to look in the ASDM 6.4?

View 2 Replies View Related

Cisco WAN :: ASA 5505 - Assign External IP To Internal Server?

Mar 2, 2012

I have 3 external ips from my isp:

The first one I use to provide internet access to my office. The other two I'm going to use for the following: I'm going to deploy a server in internal network which must have 2 external ips on his network interface (& one internal ip on the second,but that's ok: I cannot put an extra network switch before asa & plug this server there: this server is virtual & is on esxi host in internal network. External ips must be assigned to servers' interfacw,bot just forwarded there (ms direct access requirement).

My current config:
ASA Version 8.4(3)
hostname msk-office


View 20 Replies View Related

Cisco Firewall :: Multiple WAN IPs Routed To Separate Internal VLANs On ASA 5505

May 25, 2011

I have an ASA 5505 with the security plus software and I'm trying to find out how to assign 2 public IPs to the outside interface and have each IP routed to a separate internal VLAN. For example, IP 1 = X.X.X.1 routed to and IP 2 X.X.X.2 routed to I was told this was possible and I've been trying to find configuration examples, but I can't seem to get anywhere and now I'm getting desperate because I'm scheduled to install it this weekend.

View 1 Replies View Related

Cisco WAN :: WRVS4400N - External Web Server Can't Connect To Internal SQL Database

Jul 4, 2011

I have a hosted web server that has a website on it that needs to connect back to a database within our internal network. We have a Cisco WRVS4400N Wireless Router with 2 VLANS. VLAN 1 goes to a Watchguard Firebox which is connected to our internal network. VLAN 2 goues to our classroom network.
Our database is on VLAN 1. I have opened port 1433 on the Watchguard to allow SQL traffic from our Web Server. I can telnet from my workstation on VLAN 1 to the Web Server over port 1433, so I know the Web Server is not blocking anything. When I try to telnet from the Web Server to our Public IP address over port 1433, it fails.
I believe I have the firewall on the Cisco WRVS4400N off, so it shouldn't be blocking any traffic, but for the life of me I can't get this to work. I have been working on this for two days, and I NEED it to work. This was working up until last week, then it quit working. I am the only person making changes to our network, and there were no changes made during that time.

View 1 Replies View Related

Cisco Firewall :: 5520 Can't Access Internal Web Server From Outside Network

Aug 23, 2011

I am using ASA 5520 with 8.2.4 IOS. I'm new to ASA/Firewall. I need to do access webserver from outside network.From Laptop (, If I connect to url... it should open page from also need to ssh to webserver from laptop. If I ssh to from laptop, it should connect to 10. 10. 10.50. [code]I can't get to webserver from outside network, so now, I connected laptop to directly ASA 5520 outside port with crossover cable.ASA Inside port connects to L3 switch. Webserver also connects to L3 switch. But still doesn't work.

View 9 Replies View Related

Use Two Separate Internet Connections On Same Network?

Feb 4, 2013

Internet connection come from an ethernet port in the wall. Cat 5 then goes to the switch and then to various computers.Desktop #1 has a IP of, sub, default gateway, DNS want to be able to attach a cat5 cable to the LAN port of a Linksys WRT 54G going from the switch.What is the settings I need to select in the Linksys router for this to work.DHCP - Off. I guess the LAN IP of the router must fall in the range of the Main DHCP pool. Could I select anything in the 10.1.1 100's as long as another computer did not have the same IP. The starting IP of the linksys router stays in 192.168.1...... and doesn't looked like it can be changed. Does any Laptop that connects wirelessly to the linksys router need a static IP or can it obtain an IP address through

View 14 Replies View Related

Cisco Firewall :: NAT Two Internal IPs To One External IP In ASA 8.4?

May 6, 2013

I found a link to accomplish this on the old code but how can I get this done on 8.4. 


View 11 Replies View Related

Linksys E3000 - Internal / External LAN Firewall Setup?

Oct 20, 2012

I have Astaro UTM running on an old computer as my only firewall right now. The Astaro also serves as my DHCP server. My Wifi is provided by a Linksys E3000 running DD-WRT software. NAT/SPI are disabled on the E3000, and it forwards DHCP requests to the Astaro. All my network clients connect via wifi/ethernet to the E3000.

All clients --> E3000 (no firewall) --> Astaro --> www

I am considering setting up my own personal cloud server using a Synology NAS that I can access remotely. I would also like to remotely access my Surveillance DVR. I would like to access them via VPN or portforwarding. I do not want to use DMZ.

I would like to utilize the SPI firewall on the E3000 to provide an extra layer of defense. I would like the NAS and the DVR to be on an external LAN between the Astaro and the E3000...and all other clients being on an internal LAN behind the E3000. I have the necessary switches/cables to make this work.

My question is...How do I configure the E3000? Can I have both the internal and external LANs on the same subnet? Do I have to use the NAT on the E3000? I'd rather not...since that will render the Astaro's reporting functions rather worthless.

I would like the Astaro to remain the only DHCP server. I would like all internal LAN clients to be able to reach out to the external LAN/WAN...but the external LAN should not be able to reach into the Internal.

View 1 Replies View Related

Cisco Firewall :: Accessing Internal Sites Via External IP 5505

Jun 4, 2012

I have a Cisco 5505, 2 sites that are internal, 1 external IP (dhcp from cable modem).   While on my laptop, ipad, iphone, I cannot access the server via it's external IP address.  I MUST use the internal IP in order to access this site. I have heard of hairpinning, internal dns server(don't really want this).

View 8 Replies View Related

Cisco Firewall :: 8023 / External Access To Internal Router Via ASA

Dec 31, 2012

I am aware that we can allow external admins to telnet over a custom port to the internal router. Even i was allowed to connect to a remote router via the remote firewall. The way i was accessing the router is by telnet to the remote ASA address on port 8023.I am not sure how exactly we can configure this on a ASA.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Internal Address To Forward From External One

May 30, 2013

I have an old ASA 5505, and I'm having some trouble with Nat Hairpinning. I've done this with other firewalls before and I am having no luck now. I have an internal address that I wish to forward from an external address- so if someone goes to 123.456.789.012:3456 then it will forward to (All numbers are arbitrary here- only for illustration). I have and Access Rule and NAT and PAT set up so that I can get in if I originate from outside the LAN. What I am trying to do is to have this work from inside the LAN as well- so that if I am at my desk, and I connect a device and type in 123.456.789.012:3456, it will deliver the content at The problem I am having is that it just isn't working, and I cannot figure out why- When I started here, there was an address configured to work this way, and it still works- I just cannot find what is different between what I am doing and what the person who configured it did.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 / Allow External Traffic To Access Internal Computers

Mar 22, 2012

We have an ASA 5505 running version 8.4. We are having problems allowing external traffic to access computers behind the firewall. Our current config is:
ASA Version 8.4(3)!hostname ciscoasadomain-name default.domain.invalidnames!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!interface Vlan1nameif insidesecurity-level 100ip address!interface Vlan2nameif outsidesecurity-level 0ip address!boot system disk0:/asa843-k8.binftp mode passivedns server-group DefaultDNSdomain-name default.domain.invalidobject network a- network a- network ext-serversnetwork-object host host host network ecomm_serversnetwork-object


View 10 Replies View Related

Cisco Firewall :: Statically PAT Multiple Internal Hosts To One External Host 5510

Feb 20, 2012

I am working on replacing our Checkpoint Firewalls with ASA's, and am running into the following NAT problem. On some of our Checkpoints, there are external NAT's that are mapped to multiple internal hosts based on ports.Is there any way to translate that to the ASA? I'm not sure the ASA will let you have multiple internal hosts mapped to one external IP using static NATs. The main issue, is these are alarm panels that receive data from external hosts (the traffic is initiated externally on the Internet) so I can't use dynamic PAT with this.

View 1 Replies View Related

Cisco Firewall :: 5510 - Connections Routing Between Two Internal ASAs Fail

May 19, 2012

We have a site with two inbound circuits, one for internet and one for our MPLS.  Each circuit is being terminated by a 2921 Router and matching ASA 5510 Firewall.  For the internal network, the Internet ASA's inside interface ( is the default gateway for all hosts.  OSPF is the routing protocol between all the routers and ASA's and routing is working.  In fact, ICMP is working as well.  From an inside host (, we can ping anything on the MPLS network.  But when I try to use telnet (for example), the connection fails.  If I add a route to to the host, or re-configure the host to point to the MPLS ASA ( as it's default gateway, connections will establish.
Both ASAs are running 8.4(3), and have the following commands:
same-security-traffic permit intra-interface
interface Ethernet0/0
nameif outside


And from the MPLS nodes, I can see a tcp request is made. 

View 6 Replies View Related

Cisco Firewall :: 6500 - FWSM With Multiple Connections?

Aug 29, 2012

There is a 6500 switch with fwsm. We have extended 2 vlans from the ISP into the FWSM. Also there are atleast 10 other vlans for our internal network. We would like say half of the internal vlans to go out of the 1st ISP vlan and the remaining half from the 2nd ISP vlan. Is there a way we can do this in the FWSM?

View 2 Replies View Related

Cisco Firewall :: ASA 5505 To Have Internal Address That Wish To Forward From External Address

Jul 8, 2012

I have an old ASA 5505, and I'm having some trouble with Nat Hairpinning. I've done this with other firewalls before and I am having no luck now. I have an internal address that I wish to forward from an external address- so if someone goes to 123.456.789.012:3456 then it will forward to (All numbers are arbitrary here- only for illustration). I have and Access Rule and NAT and PAT set up so that I can get in if I originate from outside the LAN. What I am trying to do is to have this work from inside the LAN as well- so that if I am at my desk, and I connect a device and type in 123.456.789.012:3456, it will deliver the content at The problem I am having is that it just isn't working, and I cannot figure out why- When I started here, there was an address configured to work this way, and it still works- I just cannot find what is different between what I am doing and what the person who configured it did.

View 7 Replies View Related

Cisco WAN :: Can Separate Or Pass Through External IP Through 1841

Dec 28, 2011

Our bank is required to do disaster recovery testing. We are doing this offsite at one of our director's businesses. His setup is as follows: His ISP is Time Warner which provided him with a wall unit and a switch He has a Cisco 1841 router out from the Time Warner switch and then down to his internal network, so TW wall unit --> TW switch --> Cisco 1841 --> internal network.The IPs provided to them from TW are We are trying to use the external address of, which his business is not currently using internally The Cisco 1841 router holds and NATs all of these addresses currently. We have a Cisco 800 series that is a dedicated router that needs an unused external static IP setup separate from their network. We were trying to plug into their Cisco 1841 and give the 800 series an internal address of This will not work for our bank's core processing data center. It has to be out of the TW switch and have an address of the
We tried plugging into the TW switch and making the 800 series router parallel to the 1841 router. Communication is not functioning when set up this way. This was tried on a laptop before using the 800 series router. Is there a way to pass through the address internally through the Cisco 1841 so we can connect the 800 series directly to this address and the 1841 doesn't use or NAT it in any way?
We had contacted TW support and they made it sound like we would have to block out some addresses and resubnet our director's network. This probably will not be an option. Basically we need to pass the addresses internally and have the Cisco 1841 pretend not to see it at all.So we would like to have into the TW wall unit --> TW switch --> Cisco 1841 --> all 74. addresses resolved to to internal EXCEPT which would pass through to the Cisco 800 series router.

View 2 Replies View Related

Cisco Firewall :: How To Add External Server To ASA 5505

Feb 24, 2013

I have a Cisco ASA5505 and windows DHCP server, how do I add this external server to ASA so my PC clients can get DHCP from this server?

View 3 Replies View Related

Sharing :: Use 1 External Hdd To Backup Data From 2 Separate PC's?

Jan 20, 2011

I have got a 1TB external HDD...I want to use this to backup my data (dokuments , pics , video) that are on 2 desktops and one laptop---

AS I understand the terminology a I won't have enough room to do image backups (these back up all info incl OS ??) as on pc is usingb 677 gb and the other 400 gb ---- and anyway I can re-install windows if anything goes wrong...

SO---am I able to do this-

1. connect the ext- HDD to PC running win 7 64 bit....create a folder called "win 7 64 bit" and then drag and drop filesand folders into that folder(or use windows backup..which i am unfamilar with)

2. then connect to PC running Vista 64 bit ..create a f�lder called "Vista 64 bit" and do as above....

3. Do the same for the laptop running win 7 32 bit

Am I right in assumming that because it's just data I can put info from different OS on to it without and conflicts when connecting it to different Pc's?

View 7 Replies View Related

Linksys Wireless Router :: E2500 Need To Configure Two VLANs In Home Network To Separate Server 1 With VM

Jan 14, 2013

I need to configure two VLANs in my home network to separate a server 1 with VM from another part of network with server 2 and wifi clients. Is it possible to keep DHCP server and internet access on E2500 enabled for both vlans? If so, how should I configure ports tagging (variant shown on screen shoot below doesn't work).

View 5 Replies View Related

Cisco Firewall :: Internal DNS Server Entry ASA-5505

Jan 12, 2011

I have a client in a workgroup environment. They are a small company with perhaps twenty systems. Their infrastructure consists of a Dell Switch, a Cisco ASA-5505 which hands out the DHCP and a router. And that's that.They have been using an external IP as their DNS Server to get out to the Web. However, they now want to add an internal Linux-based DNS server.In looking through the ASA-5505 today I noticed a field for DNS enteries. Is this where the IP for this new internal DNS Server (in the secondary DNS field) would go?If so, would it be necessary to reboot the ASA-5505 for this change to take effect?

View 12 Replies View Related

Cisco Firewall :: 3.2 (18) - URL Filtering In FWSM Without External Server

May 18, 2011

I have an FWSM running in multiple context mode running 3.2(18) code.  I have 3 urls that I would like to block so I can't justify the cost of an external URL filtering server.  I have found a way to filter individual URLs on the ASA but the same configuration does not seem to be available on the FWSM.  At least not on my code. Any way to do this other than resolving the hostnames and blocking the current IP addresses?

View 1 Replies View Related

Cisco Wireless :: CAP-1602E - External Antennas In Separate Rooms

Feb 14, 2013

I have a question about external antennas on an access point. I have to plan a wireles solution, that also includes coverage in the industrial freezers. The freezers are one part of the sotck rooms, so the general coverage will be done with 1602I access points.
Since there are quite a lot of freezers in one location, installing separate AP in every freezer will be very expensive. I wondered if there is a possibility to put one 1602 access point with external antennas outside the freezer and then extend the antennas with 2m cables inside different freezers (1602E has three external antennas, so one antenna to each freezer).
Would this installation even work?
The freezers are quite small rooms maybe 2-3m2 sow the coverage is not a problem. But does this installation support multiple clients per AP in different freezers doing stocktaking with handheld terminals?

View 4 Replies View Related

Cisco VPN :: Separate L2L VPN Tunnels On Multiple External ISP Interfaces With ASA 5510

Oct 18, 2012

Due to special circumstances we have 2 ISP links on an ASA5510. I am trying to terminate some L2L VPN tunnels on one link and others on the second ISP Link, eg below:
crypto map outside-map_isp1 20 match address VPN_ACL_Acrypto map outside-map_isp1 20 set peer map outside-map_isp1 20 set transform-set TS-Generic
crypto map outside-map_isp2 30 match address VPN_ACL_Bcrypto map outside-map_isp2 30 set peer map outside-map_isp2 30 set transform-set TS-Generic
crypto map outside-map-isp1 interface ISP_1crypto map outside-map-isp2 interface ISP_2
crypto isakmp enable ISP_1crypto isakmp enable ISP_2
route ISP_1 ISP_2
Establising the VPN tunnels in either direction when using ISP_1 works fine establishing in either direction from remote access users and multiple L2L tunnels (only showing one for example).
On ISP_2
1. Peer device establishes a VPN tunnel, but the return traffic does NOT get back to devices on tunnel.
2. The local firewall does NOT establish a VPN tunnel going to
It would seem to indicate that the problems lies with this multihomed firewall not directing the traffic correctly to either return down and establised VPN tunnel (point1) or to intiate a tunnel if none exists (point 2).

Reconfiguring the VPN tunnel peer for to be on ISP_1 of the local firewall, all springs into life! There are sufficient license etc...

View 4 Replies View Related

Cisco Firewall :: ASA 5505 8.4(2) Allow User To Access Internal Www Server?

Aug 2, 2011

I tried the solution posted at [URL] however it did not work on my ASA5505 8.4(2). I thought that it may be because I only have a single public address so the web server is responding to port forwarding through the one public IP already. looking in ASDM it appears to indicate that a configured access list is blocking the server from responding to the internal hosts.
object network Private_IP
object network Public_IP
object-group network internal_net

Can I fix an access list (or something) to make this work or am I wishing for too much with only one public IP? This worked by default on my Netgear firewall.

View 4 Replies View Related

Cisco Firewall :: 2801 / Setting Up Static NAT To Internal Server?

Dec 15, 2012

One of my internal servers requires it to be available to the internet I am having a hard time allowing it to be NATed through my Ciscc 2801 router. It seems as though im missing something small. From what I can gather it seems as though its as issue with ACL, but im not sure. I have ran the following command: ip nat inside source static tcp ***WAN IP Address*** 8443 extendable Then I tried to add it to the ACL via this command: access-list 150 permit tcp any host ***WAN IP Address*** eq 8443 
Here is a copy of my config.
IP    172.19.3.x
Ciscso 2801 Router


View 5 Replies View Related

Cisco Firewall :: 5505 ASDM Location Is Using Same IP As Internal Server

Oct 27, 2011

I have a server that I need to open up some ports on to allow access to the new internal Sharepoint server we're setting up. I've been having some issues getting the ports open like once I put the commands in and save them that server suddenly stops allowing outbound traffic. After looking at a few things I noticed while I was looking at the config file that the ASDM location is showing 2 IP's, both are the same as the server I'm trying to open ports for one being the private IP and the other is the public IP I'm trying to use. Is this the reason I'm having problems when I try to open those ports to my server? Do I need to use both a different private and public IP for this server so I can get my ports to work? The programmers selected these IP's so if I need to change them I'll let them know in case they need to make changes for the Sharepoint setup. This is on an ASA 5505.

View 12 Replies View Related

Cisco Wireless :: WAP4410N Separate Access To Guest And Internal Employees

Sep 12, 2011

i have two WAP4410N wireless router. with software version ( , here i have a problem on SSID broadcast and access.i have created Two ssid's WC72 and SREE with same security configuration WPA2-personalmixed . i cant see the broadcasted SSID of name SREE where i only view WC72 and get connected to it..
where i initially want is separate SSID and internal network access for internal employees and Guests (shouldn't connect to internal network).

View 9 Replies View Related

Cisco Firewall :: ASA 5510 - Enable External Access To Server On DMZ

Apr 5, 2011

i'' ve one appliance ASA 5510, v8.X and asdm 6X here u have my configuration :
interface Ethernet0/0 description Link To WAN nameif outside security-level 0 ip address!interface Ethernet0/1 description Link to LAN(forefront) nameif inside security-level 100 ip address!interface Ethernet0/2 description Link to CoreSW (DMZ) nameif DMZ security-level 50 ip address
i have on server ssh ( on my DMZ .
I wan to enable my external user, i mean outside user to be able to access to this server which is in my DMZ for this port ( ssh)

View 4 Replies View Related

Cisco Firewall :: 5510 - How To Allow Access From LAN To Server Using External FQDN

Feb 20, 2012

I may have phrased the topic not too clearly, but I have an external domain name of , I want my users INSIDE the company be able to also get to url..., currently they cannot (nothing loads, looks to me as if firewall simply drops it) and I'm drawing a blank on how to get this done. Externally this works fine so if you're outside the company you can load up OWA just fine since my NAT rule translates the external IP to internal IP, but something is blocking this from the inside.
I have an ASA 5510. If you can just sent me on the right path with theory I'll figure it out on my own, I don't need exact steps, but I must be thinking of this wrong as I'm not getting anywhere.

View 10 Replies View Related

Cisco Firewall :: 5505 Configure Internal Router And DNS Server - No Internet

Dec 23, 2011

Currently I have an ASA setup as a Firewall with 1 outside interface and 2 inside interfaces. Initially, the Guest interface was setup to receive DHCP from the ASA and everything was working. I'm adding router and a server for the guest interface and what I'm trying to accomplish now is the following: ASA 5505 > Airport Extreme with a public static IP (69.xx.xx.6), handling DHCP and NAT  > Mac Server as DNS Server.Right now, when I connect to my Airport Extreme with any computer, I don't have internet. I don't understand what's wrong. My DNS Server has a reserved IP address: and it's pointing to itself and forwarding the ISP DNS servers, the Airport Extreme is handling the DNS Server IP and the ISP DNS Server IP but I can't connect to the internet from the server.  [code]

View 31 Replies View Related

Cisco Firewall :: 3391 / 3389 - PIX Config For RDP Access To Internal Server?

Aug 21, 2011

It's been a while since I've done a lot with a PIX config so what is the best way to allow access for 2 IP addresses that need to RDP into a server here inside our network. They also wanted to have ports redirected, 3391 to 3389 and 3397 to 3389.

View 12 Replies View Related

Copyrights 2005-15, All rights reserved