Recently i bought asa 5505 to practice for my exams and i failed to connect to internet since my internet provider binds IP and mac for every users and supports only 6 group mac address (xx-xx-xx-xx-xx-xx) format. because asa 5505 has 3 groups (xxx-xxx-xxx) mac address they are unable to provide me the connection.So my question is how can i assign 6 group mac address to asa5505.
View 2 Replies
I am wondering if it's possible to convert a Pix 501 configuration running version 6.3(5) to a new ASA5505 which we just purchased? We have site to site VPN on this device and i am just trying to save some time. I believe Cisco TAC might have a tool to do this but i am not sure.
View 4 Replies View RelatedMy ASA5505 has an external address of x.x.x.13. We have got another 2 spare ip addresses: x.x.x.10 and x.x.x.11.We also have 2 internal hosts, which we need to provide with internet access using NAT. y.y.y.146 and y.y.y.70.
We recently updated our ASA to software version 8.3(1). I was thinking that I could do it using network objects and groups, but didn't understand quite good how this should be done.
The goal is to set up ASA in the way, that if either of the abovementioned 2 hosts will connect to the internet, it needs take one of 2 external addresses. All other hosts should use PAT through x.x.x.13.
I would like to clone the MAC address of my ISP-supplied router to an ASA 5505 firewall to be used in router mode.
View 3 Replies View RelatedI need to create a vpn connection between two ASA firewalls and when trying to create this AI get an error message below, The config I was to use is -
object net-local
Subnet 10.51.212.1 255.255.255.0
object network net-remote
subnet 10.10.2.65 255.255.255.0
ERROR: network IP address/mask <10.10.2.65/255.255.255.0> doesn't pair
Does the ASA treat an object-group with a network-object containing a range of IP addresses as a netmask? For example, I can apply this configuration without the ASA throwing any errors though the configuration calls for a 'net mask':
object-group network test
network-object 192.168.0.0 192.168.63.255
?
network-object-group mode commands/options:
A.B.C.D Enter an IPv4 network mask
sh run ob id test
object-group network test
network-object 192.168.0.0 192.168.63.255
I found that in the documentation it requires a netmask as oppose to a range. Is this a bug in the code? I am running code version 8.0(5)23 on a 5520. If this is not a bug how does the ASA treat this type of configuration when applied to an access list? When I ran a quick packet trace and denied access from that range it looks like the ASA doesn't read that configuration properly.
Is there a conversion tool? It would make my life a lot easier to convert 43 firewalls with failovers.
View 2 Replies View RelatedIs there an script tool to convert the configuration from a Cisco ASA 8.2 to 8.6 ?
View 1 Replies View RelatedI try to convert a CISCO ASA 8.2 version to 8.4 BUT, I have a small or "little" problem :On Cisco ASA 8.2.x, i have a possibility to create multi-line global with different subnet.Example :
global (outside) 2 217.1.x.65-217.x.x.66 netmask 255.255.255.240
global (outside) 1 interface <-- Ip interface is other subnet : 217.3.x.3
global (outside) 2 217.1.x.67 netmask 255.255.255.240
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz2) 2 192.168.4.0 255.255.255.0
What is the method or solution to translate multi-global in 8.4 ? with static translation in 8.4 : i try to use different server in inside's zone, but not in same network on outside. In 8.2 Firmware, it's very easy to use that, but in 8.3-8.4 version, i don't have some idea to manipulate ...
interface Vlan1
description Lien vers reseau Interne Client
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
[code]....
how to convert your PIX configs to an ASA 8.X? [code]
View 5 Replies View RelatedI have an issue, of two parts. The first part I believe I have figured out, just the second part I am unsure of. I have an ASA 5510, currently, there is a mailserver that is static NAT'ed to one of my ISP routed IPs (not the IP of my main Dynamic PAT/Outside interface). I need to convert this over to PAT for ports 25,80,443, etc (standard ports). I know I need to remove the static NAT statement and add in the PAT statements, but I need traffic from that machine to continue to go out the IP assigned to it by the static NAT.
E.G.
1.1.1.1 <- main public IP on outside interface, everything gets internet through this IP
1.1.1.2 <-> 10.10.10.10 static NAT to mailserver, secured with ACLs
I need to enable the mailserver to continue to appear to the world as living on 1.1.1.2, due to MX records and rDNS settings, etc...
The terminology for this setup escapes me at the moment.
is it possible to convert the any two ports of asa5520 as L2 ports . If so kindly let me know how that should be done. We are planning to connect our hsrp switches to these switch ports instead of using a separate switch thats why.
View 1 Replies View RelatedIs there any significance to the parameter "firewall-group" in the command
firewall vlan-group <firewall-group> <vlan-id>…<vlan-id>?
In other words is the series of commands
firewall switch 1 module 3 vlan-group 1,2
firewall vlan-group 1 100,101,102
firewall vlan-group 2 200,201,202
exactly equivalent to
firewall switch 1 module 3 vlan-group 3
firewall vlan-group 3 100,101,102,200,201,202
or
firewall switch 1 module 3 vlan-group 1,2,3
firewall vlan-group 1 100,200
firewall vlan-group 2 101,201
firewall vlan-group 3 102,202
All three of these options associate the same set of vlans to the FWSM but using different groupings. As far as I can tell, these groupings have no functional significance either on the switch side or the FWSM side. These are simply three different ways of specifying exactly the same thing? Am I correct?
I have a ASA5505 that I need to allow IPSEC and SSL VPNs through. The ASA is connecting to a BT Business ADSL router, what address should I be using on the ASA outside interface that will allow the ASA to be reachable from the Internet?
View 1 Replies View RelatedI want to add new vlan in existing firewall group in 6500. I am confused if it will add new vlan or overwrite.. I am using ASASM module with 6500.
View 3 Replies View RelatedHow to remotely changing ip address for my ASA5505.
View 1 Replies View RelatedThe problem is that the PABX is sending out an internal address in it's INVITE messages and the ASA5505 isn't changing the internal address to the external address.We need> From: Calling Number <SIP: SIP Username@Public IP Address>However our PABX sends out> From: Calling Number <SIP: SIP Username@Private IP Address>. How to translate the internal IP address to the external IP address on an ASA 5505?
View 1 Replies View RelatedWe have an HQ site with a 2811 (w/ADVSECURITYK9-M) acting as the firewall. We currently have 1 ASA5505 that has an established ipsec l2l VPN. I'm trying to connect a 2nd ASA, but I've noticed I can only add 1 cryptomap to the outside interface. A show ver shows 1 Virtual Private Network Module... Surely that doesn't mean only 1 VPN?Do I use one crypto map, and add a second 'set peer' & 'match address' inside the crypto map itself?
View 10 Replies View RelatedI have a normal setup of ASA5505 (without security license) connected behind an internet router. From the ASA5505 console I can ping the Internet. However, users behind the Firewall on the internal LAN, cannot ping the Internet even though NATing is configured. The users can ping the Inside interface of the Firewall so there is no internal reachability problem. In addition, I noticed that the NAT inside access list is not having any hit counts at all when users are trying to reach the internet.
When i replace the ASA5505 with a router with NAT overload configuration on it, the setup works normally and users are able to browse the internet.
The ASA5505 configuration is shown below.
hostname Firewall
interface Ethernet0/0
description Connected To Internet Router
switchport access vlan 10
[Code].....
i have asa 5505 with the asdm v5.2 (4), and the asa v7.2(4). This platform has a base license. if i upgrade adsm and asa on v6.2(1) and v8.2(2) if I lose my license and that you need to activate them? i configured site to site vpn (this firewall and the another) that i lose my configuration if i upgrade my firewall.
View 2 Replies View RelatedI've recently upgraded my old firewall from a PIX to an ASA5505 and have been trying to match up the configuration settings to no avail. I have is that I can't ping the new firewall on it's inside interface, despite having "icmp permit any inside" in the running config. Secondly, the server I have on there ("Sar") can't connect out to the internet.I've included the ASA's running config incase anybody can see if something stands out. I have a feeling it's either not letting anything onto the inside interface, or there is no nat going on. Lastly (and possibly relevant), the firewall is actually going at the end of a vlan, which is different to the firewall's inside vlan number. I don't know if this is actually the problem because the server can't connect out even if connected directly into the firewall.
View 32 Replies View RelatedInternet ISP -> Juniper SRX 210 Ge-0/0/0
Juniper fe0/0/2 -> Cisco ASA 5505
Cisco ASA 5505 - >Inernal LAN switch.
1. Internet is connected to Juniper Ge0/0/0 via /30 IP.
2. Juniper fe0/0/2 port is configured as inet port and configured the Internal public LAN pool provided by the ISP. And this port is directly connected to Cisco ASA 5505 E0/0. Its a /28 pool IP address. This interface is configured as outside and security level set to 0.
From Juniper SRX, am able to ping public Internet IPs (8.8.8.8).
Issue:
1. From ASA am unable to ping public ip configured on Juniper G0/0/0 port.(/30)
2. From ASA no other Public internet IP is pinging.
Troubleshooting Done so far.
1, Configured icmp inspection on ASA.
2. Used the packet tracer in ASA, it shows the packet is flowing outside without a drop.
3. Allowed all services in untrust zone in bound traffic in Juniper SRX.
4. Viewed the logs when I was trying the ping 8.8.8.8 in ASA. It says "Tear down ICMP connection for faddrr **** gaddr **
I try to map LDAP Group to ASA Group policy following documentation:
[URL]
This is a config for ASA 8.0. I would have expected it to work on 8.4 as well but I do run into problems. The mapping as shown in LDAP Debug and ASA Log will actually happen but it is overwritten by the "GPnoAccess" Group Policy configured locally in the Tunnel Group. From earlier works with RADIUS I would have expected the user specific Attribute to be "stronger"?
ASA Log:
AAA retrieved user specific group policy (correct Policy) for user = XXX
AAA retrieved default group policy (GPnoAccess) for user = XXX
I am trying to issue command "ssh key-exchange group dhgroup14" on several of my ASA firewalls. The key-exchange command is failing on 3 of 4 ASA firewalls. According to Cisco documentation, this command was introducted in 8.4. My ASA's are running version 8.6.1.10, 9.1.1.8, 9.1.1.10 and 9.1.2. The command is available only with 9.1.2.
Example from one my ASA.
lbjinetfw# show version | in Version
Cisco Adaptive Security Appliance Software Version 8.6(1)10
Device Manager Version 7.1(2)
Baseboard Management Controller (revision 0x1) Firmware Version: 2.4
lbjinetfw# config t
lbjinetfw(config)# ssh
[code]....
I'm trying to troubleshoot an ASA5505.
The original goal was to block "Mumble/Murmur" (a voip app) traffic, which runs on TCP/UDP 64738, both inbound and outbound, except to a certain host (63.223.117.170).
However, when nothing I tried seemed to make a difference, just to troubleshoot, I decided to try blocking all inbound traffic. I first disconnected ethernet port 0/0 to ensure that it was cabled correctly and the outside interface went down when I did. That worked as expected, so I confirmed I had the right interface and it was cabled correctly.
I then applied a "any any deny ip" rule as the first element in the outside interface access_list, as you can see below. However, it appears to have had no real effect and the hit count is very low (it should be astronomical).
show ver
Cisco Adaptive Security Appliance Software Version 9.0(2)
Device Manager Version 7.1(2)
Compiled on Thu 21-Feb-13 13:10 by builders
System image file is "disk0:/asa902-k8.bin"
[Code].....
I have some problem to get working ACLs. The main purpose of this ACLs is to control what is going out from vlan to internet. (For example, i want that only my proxy can access to the web.) So, i use Cisco Packet Tracer and test new rules in lab without any problem.
interface Vlan1
ip address x.x.x.x x.x.x.x
ip flow ingress
ip flow egress
ip nat inside
[Code]...
But it doesn't work on my Cisco 1811w and i dont uderstand why and i'm not sure to have sufficient knowledge to aolve my problem by my own.
I can not have "dns server-group" on my asa 5510, could you tell me how to get this command in my ASA 5510.
View 3 Replies View Relatedi wounder why i'm getting such log message whenever i'm trying to reach my remote site: No translation group found for tcp src outside XXXX dst dmz ZZZZ, i have a Cisco PIX515E firewall and that message is captured there, the traffic is going through a VPN tunnel (the VPN are up on both ends)
View 2 Replies View RelatedWe are having ASA 5550 running on 8.0(5)23 IOS. We are having 2 failover groups group1 & group2. currently all contexts are on group1 & its active & Group2 is in BulkSync mode but from last 2 days the failover for group 2 is happning, i am not able to find anything in logs. Its happing daily from 2 days.
View 4 Replies View Relatedi have fwsm in cat6500, i have one firewall vlan group which is in firewall module 1 vlan group 10. I need tocreate another vlan group and add to firewall module 1 vlan group 10, 20. i need to have zero downtime.
View 2 Replies View RelatedError message
305005: No translation group found for udp src c_dmz:10.0.176.120/51910 dst inside:195.244.192.16/53
305005: No translation group found for udp src c_dmz:10.0.176.120/51910 dst inside:195.244.192.166/53
[Code]....
I thought it needed a nat (c_dmz) command but I got the following error message
PIX(config)# nat (c_dmz) 0 0.0.0.0 0.0.0.0 0 0 nat 0 0.0.0.0 will be identity translated for outbound WARNING: Binding inside nat statement to outermost interface. WARNING: Keyword "outside" is probably missing.
I have an ASA5520 with mobile VPN Ipsec.The "splitTunnelAcl" set the group is not working.
View 7 Replies View RelatedI need to use a Cisco ASA 5505 on a BT Openreach connection, The configs that I have ben using are below -
interface vlan2
nameif outside
security-level 0
[Code]....
