Cisco Firewall :: ASA 8.4 What Commands Can Use To Verify Related Configuration On Firewall

Apr 7, 2013

We have an ASA with 8.4(5) version. we had detected that few ip's were getting shunned ,to overcome the problem no shun was used and the traffic normalised.But, the same problem re-occured a few days after that with logs showing traffic being shunned.
 
is there any fixed way to get rid of this. what commands can i use to verify related configuration on the firewall.

View 3 Replies


ADVERTISEMENT

Cisco Firewall :: Configuration Changes Logging ASDM 8.4 Related?

Mar 1, 2012

I've run into an interesting problem.
 
-ASA: 8.4(2)
-ASDM: 6.4(5)
 
When I make a change at the CLI, syslog message ASA-5-111008 is generated and sent to the syslog servers, local buffer, and ASDM.When I make a change in ASDM, syslog message ASA-5-111008 is  generated and sent to the local  buffer and ASDM. It is NOT sent to the syslog server.

View 2 Replies View Related

Cisco Firewall :: ASA 8.4 SYN ACK Missing Related With Firewall Inside DMZ

Aug 20, 2012

I have two control point, two firewall the second one is linked inside one DMZ from the first firewall route is good and inside the DMZ from first firewall I have servers too.so  to be more clear we could call as IP for the DMZ from first firewall,  Interface IP 1.1.1.1 that generate this DMZ with first firewall (netmask  255.255.0.0)
 
inside the DMZ I have an interface from second firewall with IP 1.1.1.5 and inside DMZ 1.1/16 I have servers too keep one test server with IP 1.1.1.3.The LAN passing the second firewall is 2.2.2.1 ever 16 bits of netmask (255.255.0.0) inside  the DMZ generated from second firewall I have a machine with IP 2.2.2.9  that need to access in TCP services on machine 1.1.1.3
 
TCP packets from 2.2.2.9 pass the second firewall and arrive inside DMZ with net 1.1/16 and arrive to server with IP 1.1.1.3 defaul gateway (to answer to originating machine with IP 2.2.2.9) is 1.1.1.1 ASA  interface 1.1.1.1 claim a missing related as it haven't mapped the  connection that has passed on first firewall. I need only that 1.1.1.1  route packets to second firewall (who own net 2.2/16) avoiding to be  trappen in missing related check
 
at  start it was working! around 1 year ago we upgraded IOS to 8.4 and ever  so late (one year) doing maintenance to a machine I discovered it was  no longer talking with these server on net 1.1/16
 
I  have found on cisco docs chapter 51 and TCP State Bypass before was working, is something that has changed inside ASA IOS 8.4 ?

View 2 Replies View Related

Cisco Firewall :: How To Verify If CG-NMS Is Enabled On ASA5520

Apr 11, 2013

how do I verify if CG-NMS is enabled on ASA5520. I just need to know if it's enable/install to be enabled and used?Cisco Adaptive Security Appliance Software Version 8.0(5)28..Device Manager Version 6.1(5)51

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / How To Verify That RPF Disabled On Particular Interface

Feb 24, 2011

I have disabled Unicast RPF on a Cisco ASA 5510 for one specific interface. However, how do I verify that RPF indeed has been disabled on that particular interface? It doesn't show up in the config, neither does it up when I issue the command "sh int interface'.
 
To disable the RPF feature, I issued the following command: no ip verify reverse-path interface interface_name

View 1 Replies View Related

Cisco Firewall :: Verify Idle-timeout On ASA 5510?

Apr 13, 2011

How to verify on the asa 5510 , the vpn-idle timeout,is running on default setting(30mts)

View 3 Replies View Related

Cisco Firewall :: 5510 - Verify Wrong Password For VPN Users?

Apr 8, 2011

when u use the debug cryoto isakmp 127 on the asa 5510, in order to troubleshhot remote access vpn users,to which entry r u looking in the debug to see if the user enter wrong password?

View 1 Replies View Related

Cisco Firewall :: ASA 8.4.2 NAT Commands

Jul 13, 2011

I try to get a ASA with the new software 8.4.2 running. On an old pix we had the nat command: static (inside,outside) tcp interface www 192.168.15.252 www netmask 255.255.255.255 0 0,In all the new documents about 8.4.2 I can find that it should work with something like:
 
object network web_host nat (inside,outside) static interface service tcp www www
 
I want to forward http traffic from the outside interface to this host. In the log I just get entries about blocking ACL - but both is allowed on the outside access-list - traffic to the inside IP and also to the outside interface IP.
 
I also tried it with "Public Server" - but when I try to use the Interface address I just get the message: Address x.x.x.x overlaps with outside interface address.

Is it still possible to do port forwarding on the outside interface?

View 5 Replies View Related

Cisco Firewall :: PIX 515 - How To Set NATing Up Or Commands

Oct 19, 2011

I have just received 4 static ip's from my isp, i want to be able to point these ip's at different services on my internal servers, for example: [code]. The firewall I have is Cisco PIX 515, how to set the NATing up or commands?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 SLA Commands Not Working

Jan 28, 2013

I am trying to set up a SLA statement on an ASA 5505 version 8.2(5). When I enter the command "sla monitor schedule 1 life forever start-time now" I get a message stating "%Entry not configured."

View 1 Replies View Related

Cisco Firewall :: ASA 5515 - CLI Commands Just Scroll

Dec 19, 2012

Why do my cli commands just scroll all the content rather than having to press space to show more?  It is hard to type sh run and the entire config flays past rather than being to inspect it page by page.

View 3 Replies View Related

Cisco Firewall :: ASA 5545 - Passwords To Allow All Show Commands

Mar 26, 2013

Currently have an ASA 5545. What I want to do is allow our support team to perform ALL show commands (up to and including show run) but not enable them to perform ANY configuration changes on the devices (not get into config t). This is to allow them to check ARP tables, routing protocol status, etc
 
i don't have access to the ASA at the moment and haven't been able to figure it out in IOS, i'm assuming its not too hard.

View 1 Replies View Related

Cisco Firewall :: Multiple Route Commands On ASA 5505?

Jan 7, 2013

I want to know with an ASA 5505 w/ Security Plus License I get up to 20 VLANS/Named Interfaces.I have a customer that is getting a new subnet of external IP addresses from their service provider and a different default gateway to accomodate re-hosting their datacenter at their main office instead of at a Colo. My question, when building out their new DMZ, can I have multiple route 0.0.0.0 commands?
 
Example.
 
Current Default Gateway 1.1.1.X
 
Internal hosts 192.168.1.0 use and are natted to 1.1.1.X
 
New Default Gateway for DMZ Servers 2.2.2.x
 
Internal hosts still use 1.1.1.X, but server hosts in 192.168.1.3 should use 2.2.2.X -- there are also a bunch of pre-existing static NAT rules for these servers such as 2.2.2.30 translates to 192.168.1.30.
 
I think I would accomplish this by using the following:
 
route inside 0.0.0.0 0.0.0.0 1.1.1.X
route DMZ 0.0.0.0 0.0.0.0 2.2.2.x
 
Would this be correct?

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Logging / Viewing Commands?

Sep 27, 2011

How to view  the commands that someone  changed the configurations in ASA 5520?

View 1 Replies View Related

Cisco Switching/Routing :: 2811 / IOS Firewall Commands Not Working?

Mar 8, 2013

I have a Cisco 2811 router and i want to experiment on the IOS firewall.The thing is, none of the commands that are proposed in online guides - like ip inspect, ip audit, etc. - seem to be working. I just get "unrecognized command" on a router that is supposed to support such features. I'm wondering if it has something to do with the IOS image.

My show version output is this:
 
Cisco IOS Software, 2800 Software (C2800NM-SPSERVICESK9-M), Version 12.3(11)T9, RELEASE SOFTWARE (fc3)
Technical Support: [URL]
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Tue 13-Dec-05 08:24 by ccai

[code]....

View 5 Replies View Related

Cisco Switching/Routing :: 3560 Topology In Packet Tracer Related To Etherchannel Configuration

May 23, 2012

i have made a topology in packet tracer related to etherchannel configuration.i am using 2 3560 switches and 1 2950 switch. Now what i want is to bundle up the redundant links between these 3 switches. The links fa0/1-3 between 2950_1 and 3560_1 switches have been bundled up but when i try to bundle the links fa0/4-6 of 3560_1 to fa0/4-6 of 3560_2 it wont work. i am using channel-group 1 mode desirable between the 3560 switches. secondly if i want to assign ip to port channels then it has to be of same subnet between 2 3560 switches right and it must be same between 2950_1 and 3560_1. But these 2 subnets should be different from one another.

View 3 Replies View Related

Cisco Firewall :: 5505 Cannot Type In Commands In Putty Or Hyper-terminal

May 5, 2013

I have a Cisco ASA 5505. This has been previously configured. I am trying to give it a factory reset and I am being able to connect via Putty and Hyper-terminal but I cannot enter anything. I am able to go into ROMMAN mode by using the esc key.

View 6 Replies View Related

Cisco Firewall :: 1811 / Zone-Based Policy Firewall Configuration

May 16, 2011

I have two 1811's connected in a lab using a ipsec vpn tunnel (using a switch to simulate an internet connection between them).I am trying to configure one of the routers as a ZBPF just to allow a remote windows login (DC on the firewalled side, workstations on the other side).I'm trying to verify that the zbpf is working, but it doesn't seem to stop anything.  I had match icmp added to the class-map, but took it out to test if icmp would fail.  It didn't.  Basically, I don't think the firewall is working at all.  Any thoughts on how I can configure this so that the policies will work between zone-pairs?

Here's an quick drawing:

Here are the configurations:

 Local router:
 hostname sdc-1811-LocalLab
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
resource policy

[code]....

View 11 Replies View Related

Cisco Firewall :: ASA5505 Lose Configuration If Upgrade Firewall

May 17, 2011

i have asa 5505 with the asdm v5.2 (4), and the asa v7.2(4). This platform has a base license. if i upgrade adsm and asa on v6.2(1) and v8.2(2) if I lose my license and that you need to activate them? i configured site to site vpn (this firewall and the another) that i lose my configuration if i upgrade my firewall.

View 2 Replies View Related

Cisco Firewall :: Configuration Required For Transparent Firewall ASA 8.2?

Mar 31, 2013

I have one firewall need to be configured in transparent mode. I have inside and outside router. What is the configuration of transparent firewall ASA8.2. I didn't find the configuration on Cisco site.

View 17 Replies View Related

Cisco Firewall :: Transparent Firewall Configuration In PIX 515E

Nov 25, 2012

I am trying to set the PIX firewall to transparent mode.After I set it to transparent firewall, I allowed all icmp, tcp, udp traffics.Currently, any devices in the inside network can get the ip automatically from DHCP server in the outside network but cannot ping to any servers in the outside network either access the internet.Do I need additional confiration on the firewall?
 
Here's the configuration:
 
PIX Version 7.0(1)
firewall transparent
names
!
interface Ethernet0
[Code]....

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Transparent Firewall Configuration?

Sep 11, 2007

I want to configure an ASA 5505 in transparent mode (7.x). Somehow, I got it to work.. but i need some kind of step by step description. I just want to connect it with outside on a route .. inside in my LAN. Its working now with one ASA. But in the Web Interface the Interfaces inside and outside are down.. but its working.

View 5 Replies View Related

Cisco VPN :: ASA 8.2 / 8.3 - NAT Configuration And Commands

Apr 14, 2013

In studying and testing SSL VPN on an ASA I have the network as shown in the attached diagram. The configuration is based on an ASA with 8.3 but our ASA is 8.2 and at this time I'm not familiar with the new NAT configuration and commands in 8.3 or later and how to translate the 'nat (inside,outside) source static' for me to an 8.2 version.

View 3 Replies View Related

Cisco WAN :: Nexus 7k Configuration Commands For PBR?

Sep 25, 2012

I am looking to configure PBR in Nexus. The current setup in IOS is :
 
interface Vlan10
ip address 172.27.206.1 255.255.255.0
ip address 172.27.208.1 255.255.254.0 secondary
ip policy route-map Vlan_10_to_Corp
 route-map Vlan_10_to_Corp permit 10match ip address Vlan_10_to_Corp
set ip next-hop 172.27.209.250!route-map Vlan_305_to_EFH permit 30

[code]....

But, Nexus PBR will not work with deny statements init. Now, what options do I have ?

View 2 Replies View Related

Cisco Firewall :: 861 Firewall Configuration Not Available With CCP

May 5, 2012

Setup new Cisco 861 and working well for a new BTNet line for the customer. Changed the firewall using CCP from Zone to Classic Firewall. Worked great all day and configured what I needed to do.Now, with CCP (version 2.6) have the following message.Cisco CP has detected that the router is configured with either legacy and Zone Policy Firewall (ZPF) or Legacy firewall. If you want to use Cisco CP to configure an zone-based firewall, you must first delete the Legacy configuration.

View 4 Replies View Related

Cisco :: 7206 VXR - Configuration Of SNMP V3 Commands

Jul 19, 2012

I have configured below SNMP v3 commands in Cisco Router 7206VXR (NPE-G1) . I have tested with all option but it is not working . SNMP server is a SNMPc tool and I have configured user name and piv and authentication credential correctly in both side . Same configurations is working for all Cisco switches but not working for Cisco Router.
 
SNMP V3 configurations:
 
access-list 20 permit 43.194.10.0 0.0.0.255
snmp-server view readview iso included
snmp-server group readonly-group v3 priv read readview access 20
[ code]....
 
Router :
 
Host Name# sh versionCisco IOS Software, 7200 Software (C7200-ADVIPSERVICESK9-M), Version 12.2(33)SRD7, RELEASE SOFTWARE (fc1)[ code]...

View 3 Replies View Related

Cisco :: WLC 5508 - Configure 802.1 Configuration Commands On Switch

Dec 14, 2011

How to, for the most part, setup 802.1x via wireless. I'm using two 5508 WLCs, and Cisco ACS. I will setup the user account/password information via Cisco ACS and User Identity and Hosts. I know from the WLC 5508 web admin tool that I can choose 802.1x in the security parameters. I only have a few question. We have two wireless networks, one is wide open and provides internet access, the other will provide internal access for select users. I am setting up 802.1x on the internal wireless lan. Do I need to configure any 802.1 configuration commands on the switch in order for this to work, if so where would be the locations to do this at? Also, if there is a MAC isolation configuration option I can configure to not allow other hosts on this specific wireless network to communicate with each other?

View 3 Replies View Related

Cisco Firewall :: 881 - ACL Configuration

Mar 28, 2011

I would like to replace my firewall by using ACL on my Cisco 881 for testing. Could it be possible?
 
Configuration:
 
access-list n° permit ip host distant_site_public_IP host my_public_IP
access-list n° permit tcp any host my_public_IP eq port
 
This configuration works fine for SSH in exemple.
 
I can't allow "web pages" flow!!!
When i put: access-list n° permit tcp any host my_public_IP eq www
It does'nt work.
 
With Wireshark, I've seen that random ports are used to set the "http connexion". How could I resolve it keeping the best security configuration? I place my ACL on WAN port, Maybe I have to place it on LAN or create others ACL list to complete the configuration?

View 2 Replies View Related

Cisco Firewall :: NAT Configuration On ASA 9.1(1)

Jan 21, 2013

I recently installed an ASA firewall for one of our customer. I am trying to map the web server’s private address to the public address:
 
The private address is 192.168.207.15
 
The public address is 71.x.x.51
 
Here is the NAT configuration. For some reason this configuration is not working. I am not sure what is wrong with this configuration.
 
object network inside-out
nat (any,outside) static interface
object network new-www
nat (inside,outside) static 71.x.x.51
access-group inside_access_in in interface inside
access-group global_access global
 
NOTE: Inside network users can access Internet just fine. But I just cannot get natting to work.

View 14 Replies View Related

Cisco Firewall :: 501 ASA / PIX Configuration

Sep 26, 2012

I'm having trouble configuring an ASA into a network solution.  We have a 501 with the outside interface on 10.24.10.1, the inside interface as 172.18.10.1, and a DMZ on 192.168.1.1. in the DMZ there is a HTTP/FTP/TFTP server connected to 192.168.1.2 on a virtual machine.  When on a machine configured to 172.18.10.10 I can ping to the outside interface but not the DMZ. When I am in the DMZ the PIX does block traffic to the inside, but I can't reach the outside interface.  When on the outside I am blocked from the inside, but also blocked from the DMZ. 
 
Group10(config)# sh run
: Saved
:
PIX Version 8.0(4)

[Code]......

View 22 Replies View Related

Cisco Firewall :: ASA 5510 DMZ Configuration?

Dec 26, 2011

I have a Cisco ASA 5510 connected to 2 private lans (1 for my HQ pc's{inside} and 1 for the worldwide mpls{outside}) It is also connected to the public internet at interface "public" and my dmz at "dmz" interface.  I suspect I have a routing issue because packet-trace yields allow, the nat looks ok and the objects look ok at least to me but I'm the one with the non working config so...Basically this is the desired flow: 

1. I need all traffic from the inside to be able to flow to the outside unimpeded as they are both trusted networks. (this is ok right now as I allow everything via access-list 101.)

2. I need any host on the public internet to be able to reach a server on the dmz via the pat which I set up from the "public" interface to the "DMZ" interface.  The desired flow would be that the person on the internet types in [URL] and this is directed to the public interface ip which forwards to the webserver object on the dmz. (I cannot get this working any which way)

3. I need the dmz to be able to communicate with another server on the mpls via the "outside" interface when it recieves the request from the public it then checks with this other server on the outside via nat(translating the dmz range into the ip of the outside interface on the firewall)I have a default route that points to the mpls or outside interface for 0.0.0.0 0.0.0.0 via 10.x.x.1 - (and although I'm not sure I suspect this could be conflicting with traffic that needs to be sent to the "public" interface .... meaning that the firewall should dump packets bound for 0.0.0.0 0.0.0.0 to the public interface - 184.x.x.194 but I'm very reluctant to change the default route as this is in production and I'm not sure how it will affect traffic).However, I do suspect that if I changed the route from default to static as such:

route 10.0.0.0 255.0.0.0 10.x.x.1 (this would get all lan and mpls traffic to the mpls gateway) route 0.0.0.0 0.0.0.0 184.x.x.193 (this would send everything else from public to the public internet gateway)I think this is accurate but then I would bypassing my corporate internet proxy which is behind the mpls gateway at 10.x.x.1? Is there a way to get http traffic originating from the lan (10.x.x.x) to use the mpls gateway and http traffic for the dmz to use the public internet gateway at 184.x.x.193.  I don't want to start causing a flow problem for the internet nor do I want to bypass my corp internet proxy.Either way I cannot get this to work, eventhough the logic checks out, I cannot get even a ping response when I allow icmp any any for testing. Note: I can ping resources on each network from the firewall, not only it's own ports in the associated network but other resources on those networks as well. 
 
Here is the running-config:

ciscoasa# sho run
: Saved
:
ASA Version 8.4(1)
!
hostname ciscoasa
domain-name marcjacobs.lvmh

[code].....

View 16 Replies View Related

Cisco Firewall :: ASA 8.0 Configuration Migration To 8.6

Feb 12, 2013

I have old ASA with 8.0 configuration that includes huge number of ACL, NAT , VPNs , we got a new ASA with 8.6 , and we are planning to move the configuration to the new box , I'm wondering what is the best approach to do this , I'm thinking of one of the following scenarios1- downgrade the new ASA to 8.3 , the apply the config , remove the identity nat commands and names then upgrade to 8.6 and after that reconfigure the NAT rules and object groups .2- convert the old config manually to 8.6 code including NAT , object-group ,ACL and apply it to the new ASA ( this is going to be huge task). What are the commands that I have to look at when I convert to 8.6 and will the VPN configuration be affected ?

View 5 Replies View Related

Cisco Firewall :: QOS Configuration On ASA 5585?

Nov 29, 2011

I want to configure Qos for 2 diffrent Vlan 2 , each vlan for 2 mbps bandwidth .(VLAN details VLAN 10 (10.10.x.x /24) and vlan 20(20.20.x.x/24) Is any difference regarding initials configuration B/w ASA 5520 and 5585

View 9 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved