Cisco Firewall :: ASA 8.4 NAT Not Working?
Jul 15, 2012my ASA config does not work? My config is attached in a txt file.
I tried to forward port 25 and 110 from the outside to the inside server, but I can't connect...
ADVERTISEMENT
Cisco Firewall :: Get ASA 8.2(1) Working With FTPS On IIS 7.5?
May 16, 2012I found the link that effectively said PIX/ASA 7.x does not support FTP with TLS/SSL (FTP/FTPS). I can't find anything which states whether it works on a later release? We have 8.2(1) and we are struggling to implement it. The FTP/FTPS server is in the DMZ and is hosted by Windows 2008 IIS 7.5. How to get this solution implemented, as the contractor from our local Cisco vendor spent 3 hours on it and couldn't get it working this morning.
View 1 Replies View RelatedCisco Firewall :: ASA 5512 - SSL VPN Not Working
Nov 10, 2012I have a windows 2003 server and an ASA 5512
I'm trying to use SSLVPN and it was all working, and I don't believe any configs on either box have been changed.
On Friday people were connecting, but now I get a message "Login Error" in the browser. In the ASDM home 'latest ADSM Syslog Messsages' I get "AAA authentication server not accessible", followed by two messsages AAA Marking LDAP server in group as FAILED AAA Marking LDAP server in group as ACTIVE
When I go to configuration --> Remote Access VPN --> AAA/Local Users AAA server groups and click on my RADIUS server and click Test, it takes a while and says ERROR: AD agent Server not responding: No error
If I stop my IAS server on my Windows box i get the same error but much more quickly.
I have a sonciwall set up doing the same thing, and RADIUS seems to work happily, so I don't think it's the server config...
Cisco Firewall :: PoE On ASA 5505 Not Working (8.4)
Jun 2, 2012I recently acquired a used ASA 5505 and have encountered issues with getting the PoE output on Ports 6 & 7 working. Theese two PoE ports are behaving like all the other ports (100mbit, Vlan 1). Per the best I could Google, I made sure the all relevant ports are set to "auto" for duplex and link speed. Again, the ports do work for data - just not PoE. The LEDs light up ok.
I've tested four different working devices that can be powered off PoE with it, and all failed to power up using a straight-thru Ethernet cable connected to ports 6 & 7.
Ubiquiti PicoStation M2
MikroTik OmniTik
MikroTik RB450G
MikroTik RB433
What should I do to get PoE working? Is it a defective unit?
: Saved
: Written by enable_15 at 18:56:43.926 CDT Sun Jun 3 2012
!
ASA Version 8.4(4)
[Code].....
Cisco Firewall :: SSH Not Working In 5505?
May 20, 2013i'm trying to setup my 5505 for SSH but it seem doesn't work. console and HTTPS/ASDM are working.
my teraterm is just stuck with the user/password screen. also tried using putty but still failed.
ciscoasa# exit
Logoff
Username: admin
[Code].....
Cisco Firewall :: ASDM Not Working With ASA 8.4
Jan 14, 2013I have recently upgraded ASA to 8.4 and found that ASDM is not working on it. I tried the latest ASDM version 7.1 still no luck. When I try to access ASA using IE...it just shows " Page can not be displayed "
Following is the config which I have
http server enable
http 0.0.0.0 0.0.0.0 inside
http 10.52.193.218 255.255.255.255 inside
asdm image disk0:/asdm-711-52.bin
asdm location 0.0.0.0 0.0.0.0 inside
asdm history enable
Is there anything else required in ASA 8.4 for ASDM to work? When I telnet to ASA interface with 443 port it works
Cisco Firewall :: ASA DNS Modification Is Not Working On 8.4(3)?
Jul 22, 2012I have a server (172.16.10.1) inside the LAN and IP of the server has been maped to public IP 41.219.130.10.
Topology
Server(172.16.10.1)
DNS Server (8.8.8.8) ----- Outside ASA Inside ----------- |
User (192.168.1.x)
Users are using Public DNS Server to resolve the domain. In this case, users will resolve the server domain to public IP address 41.219.130.10 instead of 172.16.10.1 that cause the server is unreachable for the users by default.So I enable DNS modification feature on ASA. DNS keyword has been add to static NAT clause. ASA suppose to modify the DNS record to change the public IP to private IP address. But it is not working.
access-list inside_acl extended permit udp any host 8.8.8.8 eq 53
access-list outside_acl extended permit tcp any host 41.219.130.10
access-group inside_acl in interface inside
access-group inside_acl in interface outside
[code].....
Cisco Firewall :: ASA 8.3 Outgoing NAT Not Working Right
Jul 11, 2011We recently upgraded our ASA to 8.3, most everything went ok, but I am having problems with outgoing nat. It seems that when one our systems that needs to be natted to an outside IP address when connecting out is not doing it. When that system goes out the ip address is our internet IP and not the natted address, however, inbound everything works.
We have one rule that does PAT
nat (INSIDE,OUTSIDE) source dynamic OG_IP_NAT_DMZ obj-1.1.1.1This is the natting statement that should be translating the addressesobject network obj-10.200.0.10
nat (INSIDE,OUTSIDE) static 2.2.2.2I think I need to double nat, is that right if so how?
Cisco Firewall :: Telnet / Ssh To ASA 8.2 Not Working
Oct 7, 2012I am not able to telnet or ssh to ASA running 8.2.5(33). [code] I am able to ping inside interface of the ASA. Telnet gets stuck at Trying
View 2 Replies View RelatedCisco Firewall :: ASA 5510 - SSH Is Not Working
Jul 1, 2011I configured ASA 5510 with IOS 8.4.2 version. I configured SSH to outside and backup interface with any any permission.
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 backup
configured password with command
passwd < Password>
While connecting from outside through Putty i am not able to authenticate the password.
Aftter entering user name as pix its asking password. After entering its not authenticating.
I taken output by telnetting to inside after connecting to the firewall from outside and entering username as pix
PM-ASA-5510# sh ssh sessions
SID Client IP Version Mode Encryption Hmac State Username1 122.169.252.112 2.0 IN aes256-cbc sha1 KeysExchanged pix OUT aes256-cbc sha1 KeysExchanged pixSPM-ASA-5510#
Cisco Firewall :: Twice NAT Not Working With 5510
Aug 22, 2012Our NOC is trying to configure a site to site tunnel to one of our customers. The tunnel is up and operational, however we can't get our NAT rules to match what we want.
We are running ASA version 8.4(3)
The traffic is sourced from 172.16.1.50 (inside1) and destined to192.168.2.9 (outside), the nat configuration is posted below:
NOC-ASA5510-01# show run nat
nat (inside1,inside2) source static ng-noc-networks ng-noc-networks destination static ng-inside2-networks ng-inside2-networks
nat (inside1,outside) source static test test-EXT destination static otherside otherside
object network obj_any
nat (inside1,outside) dynamic interface dns
object network servers-noc
nat (inside1,outside) static 192.168.1.68
Here is the output from the show nat detailed:
NOC-ASA5510-01# show nat detail
Manual NAT Policies (Section 1)
I left off entry 1 but it doesnt have any translated hits either
2 (inside1) to (outside) source static test test-EXT destination static otherside otherside
translate_hits = 0, untranslate_hits = 624
Source - Origin: 172.16.1.50/32, Translated: 192.168.1.67/32
Destination - Origin:192.168.2.9/32, Translated:192.168.2.9/32
Auto NAT Policies (Section 2)
1 (inside1) to (outside) source static servers-noc 192.168.1.68
translate_hits = 0, untranslate_hits = 187
Source - Origin: 172.16.1.101/32, Translated: 192.168.1.68/32
2 (inside1) to (outside) source dynamic obj_any interface dns
translate_hits = 58417, untranslate_hits = 1511
Source - Origin: 0.0.0.0/0, Translated: 192.168.1.66/29
Here are the network objects:
object network test
host 172.16.1.50
object network test-EXT
host 192.168.1.67
[Code]...
Cisco Firewall :: ASA 5505 Not Working?
Jul 2, 2012When i install my ASA5505 i get the following message? "This platform has a Base license.
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CNlite-MC-Boot-Cisco-1.2
SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05
i2c_write_byte_w_suspend() error, slot = 0x0, device = 0x40, address = 26 byte
count = 1. Reason: I2C_UNPOPULATED_ERROR"
Cisco Firewall :: ASA 5510 NAT Doesn't Appear To Be Working
Mar 8, 2012I've got an ASA 5510 running 8.4.I have a host on an inside interface, with a static NAT configured on the ASA. The inbound/return half of the NAT doesn't appear to be working. [code] I run a ping from the host (192.168.100.98) to something on the outside (1.2.3.4)Running captures, I can see the outbound ping leaving, having been NATed OK. I can see the reply coming back in to the outside interface with the correct IP address, but I never get the final NATed packet appear on the inside interface. The packet just disappears inside the ASA.
View 2 Replies View RelatedCisco Firewall :: Cut-Through Proxy Not Working With ASA5520
Jan 16, 2012I'm trying to configure an ASA 5520 with cut-through proxy feature. The user is required to be authenticated when trying to access an outside resource from the inside. This is a test lab before it is implemented in production. [code]
View 15 Replies View RelatedCisco Firewall :: Getting Failover Working Again After Upgrade From 8.2.2 To 8.4.2
Sep 6, 2011When we had 8.2.2, we bought a Mobile license to make the iPads running AnyConnect happy. I applied it, but since we'd only purchased one license, it broke failover. 8.4 lets you share tracking licenses, and since we were planning on the upgrade to 8.4.x anyway, I figured no big deal, I'll get that straightened out when I do the upgrade.
Did the upgrade this weekend, and I still can't get things happy, the boxes don't see one-another:
Here's a show failover on the primary:
Failover OnFailover unit PrimaryFailover LAN Interface: failover GigabitEthernet0/3 (up)Unit Poll frequency 1 seconds, holdtime 15 seconds Interface Poll frequency 5 seconds, holdtime 25 seconds Interface Policy 1Monitored Interfaces 6 of 160
[Code].....
Cisco Firewall :: ASDM 524 Not Working On PIX 515e 7.2.4(30)
May 21, 2012I've been struggling to get ASDM (PDM) installed and running on my PIX 515e. The PIX IOS version is 7.2.4(30) The ASDM version I've copied to flash is 524.
I've followed the Cisco documentation verbatim, however I still cannot connect via the Java ASDM client or via http. When I try to connect via http, my PIX shows the following error: "tcp access denied by acl from..." I do not this this is a security (ACL) issue as I've tested after opening everything up and still no luck.
Here's my running config (w/ the relevant statements prepended with ">>>"):
show run
: Saved
:
[Code]....
Cisco Firewall :: ASA 5540 - NAT Not Working After Upgrade
Apr 26, 2011Just upped our external ASA-5540 pair to 8.4(1), and now one of our nat's is busted.
Here's the lowdown:
Our public IP for our IronPorts ends in .167. That IP is natted to a VIP on our ACE, which load balances to the IronPorts.
The outside interface of the ASA uses .162, which has been the pat for all outbound traffic for a few years... except for the subnet that houses the IronPorts. Due to reverse lookup, that subnet uses the .167 IP address for all outbound traffic.
After the code upgrade, the nat won't work. No email sent or received. Nothing but Deny's on the ASA with flags reading either "SYN" or "RST". IE: Apr 27 12:56:11 10.22.151.41 local5.crit %ASA-2-106001: Inbound TCP connection denied from 69.25.174.17/36917 to 207.236.211.167/25 flags SYN on interface outside
If I return the subnet pat back to the outside interface, then inbound traffic works fine, though reverse lookup fails and anyone running a reasonable spam filter won't send to us.
Cisco Firewall :: Static 1 To 1 NAT Not Working On ASA 5505
Jan 28, 2013i have 2 internal server sitting in inside interface
inside network vlan 1 ip address 192.168.0.20, and 192.168.0.22
i going to map 192.168.0.20 to public ip routable address 203.117.124.180 and 192.168.0.22 to public ip routable address 203.117.124.181
the purpose is to make those 2 server 192.168.0.20, and .22 to be able to access remotely using public routable ip address,
however, after done the configuration i still not able to ping or access the public IP Address mention above. my both server are turn on and can access internally.both server are also able to access internet. See below partial configuration retrieve from Show Run.
nat-control
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
nat (Antlab) 1 0.0.0.0 0.0.0.0
[Code].....
Cisco Firewall :: ASA5505 PPPOE Is Not Working
Aug 23, 2011I am trying to get a Cisco ASA5505 to get onto the internet using PPPOE through a Netgear DG384 ADSL router. I have the Netgear in Modem only mode - if you put it in Router mode internet access works fine. When I change it to Modem mode, the error I get on the ASA is PADI timeout. Looking through the config I think I am missing a Global NAT??Also not 100% on the best way to set the IP - we have a static IP from the ISP. Do you set the interface to use DHCP and get this address or set it statically? Then do you put the setroute option or put in a static? [code]
View 5 Replies View RelatedCisco Firewall :: ASA 5510 8.4 - Internet Is Not Working?
Nov 14, 2011I implemented a ASA5510 with latest software version. I configured outside interface, default route, PAT to the outside interface. I am able to ping and telnet to the inside interface of the ASA.But internet is not working.Did i miss any configuration?i enabled icmp to outside,. i did a ping to the next hop from ASA. but it is not working.
View 6 Replies View RelatedCisco Firewall :: NAT Only Working For Some IP Addresses On 5505
Dec 16, 2011I'm trying to get a new 5505 installed in our network to replace the 1841 that died over the past few days (memory issues). One of the big pieces of functionality that the old router gave us was the ability to open certain ports to the outside world to let clients see web sites we were working on for them or let employees RDP in to their work machines. I'm having trouble getting that working properly with the new device.
After a lot of trial and error, I finally got some ports working, but only for some IP addresses. In theory, Comcast (our ISP) is routing 13 IP addresses to our device (a.b.c.177 through 189). For historical reasons, the external IP of the device is .178. Only those NAT entries for .177, .178 and .179 are currently working. I've attached the configuration of the ASA, as well as the configuration of the old 1841. As far as I know, Comcast's equipment is doing its job, so I don't have a lot of reason to question that end of it. And it was working with the 1841 in place before its untimely demise.
One note - I am also having trouble getting the VPNs working, so they are a work in progress. That will account for some of the differences in the configs.
Cisco Firewall :: Internet Is Not Working Behind 1841?
Apr 6, 2011I have configured a Cisco router. I am able to ping google from rotuer. I can ping my local IP from router and router local IP to my machine. But I can not access internet on machine. I can not ping google and any other IP out of network.
View 11 Replies View RelatedCisco Firewall :: ASA 5505 9.0(2) Traceroute Not Working
Apr 16, 2013there is an issue with tracroute from ASA 5505 with 9.0(2) - here is the running configuration [code] with this running configuration - from the LAN tracerouet to public IP, it is working fine. but once I traceroute from the LAN 192.168.225.x to the corporate networks via the IPSec l2l tunnel - it does not show any hop at all - even the inside interface of the ASA does not show in the traceroute.
View 4 Replies View RelatedCisco Firewall :: Inspect Not Working In ASA5520?
Aug 15, 2012I have a cisco ASA5520 box running with IOS version8.2(5)13 where default policy map is applied globally. But I have not seen any traffic being inspected through included protocol defined under policy map.All configuration seems to be ok for me.
service-policy global_policy global
Global policy:
Service-policy: global_policy
Class-map: inspection_default
Inspect: ftp, packet 0, drop 0, reset-drop 0
[code]....
Cisco Firewall :: ASA 5540 SSH Not Working From Outside Port
Mar 13, 2011We are try to connect ssh via outside system (from Internet) its was not getting connected.
When we try to connect from outside pool of ip than its working.
Cisco Firewall :: SSH Stopped Working On ASA5520?
Mar 27, 2012I can no longer SSH to a primary active firewall. It had all of a sudden stopped working. However I am able to SSH to the secondary standby firewall without any problems. I did try to regenerate the RSA key on the primary fw, but still unable to connect. The only way I can connect to it is by using telnet.
I ran the "show asp table socket" command and I'm seeing port 22 listening on the primary IP address (not the standby), foreign address is 0.0.0.0:*. I did a packet capture on port 22 on the inside inside, seeing my request hit the fw and then right away a reset back from the fw.
version 8.2.(5)
model ASA5520
I'm hitting a bug in the software version I'm running? Or what else can I check before rebooting the primary fw?
Cisco Firewall :: ASA 8.4 ICMP Not Working On Default NAT?
May 23, 2012I'm having issues with NAT dropping ICMP on default NAT. Do I need to create another NAT for ICMP?
Here's the packet-tracer result:
firewall01# packet-tracer input inside icmp 172.23.1.74 0 10 8.8.8.8 detailed
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
[code]....
Cisco Firewall :: ASA5510 / SSH Not Working After Upgrade
Mar 2, 2011I have an ASA5510 which was running version 8.31. SSH was working fine on version 8.31 but since i upgraded it to version 8.41 the SSH stopped working.
View 7 Replies View RelatedCisco Firewall :: ASA 5505 SLA Commands Not Working
Jan 28, 2013I am trying to set up a SLA statement on an ASA 5505 version 8.2(5). When I enter the command "sla monitor schedule 1 life forever start-time now" I get a message stating "%Entry not configured."
View 1 Replies View RelatedCisco Firewall :: SSH In ASA 5520 Not Working Even With All Configuration In It
May 3, 2013I am having a wierd case, where in i have a 5520 and i am not able to ssh into that firewall. When did a capture on that firewall it shows my connection is getting reset as soon as i try to ssh into the box. Given below is the config for ssh into the firewall.
!
ssh 10.252.253.0 255.255.255.0 inside
ssh 10.114.255.240 255.255.255.255 inside
ssh 169.2.162.75 255.255.255.255 inside
[Code].....
Cisco Firewall :: ASA 5505 - 8.4(3) - PCTV Not Working?
Apr 1, 2012I have an ASA 5505 running 8.4(3) at home and I'm banging my head against the wall trying to get the PCTV working from my local ISP.Basically I open a web page for the service and I can stream all the basic TV channels to my PC screen.
I just simply cant get this working through the ASA.. I know absolutely nothing about voice/video in networking.
My setup regarding ASA configurations are as follows
interface Vlan1
description LAN
nameif LAN
security-level 100
ip address 10.0.0.1 255.255.255.0
igmp forward interface WAN
[code....
I can get the PCTV working if i bypass the ASA. I can for example get the PCTV working on PC2 if I simply change the port Ethernet0/2 to access vlan 10. So theres just simply something that I havent configured on the ASA or the ASA doesnt support something?I took a capture from my PC2 just as I opened the browser and connected to the PCTV url (opens our local channe 1 right away)Only thing I can see in the capture at that point is:
- V2 Membership report / Join group 232.1.3.1
- Right after a remote host from the ISP networks starts sending the stream with the destination port udp/2000 with the destination address of 232.1.3.1
what I could check in my configuration? Or is there something that I have simply configured wrong already on the partial configuration shown above?
Cisco Firewall :: ASA 8.4.2 - Clear Route Not Working
Jul 8, 2011After command clear route, all timers just continue, there is not actually clearing the routing table... This is happening on two different boxes: pair of ASA 5520 and one 5505 ASA... I presume it is happening on all others too, but I don't have this release installed anywhere else...
Codes:
C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route(code)
Cisco Firewall :: SSH Stops Working To ASA 5510?
Feb 5, 2013I find are steps to turn on SSH access. I have quite a few customers with ASA5510's installed. SSH is set up and working fine on every one. After a period of time, you are no longer able to SSH into the firewall. Using Putty, it just sits there on a blank screen without giving a "denied access" message or a login prompt. Rebooting the firewall will solve the issue and SSH access works again. Today, I had a customer with and active/standby configuration where I had to reboot both of them to be able to log in. Most of my customers are on 8.2.software as most don't want to reconfigure for the new NAT, etc.
I'm sure others have seen this before since it appears to be occuring on almost every ASA that I have access to. Is there any fix to eliminate this or is there something that can be run from the ASDM that will grant SSH access again without just doing a reboot?