Cisco Firewall :: ASA Version 9.0(1) / Configuring NAT On Intranet Firewall?

Dec 26, 2012

configuring NAT on intranet firewall. here is the my topology:
 
  DMZ Network  - - - - - - - - - External Firewall   - - - - - - - - - Internet
                                                          |
                                                          |    
                                                          |
  Internal Network  - - - - - - - - - Internal Firewall  
 
1) I can Ping the intneral host from external firewall, internet firewall and DMZ network

2) Both ASA's are running OS Version 9.0(1)

3) ACL used permit IP any any, on both (i.e inside and outside)
 
NAT configuration on Internal Firewall  (Identity NAT)
 
object network MGMT-SRV-INSIDE           subnet 10.10.10.0 255.255.255.192
object network MGMT-SRV-identity
subnet10.10.10.0 255.255.255.192
 object network MGMT-SRV-INSIDE           nat (Inside,Outside) static MGMT-SRV-identity

[code]....

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: Configuring UC-Proxy On ASA 5505 Version 8.0?

Jan 24, 2012

I'm trying to configure UC-Proxy using an ASA 5505 with software version 8.0.4.I was following the instructions in DOC-5704 and ASA 8.0 CLI.I don't have USB security tokens in UC solution, instead I'm using IP phones Cisco 7961 with MIC.I configure all the items as the documentation says but when I restart the phone outside the Firewall, the 7961 don't registrate with the Call Manager.Checking the troubleshooting I found that it's possible certificates problems but I don't know if I need to do something in phones.
 
I would like to know if there is any consideration when the UC proxy works just with MIC.The outside phone is a Cisco 7961 configured with static IP address and TFTP address of Call Manager (static NAT in ASA).

View 6 Replies View Related

Cisco Firewall :: Migrating Netscreen Firewall To ASA 5515 Version 8.6?

Mar 5, 2013

I am currently migrating a netscreen firewall to a asa 5515 version 8.6 The issue is setting up the management connectivity.
 
basically the management IP of the cisco asa is not advertised. But, we want to route a management IP through the management interface to interface Gi0/2.
 
so IP of management interface is say - 216.10.100.10. and the IP of the inside interface is say - 198.1.1.10/24 on our router we have a static route sending 198.1.1.0/24 to next hop of 216.10.100.10 (management interface of cisco asa).
 
On the Cisco ASA can I send the traffic to the inside interface and manage the firewall via ssh that way?

View 4 Replies View Related

Cisco Firewall :: 5510 - Transparent Firewall Installation Using ASA Version 8.4(3)9

May 14, 2012

I'm trying to install an ASA 5510 transparent firewall using ASA version 8.4(3)9 but I don't understand how traffic will ever pass through my firewall if both interfaces are on the same sub net(V lan) as the host and it's default gateway? The reason I'm doing this is were installing UAG (or Direct Access) and the UAG appliance need to have public IP's but still be behind a firewall (see attached diagram).
 
Looking at the documentation (which all seems to be for 5505's running 8.2) it almost seems like i need to have the transparent firewall 'in-line' to the ISP router?, but this router services another IP address range on another v lan for other (routed) firewalls (not shown on diagram) so putting it 'in-line' is not possible. Surely this can't be the case can it? If not how is it supposed to be cabled up and configured so packets go through the firewall?

View 3 Replies View Related

Cisco Firewall :: Software Upgrade For ASA 5520 Version 7.0(1) To Version 8.4?

Apr 3, 2012

provide me with the important links which can show me how to do the software upgrade for my ASA 5520 ver 7.0(1) to ver 8.4 ? as well as the ASDM

View 10 Replies View Related

Cisco Firewall :: ASA 5540 - Version Change In Firewall?

Mar 15, 2012

How are asa5540 in high availability mode upgraded for their versions.

View 1 Replies View Related

Cisco Firewall :: Block Ip Address From CLI At PIX Firewall Version 6.3(4)?

Oct 11, 2011

I would like to know  how can I block a ip address from the  CLI at the Cisco PIX Firewall Version 6.3(4)

View 4 Replies View Related

Cisco Firewall :: How To Upgrade ASA 5510 Version 8.0(4) To Version 8.3

May 10, 2011

i am using Cisco ASA 5510  with ASA Version 8.0(4) and memory 256MB. me to Upgrade it to 8.3

View 6 Replies View Related

Cisco Firewall :: Configuring ASA 5505 Firewall

Sep 21, 2012

I am configuring a Cisco ASA 5505 firewall.In the office there is 1 x SBS 2008 server and 5 x PCs, all sat behind a Netgear DGN1000 ADSL router.We want to implement a ASA 5505 for added security.I have configured the internal interface of the Cisco ASA 5505 to be 192.168.0.1 - this is connected to local switch. The client PCs use 192.168.0.1 as their default gateway.I have configured the external ASA 5505 interface to be x.x.x.217. [code]Change the current router status from Router/Firewall/Modem to Modem only (Bridge mode). The ASA 5505 has its outside interface connected into one of the LAN ports of the netgear. The lan port has an IP of 192.168.0.254.

View 3 Replies View Related

Cisco Firewall :: Configuring NAT In 8.3 Using DMZ 2

Sep 26, 2011

We have a requirement where we need to enable a dynamic NAT from DMZ-1 to Inside, I gave the command below, but for some reason it does not work.nat (DMZ-2,Inside) source dynamic any interface,NOTE: The access-list is permitting all the traffic from DMZ-1 and Inside (for test)

View 1 Replies View Related

Cisco Firewall :: Configuring NAT On ASA Running 8.3?

May 15, 2012

I'm having an issue configuring NAT on an ASA running 8.3. 've managed to configure NAT from the Inside interface to the DMZ, using PAT, so that the traffic is hidden behind the IP of the DMZ interface. This seems to work ok.
 
object network obj_any-18
subnet 0.0.0.0 0.0.0.0
 object network obj_any-18
nat (inside,dmz1.005) dynamic interface
 
The problem I have is when I try to configure a rule for traffic that originates in the DMZ back to the Inside. I can't seem to get any traffic to flow from the DMZ to the Inside, and sometimes I manage to stop traffic flowing in both directions!
 
What would be the best way to configure the return traffic from the DMZ to the Inside.

View 12 Replies View Related

Cisco Firewall :: CSM 4.3 Compatibility With Asa Version 9.1

Jan 12, 2013

I would like to know whether CSM 4.3 is compatible with ASA version 9.1(1). Any appropriate url that contains information about these two version's compatibility?

View 2 Replies View Related

Cisco Firewall :: Convert ASA 8.2 Version To 8.4?

Jun 17, 2012

I try to convert a CISCO ASA 8.2 version to 8.4 BUT, I have a small or "little" problem :On Cisco ASA 8.2.x, i have a possibility to create multi-line global with different subnet.Example :
 
global (outside) 2 217.1.x.65-217.x.x.66 netmask 255.255.255.240
global (outside) 1 interface     <--  Ip interface is other subnet : 217.3.x.3
global (outside) 2 217.1.x.67 netmask 255.255.255.240
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz2) 2 192.168.4.0 255.255.255.0
 
What is the method or solution to translate multi-global in 8.4 ? with static translation in 8.4 : i try to use different server in inside's zone, but not in same network on outside. In 8.2 Firmware, it's very easy to use that, but in 8.3-8.4 version, i don't have some idea to manipulate ...
 
interface Vlan1
description Lien vers reseau Interne Client
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0

[code]....

View 16 Replies View Related

Cisco Firewall :: 5520 Can Get An 8.6 Version

Apr 8, 2012

We want to make an upgrade of one of our customers' ASA 5520 (with failover). They have version 8.2 now and we want to get the more stable newest one. Can we get an 8.6 version? or we need an ASA 5500X for that one?

View 2 Replies View Related

Cisco Firewall :: ASA Error In Version 7.0(7)

Sep 12, 2012

%ASA-3-305005: No translation group found for tcp src inside:211.155.169.186/1433 dst outside:42.121.87.89/6000,  I found this error ,but the IP 211.155.169.186 is public address. I check the configuration but didn't find any information about this address.I don't understand why src is inside? How can I solve this error?

View 1 Replies View Related

Cisco Firewall :: LAN To LAN Between ASA5520 Version 8.3 And PIX?

Apr 19, 2011

We have 2 firewalls on PIX facing the Internet and connected to interface e1 (behind it) an ASA version 8.3 Both the PIX (Firewall facing) and the ASA are on the same subnet.
 
By using Routing statements and statics I have been able to reroute specific traffic to the ASA5520 version 8.3 Now I need to inverse the 2 devices. The ASA5520 will be facing the Internet and the PIX will be behind it.Unfortunately the ASA5520 is refusing to route the traffic to the PIX. The access-lists are open accordingly and a NAT on the ASA has been created.

View 2 Replies View Related

Cisco Firewall :: What New Command Is For NAT In Version 8.3

May 29, 2013

what the new command is for NAT in version 8.3?The config i have is from Version 7.2 and doesnt work on 8.3. [code]

View 12 Replies View Related

Cisco Firewall :: IP SLA Monitoring On ASA Version 7.0 (6)?

Dec 20, 2011

how to configure ip sla monitoring on asa ver 7.0 (6) ?

View 4 Replies View Related

Cisco Firewall :: NAT Configuration On PIX 506 Version 6.3(1)?

Jun 23, 2011

I try to setting up a PIX firewall to server as firewall end point for a small network for Internet access.  I had include PIX configuration setup, I had replaced IP address information by sentence which describe them since IP Address is sensitive information in our network.
 
For some reason NAT process doesn't work in log I always receiving this kind of messages :

106011: Deny inbound (No xlate) tcp src inside:INTERNAL_HOST_IP/2490 dst inside:HOST_PUBLIC_INTERNET_IP/80
106011: Deny inbound (No xlate) tcp src inside:INTERNAL_HOST_IP/2490 dst inside:HOST_PUBLIC_INTERNET_IP/80
106011: Deny inbound (No xlate) tcp src inside:INTERNAL_HOST_IP/2491 dst inside:HOST_PUBLIC_INTERNET_IP/80PIX Configuration

[code]...

View 1 Replies View Related

Cisco Firewall :: NAT In ASA 5505 Version 8.3

Mar 14, 2011

I need to fullfill the below configuration which is working fine on my actual D-Link Netdefend firewall.
 
We have a range of IP assign by our ISP : 194.250.47.128/29
194.250.47.129 is the firewall IP and 134 the isp gateway.
 
We have 4 interfaces
- The local user interface: lan =192.168.170.1/24
- The servers interface : dmz =192.168.171.1/24
- The database interface : oracle=192.168.169.1/24
[Code]...

View 7 Replies View Related

Cisco Firewall :: Configuring VLANs On 5515-X Is It Possible

Mar 29, 2013

I am trying to connect 2 VMWARE servers directly to my 5515-X firewall. [code]ASDM will not let me assign the same VLAN to both Gi0/2 and Gi0/3. I dont want to connect my VMWARE servers to a switch first (that just adds one more component that can fail).

View 4 Replies View Related

Cisco Firewall :: Configuring New ASA 5520 With AIP Module?

May 14, 2011

I am configuring new ASA 5520 with AIP module for our network with HA (2 boxes), would be the best practice to configure in order to protect web servers and email server.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Loss On Configuring Twice NAT

Mar 30, 2012

There seems to be a large number of the subject queries in one form or another.  Having acquired an asa 5505 and using 8.43 firmware and the ADSM gui for router configuration it has not been an easy transition from other products.   I have come to understand embedded NAT objects for basic port forwarding but am at a loss on configuring twice nat or manual nat, not really ever dealing with it before, or in this manner.  
 
What I would like to suggest to the experts, is to include far more ADSM web gui examples and discussion for manual nat.   The tools are all there - in the nat rules editing page,  the display of the rules pictorially and the packet flow at the bottom of the page (and finally thru packet tracing).   What is needed is more on the actual entries on the nat editing pages and the logic and explanation of those entries.   In this forum what I would like to see is when there are responses that they include both the CLI recommended entries b AND the associated adsm web gui pics.  With good documents for reading and examples in the forum, I think there should be much less confusion allowing more attention to some very complex scenarios. At the very least I and others like me will get better edumecated.  I am looking to understand CIsco packet routing through explanations of the web gui entries. In fact, I am learning far more by trying to understand the web gui vice simply copying and entering CLI commands.  In terms of documents, for example, there should be a very thorough explanation of the relationship between "Translated Addr:" in the first NAT editing page with "Destination Inteface" in the second Advanced page .I have added the packet tracing jpegs for further context.  There is an UNNAT lookup entry (first trace block, out of view on the pic) a concept which is missing in the documentation I've read that needs to be added but it is illuminating in how the router handles traffic.   What is also interesting is the fourth jpeg which also shows the flow designation of a packet and its handling internally (new packet or one that is associated with an existing packet (previously identified and put in an appropriate table xlate etc)).

View 2 Replies View Related

Cisco Firewall :: Configuring QOS On ASA 5520 Release 8.0(2)?

Jun 20, 2011

I present wish to develop a policy and template for QOS on our ASA 5520 release 8.0(2) we presently have wish to do server hosting in our network for other organization,which the they will be able to access their servers they have both public and private addresses. we do have our one servers also already in production all behind the ASA And therefore we wish to apply qos on the servers to be hosted and we wish to do this on the ASA. how to go about this to apply qos on the ASA?

View 3 Replies View Related

Cisco Firewall :: Command For Configuring NAT On ASA5505?

Dec 5, 2012

want to know the command for configuring NAT on My ASA5505.

Local IP - 192.168.1.0/241

Public IP - 182.73.109.118 255.255.255.252

View 4 Replies View Related

Cisco Firewall :: Configuring VoIP On ASA 5500?

Nov 20, 2011

We have to set up voip for our network(for 50 phones not he cisco phones).
 
I need to just the route the voip traffic to gateway address of telephonic company(1.1.5.7)  where they provide us the connectivity for the setination call.
 
What sort of protocols should i have to enable in pix i saw the concepts like sip, h323, ras, skinny.
 
We are using only voip for asa and no data or other traffic should be allowed.
  
inside adrees: 10.10.10.0/24 for all voip phones
outside:121.21.22.1
telephoneic gateway: 1.1.5.7

View 1 Replies View Related

Cisco Firewall :: Configuring Failover For ASA 5510

Oct 16, 2012

I have two ASA 5510's that I want to setup in a Active/Standby configuration. My only question is on how to connect the inside ports to my LAN. I have 5 Catalyst 3750's stacked together that connect to the ASA's. Should I run the inside interface on ASA1 to a port on switch 1. Then run the inside interface on ASA2 to a port on switch2? And make sure both those ports are in the same VLAN? But, then when failover occured, how to I automatically make it clear the arp cache so the traffic starts flowing out of the right port?                   

View 1 Replies View Related

Cisco Firewall :: Configuring ACLs 3560 In A Lab

Dec 27, 2011

In my lab setup i configured Cisco 3560 switch.

VLAN 20 and VLAN 30 i configured.
VLAN 20 interface IP : 192.168.20.1/24
VLAN 30 interface IP : 192.168.30.1/24.
Inter-vlan communication is happening fine.
 
For testing for purpose i configured extended ACLs. Here is my requirement: I want to stop communication from VLAN 30 to VLAN 20 but not vice-versa.
 
Here i configured like this:
 
access-list 111 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 111 permit ip any any
applied ACL in VLAN 30 interface 'in' direction.
ip access-group 111 in
 
In this scenario, communication is stopping in both directions. If i ping from one of the IP VLAN 20 to one of the ip of VLAN 30, i was gettng Requested time out. And if i ping from one of the IP VLAN 20 to VLAN 30 interface IP, i was able get pinging.
 
From VLAN 30 to VLAN 20, i was getting destination host unreachable from VLAN 30 ip( Its fine as its my requirement). So, solution needed to communicate from VLAN 20 to VLAN 30.

View 1 Replies View Related

Cisco Firewall :: Configuring ASA 5510 From Scratch

Aug 19, 2012

I just upgraded an ASA-5510 from 7.0 to 8.4.4-1 and theres a lot of stuff in it I don't recognize that I never added, mostly because of new network objects, nat commands, and other migration stuff. Its been awhile since I've configured the ASA and I think I'd like to start from scratch and clean it up a bit because theres so many lines for so little that I really need.
 
I have a 5510 assigned an IP address on the outside interface with 3 inside interfaces and below are the only requirements I need.
 
Network-A (192.168.1.0/24)
   - incoming ssh port 2202 goes to node 192.168.1.2
   - incoming ssh port 2203 goes to node 192.168.1.3
   - handle incoming https (443) requests
   - handle incoming www (80) requests
   - cannot see Network-B or Network-C
 
Network-B (10.0.0.0/16)
   - ssh to nodes on Network-A
   - incoming ssh port 22 goes to node 10.0.0.20
 
Network-C (192.168.2.0/24)
   - ssh to nodes on Network-A
   - incoming ssh port 2210 goes to node 192.168.2.2
 
ASA-5510
   - sends logging to syslog node 192.168.1.3 on Network-A
   - there are DNS and NTP servers located outside

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - Configuring Dynamic NAT And PAT

Jan 13, 2013

To configure a dynamic NAT, PAT, or identity NAT rule, I need to perform the following steps: 

Step 1 From the Configuration > Firewall > NAT Rules pane, choose Add > Add Dynamic NAT Rule.
 
The Add Dynamic NAT Rule dialog box appears. However, when I click on Add I don't get the option to Add Dynamic Nat Rule. To see the options I get please see attachment.
 
The following is a capture of the show version:
 
ciscoasa# show ver Cisco Adaptive Security Appliance Software Version 8.4(2) <system> Device Manager Version 6.4(1) Compiled on Wed 15-Jun-11 18:17 by builders System image file is "Unknown, monitor mode tftp booted image" Config file at boot was "start up-config"
ciscoasa up 16 mins 57 secs Hardware: ASA 5520, 1024 MB RAM, CPU Pentium II 1000 MHz Internal ATA Compact Flash, 256MB
BIOS Flash unknown @ 0x0, 0KB  
0: Ext: GigabitEthernet0 : address is 00ab.a72f.0100, irq 0
1: Ext: GigabitEthernet1 : address is 00ab.a72f.0101, irq 0
2: Ext: GigabitEthernet2 : address is 0000.ab6d.9802, irq 0
[code]...
 
This platform has an ASA 5520 VPN Plus license. Serial Number: 123456789AB
Running Permanent Activation Key: 0x4a3ec071 0x0d86fbf6 0x7cb1bc48 0x8b48b8b0 0xf317c0b5
Configuration register is 0x0
Configuration has not been modified since last system restart.

View 8 Replies View Related

Cisco Firewall :: Best Practice For Configuring ASA 5505

Jun 6, 2011

I am planning on building the configuration on my ASA 5505, and then distribute that same configuration to several places on ASA5505's.

What is the best way to do this? Screen dumps of the ASDM. Copy the running-configuration from a text file into the ASA5505. TFTP the running-config.

View 2 Replies View Related

Cisco Firewall :: Do PIX515 Support For Version 8.3

Jun 12, 2012

I have PIX515 with version 7.0 installed, so can i install version 8.3 on it?and what will be the memory requirements?

View 2 Replies View Related

Cisco Firewall :: ASA IOS Version 8.4 Download For GNS3

Apr 2, 2013

I have to test new Cisco ASA's IOS version 8.4 in my GNS3 LAB . do provide the link for downloading the same.I dont have direct download access from cisco.com.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved