Cisco Firewall :: ASA 5520 - Creating Host Objects Via CLI

Nov 3, 2011

I am trying to create host objects that I'll then add to network-object groups for use in ACL/ACEs.When I try to create a host I am having trouble adding the IP address.I then get an error saying the host name must start and end with letters or numbers and only contain letters or numbers. What do I need to do to create hosts from CLI?

View 2 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5520 Adding Network Objects Via CLI

Nov 3, 2011

I'm working with ASA 5520s. how to add network objects via CLI. I know I could easily do it using ASDM, but I like to learn the hardway first. How do I add the subnet mask for a network object when creating via CLI? [code] That sets up the hosts with IP addresses, but how do I add the subnet mask?

View 2 Replies View Related

Cisco Firewall :: Creating Subinterface In ASA 5520?

Jan 31, 2013

I am in a non-admin context mode in ASA 5520  8.0 (5) and i m trying to add a new interface
 
GigabitEthernet1/2.4 172.19.4.1 255.255.254.0 manualGigabitEthernet1/2.6 172.19.6.1 255.255.255.0 CONFIGGigabitEthernet1/2.180 172.19.180.1 255.255.252.0 manualGigabitEthernet1/2.190 172.19.190.1 255.255.254.0 manualgvadc-fw/tgf# conf tgvadc-fw/tgf(config)# int ggvadc-fw/tgf(config)# int gigabitEthernet 1/2?
configure mode commands/options:1/2.180 1/2.190 1/2.4 1/2.6gvadc-fw/tgf(config)# int gigabitEthernet 1/2.168 ?ERROR: % Unrecognized commandgvadc-fw/tgf(config)#
 
what do i do?

View 2 Replies View Related

Cisco Firewall :: Creating Access Rules On ASA 5520 Platform

Aug 2, 2011

Our company has recently upgraded our firewall from a Borderware Steelgate v7.1 platform to a Cisco ASA 5520 platform.  Needless to say the interface on the Cisco platform is much more complex and I don't have much experience working with firewalls. Our other IT guy is out of town and this is the first time I have worked on this setup. 
 
I need to create the following access rule
 
I need to open port 4**0 to be allowed through the firewall from external ip address 10.XXX.XX.XXX only. Then forward port 4**0 to 10.XX.XX.XX port 80 tcp

View 9 Replies View Related

Cisco Firewall :: 5520 High Memory Usage And Error Creating Access Rules

Feb 13, 2013

I'm having a problem with the memory and also trying to create some rules on the CISCO ASA. The version that I got installed was the 8.2.5.33 on a CISCO 5520 with 512 RAM, the memory usage is on 99% used, 1% free and because of that when I'm trying to create a new rule the firewall brings me the next error..So what I did was a downgrade to the version 8.2 (4) 4 and the memory went down a little (82% used, 18% free) but I still got the error when I'm creating an access rule on the device. One thing and I'm not sure if this could affect on the performance are the number of access list and the object groups that are created.
 
I already open a case with CISCO TAC and they are checking if the problem is with the memory capacity or maybe a memory leak.Also the doubt that I got is with the memory that I got now available should I can create access rules or 82 is still to hig to create a rule or and object group?

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - SSH From Internal To DMZ Host

May 13, 2012

I am not very familiar with ASA 5520 yet.I have been able to allow the OUTSIDE world to connect via SSH to the intermal host 172.17.2.50 on my DMZ network. I've created a NAT rule and an ACL as written on the configuration below.
 
Now I need the INTERNAL network to ssh 172.17.2.50 but ASA stops me with the following error: [code]

View 2 Replies View Related

Cisco Firewall :: Host Cannot Browse And Allowed With Asa 5520

Apr 20, 2013

Port forwarding done to a DMZ located server on the cisco ASA 5520. Now this host cannot browse but allowed outside to inside access is possible Is there anyway i can give this system to browse internet? may be through the natted IP ( 94.20.*.*)

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - PING From Outside Into Inside Host

May 13, 2013

I have ASA 5520. I cannot ping the host(192.168.1.20) which is inside firewall from outside hosts. Inside host (192.168.1.20) is translated into (198.24.210.226) using static NAT.From outside host, I used "PING 198.24.210.226".  Is it because I used dynamic PAT for inside hosts?

interface GigabitEthernet0/0nameif outsidesecurity-level 0ip address 198.24.210.230 255.255.255.248!interface GigabitEthernet0/1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0

[Code].....

View 3 Replies View Related

Cisco Firewall :: ASA 5520 - Host 300+ Secure Websites Using Couple Of Public IPs

Jun 22, 2011

How can we host 300+ secure (https) websites using a couple of public IP's on an ASA5520 with AIP SSM-20 and with as few certificates as possible?
 
Summary of set-up:
We currently host a number of websites using an ASA5520 and use host headers, so have 6 servers with around 40 hosted URL's. The number of websites is due to double very soon and we will need to use more of our public IP's. We can see that we will will run out of public IP's very soon especially as there is a project in the pipeline that has a likely requirement to host an additional 200+ websites.

Each of these websites are required to use https and therefore each must have a certificate which will be very expensive. PCI DSS (payment card industry data security standard) is causing us issues because we had hoped to post the certificates on the firewall (one for each physical server) and then run the data UN-encrypted from the firewall to the relevant web servers, so that we could use one certificate for lots of websites and therefore reduce our certificate costs, however is not best practice to do this due to the data being unencrypted within the firewall and on the DMZ network and therefore potentially open to compromise. I doubt that we could install 200+ certificates on a 5520 and then re-encrypt the data to the web servers especially seeing as we also have an IPS card that is already running at around 70-80% util due to the performance overhead.
 
BTW - We also have an in-line Breach WAF which will be required to inspect the packets (certificates to be installed on the WAF to allow this).

View 1 Replies View Related

Cisco Firewall :: 5520 - Inside Server To See Actual Outside Host Source IP In Udp Packet

Mar 3, 2013

I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server.   The server can get to outside hosts OK, and the traffic is being NATed  properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send  'announcement' UDP packets to the inside server.  I thought this might be an  outside-NAT-required issue to get the traffic routed, but I need the inside server to see the  actual outside host source IP in the UDP packet, so I basically set the  outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the  destination (inside server) subnet, and its gateway is the outside  interface of the ASA, the same way the inside server is able to get to  hosts outside.  The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
 
I have the appropriate ACL's set up, and when I do 'show access-list' I  see policy hits for the 'permit' statements where the outside host is  generating the announcement and it's hitting the ACL.  I even duplicated  the ACL into list 101 and 102, and applied 101 for inbound traffic on  the outside int, and applied 102 for outbound traffic on the inside int,  and I'm seeing policy hits on both permit statements outside and  inside, so it looks like the traffic is being passed on to the inside  interface and permitted, but the server isn't seeing the packets.
 
I can ping the outside interface from the outside, but cannot ping the  inside interface or any inside hosts from the outside, even though I  have 'permit icmp any any' enabled on the ACL on both ints. When I  remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
 
I set up the same scenario in my lab with an ASA 5505, with the same results.  Below is the running config from the 5505 in the lab.  The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
 
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
description Inside LAN Interface
nameif inside(code)

View 6 Replies View Related

Cisco :: LMS 4.0.1 - Error Creating User Tracking End Host Report

Sep 19, 2011

I have installed LMS 4.0.1 again. Now LMS is running on a Windows 2008 R2, 64 bit. Using Custom Reports from Reports> Report Designer> User Tracking to create an end host report I get this error message: "The syntax is not valid: the system cannot find the path specified". Anyway, the report is created but I’m not able to edit or delete: it is not listed on Available Custom Reports.

View 6 Replies View Related

Cisco Firewall :: How Many Objects Can ASA 8.3(2) Support

Jun 22, 2011

We are currently running 8.3(2) and I'm just wondering how many network/host objects the device can support? and how big can an access-l get?

View 1 Replies View Related

Cisco Firewall :: ASA 8.3 - Migration Changes Hosts To Objects?

Sep 24, 2012

I'm testing upgrading an ASA from 8.2.5 to 8.4.4.  During the the upgrade, it change all of my ACL host entries to objects.  But I noticed that the keyword "host" is still a valid option when creating an ACL.
 
I'm trying to understand why this change is made during the migration.

View 3 Replies View Related

Cisco Firewall :: ASA5505 NAT For Group Of Objects

Oct 4, 2010

My ASA5505 has an external address of x.x.x.13. We have got another 2 spare ip addresses: x.x.x.10 and x.x.x.11.We also have 2 internal hosts, which we need to provide with internet access using NAT. y.y.y.146 and y.y.y.70.
 
We recently updated our ASA to software version 8.3(1). I was thinking that I could do it using network objects and groups, but didn't understand quite good how this should be done.
 
The goal is to set up ASA in the way, that if either of the abovementioned 2 hosts will connect to the internet, it needs take one of 2 external addresses. All other hosts should use PAT through x.x.x.13.

View 21 Replies View Related

Cisco Firewall :: Recreate Objects In Groups After Migration To 8.3?

Feb 22, 2012

when I migrated the ASA config from 8.2 to 8.3, in all groups the group members has been replaced by the IP address object. However, the "name" for this object has been migrated, but there is the "object network name" configuration missing.
 
What I can do now is that I can open the new created object in the ASDM, search for the object with this IP address and then enter the object name I had before. When I apply the config, ASDM then creates the object and replaces all affected objects in all groups, by replacing the object group memeber "network-object host hostname" with "network-object object hostname".
 
Do you know if there exists an automated way, which checks all the groups for members "network-object host", creates the "object network" and replaces the "network-object hosts" with "network-object object" within the group? As long we have a lot of groups which contains partially > 50 members?

View 2 Replies View Related

Cisco Firewall :: Can't Create Network Objects On ASA 5505

May 17, 2011

I have a customer an exisiting 5505 which connects to multiple sites for a site-to-site VPN.  This firewall was not installed by myself originally I have just been asked to take a look now.The situation is that we now need to edit one of the existing site-to-site VPNs to include the remote sites expanded network.  I have tried doing this through the ASDM and have found that I cannot add new network objects.  I have tried creating a new network object group and then added the new networks from there but I am completely unable to add the new objects.I believe a picture tells a thousand words in this case so I have attached some images which show the problem.  I have also tried going through the VPN wizard, this also does not allow me to add new network objects. 

View 2 Replies View Related

Cisco Infrastructure :: Export Objects (net And Security) From ASA 5500 Firewall To CSV File?

Feb 14, 2012

how to export objects (net and security) from an ASA 5500 firewall to a .csv file?

View 1 Replies View Related

Cisco VPN :: 5520 / 2811 Router - IOS To ASA VPN Creating Multiple ISAKMP SAs?

Jan 11, 2012

I'm running a IPSec VPN between a 5520 ASA and a 2811 router. The ASA has a static IP and the router has a DHCP interface.The VPN seems to work fine once I get done clearing old SAs, but each new IPSEC SA creates a new ISAKMP SA on the router?  There are multiple subnets that need to create multiple IPSEC SAs. Eventually I can clear the older ISAKMP SAs and get all the traffic on one ISAKMP SA, but until I clear older SAs, new associations won't form. Why the router (initiator) would keep creating new ISAKMP SAs and not use an established one?  Using PSK, aggressive mode and no PFS. ASA has another dynamic crypto map with lower priority than this one. Using FQDN for identity on the router. ASA version 8.2(5) and IOS is 12.4(20)T1.
 
Must be something I'm not understanding. The ASA says no established SA and drops the new SA attempt until I clear older ISAKMP SAs out of the router. Interesting, the first few IPSec SAs form when the tunnel initially comes up. I assume the initial requests are getting cached and work immediately after the first ISAKMP SA forms, but subsequent IPSec SA attempts will fail. Once all subnets are talking with 1 ISAKMP SA, rekeys don't cause any problems. Since the router subnets have to instantiate the new IPSec SAs, this is a real pain to go through anytime the WAN/VPN fails.

View 1 Replies View Related

Cisco VPN :: Licensing Required To Perform Host Scan On ASA 5520

Apr 6, 2011

I want to mark company owned laptops with a registry setting and have our ASA 5520 identify these systems when connecting via SSL and IPSEC remotely, and allow broader access to the internal network than the telecommuter that use their personal PCs.  For the users that connect with their personal PCs, I want to only allow RDP access to their company PCs on the internal network.
 
Can I accomplish this with the current VPN Plus license and Anyconnect Essentials feature enabled?  If not, what license/features do I need installed/ enabled to accomplish these objectives?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Creating Interface Vlan In Firewall

May 3, 2011

I have been working with ASA 5510,20,40,80 but not with 5505 this vlan and its interfaces are quite confusing.Just want to know how it works and its connectivity to Cisco Switch.Do i have to put the interface of the switch in the same vlan as i am creating the interface vlan in firewall ?Now the switch port connecting to this Eth1 interface should also be in the same vlan ? i.e vlan3 ?? or it will be in trunk ? The default configuration shows the eth0 with no access vlan and interface eth1 with access vlan 2... does it mean the eth0 is in vlan1 ? (Nativ Vlan ) ???

View 4 Replies View Related

Cisco Firewall :: Creating ACL And Nat Rules On ASA5505

Mar 23, 2012

Ive migrated from my lab pix to a lab asa and am trying to open certain ports to my internal network.
 
in my confg on my pix i had acls to open port 51413 to an inside host along with the static nat rule.
 
what i am trying to accomplish is same on my asa, however the nat rules seem to be slightly different, and i'm not completely sure how to do it.
  
My ACL and nat rule is below.  I'm pretty certain my acl is correct,but i am not sure as to what to do with my NAT rules to allow a translation for the tcp service.
  
access-list outside-in extended permit object tcp51413 any object outside nat (inside,outside) source dynamic all-inside-nat interface

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Creating NAT Rule

Mar 7, 2012

Our external security department needs to scan, every three months, a computer behind the firewall. I need to create a simple NAT rule that will allow an ip address or subnet to the computers behind the ASA 5505. At the moment, we have a simple NAT rule which allow all network traffic to exit from inside to outside.

View 19 Replies View Related

Cisco Firewall :: ASA5512 - Creating Routing DMZ Inside

Jan 15, 2013

I have a little problem creating a network infrastucture with an "inside", "dmz" and an "outside" network on my ASA5512-x 8.6(1).

I have have clients and servers with the networks 10.0.1.0/24, 10.0.2.0/24 until 10.0.12.0/24 on my inside interface. Then I have two servers 10.0.254.50/24 for SMTP and 10.0.254.70/24 for HTTPS in my dmz network. The outside interface is one static IP to the Internet.

View 7 Replies View Related

Cisco Firewall :: ASA 5505 - Creating Simple Static IP

Mar 22, 2012

I have created a simple static ip address by using this command:
 
interface Vlan1
nameif inside
security-level 100

[Code]..... 
 
But, no matter what, the I can't ping the static address or access the computer 10.2.1.2 from outside of the asa 5505. I have attempted to ping from inside of the asa 5505 or from another computer. I just does not work.
 
I also have created several rules that allows icmp traffic.
 
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo-reply inside
icmp permit 10.2.1.0 255.255.255.0 inside
icmp permit any echo-reply outside
icmp permit any outside

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Object Groups / Creating New ACL

Jul 20, 2011

I have an ASA5510 where I have defined object-groups and then associated them with a specific ACL.  Our ISP is pulling their point of presence from where I live and I am force to move to a new ISP.  I am in the process of setting up another interface for the ASA5510 to connect to the new ISP.
 
My questions is can I create a new ACL lets call it new_access_in and use it with the same object groups that I have already defined?  I know that I can only have one ACL bound to an interface, and will bind this new ACL to the new interface I am setting up, but I wasn't sure if I could use the same object groups and connect them to a different ACL.  I really don't want to have to create new object groups if I don't have to.

View 2 Replies View Related

Cisco Firewall :: ASA 5500 - Command For Creating Read Only User

Jan 13, 2009

What is the command for creating a user on an ASA 5500 running 7.2(3) that can only view the config but not make any changes?

View 8 Replies View Related

Cisco Firewall :: 6509 -Creating FWSM Intra-Chassis Redundancy

Oct 27, 2011

Currently we have two inter-chassis FWSM redundancy. I would like to configure them for intra-chassis.
 
Both FWSM's are in slot 7 of 6509 switches and i want to take secondary out from one of the 6509 switch and insert in the slot 3 of primary switch.
 
I addedd the following commands in my primary switch.
 
There were commands already present for FWSM in primary switch
 
firewall multiple-vlan-interfaces
firewall module 7 vlan-group 1
firewall vlan-group 1  2,3,777
 
to create intra-chassis redundancy i addedd the following command also there.
 
firewall module 3 vlan-group 1
 
after adding that, my firewalls worked fine but there was a issue with site loading. People from outside were able to access inside but from inside, we were not able to go outside.
 
do we need to clear arp from both FWSM's ? is there any other precautionary step, which we need to follow while working on it.

View 1 Replies View Related

Cisco Application :: MIB Objects For CSS 11503?

Jun 9, 2009

i need the MIB object names for monitoring the processor and Memory Utilization of CSS 11503 with software version 7.50 Where can I find it?

View 5 Replies View Related

Cisco WAN :: 2821 / IP SLA Tracking Objects Dropping?

Mar 24, 2013

I use tracking objects aroung the organization where I work to monitor WAN and VPN connections and add/remove routes based on the state of the object.  I'm having 2 locations that are constanty going up and down and I've been troubleshooting and monitoring for the last few weeks without finding anything.  I've been incrementing the timeout for the SLA and it seems like this is working a little (less overall drops) but the drops still occur.  Our ISP reports no issues and we see no issues internally on the circuits.  Just out of curiosity could this be some kind of IOS bug or hardware malfunction?  The router logs are full of these:
 
Mar 21 16:18:33: %TRACKING-5-STATE: 2 ip sla 2 reachability Up->Down
Mar 21 16:18:38: %TRACKING-5-STATE: 2 ip sla 2 reachability Down->Up
Mar 21 17:24:14: %TRACKING-5-STATE: 2 ip sla 2 reachability Up->Down
Mar 21 17:24:19: %TRACKING-5-STATE: 2 ip sla 2 reachability Down->Up

[code]....
 
The IOS version of the router I took these from is 151-4.M6 advanced IP services and it's a 2821 router.

View 5 Replies View Related

Cisco WAN :: 800 Network Objects To Allow Management User IP

Aug 27, 2012

I'm trying to add an extended ACL (120) to an 800 series router (887) using Network Objects to allow the management user IP range full access to IP services and restricted access to email only for standard user IP range. However as soon as I apply the ACL to the outbound of my Vlan no matter what is in the ACL my PC looses internet connectivity. I've tried adding an explict allow for my IP address and still no access so I'm thinking possible a NAT issue, please have a look at my attached config and let me know what you think. Would I be better trying to control data flow with ZBF? I want to restrict standard users to email access only during the work day with web access and IM access after hours along with blocking all P2P programs for standard users at any time. Management group will have unrestricted access to all IP protocols. My original plan was to use time based ACL's!

View 9 Replies View Related

Cisco :: Named Objects Or Object Groups In ASR 1000s?

Mar 5, 2012

Any way of doing named objects or object groups for ACLs on the ASRs? (1000 series in this case.) I'm setting up an ASR with a zone-based firewall and writing out all the addresses, ports and protocols for the ACLs associated with the various zones is creating huge, unwieldy ACLs in the config.

View 11 Replies View Related

Cisco VPN :: Pix 515e - Remote Host Cannot Ping Any LAN Host

Jun 27, 2011

I have a host that can successfully connect to a PIX 515E (7.x OS) via VPN Client; however, I have no IP routing to the LAN from the remote host.The VPN IP pool works finem,The LAN default gateway is the inside interface on the PIX; the network is flat L2 behind it.The default route on the PIX points out; no other routes are defined,The VPN remote host can be pinged from LAN hosts, but the VPN remote host cannot ping any LAN host, not even the PIX inside interface.

View 2 Replies View Related

Cisco VPN :: ASA 5510 Ping / Communication Host To Host

May 7, 2012

ASA 5510
Ver 8.2(5)
 
I have been looking all over the place for the answer of how to allow clients on an IPSEC VPN to ping from host to host.

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved