Cisco Firewall :: ASA5505 - Outbound Traffic Ceases Even Though Port Is Up

Mar 10, 2011

I've had a Cisco ASA 5505 firewall connected to a cable modem (Virgin Media, UK) for the past 3 years.  In the last 6 months or so I have noticed that the ASA would drop the outside (internet) connection intermittently, usually at least once every 1-2 weeks - the interface still shows as being up but no traffic crosses it, and computers on the inside network abruptly lose internet connectivity.  Rebooting the ASA or administratively shutting down the interface and bringing it back up again would cure the problem straight away until the next time it happens.
 
In the last couple of days however despite nothing having been changed in the configuration the frequency of this connection drop has increased to the point where I would lose access to the internet within an hour of rebooting the ASA.  It does not seem to matter whether or not there is traffic currently going out or not, inside computers just appear to suddenly lose internet connectivity.
 
I have tried the following without success:

1) I completely wiped the configuration (configure factory-default)

2) I changed the port the cable modem was connected to (eth0/0 -> eth0/7, changing switchport vlan accordingly)
 
I thought perhaps 2) had fixed it but it lasted a whole 2 hours before I woke up this morning to find that none of the internal equipment had internet access despite the fact eth0/7 was showing as up/up in ASA CLI.
 
This morning I manually set the eth0/7 port to "speed 10" (10Mbps, full duplex).  It was previously set to be auto-negotiation (default) on both speed and duplex.  As of this post it has managed to keep the outside connection up for 3 hours - but I'm not optimistic that it is fixed.
 
Interface counters have never shown any collisions, errors, etc - only packets input and output as expected.
 
Since the problem persisted across ports (eth0/0 -> eth0/7) I'm wondering whether or not the problem could either be faulty memory, or some kind of speed/duplex incompatibility between the cable modem and ASA.

View 13 Replies


ADVERTISEMENT

Cisco Firewall :: Blocking Outbound Port 80 Traffic Using ASDM On ASA 5510

Nov 26, 2012

I am attempting to block outbound traffic for a specific PC on my LAN using the ASDM.

View 2 Replies View Related

Cisco Firewall :: ASA5505 Can't Port Forward Traffic From Two External IP Addresses

Dec 30, 2012

I am a total Cisco novice who has just had a ASA5505 installed to replace a linux freeware firewall (smoothwall).I'm told that the 5505 can't port forward traffic (e.g. ssh) from two external IP addresses to two internal destination machines via the same port # (22 in this example).

View 9 Replies View Related

Cisco Firewall :: Opening Outbound Ports On ASA5505

Oct 2, 2012

I need to open some outbound ports in order for our CCTV company to receive alarms from our internal CCTV Machine.
 
The ip addresses of the company who access the CCTV are as follows:

213.130.134.56
81.130.198.97
 
The above are fixed IP addresses. The internal machine is on 192.168.204.170
 
The outbound ports that I need to open are the following:
 
TCP
21
23
80
5201
 
UDP
1025
2074
2075
 
I have access to the current config if needs be.

View 8 Replies View Related

Cisco Firewall :: ASA5505 Blocking Outbound IPSec VPN Client?

Jun 20, 2011

I have a XP workstation behind my ASA that can not connect to a client's network via Cisco VPN Client using IPSec...
 
In the logs it shows the translation is working on 500 but the VPN Client has the error 412, that the client is not responding.
 
Config below
 
ASA Version 8.2(1)!hostname RWFW1enable password encryptedpasswd encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address x.x.x.x

[Code].....

View 16 Replies View Related

Cisco Firewall :: ASA5505 - Configuration To Allow Inbound / Outbound Mail Communications

Dec 26, 2011

I’m trying to configure my ASA 5505, in order to allow my inbound and outbound mail communications. Here with this mail I’ve attached a diagram which illustrates my exact network setup along with ip addresses.

In this setup I’ve enabled port forwarding on my ADSL router (port 25 and 110) and configured the ASA accordingly, and my mail server is located inside my network.

My problem is currently I can send mails from my inside network to outside but my not receiving any mails which originate from outside. I’ve attached my current ASA configuration as well,

C:UsersSuthakarDocumentsOffice_DocsThakralABC Computers

Final config on ASA5505

host name Cisco
enable password 8Ry2YjIyt7RRXU24 encrypted
password 2KFQnbNIdI.2KYOU encrypted
names
!interface Vlan1
nameif inside
security-level 100
ip address 192.168.155.201 255.255.255.0
[Code] ......

View 3 Replies View Related

Cisco Switching/Routing :: How To Setup Traffic Shaping On 4500X Outbound Port To WAN Routers

Mar 26, 2013

We have some ASR WAN routers which have a dedicated 400M interface to a remote site.
 
Servers on our Local network source the data through some firewalls via 10G interfaces, which connects to 4500X WAN switches then to the Routers on 1G links.
 
The sources are rate limiting the traffic but the routers are periodically dropping packets which I think is mostly due to burstiness in the traffic between as it traverses through from 10G links to 1G then to 400M. 
 
How to setup traffic shaping on the 4500X outbound port to our WAN routers.I'd like to see if we could buffer and smoothe out the traffic as it exits the 4500X WAN switch 1G port to the WAN Routers.

View 1 Replies View Related

Cisco Firewall :: PIX 515 Blocking Outbound Traffic To Certain Sites

Oct 14, 2012

I have a LAN with several linux boxes (Fedora 17, both 32 and 64 bits),  as well a a WInXP box. All of these are connected to the same switch,  which is connected to the inside port of my PIX 515.
 
For a few sites (mozilla.org happens to be one of them), for http access, the tcp connection is established, but the "GET" request - or anything else for that  matter - will not go through the PIX (from inside to wan). I have  verified this by first, using wireshark to watch the packets being sent  out from the client box, then by using the trace function in the PIX to  see that the packets ARE arriving at the inside interface, but ARE NOT  sent out of the wan interface.
 
This is for the linux boxes ONLY. When I do the same thing with my WinXP  box, all works: in the PIX trace, I see the packets arrive at the  inside interface, and leave the wan interace. And access to these sites  are okay.
 
(What's a bit weird, although somewhat expected, when I connect my android phone to my LAN via WiFi, it too is unable to reach those sites - but then again, android is linux, right?)
 
In addition to the tracing, I have narrowed this problem down by connecting a linux box directly to my DSL router, then replacing the PIX with a simple router/gateway. Both of those solutions work.
 
Some background:
 
I have been using this PIX for about 10 years now, with the same  configuration (except IP addresses). Only in the last several months has  this problem started to show up.
 
I got this pix from a dead company at a really great price (free), so I'd like to keep it, and not have to spend money on something  else. I don't have any support license, and have not been able to get  any software upgrades. Here is its version info:
 
taz(config)# sho ver
 
Cisco PIX Firewall Version 6.2(2)
Cisco PIX Device Manager Version 2.0(2)
 
Compiled on Fri 07-Jun-02 17:49 by (code)
 
Serial Number: 405200362 (0x1826ddea)
Running Activation Key: 0x38ac31f3 0x0630df47 0x9a77b805 0x8bc39a60

PS: Since this PIX is at its end of life, I was wondering if any of the  software upgrades would be now available without a license?

View 2 Replies View Related

Cisco Firewall :: Enabling Outbound Traffic Through ASA 5520 8.4(4)1

Apr 4, 2013

We've got a proyect that requires a few thin clients to connect to a remote PCoIP server.
 
Looking to the documentation, the only port required to be open through Firewalls is TCP/UDP 4172, however, we've seen (making interface captures) that it somehow also uses ESP (IP protocol 50).
 
We've got a static NAT translation translating those thin clients to a public IP address, we've created ACLs to allow inbound (shouldn't be necessary as our user is connecting to a remote server) and outbound traffic for TCP/UDP 4172 and ESP and I cannot make it work.
 
I've also enabled IPSec pass-through Inspection to no avail.
 
how should we configure our ASA to enable this kind of traffic?

View 4 Replies View Related

Cisco Firewall :: ASA-5510 Dropping Outbound SMTP Traffic?

Aug 21, 2011

A recently added outbound rule has left my SMTP communications broken. I have since removed the rule, and had Cisco do some damage control, but it's still dropping some of the SMTP traffic. I get a number of NDR messages each day like the one below:Your message did not reach some or all of the intended recipients. Subject: RE: Christopher, Curt Sent: 8/19/2011 9:38 AM The following recipient(s) could not be reached:
  
[URL]
on 8/21/2011 9:49 AM
Could not deliver the message in the time limit specified. Please retry or contact your administrator.
<630.SM.Local #4.4.7>
 
Your message did not reach some or all of the intended recipients. Subject: RE: Christopher Curd Sent: 8/19/2011 9:38 AM The following recipient(s) could not be reached:   JWillar@email.com on 8/21/2011 9:49 AM  Could not deliver the message in the time limit specified. Please retry or contact your administrator.  <630.SM.Local #4.4.7>
 
I've attached an image of my configuration (ASDM GUI). The part of the image highlighted in green are the SMTP rules. The part highlighted in yellow is another rule that I added about a month ago to block a SYN attack. This rule may be part of the problem because of the order it is in the list. Not sure, though.
 
I have had two Cisco techs Putty into my ASA to check things out. I think they've done all they can. I wonder at this point if it be wise to just reload the last good running-config I have prior to the Outbound rule being added.

View 13 Replies View Related

Cisco Firewall :: ASA 5510 - Open Outbound Port For Specific IP

Dec 6, 2012

We have a ASA5510 and I need to open port 22 for a speacific IP in our LAN outbound only.      

View 15 Replies View Related

Cisco Firewall :: UDP Port 9500 Open Inbound / Outbound To Specified IP Addresses

Feb 28, 2012

I have a weather station at our high school that needs UDP port 9500 open inbound/outbound to specified IP addresses.

Cisco PIX Security Appliance Software Version 8.0(4)
Device Manager Version 6.1(5)57

View 1 Replies View Related

Cisco Firewall :: ASA5505 Does Not Pass Traffic

Jan 25, 2013

I used the GUI configuration tool for this ASA 5505. When I install it no traffic passes. I am wondering to verify my config. I have masked the usernames for VPN with xxxxxx and yyyyyy. [code]

View 6 Replies View Related

Cisco Firewall :: ASA5505 Will Not Pass Traffic?

Nov 15, 2011

I am trying to setup my very first ASA5505 and I cannot get it to pass traffic from the inside to the outside. I am not using NAT/PAT. Here is what I have done so far.
 
ASA5505(config)# interface Vlan 1ASA5505(config-if)# nameif insideASA5505(config-if)# security-level 100ASA5505(config-if)# ip address 33.46.132.34 255.255.255.248ASA5505(config-if)# no shut

[Code]....

Then from the asdm I permited everything from inside to go out but I cannot get any traffic through. I can ping the outside if I source the outside interface but not if I source the inside. The logs would not show me anything.
 
I did a packet tracer and it indicates the implicit deny rule at the end of the access-list is stopping my traffic eventhough I have allow rules above it?
 
I also checked the box in the asdm to allow traffic to pass without NAT

View 5 Replies View Related

Cisco Firewall :: ASA5505 Connects Through Lan But Cannot Pass Traffic

Sep 13, 2011

We have an issue where by we connect to various customers and the Cisco IPSEC remote access works fine from our LAN through an ASA5505 to a customer site.We have 1 customer that we have some issues with. We can connect  from the LAN through to the customers VPN, authenticate and establish a tunnel but in we cannot pass traffic. When we try from outside of the office on a public internet connection the VPN works fine. What could cause this issue?

View 3 Replies View Related

Cisco Firewall :: Cross Interface Traffic ASA5505

Mar 12, 2012

I have an ASA-5505. [code] I have an Exchange server on the 10.10.10.0 network.  I need to be able to allow Active-Sync and OWA from the Guest WiFi through to the Exchange server on the 10.10.10.0 network.  The Guest Wi-Fi uses external DNS so traffic is going out to the Internet and getting an IP address which is of course assigned to the Outside interface abd trying to come back in on that interface.How do I make this do what I need?  How do I setup the rules to allow this traffic?

View 2 Replies View Related

Cisco Firewall :: Allowing Traffic From Inside To Outside ASA5505 7.2(3)

May 15, 2012

Let me start by saying that I'm just starting to study for CCNA, so the ASA seems to be a bit above me yet.  The ASA's we are using is for VPN to our corporate office and only allowing access to our Citrix environment, so no direct internet allowed.  We have a person who works in the remote office who has need for a caption telephone that requires direct access to the internet.  The phone only supports DHCP, and getting the ASA to do an ARP reservations is proving difficult.  For now I wrote an access list to allow it's DHCP address out but it still isn't working.  The access list I wrote is:
 
access-list 101 extended permit ip host xxx.xxx.xxx.124 any log
access-list 101 extended permit ip any any
access-group 101 out interface outside
 
When I do a show access-list I'm seeing that traffic is hitting the access list as the hit counter has increased.  When I do a show conn I'm seeing one of the IP's that the phone should have access to, however the flags are: saA, so I'm assuming they are not getting a response.  According to the manufacturer, only outbound connections are needed, no incoming ports required.  All traffic is TCP.

View 8 Replies View Related

Cisco Firewall :: ASA5505 - Redirect ASA Traffic To Proxy Server?

May 20, 2011

I have ASA5505 with bese-license. I like to install proxy sever in my network and i want redirect traffic to the proxy server.
 
Below  i added configuration in my firewall.
 
ASA(config)#access-list wccp-servers permit ip host 192.168.6.10 any ASA(config)#access-list wccp-traffic permit ip 192.168.6.0 255.255.255.0 any ASA(config)#wccp web-cache group-list wccp-servers redirect-list wccp-traffic ASA(config)#wccp interface inside web-cache redirect in
 
furher configuration and if this configuration is enough, then how to check whther its working or not in my firewall.

View 1 Replies View Related

Cisco Firewall :: ASA5505 - Blocking Internal Traffic Between 2 Servers

Oct 25, 2012

I have a cisco ASA5505, it runs a wide site to site VPN network and has 4 servers connected to it
 
10.50.15.4 > fileserver
10.50.15.5 > domain controller (exchange)
10.50.15.6 > terminal server
10.50.15.7 > terminal server
 
Now yesterday i removed 10.50.15.6 and replaced it with a new terminal server with the same ip address, ever since the ASA is blocking traffic between it and the domain controller (example)
 
2Oct 27 201214:51:0510600710.50.15.655978DNSDeny inbound UDP from 10.50.15.6/55978 to 10.50.15.5/53 due to DNS Query What has me baffled is the only thing different between today and yesterday is the new server is windows server 2008 and the old one was windows server 2003. The new server has the same LAN ip address as the old one to make the changeover seamless for the users.
 
why all the sudden my ASA has decided to block the traffic between those machines? all the other machines can talk to it fine just not the domain controller, and seeing that this is a terminal server naturally you can see the problem i face!
 
this router has worked flawlessly for 2 years now without any config changes and i cant work out why its blocking traffic between those 2 machines.

View 15 Replies View Related

Cisco Firewall :: ASA5505 Return Traffic Is Blocked By System

Jul 23, 2012

I've just bought a ASA 5505 to project my LAN. I've already use Cisco router in the past but it's the first time with ASA line.Everythings work except one major point, the return traffic is blocked by the system… I don't really understand how the zone based firewall is supposed to work but it seems OK by default, my LAN side is allowed to talk with the Internet but Internet is not allowed to directly call my LAN. The NAT is setup to use the IP of my outside interface.When I try to ping a public server, the ASA debug log show me that the communication can go out the network, with the good translation, then go back to the ASA from the public server and here, the ASA block it because the communication is not allowed.I've only found two workaround:

-allow inside trafic with static rules, and I say NO ;

-disable the zone based feature by settings all zone to the 0 level…
 
How I'm supposed to make my state-full firewall work with zone based feature?

View 3 Replies View Related

Cisco Firewall :: ASA5505 - Routing Traffic From VPN Clients To Interface?

Sep 17, 2011

I have two attachments that show my basic network layout.  I can get from the VPN Cisco Client to Workstation 2 just fine with my current NAT rules in place.  I can also get from Workstation 2 to Workstation 3 just fine.  But I'm having issues when I try to get from the VPN client to Workstation 3...  What would I need to do enable to get to Workstation 3 from the VPN client?  IT seems very simple to me (just PAT that traffic as I do the traffic from Workstation 2 to Workstation 3) but that does not work.

View 10 Replies View Related

Cisco Firewall :: ASA5505 - With Two Trusted Interfaces / Traffic Not Going Out Of Inside2?

Nov 14, 2011

I'm going nuts with this ASA5505. This is a secondary firewall used only in emergencies when the primary Checkpoint failes.
 
The basics, it has two trusted interfaces, E0/1 and E0/2-6. E0/1, inside2 has 192.168.01/29 and inside is 192.168.200.1/24.  I'd like any traffic to be allowed from inside and inside2 to outside and any traffic from the inside interfaces should be routed. No restrictions should apply between the two interfaces.
 
inside works just fine but no traffic is going out of inside2, not to outside or to inside.

View 8 Replies View Related

Cisco Firewall :: ASA5505 / 5510 - Prioritize Traffic Based On Destination IP?

Sep 25, 2012

we're looking to use an ASA5505 or 5510 as our firewall but want to see if one of them can prioritize traffic. I know it does QoS but we're wanting to dedicate x amount of our bandwidth to traffic based on destination IP address. Is that possible and does it take a license upgrade?

View 3 Replies View Related

Cisco Firewall :: ASA5505 Appears To Be Dropping Traffic For Internal Network?

Jan 10, 2013

we have a Cisco 2901 as a router on a stick for several vlans. Everything on the segment routes fine and accesses the internet just as they should. The 2901 connects to an ASA5505 on port 0/1. Any host connected to the ASA5505 can access the internet, but can not ping into any of the vlans off of the 2901. The strange thing is on either segement of the network I can ping all of the gateways. What is even more strange is when I run wireshark from behind the firewall going into the 2901 I can not see the packet on another wireshark instance behind the 2901. However if I start a ping for a host host behind the asa I can see the packet in wireshark on the host, which I am trying to ping, hit the gateway.

View 15 Replies View Related

Cisco Firewall :: ASA5505 8.4.2 NAT To Forward SMTP And RDP Traffic To Internal Host

Nov 26, 2011

I am new to the ASA series and I am at a complete loss as to why I cannot configure this router to forward SMTP and RDP traffic to an internal host.
 
The packet trace tool in ASDM shows complete end-to-end connectivity for RDP but it still fails to connect from outside. This is my config file, what I need to change in order to make it work?

View 19 Replies View Related

Cisco :: Inbound And Outbound Traffic In BGP?

Dec 6, 2012

I have two ISP, I want to divide Inbound to ISP1 and Outbound to ISP2.

View 3 Replies View Related

Cisco VPN :: PAT Outbound On 5540 For Traffic?

Feb 28, 2011

We're running 8.3(2) in the ASA5540. Users all over our enterprise connect to a business partner's application through the ASA/VPN. We have a class-b address space, and since the users are spread out all over the place, I have the entire class-b space as the local object in the ACL that allows traffic through the VPN tunnel.
 
The business partner has concerns that our entire address space is available to access the VPN tunnel. So I thought, to alleviate their concerns, to PAT all of our connections outbound to a single IP address.
 
How is this done in 8.3(2)?  We use ASDM to configure the 5540.  For example, say our class-b is 159.12.0.0 and the PAT'd IP address will be 199.30.36.6.

View 5 Replies View Related

Cisco Firewall :: Management Port On ASA5505?

Nov 7, 2011

I have interfaces defined on the 5505:
 
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1

[Code].....

I only need one interface to connect to a single host on the inside (VLAN1) and then connect E0 to a DSL.
 
Is it possible (are what are the commands required) to take one of the other interfaces and create a Management port on the local office LAN?

View 2 Replies View Related

Cisco WAN :: 2821 - Split Outbound Data Traffic

Feb 29, 2012

I have hooked up to the Cisco 2821 router a T1 on Serial and Cable Modem to GigEth0/1 and I want to split outbound traffic so that all regular users will use G0/1 interface for web traffic and the rest of the traffic stays with the T1.  I am having an issue where the users on the network are not able to use the internet when using the following config:
 
!
interface GigabitEthernet0/0.10
description Data
encapsulation dot1Q 50

[Code].....

View 11 Replies View Related

Cisco Firewall :: ASA5505 - Port Forwarding For L2TP

May 25, 2011

I have a Windows 2003 server running a L2TP VPN server on it. I'm putting theASA5505 in replacement of an open source firewall.
 
My question is that, I can't seem to forward the ports correctly for L2TP to the internal address of the 2k3 VPN server. It seems to me that the ASA is trying to negotiate the VPN connection rather than forward it internally.
 
Cisco ASA5505
WAN 216.136.1.2
LAN 10.1.1.1/24
Windows server - 10.1.1.14
 
I've added the NAT and ACL and still nothing.

View 2 Replies View Related

Cisco Firewall :: ASA5505 / Port Forwarding Not Working?

Apr 6, 2012

I'm not able to access my Slingbox from the outside.  I've set up port forwarding on port 5001 to allow outside connections in, but port forwarding isn't working.  Am I missing something?
 
object network INSIDE-HOSTS
subnet 10.10.10.0 255.255.255.0
object network Slingbox
host 10.10.10.254
object-group protocol TCPUDP

[code].....

View 13 Replies View Related

Cisco Firewall :: Opening Port Range ASA5505

Mar 26, 2013

I just bought a Cisco ASA5505. I'm trying to opening a port range through CLI, but it doesn't seem to be working.
 
Background:I have an FTP Server running behind the firewall and need to allow port ranges 30000-30100 for data connections.  I have been using FTP through the command prompt and its working. However, I cannot use it through the FileZilla client as it fails to query the directories.  I have the ASA forwarding to port 1125 from 21 in passive mode.
  
Access-List:
access-list Outside_Access_In line 3 extended permit tcp any any eq ftp-data (hitcnt=0) 0xfa8ed43d
access-list Outside_Access_In line 4 extended permit tcp any any eq ftp (hitcnt=17)

[Code].....

View 14 Replies View Related

Cisco Switching/Routing :: 2811 Runs ITP IOS / Cannot See Outbound Traffic

Apr 14, 2013

Cisco 2811 runs ITP IOS. On that router we run the SMPP service. A client on the network connects to this service, and we need to capture the traffic for debug.
 
I've tried traffic-export, but I cannot see any outbound traffic. Is there any way to capture the outbound traffic?

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved