Cisco Firewall :: ASA 5505 - VPN NAT Overlap Subnets Remote Interface Does Not Reply
Jul 10, 2012
Not really a big problem, but not knowing the answer is killing me. This is what I have:
Host 1 <-> ASA 5505 <-> VPN connection<-> ASA5510 <-> Host 2
The problem is when one of the hosts trys to reach the inside interface of the remote ASA. E.g. Host 1 trying to ping ASA5510 inside interface. Again Host 1 and 2 have the same subnet address of 10.1.1.0/24. I have configured the ASA 5505 to do the the NAT translations.
[code]...
View 3 Replies
ADVERTISEMENT
Apr 28, 2013
I need to monitor with ping the inside sub-interface of my ASA5540, is that possible? I get the ICMP requests but no replys going out from the box.
I need to ping the 192.168.10.250 from the 192.168.5.55:
ASA Version 8.0(5)
interface GigabitEthernet0/1
nameif inside
[Code].....
View 2 Replies
View Related
Jan 20, 2011
I am trying to Port Forward HTTP: 80, but my Router wont let me and it keep giving me this error message Status: Port Range Overlap with Remote Management.I have a NETGEAR CG814GCMR Router, I need to add that port for setting up a Game private server online, but my router wont let me, how to fix it?
View 12 Replies
View Related
Oct 21, 2012
I have two ASA 5510 in an active-standby cluster, not that I think that the fact that they are clustered will be of any importance here so feel free to think of it as a single 5510. The internet connection is delivered in a single RJ45 connection. To be able to use it with the cluster there is a simple unmanaged switch connected between the ISP and the ASA's. I have two subnets with public addresses, for simplicity lets call them 1.1.1.0/24 and 2.2.2.0/24. Default routers are 1.1.1.1 and 2.2.2.1 respectively.
Can I somehow use both these subnets in the ASA's? Im currently using the first subnet and use PAT to direct traffic to internal servers. But if I want to use adresses from the second subnet wont that mess up the routing, since there is no way I can specify the default router for the second subnet? I have as of yet not tried anything, Im just trying to plan ahead and I cant seem to wrap my head around how this could possibly be done.
View 5 Replies
View Related
May 26, 2013
Site A:
ASA5520
VLAN data subnet 172.16.10.x/24
VLAN Voice subnet 10.0.0.x/24
Site B:
ASA5505 Base license
VLAN data subnet 192.168.10.x/24
VLAN Voice (restr) subnet 10.0.1.0/24
The callmanager is located on site A and needs to sent out DHCP-offers to site B through the VPN so the IP-phones can register to the callmanager. I got the VPN up and running for the data-subnet but i can't get traffic through the voice-subnet/VLAN.
Can the ASA's do the job or do I need to route traffic before the ASA's on both sides and sent it through the tunnel, configured both subnets as interesting traffic? Ofcourse the last situation I need to upgrade the license for the 5505 to gain more VLAN's.
View 4 Replies
View Related
Aug 17, 2011
I have an ASA 5505 running 8.2
I used the ASDM wizard (6.3) to set up a remote VPN. After slightly adjusting the wizards configuration the VPN is working well.
Now I need to change the Outside interfaces IP address. When I do that the VPN no longer works. If I change it back to the original value the VPN works again.
What configuration changes do I have to make regaurding the remote VPN after changing the outside interfaces IP address?
View 11 Replies
View Related
Apr 4, 2013
I have many VPN sites using ASA5505 with broadband connection and terminating on a single ASA5550.I have a problem with one site. they are having poor performance. One of the issues I can see is an error on the remote ASA 5505.ive tried the reccomended fix using this command: crypto ipsec security-association replay window-size 1024.
View 1 Replies
View Related
Jun 12, 2011
when a user login into the Cisco ASA Firewall (v8.3.2) via WebVPN, and accesses the applications. This works fine. In fact, the user can also create bookmarks etc.The problem here is when this user signs off and another user signs in via WebVPN, on the same PC or even on a different PC, this new user can view the screen viewed by the previous user. Basically, even though certain users can view only certain applications, but in my case, not all the time, but most of the time, users logging into via WebVPN can view someone else's profile application.
I suspect this is due to cookies or cache but I'm not sure myself. What can I do to resolve the problem.Currently, this issue is being resolved via a lousy manner i.e. we go to the SMB location and we clear the .CSP file manually, which is not the correct way to address this issue.
View 1 Replies
View Related
Aug 15, 2012
I need to NAT some subnets to one IP and other subnets to another IP. The range command want work because some of the subnets are out of order.For example subnets 192.168.1.0 - 192.168.7.0 and 192.168.25.0, 192.168.28.0 nat'd to 1.1.1.1. subnet 192.168.26.0-192.168.27.0 nat'd to 1.1.1.2
View 2 Replies
View Related
Feb 19, 2012
I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?
View 1 Replies
View Related
Jun 12, 2012
we are planning on connecting a new aquired company to ours soon?We will connect the remote site to the HQ via a D3. I've been told we will need to have a firewall between them and us for a time. I was thinking of terminating the D3 connection at the remote site of 80 users. Can I use the asr as a firewall as well, to protect the HQ from the Remote site - or should I use a seperate appliance?I was thinking of a asa5505 but, am concerned with bandwidth limitations of the box?
View 1 Replies
View Related
May 3, 2011
I have been working with ASA 5510,20,40,80 but not with 5505 this vlan and its interfaces are quite confusing.Just want to know how it works and its connectivity to Cisco Switch.Do i have to put the interface of the switch in the same vlan as i am creating the interface vlan in firewall ?Now the switch port connecting to this Eth1 interface should also be in the same vlan ? i.e vlan3 ?? or it will be in trunk ? The default configuration shows the eth0 with no access vlan and interface eth1 with access vlan 2... does it mean the eth0 is in vlan1 ? (Nativ Vlan ) ???
View 4 Replies
View Related
Dec 19, 2012
I have a Cisco 5510 which has remote access VPN configured.Now I have new block of IP address, is there a way I can just change the outside interface IP so that people can remote in without doing anythng else?Or if I coulds be taught to create a new one.Or best way to approcah this issue?For example: it was 67.64.x.x now I need to change to 64.44.x.x.
View 1 Replies
View Related
Dec 3, 2012
I have two routers on my internal network.
10.10.199.106 is a Cisco ASA5510.
10.10.199.108 is a Sonicwall NSA 3500
The sonicwall handles our site to site VPN tunnels. The Cisco handles our client to site VPN connections.
I have a unit that points to 10.10.199.106 (Cisco) for internet access. All other clients on the network point to 10.10.199.108 (Sonicwall) for internet access.The device in question, a Synology NAS, is using 10.10.199.68 as it's IP address.
I'm trying to hit the web interface on the NAS from a remote site across our VPN tunnel. The IP scheme on the remote end of the VPN tunnel is 192.168.72.0/24.
Going through the VPN, I can hit every object on the network that uses .108 (Sonicwalll) as it's gateway. However, I cannot hit the unit that uses .106 (Cisco) as it's gateway.
I added a route statement (using ASDM) that routes all traffic destined to 192.168.72.0/24 to the Sonicwall so it can send it back down the VPN tunnel. If I'm understanding routing correctly, this should allow responses from NAS destined for 192.168.72.0/24 to go back down the VPN tunnel.
View 4 Replies
View Related
Nov 7, 2012
I had a previous issue in which I couldn't make a connection to an ASA 5505 behind an edge firewall found here: url...My continuing issue is that I can indeed connect to the ASA 5505 remotely but I cannot access anything internally. I believe it is a NAT issue but as of yet, nothing has worked.
View 1 Replies
View Related
Jun 15, 2011
I've got a 5520 running 8.4(1).I've setup a simple NAT: [code] Running wireshark on the outside of the ASA, I can see the packets going out fine (the source address has been translated). I can see the replies coming in from the 'net. But the replies don't get through the ASA to the internal host.What do I need to do to allow the reverse packets to get through the ASA back to the host ?
View 3 Replies
View Related
Dec 10, 2012
I want to creat sub int on ASA 5505 but when I am trying below command it show error.
------------------------------------
config t
int f0/0.3400
------------------------------------
My ASA software version is 8.2(5).
View 5 Replies
View Related
May 13, 2009
Can we make sub interface on Cisco ASA 5505 model and if its possible then do that interface need to be upgraded into Trunk Port.
View 8 Replies
View Related
Aug 22, 2012
unresponsive / lockups with Cisco ASA 5505 remote management ?
I think it happens like this:
1) With ASDM (Java Web Start), add new crypto map (it could be anything, just happens to be what i added the last time this happened)
2) Click apply
3) ASDM hangs (at this point the Java client becomes entirely unresponsive)
4) ASDM.jnlp refuses to connect and eventually timeout dialog appears. However, VPN connections are still accepted.
5) After a few hours (over night), the ASA refuses all incoming traffic including VPN connections.
View 5 Replies
View Related
May 21, 2012
I have a remote ASA5505 running 8.4(3) with a working site 2 site VPN tunnel to my main office. (The main office is running an ASA 5510 with OS 8.4.3 as well). The encryption domain is all private IP on main site vs. 172.16.10.0/23 on remote site.
Relevant config of the remote ASA:
interface Vlan1
nameif inside
security-level 100
[Code].....
I can manage the ASA on the outside interface (outside of the site 2 site VPN) using the TACACS credentials I can also ping my management station from the ASA using the inside interface, but as stated, the other way around does not work. I have not yet tested if management from the local 172.16.10.0/23 subnet works, but I will try this next.
View 5 Replies
View Related
Jan 5, 2012
How do I enable remote access to ASDM from outside of the network on the ASA 5505? This would be used for remote access to the firewall at a site that is not utilizing VPN.
View 5 Replies
View Related
Oct 29, 2012
I have 5505 license with default 10 user license, want to increment the remote vpn user to 50 user license;will it be on yearly basis.Another question, can we purchase security plus license for configuring the failover config ,as well support the 50 user license on the same..
View 3 Replies
View Related
Sep 9, 2011
I setup a site-to-site VPN tunnel at the remote ASA5505. I am able to asdm to the outside interface but not ssh. I switch to telnet and still not allow me to access. I added an ACL to allow telnet any to the outside interface but still not working. In ASDM I see the log Here is the second issue. When I want to change the telnet back to ssh using ASDM I got the following error.
View 2 Replies
View Related
Aug 13, 2011
I have a problem where my outside interface stops passing traffic and the only way to resolve the issue is to reload the ASA, the interface never is down it just stops passing traffic. The inside interface never stops allowing traffic to pass as I can get to all my internal servers and shared drives.
The firmware is:
asa821-k8.bin
Running Config
: Saved:ASA Version 8.2(1) !hostname f1domain-name somedomain.co.ukenable password w1Y.GBKFyC5NqO3M encryptedpasswd 2KFQnbNIdI.2KYOU
[Code].....
View 4 Replies
View Related
Nov 6, 2011
I'm using asa 5505 with 8.4(2) and have the following problem.I have 2 Networks. each Network has it's own externel Internet-Ip and also Mail-Server.
[code]
Now I want a communication between the two Mailservers with their external Ip-Address.I did a static NAT from ipnt any to int any or also from int routed to int routed, but nothing worked.Packet tracer showed at NAT-Lookup where the externel adress of the second Mailserver is passed: Info Static translate Network1 to Network1
But it should show a translation from network1 to network1-external.Due to Security reasons, I cannot paste the whole config.Under 8.0 I did the same configuration with Policy-Nat and it worked.
View 1 Replies
View Related
Nov 21, 2011
I have setup ASA 5505 with 2 ISP, named outside (primary) and backup, the scenario is if outside down, then backup will take over, it works now. But it is not working when the primary connection cannot reach the gateway with the interface still up.
Is it possible when the primary connection cannot reach the gateway then backup automatically take over?
My configuration is:
ASA Version 8.2(1)
!
hostname cisco
[Code].....
View 4 Replies
View Related
Nov 14, 2011
I have a Cisco ASA 5505, the problem is I am not able to ping to outside natted interface (ip: 172.88.188.123 and 124 and 125) from inside network I have looked for ASA documentation through the internet and still got nothing.
the config are:
: Saved
:
ASA Version 8.2(1)
!
[Code].....
View 2 Replies
View Related
Sep 13, 2012
I am trying to access and ping the inside interface of a ASA5505 from a remote network. From the remote network, I am able to access anything on the local network, but the ASA5505 inside interface.The 2 networks linked by a fiber link which have a transport network on another interface. From the remote network, I am able to ping the transport network interface IP, but I would like to be able to ping the inside interface IP. When I do a packet tracer, I get a deny from an implicit rule.How can I achieve that?
Here are the subnets involved and the ASA5505 config.
Remote network : 10.10.2.0/24
Local network : 10.10.1.0/24
Transport network : 10.10.99.0/24
[code]....
View 1 Replies
View Related
Dec 16, 2012
Doing a port forward for remote desktop with asa 5505 9.1.1 and asdm 7.1.1 I could have done this with the previous versions of asdm but now it even more confusing?
View 21 Replies
View Related
Mar 7, 2011
I am using my ASA 5505 to remote VPN. I use both windows and Macs. I use the Cisco VPN client software on the windows machine, on the Mac I have used both the Cisco VPN software and the built in OS X VPN client.
I am able to VPN with all machines, but randomly the VPN will disconnect all users. I know there is a setting that may fix this which I think I tested in the past and it did not work, but I have now forgotten it.
View 4 Replies
View Related
Jul 13, 2011
I would like to allow remote access to a windows server through a ASA (5505) firewall. Users will use the vpn connection in order to connect to a private network. Is there any link that describes the steps for ASDM?
View 3 Replies
View Related
Jun 28, 2011
ASA 8.3(2) 5505
I've configured a number of remote access vpns on ASAs, but I don't recall having a default gateway setting assigned after logging in.
Is there a way to disable the assignment of a default gateway upon login?
The value assigned is meaningless. It's just the next available address in the local pool.
View 2 Replies
View Related
Mar 23, 2011
I want to give access to remote subnet on firewall 5505.
Remote subnet is 16x.15X.56.0
Here is my access list
access-list outside_5_cryptomap extended permit ip 192.168.12.0 255.255.254.0 16x.15X.56.0 255.255.254.0
View 7 Replies
View Related
