Cisco Firewall :: ASA 5505 - No DNS Assigned

Jun 4, 2013

I have just set up my asa5505 and while in the sh run I have the following lines
-dhcpd address inside
-dhcpd enable inside
-dhcpd dns interface outside
When a client connects to the device like: there is no dns assigned. My devices are unable to access the internet unless I manually assign the dns in the local settings for that host.

View 6 Replies


Cisco Firewall :: ASA 5505 VLAN Assigned To Outside For Internet Access

Aug 7, 2011

ASA 5505 and DMZ and Base License,"For example, you have one VLAN assigned to the outside for Internet access, one VLAN assigned to an inside business network, and a third VLAN assigned to your home network. The home network does not need to access the business network, so you can use the no forward interface command on the home VLAN; the business network can access the home network, but the home network cannot access the business network." Page 6-17.
This is exactly what I need. Mail server in DMZ, full access from internet to DMZ, and from inside network to DMZ, no access from DZM to inside network. If I good understand, this is possible with base license.
I successfully configure, internet Access for DZM and inside network, Mail server can be accessed from internet, as well as RDP on inside network. But I have problem to configure communication from inside network to DMZ. [code]

View 13 Replies View Related

Cisco Firewall :: Invalid Hostname With Dynamically Assigned DNS Error On ASA 5505

Jul 7, 2011

I have connected an ASA 5505 to an ADSL router that is able to assign the IP address and the also the DNS servers for the ISP for the outside interface. The ASA is loaded up with IOS "asa842-k8.bin"
I am using vpnclient with a hostname as oppose to an IP address to connect to a headend remote server. If I hardcode the DNS servers IPs in the "dns server-group DefaultDNS" I am able to resolve the hostname. If I then remove the IPs from the group and rely on the dhcp to assign them, when I try to resolve the name I have an error at the console "ERROR: % Invalid Hostname"

View 2 Replies View Related

Cisco VPN :: ASA 5505 - Reverse NAT With Only One IP Assigned To Interface

Jul 27, 2011

I'm new to working with the ASA 5505 ,VPN and reverse NAT.
The basic setup is as follows. I'm trying to setup a IPsec site to site tunnel with reverse nat on the remote side.
I have as the tunnel up and it passes traffic. I have setup reverse NAT for 172.x.x.1 to translated IP 216.x.2.101 my ASA also has an IP address of 216.x.2.102.
Any connection from  172.x.x.1 to  216.x.2.1 should appear to be comming from 216.x.2.101
When I ping or telnet from to an open port on 216.x.2.101 I get the banner from 172.x.x.1, seems like it is working.
However in my setup I'm only given a singel IP that of the NAT address 216.x.2.101, so when I remove the IP address assigned to the inside interface  216.x.2.102. all conductivity is lost.
When I set the inside interface to 216.x.2.101 and  I setup a static NAT rule for  172.x.x.1 to 216.x.2.101, I get a message that says all traffic will be redirected and I will be unable to connect to the ASA.
Once thats in place, and I make any connection from 216.x.2.1 to  216.x.2.101on any port I get a connection but then it's reset, I no longer get the telent banner I was expecting.
My running config is,
ASA Version 8.2(1)
hostname ciscoasa


View 1 Replies View Related

Cisco VPN :: ASA 5505 - IP Address Assigned By Pool Not Reach LAN Network

Nov 13, 2011

I've configured vpn ipsec with wizard but my ip address assigned by pool not reach the lan network ,lan network: /24,pool network: /24

View 12 Replies View Related

Cisco Switching/Routing :: ASA 5505 Outside Access For Clients With Dynamically Assigned IPs

Feb 7, 2013

We have an ASA configured to access the internet, which works fine for clients who have an IP address assigned by DHCP, but not for clients with manually assigned IPs.
For instance, with the DHCP server configured to give IP addresses between and, a device may get the IP address This machine will have connectivity to the internet.
If we then configure DHCPd server range as to and statically assign the IP to the client, it will not have internet access. It will, however have inside access and VPN access.
If I try to ping, the following is logged:
ASA 3  Feb 08 2013  15:51:01    Deny inbound icmp src    outside:    dst (type 0, code 0)
Where 'servers' is the name of the inside interface the request is made from and '' is the external IP. It seems as DNAT is not working when the client IP is static assigned.

View 5 Replies View Related

Cisco Firewall :: Number Assigned For Firewall-group On 6509 Significant

Nov 17, 2011

Is there any significance to the parameter "firewall-group" in the command

firewall vlan-group <firewall-group> <vlan-id>…<vlan-id>?
In other words is the series of commands
firewall switch 1 module 3 vlan-group 1,2
firewall vlan-group 1 100,101,102
firewall vlan-group 2 200,201,202
exactly equivalent to
firewall switch 1 module 3 vlan-group 3
firewall vlan-group 3 100,101,102,200,201,202
firewall switch 1 module 3 vlan-group 1,2,3
firewall vlan-group 1 100,200
firewall vlan-group 2 101,201
firewall vlan-group 3 102,202

All three of these options associate the same set of  vlans to the FWSM but using different groupings. As far as I can tell, these groupings have no functional significance either on the switch side or the FWSM side. These are simply three different ways of specifying exactly the same thing? Am I correct?

View 2 Replies View Related

Cisco Firewall :: PIX 515e Allow LAN Users To Access ISP Assigned Public IPs

Dec 16, 2012

Pix 515e 6.3.4..A web server on our DMZ is exposed for external access.There is an "A" record (webserver.yyy) on a public DNS for this public IP.This works fine for external users. url..Now I have been asked to allowed our LAN user to access the same link and I CANNOT CREATE AN INTERNAL DNS RECORD TO TAKE CARE OF THIS, which means when our internal users access that link, the request goes out of OUTSIDE interface with a NAT overloaded address( that is in the same subnet as the URL is trying to resolve. Once it knows the IP address thru DNS resolution tries to comes back in thru the same Interface(OUTSIDE) to hit the web server in the DMZ and is not able to.
1- Where does the request from an internal user to hit url is dropped?
2- what can be done to allow this type of connectivity in the PIX 515e device?

View 7 Replies View Related

Cisco WAN :: Configure 877W Router As Firewall With DHCP Assigned WAN IP

Nov 15, 2010

I'm configuring a Cisco 877 router as my firewall.My WAN IP will be assigned dynamically with DHCP.  I will also get my default route from DHCP.I will need to configure ip inspection and packet filtering.I will need to configure NAT, I will eventually need to also configure a dial-up VPN.

View 7 Replies View Related

Cisco Firewall :: 5585 - Two Different Subnets Assigned To Single Bridge Group

Apr 9, 2013

We are deploying two Cisco 5585 in transparent mode and multiple contexts. they are running Active-Active fail over.
There are a lot of V LANs need to be added in the contexts, we are trying to use least contexts to fulfill.
ASA supports 8 bridge groups for each contexts, and maximum 4 interfaces for each bridge group.
We have assigned four interfaces in different V LANs , set two of them as a pair with one IP sub net and the other two interfaces are in another IP sub net.
For example :
Bridge group 1:
inside1  and  outside1    ------->
inside2  and  outside2    ------->
However, we can only make one sub net(V LAN pairs ) work when the BVI is set to that IP sub net. If the BVI set to, the inside1 and outside1, the other pair not work. If the BVI set, then only inside2 and outside2 work. 
Since the BVI can only be assigned to either of the sub net, Is it possible to make both vlan pairs work ? Or we only can have one sub net in one bridge group ?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / Can LDAP-authenticated Remote User Be Assigned A Connection

Jun 30, 2011

ASA 5510 ASA 8.0 ASDM 6.1 I want some remote users to have split-tunnel connection, others not.  I used Cisco Document ID 100936 "Allow Split Tunneling for AnyConnect VPN Client on the ASA Configuration...".  I created a new Group Policy with split-tunnel enabled.  I created a new Connection Profile and assigned to it the new Group Policy.  When I authenticate at the AnyConnect client I get a dropdown of the 2 connecton profiles, to choose the one I want.  Each of them works, enabling or disabling split-tunnel.  But I want to assign a connection profile to the particular user, not give the user a choice.  The problem is I'm using LDAP authentication.  The Local Users I set up before LDAP are obsolete, assigning them a Group Policy does nothing.  I really don't want to give up LDAP and force people back to another local password.  But the LDAP authentication to Active Directory just says yes or no, it won't assign a connection profile.  At the AnyConnect Connection Profiles page I have set a switch "Allow user to select connection profile, identified by its alias, on the login page.  Otherwise, DefaultWebVPNGroup will be the connection profile".  If I clear that switch every user will be assigned the same default profile, which does not work.

View 2 Replies View Related

Cisco Firewall :: Monitoring ASA 5505 Firewall Active / Standby Pair Using SNMP?

Sep 7, 2011

How I can actively monitor the interfaces and overall status of 2 x ASA 5500s in an Active/Standby configuration?
I can setup monitoring of the interfaces on the Active member but I'm not sure how to manage the Standby member?

View 1 Replies View Related

Cisco Firewall :: IOS Firewall Versus ASA (5505 / 5510) For Smaller Clients (less Than 50)?

Apr 24, 2012

We were having a discussion of ios firewall vs. asa for smaller clients(less than 50). On using ios firewall(zbf or cbac)and an asa 5505/5510.  One of the arguments brought up on using ios firewall on the router is that a router will do an ip sla failover.  I have configured a number of isr's for this and i know it works good. 

View 1 Replies View Related

Cisco Firewall :: Failover ASA 5505 - Setup Second Inside Interface On Firewall?

Feb 19, 2012

I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?

View 1 Replies View Related

Cisco Firewall :: Setting Up ASA 5505 To Be Used As Firewall Between BT Internet And 3560 LAN Switch?

Aug 23, 2011

setting up an ASA 5505 to be used as a firewall between a BT internet router(BTNet service) and a Cisco 3560 Lan switch. BT have presented me with a cisco 3800 series router with the following details:

Network Address   Network Mask  BTnet NTE Router LAN Address
There are 2 Gigethernet ports on the back of the router port Ge0/0 is connected to the BT NTE and the status light is flashing green. Int ge0/1 is connected into port int e0/1 of the ASA but i am unable to get any connection.

View 21 Replies View Related

Cisco Firewall :: Upgrade From 5505 To 5520 On Network - ASA Firewall Throughput

Feb 27, 2013

I'd like to see some REAL LIFE comparisons of ASA firewall throughput (a bit like this one for ISR G2 Routers - [URL].
The reason I ask is that I recently upgraded a firewall from an ASA5505 to an ASA5520 on a small network where the only outside connectivity was a single 10meg Internet circuit with an IPSEC VPN (not landed on the firewall but on a router) to another site.
When I swapped out the firewall the users noticed a big improvement. The firewall is not doing anything out of the ordinary - no IPS or VPN, just standard state full inspection.

View 5 Replies View Related

Cisco Firewall :: 5505 - Setting Transparent Firewall Ip Address?

Dec 22, 2011

Trying to set up a asa 5505 in transparent firewall mode. I cannot set the management ip address:
ciscoasa> enable
ciscoasa# config term


View 7 Replies View Related

Cisco Firewall :: ASA 5505 Creating Interface Vlan In Firewall

May 3, 2011

I have been working with ASA 5510,20,40,80 but not with 5505 this vlan and its interfaces are quite confusing.Just want to know how it works and its connectivity to Cisco Switch.Do i have to put the interface of the switch in the same vlan as i am creating the interface vlan in firewall ?Now the switch port connecting to this Eth1 interface should also be in the same vlan ? i.e vlan3 ?? or it will be in trunk ? The default configuration shows the eth0 with no access vlan and interface eth1 with access vlan 2... does it mean the eth0 is in vlan1 ? (Nativ Vlan ) ???

View 4 Replies View Related

Cisco Firewall :: ASA 5505 Firewall To Filter HTTPS Websites?

May 28, 2012

I have a cisco asa 5505 firewall. Is it possible to block secure websites in it like [URL]? I have already tried regular expression filtering but it filters only http traffic.

View 4 Replies View Related

Cisco Firewall :: ASA 5505 - Can't Reach FTP Site While Inside Firewall?

Feb 26, 2011

I am trying to configure our ASA 5505 so that our users can access our ftp site using [URL] while inside the firewall. Our ftp site is setup so that you can reach it by either browsing to the above url or by browsing to but we are unable to access our ftp site from either route while inside the firewall. We can access our ftp site using the internal ip address of
Here is our current confguration:
Result of the command: "show running-config"
: Saved:ASA Version 8.2(1) !hostname ciscoasaenable password qVQaNBP31RadYDLM encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1nameif insidesecurity-level 100ip address !interface Vlan2nameif ATTsecurity-level 0pppoe client vpdn group ATTip address pppoe setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!ftp mode passiveobject-group service DM_INLINE_TCP_1 tcpport-object eq ftpport-object eq ftp-dataport-object eq wwwaccess-list ATT_access_in extended permit tcp any host object-group DM_INLINE_TCP_1 access-list ATT_access_in extended permit tcp any interface ATT eq ftp access-list ATT_access_in extended permit tcp any interface ATT eq ftp-data access-list ATT_access_in extended permit tcp any interface ATT eq www access-list 100 extended permit tcp any interface ATT eq ftp


View 6 Replies View Related

Cisco Firewall :: 5505 PAT With Single Public IP And Several Servers Behind Firewall

Nov 21, 2012

New to the ASA 5505 8.4 software version, but here is what I'm trying to do:
-Single static public IP:
-Need to PAT several ports to three separate servers behind firewall
-One server houses email, pptp server, ftp server and web services:
-One server houses drac management (port 445):
-One server is the IP phone server using a range of ports:
Basically, need to PAT the ports associated with each server to the respective servers behind the ASA 5505.  Is anything missing from this config? Do I need to include a global policy for PPTP and SMTP? [code]

View 11 Replies View Related

Cisco Firewall :: ASA 5505 Transparent Firewall With Web Sense Integration

Apr 27, 2011

I'm integrating a Cisco ASA5505 with a Websense proxy. I have a configuration setup where we have four routers which are used for Internet access. There are two VLAN's - Guest and Private. What I would like to achieve is making the use of available bandwidth by load distribution via GLBP, and filtering users web traffic. Two routers will be used for a GLBP group in one VLAN, and the other two routers will be used for GLBP in another VLAN.The users are connected to a Cisco 2960 switch and are in their respective VLAN's. I'm planning a 802.1q trunk to a Cisco ASA from the 2960 switch, carrying both VLAN's.What I would like to know is if there is a CSC module (or similar) which has Websense installed on it, and if it is possible to setup the ASA5505 in transparent mode to filter the traffic in this way? Hopefully this would allow multiple users to take advantage of the additional bandwidth, and not be restricted by using a traditional proxy setup which where all web traffic would be originating from a single MAC address.

View 1 Replies View Related

Cisco Firewall :: 5505 ASA Trunk Port In Firewall

Apr 30, 2012

I have an issue with my firewall,each time i configured a trunk port in the firewall and connect a sw 2960S with a trunk port also, all the interfaces in the Firewall go down ( virutal intertaces, inside, outside , dmz) , also another switch 3750 that is connected to another port in the firewall( access port only) it start to a new negotiation of spanning tree.What could be causing this problem? the firewall didnt sedn bdpdu i think the IOS of the firewall its a 8.2

View 3 Replies View Related

Cisco Firewall :: 5505 Firewall Between HQ And Remote Site

Jun 12, 2012

we are planning on connecting a new aquired company to ours soon?We will connect the remote site to the HQ via a D3. I've been told we will need to have a firewall between them and us for a time. I was thinking of terminating the D3 connection at the remote site of 80 users. Can I use the asr as a firewall as well, to protect the HQ from the Remote site - or should I use a seperate appliance?I was thinking of a asa5505 but, am concerned with bandwidth limitations of the box?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Transparent Firewall Configuration?

Sep 11, 2007

I want to configure an ASA 5505 in transparent mode (7.x). Somehow, I got it to work.. but i need some kind of step by step description. I just want to connect it with outside on a route .. inside in my LAN. Its working now with one ASA. But in the Web Interface the Interfaces inside and outside are down.. but its working.

View 5 Replies View Related

LAN Not Showing Static IP Assigned?

Feb 1, 2011

I�ve assigned the static IP to Server, but when i go back to network properties it show Obtain IP address automatically, however, network working fine with previously assigned IP.

View 2 Replies View Related

Laptop Unable To Get Assigned IP?

May 29, 2011

I've read a lot of threads on this and tried a lot of the suggested solutions... nothing has fixed my problem yet.I'm running Windows XP SP2. I've recently been installing a VPN and setting up firewall rules. I didn't have any problems (was using Comodo firewall) until I installed Sygate Firewall. I've since un-installed but still can't get Windows to connect to the internet via wired or wireless connections[CODE]

View 3 Replies View Related

Cisco WAN :: 892 / Static Ip Address Assigned To The Interface?

Feb 7, 2012

configure my cisco 892 router want a static ip address assigned to the interface because and I have no more internet on the router because am working on my network academy for CCENT?

View 28 Replies View Related

Cisco WAN :: 5510 Block Of IP Addresses Assigned From ISP

Jan 6, 2011

I have a Cisco ASA 5510 with a 5 block of IP addresses assigned from our ISP.  I am having issues with connectivity and routing traffic from the outside interface to the outside interface.  I have my outside interface set up with IP address of 24.182.x.146, it allows internet access and also hosts a web server.  Any time I have a client using this device for internet access, I am unable to have traffic accepted for my web server. I.E 100.100.x.52 is using this device, it browses to https://24.182.x.146 and it gets an unable to connect.  I am able to connect to the web server from any other ISP/Device. [code]

View 4 Replies View Related

Cisco WAN :: 2600 - IP Won't Get Assigned To Interface By ISP DHCP

Dec 27, 2011

I've been using this setting for clients in small offices and what not,  and since all they wanted was to give another nutch of security to their network, we've been intalling cisco routers 2600 series still outhere for their internet connections and we had no issues what so ever, not until we run into cable isp provider, and their dhcp wont be able to assign our interface a dynamic IP, this is the setting aplied to the router interface;
interface fastethernet0/0
ip address dhcp
ip nat outside
no ip redirects
no ip unreachables
no ip proxy-arp 
Why it wont be seen or assigned an ip by their dhcp, I talked to their isp and they assigned a static ip (private one) and we still have the same issue, if i connect a pix 506e interface with the ip add dhcp assigned  to it gets a dynamic ip right away...

View 8 Replies View Related

Cisco Wireless :: AIR-AP1041N-E-K9 / AP Not Getting Ip Address Assigned

Apr 21, 2012

I have a problem with my AIR-AP1041N-E-K9, i do not seem to get an ip-address assigned after a reset to factory defaults.I do see the AP with CDP:

Device-ID: ap
Advertisement version: 2
Platform: cisco AIR-AP1041N-E-K9
Capabilities: TransBridge IGMP
Interface: gi5, Port ID (outgoing port): GigabitEthernet0
Holdtime: 163
Version: Cisco IOS Software, C1040 Software (C1140-K9W7-M), Version 12.4(25d)JA1, RELEASE SOFTWARE (fc1)


I also noticed that when i connect to the AP via console-cable, i can see the AP boot up in the console session, but then i do not get a login prompt, but it seems like the AP is responding; if i shutdown the interconnecting link between the switch and the AP, i do see log messages appearing in the console-connection.I have tried to debug on the Switch, but i need a password, so i can debug, which i do not have.,

View 2 Replies View Related

Cisco VPN :: 5520 - How To Add Self Assigned Certificate For Access

Jun 21, 2012

I have a Cisco 5520 using ASDM 6.4
Currently my VPN settings use a shared key without certficate to access the VPN. I would like to now set up a self assigned certifcte from the ASA to get users to import the certficate in order to VPN..

View 1 Replies View Related

Cisco VPN :: 1811 - WebVPN Being Assigned WAN Zone

Aug 3, 2011

I have a Cisco 1811 router running the 15.1(3)T IOS.  I am having some difficulty with the current zone based firewall and the SSL VPN.
When a user connects, they are put into Virtual-Template 1 which has a zone based assignment of "sslvpn".  However the traffic report for the users is listed as being blocked by the zone based firewall in the outbound direction(office out to the wan zone).

View 1 Replies View Related

Copyrights 2005-15, All rights reserved