Cisco Firewall :: ASA 5510 DMZ Configuration?

Dec 26, 2011

I have a Cisco ASA 5510 connected to 2 private lans (1 for my HQ pc's{inside} and 1 for the worldwide mpls{outside}) It is also connected to the public internet at interface "public" and my dmz at "dmz" interface.  I suspect I have a routing issue because packet-trace yields allow, the nat looks ok and the objects look ok at least to me but I'm the one with the non working config so...Basically this is the desired flow: 

1. I need all traffic from the inside to be able to flow to the outside unimpeded as they are both trusted networks. (this is ok right now as I allow everything via access-list 101.)

2. I need any host on the public internet to be able to reach a server on the dmz via the pat which I set up from the "public" interface to the "DMZ" interface.  The desired flow would be that the person on the internet types in [URL] and this is directed to the public interface ip which forwards to the webserver object on the dmz. (I cannot get this working any which way)

3. I need the dmz to be able to communicate with another server on the mpls via the "outside" interface when it recieves the request from the public it then checks with this other server on the outside via nat(translating the dmz range into the ip of the outside interface on the firewall)I have a default route that points to the mpls or outside interface for 0.0.0.0 0.0.0.0 via 10.x.x.1 - (and although I'm not sure I suspect this could be conflicting with traffic that needs to be sent to the "public" interface .... meaning that the firewall should dump packets bound for 0.0.0.0 0.0.0.0 to the public interface - 184.x.x.194 but I'm very reluctant to change the default route as this is in production and I'm not sure how it will affect traffic).However, I do suspect that if I changed the route from default to static as such:

route 10.0.0.0 255.0.0.0 10.x.x.1 (this would get all lan and mpls traffic to the mpls gateway) route 0.0.0.0 0.0.0.0 184.x.x.193 (this would send everything else from public to the public internet gateway)I think this is accurate but then I would bypassing my corporate internet proxy which is behind the mpls gateway at 10.x.x.1? Is there a way to get http traffic originating from the lan (10.x.x.x) to use the mpls gateway and http traffic for the dmz to use the public internet gateway at 184.x.x.193.  I don't want to start causing a flow problem for the internet nor do I want to bypass my corp internet proxy.Either way I cannot get this to work, eventhough the logic checks out, I cannot get even a ping response when I allow icmp any any for testing. Note: I can ping resources on each network from the firewall, not only it's own ports in the associated network but other resources on those networks as well. 
 
Here is the running-config:

ciscoasa# sho run
: Saved
:
ASA Version 8.4(1)
!
hostname ciscoasa
domain-name marcjacobs.lvmh

[code].....

View 16 Replies


ADVERTISEMENT

Cisco Firewall :: Set Up FTP Configuration Behind ASA 5510?

Jan 24, 2013

I am attempting to set up FTP behind this new CISCO ASA 5510 we just bought. I haven't configured a cisco device in 5 years, so I am having issues., i think i am close. If I FTP from outside (fixed) IP it connects and takes the password but hangs on PASV and gives no data connection below is my configuration.  It is simple since I seem to have the connection inside correct. and yes you can connect to the FTP server from inside without issue.
 
Code...

View 4 Replies View Related

Cisco Firewall :: ASA 5510 - ISP Configuration Possible?

Jul 24, 2012

I have one Asa 5510 with base license. now we wish to add one back up ISP for VPN fail over, is this possible to configure backup ISP with this ASA 5510 and how ?
 
Check ASA features
 
Cisco Adaptive Security Appliance Software Version 8.2(2)
Device Manager Version 6.2(1)
 
Compiled on Mon 11-Jan-10 14:19 by builders
System image file is "disk0:/asa822-k8.bin"
Config file at boot was "startup-config"
 
Cisco asa up 3 hours 35 min
 
Hardware:   ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB

View 3 Replies View Related

Cisco Firewall :: Getting ASA 5510 QoS Configuration?

Jun 11, 2009

We have some users who use citrix outside corporate network through citrix web interface.These users are high priority users and we want to prioritize the citrix traffic. I want to make sure that my configuration will fullfill our requirements. Below is the configuration i was thinking to implement.:
 
ASA(config)# priority-queue outside
ASA(config-priority-queue)# exit
ASA(config)#access-list CTX-QoS extended permit tcp any 10.1.1.200
255.255.255.255 eq https
ASA(config)# class-map CTX-QoS-CMAP
ASA(config-cmap)# match dscp ef
ASA(config-cmap)# match access-list CTX-QoS
ASA(config-cmap)# exit
ASA(config)# policy-map CTX-QoS-PolicyMap
ASA(config-pmap)# class CTX-QoS-CMAP
ASA(config-pmap-c)# priority
ASA(config-pmap-c)# exit
ASA(config)# service-policy CTX-QoS-PolicyMap interface outside

View 3 Replies View Related

Cisco Firewall :: ASA 5510 DMZ Configuration?

Aug 28, 2011

I have created the following config for an ASA 5510. I implemented a DMZ on it. Is this config as secure as I can get it. I want the web server in the DMZ to only be able to access port 80 and 1433 on the SQL box inside. 

ASA Version 8.2(1)
!
hostname fw
domain-name xxxxx
enable password k4HlcGX2lC1ypFOm encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names

[code]....

View 6 Replies View Related

Cisco Firewall :: ASA 5510 Configuration PAT For A Second Network?

Apr 30, 2013

BTW, the ASA is running version 7.0 (8) and I'm doing this through the command line.I've got a group of workers coming in a couple times per week that need wireless access to 1 printer on our network and internet access; I'll deny them access to the rest of our LAN.I've already configured an AP with WPA2 on a seperate subnet and put a router between it and our network.  I've setup the router to apply an ACL to allow access to the printer's IP, deny to the rest of our main subnet, and permit everything else to go to our ASA 5510 that is serving as our gateway. From a laptop connected to the access point:I'm able to ping the printer's ipI'm not able to ping other workstations or our servers, as intendedI'm able to ping the ASA's inside interface The only part I can't seem to pull off is the final part of getting the ASA to translate the IP's from the new subnet to the outside interface.

So we have:
 
Laptop > Wireless AP > Router with ACL > Primary LAN > ASA5510 > internet
  
PAT is working fine for the primary LAN, but the laptop can't hit the internet.

View 7 Replies View Related

Cisco Firewall :: ASA 5510 Syslog Configuration?

Jul 30, 2011

i want to configure asa 5510 to send syslog messages to syslog server which i placed in my inside interface. also if enableing syslog will inrease the cpu utilization or memory? the necessary configuration parts?

View 1 Replies View Related

Cisco Firewall :: Basic DMZ Configuration On ASA 5510

May 8, 2011

creating a DMZ with my current configuration. Most of my configuration has been through the ASDM as I am still learning. I'm looking for a good tutorial through the ASDM to get me on my way. What I need to accomplish is this:
 
I have an internal GIS server which needs to have a constant database connection to an remote GIS Server which is already configured. I've got a separate VLAN setup on my 3750 switch which connects to the DMZ configured port on my ASA with a security level of 50. My GIS server has been placed in the DMZ VLAN which is accessible from my internal clients. I have a /30 Internet block which is being used for Internet and VPN. I have a separate /28 block that I'm assuming I'll need for the DMZ to work properly.

View 1 Replies View Related

Cisco Firewall :: NAT Configuration In ASA 5510 IOS Version 8.3

Mar 8, 2011

Will give configuration of NAT for my internal users with 192.168.1.0/24 with single public IP.
 
I new to configure IOS version 8.3.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 Configuration Woes

Apr 12, 2012

I'm working on getting a ASA 5510 set up and am having major difficulties. I'm really new to ASA and coming over from Microsoft ISA. Below is my configuration, how to get this all sorted out. As of nwo it doesn't appear that any traffic is going through whether it's incoming or outgoing. [code]

View 3 Replies View Related

Cisco Firewall :: ASA 5510 ACE Syslog Configuration

Dec 5, 2012

I've a problem with syslog logging on my Cisco ASA 5510 version 8.2(1). I need to:

- 1) log some ACL with warning level to log deny access.
- 2) log some ACL with informational level to log permit and deny access (notification level log only deny access and not permit access).
- 3) not log others ACL.
 
For 1), I configured the syslog server with warnings level and i enabled the logging rules with default level (syslog default level)
logging enable logging trap warnings logging host "interface" "host" . access-list "interface" extended permit ip any any log default.
    
For 2), I enabled the logging rules with specific level (informational).
access-list "interface" extended permit ip any any log 6 interval 300.
 
For 3), I disabled the logging rules.
access-list "interface" extended permit ip any any log disable
 
My problem is that the syslog logging level bypass the ACL logging level. Even if some ACL are configured with informational level, the ASA send only warnings logs to the syslog. I tried to configure the syslog default level to warnings, to remove the ACL and then put it back again with the specific logging level but I still have the problem.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Configuration For Authentication With ACS 5.X Server

Dec 30, 2012

when we are configuring ASA 5510 8.2(5) for Authenticating with ACS 5.X Server is not authentication fail error.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 Dual ISP Configuration Required

Jul 13, 2011

I have existing Sonic FW in my company we are moving from sonic FW to ASA 5510 Security plus lice. I have two ISP currently connected to sonic Firewall I am planning to implement Dual ISP configuration on ASA5510.

View 12 Replies View Related

Cisco Firewall :: DMVPN Configuration With ASA 5510 In Front Of 877-K9 HUB?

Nov 14, 2011

I have  Cisco 877-K9 router which sits behind an ASA 5510 FW. The Design :
 
Cisco 877-K9 DSL router (DSL with Static IP) ( DMVPN HUB )
||
ASA 5510 Firewall (Outside INT with Static IP / Inside INT LAN) (PAT & ACL)
||
Switch
||
LAN
 
Now my problem is, My Dmvpn configuration works just fine, I'm able to ping from my Cisco 877 to any Spoke & vise versa. I'm also able to Ping from my LAN to any Spoke Tunnel IP, but Im not  able to ping any LAN IP at Spoke site nor am I able to ping my LAN from  any Spoke site. I've googled alot but have come at designs where the ASA's are behind the Cisco Routers and not infront.

View 7 Replies View Related

Cisco Firewall :: Protocol Used For ASA 5510 Configuration Replication

Sep 5, 2011

What protocol the firewall configuration replicate and monitor the interfaces?

View 1 Replies View Related

Cisco Firewall :: Export Configuration From ASA 5510 To ASA 5520?

Oct 14, 2012

I have new ASA 5520 units currently we are using ASA 5510... I have to migrate all the configuration to the new ASA 5520 units....I am wondering is there a possible way to export and import certificates from ASA 5510 to 5520....
 
how to export or copy all the configurations, plug-ins, certificates from 5510 to 5520.Existing configuration snapshot...CA certificates from third party installed for authentication and identity certificate from Verisign

WebVPN
Anyconnect
Plug-ins
IPSEC tunnels
NAT

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Redundant Interface Configuration

Aug 14, 2012

I have configured redundant interface on ASA 5510
 
interface Redundant1
description *** INSIDES NETWORK ***
member-interface Ethernet0/1 (This is a 1000Mbps Port)
member-interface Ethernet0/2 (This one is 100Mbps)
no nameif
no security-level
no ip address
[code].... 

Then... i issue following command and its OK!
 
ASA5510# show interface redundant 1 detail
Interface Redundant1 "", is up, line protocol is up
Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
Input flow control is unsupported, output flow control is off
[code]...
 
It's transfer correctly then i no shut and back to normal Primary core switch Gi0/30 Interface again, BUT  redundant interface no revert back. I issued this command again BW remain 100Mbps.

ASA5510# show interface redundant 1 detail
Interface Redundant1 "", is up, line protocol is up
Hardware is i82546GB rev03, BW 100 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
[ code]....
 
I did manually shut down and no shut the secondary core switch interface Gi0/30 Its changed correctly to 1000Mbps .

View 1 Replies View Related

Cisco Firewall :: Configuration ASA 5510 Complete Redundancy

Mar 16, 2013

I want to configure ASA 5510 with complete redundancy first time. I have already studied all material from cisco web site. but there are avalible alot of material. and i'm confused about the exact my requirment material.
 
This is current configuration:

active# sh running-config
: Saved
:
ASA Version 8.2(5)

[Code].....

View 10 Replies View Related

Cisco Firewall :: 5510 - ASA Active / Standby Configuration

Jun 4, 2012

I currently have a LAN-based failover setup between two 5510s. The failover link is a crossover cable. In the current setup, if I unplug the crossover cable both units become active. From what I understood from Cisco documentation, each unit should mark the failover interface as down and there shouldn't be any failover. That's exactly how I want this setup to work.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 Context Base Configuration In HA Mode?

Jun 10, 2012

configure the Firewall ASA 5510 in context based configuration in HA Mode with two different subnet....
 
IP Details are below.....:
 
interface Ethernet0/0
nameif outside
security-level 0

[Code].....

View 1 Replies View Related

Cisco Firewall :: 5510 Setup In Active / Standby Failover Configuration

May 8, 2012

We have 2 ASA 5510's setup in an active, standby failover configuration. When the primary fails over to standby, the 3rd party cert does not failover to the standby ASA. The users then receive the CERT missing, invalid message and have to select yes, no to move on. This does not occur when the primary is not in failover mode. It is my understanding that failover fails over certs but in our case it does not apper to be working correctly.

View 1 Replies View Related

Cisco Firewall :: Adding Failover ASA 5510 Back After Configuration Changes On Primary

Nov 28, 2012

I had a working active/passive pair of ASA5510's, and then I had to do a rush firmware upgrade, but didn't have time to do it on the secondary at the same time.  Now I have made config changes and upgraded the secondary firmware to be the same, and wish to know if I plug it back in if it will think the secondary has the "correct" config or if it will know that the primary is newer.  I disconnected the failover cable because it was complaining about version mismatches constantly.
 
Is it safe to add the secondary back in or is it possible it will be declared newer and overwrite the config?

View 6 Replies View Related

Cisco Firewall :: ASA 5510 Displays Error - Unable To Make Any Configuration Changes

Feb 4, 2012

I have turned on the aaa command authorization without applying adequate privileges to the user. I can now log in through that user but the ASA 5510 displays an error :ASA 5510# show running-config

ERROR: % Invalid input detected at '^' marker.
ERROR: Command authorization failed.

I am unable to make any configuration changes on the firewall. Is there any default user through which I can log in and disable the aaa authorization ? if not, how can I resolve this situation ?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Identity NAT Configuration For Remote Access VPN And Site-to-Site

Mar 9, 2011

I am try to configure ASA 5510 with 8.3 IOS version.My internal users are 192.168.2.0/24 and i configured dynamic PAT and are all internet .

i want configure identity NAT for remote access VPN.Remote users IP pool is 10.10.10.0 to 10.10.10.10
 
i know to configure NAT exemption in IOS 7.2 version. But here IOS 8.3 version. configure NAT exemption for 192.168.2.0/24 to my remote pool( 10.10.10.0 to 10.10.10.10).

View 6 Replies View Related

Cisco Firewall :: ASA 5510 Configuration Modifications In Active / Active Mode

Dec 17, 2012

I have two ASA 5510s running in Active/Active mode. I need to make config changes on them. How do I go about it? Do I power off the secondary ASA and make the config changes on the primary and then power on the secondary ASA ? Or this another way to do this?

View 3 Replies View Related

Cisco Firewall :: Site-to-Site VPN Between ASA 5510 And 5505 Configuration

Apr 18, 2013

I am not very experienced with Cisco networking.

Here is the situation.
 
Site A - headquarters 192.168.1.x
Site B - remote office 192.168.20.x
Site C - remote office 192.168.30.x
 
Site A - ASA 5510
Site B - ASA 5505
Site C - ASA 5505
 
Site-to-site VPN is established and works between A and B, A and C. Users would like to establish a tunnel between B and C to work on a common project and the data is on Site B.
 
I tried configuring the S2S VPN with pre-shared keys on both firewalls at sites B and C but in the end it is not established (I cannot ping either side). I used the Wizard interface multiple times and one time the CLI. I generally followed the settings chosen between the headquarter and the individual remote sites and tried to replicate them. Obviously I have made a mistake somewhere.
 
Could there be any limitation on the ASA 5505 in terms of licensing and the number of S2S tunnels?

View 7 Replies View Related

Cisco WAN :: 5510 - How To Do BGP Configuration

Jan 3, 2013

Current configuration:
 
2xASA5510s (Active/Standby) --->3925 Internet Router---->Internet
 
Going to:
 
2xASA5510s(Active/Standby)---->3925 Internet Router A----->ISP (Primary)
                                          ---->3925 Internet Router B----->ISP (Backup)
 
Note:  Only one ISP just different speed connections
 
We're going to be using BGP to the ISP.  Our goal is to advertise one subnet via BGP over both links using routerA as the primary and routerB only if it fails.  How can should I configure my ASA and the internet routers to accomplish this?

View 2 Replies View Related

Cisco VPN :: ASA 5510 Configuration Suggestion

Oct 31, 2011

we have a cisco ASA5510 and our client owns a Juniper device. we already have a vpn tunnel in place between the two locations and its working fine.Now, they have some networks which are in more secure zone, if we add those subnets to the present tunnel we are not able to access them. so what they are suggesting that we can reconfigure the VPN to be a route based VPN instead of policy based  OR  configure a second VPN tunnel.am not sure of cisco ASA supports route based tunnels???.. Can we create a 2nd tunnel between the same devices ( asa5510 and thei juniper device) as the IP remains same, only the internal remote networks will change for me. do i need to make any changes to the present tunnel??

View 8 Replies View Related

Cisco VPN :: 5510 - IKE Configuration On ASA 9.1 / ASDM7.1

Feb 6, 2013

I am not seeing the IKE Policy configuration screens while configuring IPSEC VPN on ASA 5510. (Using ver 9.1(1) / ASDM 7.1) following the wizard after step 8, I am expecting the screen where you configure DES/3DES ,etc the screen does not show up - Have the right (3DES) licence.

View 2 Replies View Related

Cisco VPN :: ASA 5510 - Configuration To Do NAT Of Incoming Tunnel

Apr 25, 2013

I have been struggling to come up with the proper config to do a NAT of an incoming VPN tunnel to a VLAN on my network. I have an ASA 5510 with an IPSEC site-to-site tunnel to a partner network of 166.110.0.0/17.I have several VLANs on the ASA interface behind a cat4500 router (192.168.100.024, 172.16.4.0/24, 166.110.128.0/22 etc). The only network that the partner network sees is the 166.110.128.0/22.My problem is that I need to give them access to a node on my 192.168.100.0/24 net, but can't get the admin on the other side to add a route and adjust his tunnel.

View 4 Replies View Related

Reload Cisco 5510 Configuration Without Reboot?

Jan 30, 2012

is there any way to reload the current saved (not running) config without a reboot of the firewall?

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ASA 5510 - Cut Through Proxy Configuration

Jan 11, 2009

I would like to configure limited internet access to olnly a select group of Windows AD users. 
 
I beleive cut-through proxy will allow me to do this, just not sure how to configure it on a Cisco ASA-5510

View 7 Replies View Related

Nortel 5510 Can't See Port Ip Configuration

Jul 18, 2012

I have worked on cisco switches only..I want to configure nortel5510 have configured vlan.but Switch Ip address is changing when I am giving ip address to port. and i cant see port ip configuration in show runn also i want to configure loopback.I am configuring switch ip address 192.168.123.1/24 but when I give ip address to port 192.168.120.17/29(PORT IN DEFAULT VLAN) switch ip address changes automatically.I have port 1-4 configured in vlan 1 other ports are in L3 vlan.I want see port ip address details Like we see in cisco (SHOW IP INTERFACE BRIEF ) what is command in NORTEL??

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved