Cisco Firewall :: ASA 8.2 - Destination NAT With Specific Origin

Jun 11, 2013

I need configure destination NAT in my ASA 8.2 version only for a specific origin.
 
Today, the network 10.84.25.0/24 access the web server with IP 172.17.3.150, i need Nat the IP 172.17.3.150 to 10.96.202.10 only for
10.84.25.0/24 network.
 
How i can configure this in  8.2 version?

View 2 Replies


ADVERTISEMENT

Cisco Firewall :: How To Translate Both Source And Destination In ASA 8.2

Apr 16, 2012

I have a internal subnet 192.168.3.0/24 sitting behind an ASA firewal 8.2 and would behind accessing to web server 192.168.11.54 which sits behind the outside interface of the ASA firewall.The access would be like this:
 
1) 192.168.3.0/24 will be accesing to the web server http://192.168.11.54
2) We would like to translate the source 192.168.3.0/24 to the firewall outside IP address
3) We would like to translate the destination web server 192.168.11.54 to 202.90.197.146 as well

How to perform this simultaneous source and destnation address translation in ASA firewall 8.2? Could this be done in ASA firewall 8.2?

View 1 Replies View Related

Cisco Firewall :: Log Shows Wrong Source / Destination ASA 8.3

May 25, 2011

The Cisco ASDM or the event manager show wrong source/destination for teardown tcp messages:In this example the communication is an ssh session;from 1.1.1.1 -> 2.2.2.2 ssh and the connection is reseted by 2.2.2.2
 
The message build outbound is correct, i.e. source is 1.1.1.1 (message id is 302013)
 
But the teardown is incorrect, i.e. source for the connection is 2.2.2.2 which is definitely not true (message id is 302014)
 
Also there seems to be a documentation bug in syslog messages for ASA 8.4 since the message for the teardown 302014 is gone!

View 3 Replies View Related

Cisco Firewall :: NAT Source And Destination Addresses On ASA5520 Running 7.2(5)?

Apr 22, 2013

Is it possible to NAT source & destination addresses (twice nat) on an ASA5520 running 7.2(5)?

View 4 Replies View Related

Cisco Firewall :: Can Configure Two IPsec Tunnel In ASA5525X / When Destination Is Same

Sep 7, 2012

Can I configure two IPsec tunnel in a ASA5525X, when the destination is same.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Static Route By Interface Or Destination

Sep 21, 2011

Is it possible to assign a static route to an interface and not globally on a ASA 5510 ver 8.3.
  
I have two links between my offices one for Data via a VPN and one for video traffic which is a secure connection with QOS end to end.
  
All interfaces are on the same security level of 100 except Outside which is 0.
  
Office 1 Interfaces ASA 5510
 
 
VLAN  1               vOffice1Data       10.40.1.0/24
VLAN  3               vOffice1Video     10.40.2.0/24
VLAN 5                vInterOffice       10.40.5.0/24     (QOS  connection Between Offices)

[Code]....

At the moment if I try and access data from VLAN 1 to VLAN 4 it gets to the destination ok going through the static route and over the vInterOffice connection but the problem is VLAN 4 returning the traffic. This fails because there is no static route back to VLAN 1. If I create a static route from Office 2 to VLAN 1 then it will route all my data traffic over it as well.

View 2 Replies View Related

Cisco Firewall :: ASA5505 / 5510 - Prioritize Traffic Based On Destination IP?

Sep 25, 2012

we're looking to use an ASA5505 or 5510 as our firewall but want to see if one of them can prioritize traffic. I know it does QoS but we're wanting to dedicate x amount of our bandwidth to traffic based on destination IP address. Is that possible and does it take a license upgrade?

View 3 Replies View Related

Cisco Firewall :: SSM-4GE Firewall Has 5 DMZ Segments And Specific Segment For Internet Traffic

May 23, 2013

I was asked to enable netflow in an ASA Firewall for Orion/Solarwinds server monitoration. Firewall is a 5550, with 4G RAM, and no extra modules but SSM-4GE. This firewall has 5 DMZ segments and ans specific segment for internet traffic.There are segments as unique subinterfaces in physical interfaces. Other segments as individual subinterfaces in the same physical interface (but individual VLANs)Usually firewall CPU flows between 30% to 40%. Rarely to 50%.
 
1 - How dangerous or risky could be implement netflow in this firewall?...This firewall is very critical for the customer. My concern is regrading CPU, traffic generated, memory, etc
 
2 - In a month, firewall will be migrated from 8.2 software version to 8.4 software version. Is there any incompatibility in some commands?...Would be recommended to perform netflow configuration after software upgrade?
 
3 - How could it be implemented for Orion monitoring, regarding each individual sub-interface (and so, each VLAN assigned)?I there any recommendation regarding configuration, best practices?

View 6 Replies View Related

Cisco Routers :: RV082 - Route Specific Ip Address To Specific WAN Port

Oct 25, 2011

I use a router RV082 with load balancing. My problem is when I try to access a specific site, I get the error message that my IP address changes and I can not use 2 ip address. I want to specify an ip range to always use the same WAN port.

View 2 Replies View Related

Cisco VPN :: ASA 5520 / Define Specific IKE Proposal For Specific L2L Tunnel?

May 24, 2011

ASA 5520 running 8.0.4
ASDM v.6.1
 
Need assistance understanding how in ASDM/Configuration/Site-to-Site VPN/Connection Profiles/ "Any Entry" I can specify that I only want to offer an IKE Proposal of pre-share-aes-256-sha?
 
The IKE Proposal field has a number of possible options including: pre-share-aes-256-md5, pre-share-3des-md5, pre-share-aes-256-sha, pre-share-aes-192-sha, pre-share-3des-md5, pre-share-aes-sha and pre-share-3des-sha.
 
I am able to pick a specific IPSec Proposal w/o issue but when I attempt to do the same for the IKE Proposal, and click OK the choice does not "stick" but rather returns to the entire list as defined above.

View 2 Replies View Related

Routers / Switches :: Rate Limit On Specific Port From Specific Range?

Jul 1, 2012

Is it possible to enable an absolute value rate limit using QOS on a HP ProCurve 5406 switch for a particular IP range on a specific port? Is there a way to configure our HP 5406 with an absolute rate limit on "WAN" port for that server's IP range? I would like to limit it to only being capable of sending 1Mbps worth of traffic over the head end at once.Everything in the documentation points towards priority queues, which as far as I can tell, isn't really what I want.Baring accomplishing this goal using rate limiting is there a better way to prevent our services from accidentally saturating this connection?i thimkong about somthing like that:

class ipv4 rate-limit-port-A1
match ip 10.136.0.0/16 any
exit
policy qos port-a1-ratelimit
class servers-to-be-slowed action rate-limit kbps 1000
exit
interface A1 service-policy port-a1-ratelimit inI'm not sure about this.

View 4 Replies View Related

Cisco WAN :: 2801 / Assign Specific IP To Specific Host By MAC

Dec 18, 2012

I have a Router 2801 with the run conf :
 
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1 192.168.1.63
ip dhcp excluded-address 192.168.1.192 192.168.1.254
!

[code].... 
 
I want to assign a specific IP to a specifig host by MAC .. for example i want the ip 192.168.1.10 to be assign to the host "client1" by mac.I've been creating a new dhcp pool static:
 
!
ip dhcp pool static
host 192.168.1.10 255.255.255.0
hardware-address xxxx.xxxx.xxxx
client-name client1
!
 
but the "client1" is still taking other ip.

View 10 Replies View Related

Cisco Firewall :: Set Up QoS On ASA5505 For Specific Ports

Mar 18, 2012

I wish to set up a ASA5505 with QoS, and to allow specific port numbers to have priority going through compared to rest of the traffic. Eg ports 21, 80, 443. So for example if im maxing out a torrent, it doesnt impact web traffic etc.The current link its connected to is 100mbit/2.5mbit connection..

View 1 Replies View Related

Cisco Firewall :: ASA 8.0(5) / Block Specific Url From Accessing Server In Dmz?

May 4, 2011

I have Cisco ASA 8.0(5) and I need to block specific url to acees my https server in dmz ?I read about websence technology, but I think it's not free right? Also I read abotu policy inspection map's but in my case is HTTPS not http ..

View 1 Replies View Related

Cisco Firewall :: ASA 5510 8.4 / VPN Traffic For Specific Client?

Mar 16, 2013

I have ASA 5510 8.4 Firewall where more than 20 Site to Site VPN Clients are configured on it. how to see the traffic for one Specific Site to Site VPN.Actually this site to site vpn is always keep dropping for every minute. I'm sure its a problem at the other end.The remaining 19 VPNS are UP and working without any problem. How to see the traffic for specific vlan.More over we dont have any syslog server in our network. Is their any chance we can check the traffic on the firewall?

View 6 Replies View Related

Cisco Firewall :: ASA 5510 - ASDM Access From Specific IP

Jan 24, 2013

I do have one other question first.  What's the effect of the crypto key zeroize rsa command, and then crypto key generate rsa modulus 1024 while I'm SSH'd to the ASA?  Can I do it?  Or do i need to be consoled in or connected a different way?
 
ASA 5510:
ASA Version 8.4(1)
asdm image disk0:/asdm-641.bin
asdm history enable
http server enable
http 10.1.1.83 255.255.255.255 inside
http 10.1.1.82 255.255.255.255 inside

Shouldn't that right there be enough to access ASDM from either host .82 or .83?  Because I cannot.  But if I add http 0.0.0.0 0.0.0.0 inside, then I of course can.

View 2 Replies View Related

Cisco Firewall :: 5510 Connection Specific TCP Timeouts

Aug 28, 2012

I got a Problem on a customer which is using a Failover ASA 5510 pair with SSM-CSC-10-K9 modules.The clients have to connect to a webserver where they are doing some calculations.If they prepare everything and want to calculate everything what takes a couple of time the session is after about 3 minutes timedout.My first idea was to set session specific timeouts which are a bit longer then the normal but this setting did not work. I created a policy which did not work for me. How to set connection specific timeout's? [code]

View 3 Replies View Related

Cisco Firewall :: ASA 5510 Security For One Specific User

Jan 18, 2013

We have an ASA 5510 version 8.3 (2) that we accept VPN users via a radius server. Is there a way to lock down a specific user that connects to the ASA as a SSL client or IPSEC VPN user? If the specific user were to connect to the ASA, we would want the user to have minimal to not access to our system.

View 1 Replies View Related

Cisco Firewall :: 5520 - URL Blocking To Be Applied To Specific Users

Feb 10, 2010

I am having ASA firewall 5520. I want to block yahoo mail, gmail using regex for particular users only.

View 5 Replies View Related

Cisco Firewall :: ASA Version 8.0 / Are NAT's Processed From Top To Bottom Or General To Specific

Jul 5, 2012

under ASA Version 8.0:Are NAT's processed from top to bottom or general to specific?I have a many-to-many NAT that is taking precedence over a one-to one-NAT. In what order are they processed?

View 1 Replies View Related

Cisco Firewall :: 5512X - IP Address Associated With Device Or Is It Interface Specific

Jan 21, 2013

I'm trying to get started on setting up my first Transparent ASA.I understand an ASA in Transparent Mode can now have an ip address with Bridge Groups or some such mechanism. I'm looking for examples of how to set that up and other information below. Is the ip address associated with the device or is it interface specific? Will I be able to SSH with that ip address setup? Can I use ASDM if the Transparent ASA has an ip address? This 5512X has an IPS. Any one who has setup an IPS on this platform knows it has some very particular requirments in order to communicate with the outside world. I need examples of how to do that with a Transparent ASA.How is NAT setup differently (if at all) on a Transparent ASA?Are ACLs done any differently?

View 3 Replies View Related

Cisco Firewall :: ASA5510 / Specific Configuration About TCP Connection Or DNS To Setup?

Mar 8, 2011

I Changed my old firewall by an ASA5510, since that change my internet connexion is slower.Some websites takes longer to display.I would like to know if there are some specific configuration about TCP connection or DNS to setup? 

I just configured the ISP DNS :
 
Dns server-group DefaultDNSname-server 194.2.0.20 name-server 194.2.0.50

View 4 Replies View Related

Cisco Firewall :: ASA 5510 - Open Outbound Port For Specific IP

Dec 6, 2012

We have a ASA5510 and I need to open port 22 for a speacific IP in our LAN outbound only.      

View 15 Replies View Related

Cisco Firewall :: 5505 Block Port 80 On A Specific Host In LAN

Apr 22, 2012

I'm using an ASA5505 (8.4(1)) and would like to block port 80 on a specific host in the LAN so machines in other remote LANs connected via VPN can't access this port on the host. Devices in the local LAN should have access to this port on the host. Here are the commands I'm using:
 
-access-list block_port extended deny tcp any host 10.20.10.20 eq 80
-access-list block_port extended permit ip any any
-access-group block_port out interface inside
 
These commands are not working as I would expect them to. When I browse to http://10.20.10.20 from a remote machine over the VPN tunnel I am able to access the host web server.

View 2 Replies View Related

Cisco Firewall :: Force ASA 5520 Traffic Out Specific Interface

Jun 1, 2011

I'm trying to route all default traffic from my production environment through my ASA 5520 on the "outside2" interface.The 5520 has a site to site VPN to our DR site on the "outside/inside" interfaces via one ISP. On another ISP, interfaces "outside2/inside2" go to the internet.
When I make my 3750 stack default route for the inside2 interface IP I cannot get to the internet. When it is pointed to the inside interface on my 5505, I can.
 
I get the following errors when I try to open google.com from a production server:Why is the 5520 trying to use the "outside" interface instead of the "outside2" interface to go out?

View 6 Replies View Related

Cisco Firewall :: Allowing Internet Access Only For Specific Computers On PIX 501?

Jan 8, 2012

I'm a college student working on a lab involving a Cisco PIX 501 Firewall.
 
My project involves 1 computer and a firewall. My goal is to use the firewall to allow access to the internet for that computer which uses a static IP 192.168.1.5 and ONLY for that IP address. The firewall is connected to the internet.
 
I have the computer hooked up to the firewall with the serial and using hyper terminal to enter commands. I think I need to use access lists in order to deny traffic on those ports for those particular hosts. I can't figure out exactly how I need to set it up.
 
What I need to do is permit internet access for 192.168.1.5 alone. Any other IP should not be able to access the internet.
 
I tried:
 
access-list 1 permit tcp host 192.168.1.5 any eq 80
access-group 1 in interface inside
 
I cannot access the internet using the computer with 192.168.1.5. The goal is to be able to access with that IP and no other.

View 6 Replies View Related

Cisco Firewall :: ASA5540 - Disabling Anti-Replay For Specific Tunnel

Sep 23, 2012

We need Solution for disabling Anti-Replay on the Firewall for a specific tunnel. ASA 8.4(2) ) does not support disabling Anti-Replay on specific Ipsec tunnel , is it true , then if we want to disable Anti-replay , what we have  to do in ASA5540 .

View 4 Replies View Related

Cisco Routers :: WRV200 - Setup Specific External IP Addresses To Get Through Firewall?

Oct 10, 2011

Trying to get a service setup with a third party to access our system (ERP web service to access our ERP data, making data available to customers and vendors via internet).  They require that I setup four external IP addresses to have access through the firewall.  I haven't figured out how to do this. I'm using a Linksys WRV200 router. 

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Authenticate Users Of Specific LDAP Group

Apr 19, 2010

I'm actually require authentication for users who are coming from the PublicVLAN (the vlan associated with the wireless hotspot) to authenticate themself to the LDAP server via my firewall ASA 5510

View 12 Replies View Related

Cisco Firewall :: FWSM 3.2 Can Not Show Sessions In Xlate Between Two Specific Vlans

Dec 23, 2012

I have FWSM running version 3.2(23) , configured with interface vlans , all having the same security level , except outside interface vlan which has security level 0 , also same-security-traffic permit inter-interface and same-security-traffic permit intra-interface are configured, my problem is when establishing sessions (I tried TCP only using ssh and telnet , in addition of ping ) from one specific vlan (172.16.1.0/28)  to other vlan (172.16.1.16/28) , I can not see the established sessions  in "show xlate debug" output ! although I can see these sessions from capture !  the two subnets are separate , two different /28.
 
I can see the session established from the remaining interface vlans with same security level toward  172.16.1.16/28 , my question is what is the exception with vlan having this subnet172.16.1.0/28, how it can reach other vlan with subnnet 172.16.1.16/28 without showing anything in xlate table ? do you thing it is bug ?

View 3 Replies View Related

How Does Firewall Block Or Filter Traffic On Specific Port Or IP Address

Nov 15, 2011

How does a firewall block or filter traffic on a specific port or IP address?

View 1 Replies View Related

Cisco Firewall :: Internet Access Through ASA 5540 For Specific Network Object Group

May 2, 2011

I have a 5540, and i am trying to allow access to internet for an specific network object group, who has inside a bunch of users, who needs direct internet access without any restrictions, i have tried with dynamic NAT, but that configuration ask for a specific IP o a Network range, and is not permitted to configure an  object group as a source
 
The group is located in LAN zone, so a permission from one zone to another zone is needed i think, but i can allow the internet acess to that group Is there another way to get that , different from NAT ?

View 5 Replies View Related

Cisco Firewall :: RV120W - URL Blocking / Limit Internet Access To 1 Or 2 Specific Websites

Aug 18, 2011

My company has a peer to peer network of 10 personal computers without a server.  Operating systems from Windows XP to Vista.  I've recently installed a Cisco RV120W Wireless-N VPN Firewall.  It's configured in DHCP Server Mode with printers/copiers that have static IPs below the DHCP range.
 
I'm having a problem with certain stations being used for personal networking, shopping, etc. during business hours.  Consequently I would like to limit internet access on these stations.  However, some internet access is required because of online database software that's an integral part of our business.  I've been reading in the Administration Guide about URL Blocking.  Would it be possible to give static IPs to certain stations and then limit their internet access to 1 or 2 specific websites?
 
FYI, I've read about the Trusted Domains and Blocked Keywords but cannot quite understand how to parley this into the solution I need.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved