Cisco Firewall :: ASA5505 Port 3306 Request Discarded
Oct 20, 2012ASA5505 port 3306.I have been fighting for days to open the port 3306 on my appliance, I have read carefully all the forums and no success.
View 9 Replies
ADVERTISEMENT
Cisco Firewall :: How To Forward Hit Request On 5555 Port To 80 Port
Nov 7, 2011I have one server 172.16.0.100 and i nat this server to a public ip X.X.X.5 and i open RDP for this public ip.Now when i access Remote desktop on this public ip x.x.x.5 it open perfectly.Now my senario is that i want to open a http url on port 5555,server ADMIN open port 80 for this URL on LOCAL lan(http://172.16.0.100:80)So how can i map port 5555 to port 80 on ASA 5520.so when i hit URL [URL]
View 5 Replies View RelatedCisco Firewall :: ASA 8.4 Port Forward Command Request?
May 7, 2013i can't do it with ASDM and try to use command but still fail
nat (inside,outside) source static inside-10.18.20.162 4F-1.1.1.2
it is working fine for the above command if there is more than one public ip, in case 1.1.1.1 is for firewall interface public ip?if i have only one public ip and i would like to forward http traffic to my internal network? how can i use command to do that?
Cisco Firewall :: ASA 5505 - Discarded Incoming Packets On Internal-Data0/1
Apr 4, 2013How to best troubleshoot some errors I'm seeing on the internal interfaces of my ASA 5505. This is similar to the question at [URL], but the details are different enough that I felt it justified a new discussion.
I have an ASA 5505, running version 8.2(2), 256MB RAM. From time to time (on the order of once a week) our monitoring alerts us that both Internal-Data0/0 and Internal-Data0/1 are experiencing an unusual amount of inbound packets which were discarded with errors, up to 2.3 per second as of this post. Here is what I hope relevant output from my device:
asa# show interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Vlan1 10.x.x.x YES CONFIG up up
Vlan2 32.32.32.32 YES CONFIG up up
[code]....
1. My understanding is that Internal-Data0/0 is an internal bus that connects to modules like the 4GE. I don't have any modules installed at all, as you can tell. Therefore, what is this bus doing?
2. For that matter, what is Internal-Data0/1 doing? What does it connect to?
3. I'm guessing that due to the input errors and overruns reported for both of these interfaces, it's a buffering issue. Since these are input errors, does this mean that traffic destined to this bus for forwarding is being dropped because the bus itself is running out of buffer memory? How would I see (and subsequently monitor) the buffer memory for these interfaces? Once I am able to see it, what sort of tools can I use to determine what is causing this?
Cisco Firewall :: Management Port On ASA5505?
Nov 7, 2011I have interfaces defined on the 5505:
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
[Code].....
I only need one interface to connect to a single host on the inside (VLAN1) and then connect E0 to a DSL.
Is it possible (are what are the commands required) to take one of the other interfaces and create a Management port on the local office LAN?
Cisco Firewall :: ASA5505 - Port Forwarding For L2TP
May 25, 2011I have a Windows 2003 server running a L2TP VPN server on it. I'm putting theASA5505 in replacement of an open source firewall.
My question is that, I can't seem to forward the ports correctly for L2TP to the internal address of the 2k3 VPN server. It seems to me that the ASA is trying to negotiate the VPN connection rather than forward it internally.
Cisco ASA5505
WAN 216.136.1.2
LAN 10.1.1.1/24
Windows server - 10.1.1.14
I've added the NAT and ACL and still nothing.
Cisco Firewall :: ASA5505 / Port Forwarding Not Working?
Apr 6, 2012I'm not able to access my Slingbox from the outside. I've set up port forwarding on port 5001 to allow outside connections in, but port forwarding isn't working. Am I missing something?
object network INSIDE-HOSTS
subnet 10.10.10.0 255.255.255.0
object network Slingbox
host 10.10.10.254
object-group protocol TCPUDP
[code].....
Cisco Firewall :: Opening Port Range ASA5505
Mar 26, 2013I just bought a Cisco ASA5505. I'm trying to opening a port range through CLI, but it doesn't seem to be working.
Background:I have an FTP Server running behind the firewall and need to allow port ranges 30000-30100 for data connections. I have been using FTP through the command prompt and its working. However, I cannot use it through the FileZilla client as it fails to query the directories. I have the ASA forwarding to port 1125 from 21 in passive mode.
Access-List:
access-list Outside_Access_In line 3 extended permit tcp any any eq ftp-data (hitcnt=0) 0xfa8ed43d
access-list Outside_Access_In line 4 extended permit tcp any any eq ftp (hitcnt=17)
[Code].....
Cisco Firewall :: Multiple Static Port Translations On ASA5505
Aug 15, 2011I am at a loss on configuring a new ASA5505 for multiple static port translations.I would have expected to simply add several service command to a network object to complete the task, however, the service command overrides the previous and replaces rather than adds to the translations. [code] However, if entered in that order the 8443 overwrites the 8080 static translation.What is the correct procedure to establish multiple translations? If someone could also provide the "old" style for pre 8.2 release, I'd like to compare because I thought I used to do this with an access-list somewhere.
View 4 Replies View RelatedCisco Firewall :: Port Range Forwarding On Post 8.3 ASA5505
Jun 1, 2011I have an ASA 5505 on a job. It is a smaller business that would have done better with an RV082, but they have what they have. It is running firmware 8.4. The client needed ports forwarded for their FTP server. The port range in this config is tcp 43333-43339. The FTP server ip is 192.168.1.2. [Code] ......
View 8 Replies View RelatedCisco Firewall :: ASA5505 - Outbound Traffic Ceases Even Though Port Is Up
Mar 10, 2011I've had a Cisco ASA 5505 firewall connected to a cable modem (Virgin Media, UK) for the past 3 years. In the last 6 months or so I have noticed that the ASA would drop the outside (internet) connection intermittently, usually at least once every 1-2 weeks - the interface still shows as being up but no traffic crosses it, and computers on the inside network abruptly lose internet connectivity. Rebooting the ASA or administratively shutting down the interface and bringing it back up again would cure the problem straight away until the next time it happens.
In the last couple of days however despite nothing having been changed in the configuration the frequency of this connection drop has increased to the point where I would lose access to the internet within an hour of rebooting the ASA. It does not seem to matter whether or not there is traffic currently going out or not, inside computers just appear to suddenly lose internet connectivity.
I have tried the following without success:
1) I completely wiped the configuration (configure factory-default)
2) I changed the port the cable modem was connected to (eth0/0 -> eth0/7, changing switchport vlan accordingly)
I thought perhaps 2) had fixed it but it lasted a whole 2 hours before I woke up this morning to find that none of the internal equipment had internet access despite the fact eth0/7 was showing as up/up in ASA CLI.
This morning I manually set the eth0/7 port to "speed 10" (10Mbps, full duplex). It was previously set to be auto-negotiation (default) on both speed and duplex. As of this post it has managed to keep the outside connection up for 3 hours - but I'm not optimistic that it is fixed.
Interface counters have never shown any collisions, errors, etc - only packets input and output as expected.
Since the problem persisted across ports (eth0/0 -> eth0/7) I'm wondering whether or not the problem could either be faulty memory, or some kind of speed/duplex incompatibility between the cable modem and ASA.
Cisco Firewall :: ASA5505 - How To Configure Port Forwarding For All Devices
Apr 18, 2012How to configure this setup.I have an ASA5505 with dual wan failover, FiOS (eth0) & Cable (eth1). how to configure the port forwarding for all my devices so it doesn't matter what external interface the traffic is coming from. For example, I need web traffic on port 80 forwarded to 192.168.1.150 regardless of whether it is coming through eth0 or eth1.
View 2 Replies View RelatedCisco Firewall :: ASA5505 Port Forwarding For Inside Server
Dec 20, 2011I have installed ASA5505 in the network. Port forwarding has been done for one of the server in our LAN. Public users are able to access the server successfully. I am trying to access from inside using the same Public server IP, but unable to access it. Can I have this feature in ASA5505(I think it is loopback configuration). If so, may I know the configuration detail?
View 4 Replies View RelatedCisco Firewall :: ASA5505 Can't Port Forward Traffic From Two External IP Addresses
Dec 30, 2012I am a total Cisco novice who has just had a ASA5505 installed to replace a linux freeware firewall (smoothwall).I'm told that the 5505 can't port forward traffic (e.g. ssh) from two external IP addresses to two internal destination machines via the same port # (22 in this example).
View 9 Replies View RelatedCisco Firewall :: ASA5505 Blocking Port 3101 For Blackberry Server
Oct 31, 2012I thought I had the configuration to allow bi-directional traffic for my Blackberry server. I have a second fw with the same config and it worked on that one. But right now, my blackberry server is down, and all the users are upset.
ASA Version 8.2(2)
!
hostname asa5505
[Code]......
Cisco Firewall :: Basic Port Forwarding ASA5505 Version 8.4 ASDM 6.4?
Nov 24, 2012configuring the ASA particulary after the change to how NAT is implemented. What I am trying to accomplish logically seems fairly simple, yet I cannot get it to work. I have a Synology NAS at home that I am trying to reach via the internet. Prior to using my ASA, I had Verizon's FIOS router as my gateway and everything forwarded with no issues. The ports I need forwarded or reachable via the internet are TCP port 80 and 5000.I can also configure it via command line if that's the easier/preferred method.
View 11 Replies View RelatedCisco Firewall :: ASA5505 Configure Port Forwarding To Multiple Internal IP Addresses
Jun 21, 2012ASA 5505 Firmware 8.3(4), ADSM 6.4(2).I have a public IP address of 168.87.3.4.I need to forward ports (5060, 5080, etc.) to one internal address. (192168.1.1).I need to foward different ports (10020-10080) to a different internal address (192.168.1.2) Everything I read tells me how to do this in a 1 to 1 static NAT.
View 1 Replies View RelatedD-Link DIR-825 :: Allow Request / Renewal Through UDP Port / Cannot Reset DIR-655
Nov 3, 2012I have just bought a DIR-825 rev C1 stock firmware 3.0 (19 Jan 2012,) and I am pleased with its performance so far. However, I need to allow DHCP renewal request to pass through from all IP to UDP port 67 to UDP port 68; or else I will have to reboot DIR-825 every 24 hours (which is not fun ). My U-verse 2wire modem is a 3600HGV.
View 4 Replies View RelatedCisco :: VPN Client Discarded Packets
Jul 4, 2011I can connect to it fine and access everything behind the VPN. I have a Windows 7 machine 32 bits. He can connect to the VPN just fine but not access anything behind it, he is running Windows 7 64-bits. This is not a new setup, the VPN has been working before. If I debug ISAKMP and IPSEC in the ASA I see nothing out of the ordinary. The only thing I see is that the VPN client on his machine is showing that the counter for discarded packets is increasing. This is Ciscos explanation to discarded packets. "Packets discarded—The total number of data packets that the VPN Client rejected because they did not come from the secure VPN device gateway." So it seems that the client does not believe that the packets are from the ASA. I have no idea why that would be and what could have changed that made a functioning VPN turn into a non functioning one. He can not remember doing any major installs or something like that which could mess with the client. We uninstalled the version he was using and installed a slightly newer version but it made no difference.
View 1 Replies View RelatedCisco VPN :: ASA 5505 - Internet Native Client / TCP Discarded 1723
Jul 15, 2012I'm configuring this asa for to connect home users to my network using the native microsoft vpn clients with windows xp over internet.This asa have on the outside interface one public intenet ip and in the inside inferface have configured in the the network 192.168.0.x and i want to acces to this network from internet users using native vpn clients.I tested with one pc connected directly to the outside interface and works well, but when i connect this interface to internet and tried to connect on user to the vpn i can see in the logs this, and can't connect with error 800.TCP request discarded from "public_ip_client/61648" to outside:publicip_outside_interface/1723"
(running configuration)
: Saved
:
ASA Version 8.4(3)
!
hostname ciscoasa
enable password *** encrypted
[code].....
Cisco Firewall :: ASA (8.4) / Redirect Outside IP Request To Inside Host
Mar 27, 2012Wondering if on the ASA (8.4) its possible to do something like what DNS rewrite does, but with IP requests. Scenario. Mobile phone accesses a web app inside our network fine over cellular. Once it comes inside on to wifi it still has the public IP address cached so the ASA doesn't allow its request to loop around and the app appears broken. We're considering lowering the TTL on the DNS host entry but I think we are battling phones/mobile OS's that don't have a strict adherence to name resolution standards. A lot just seem to refresh their caches every 10-15 minutes.
View 4 Replies View RelatedCisco Firewall :: ASA 8.2(5)26 - ICMP Echo Request Denied On Outside?
Jan 14, 2013I'm having problem getting ICMP echo monitoring on outside interface to work. I've set: icmp permit host monitoring_station_adress outside but I still get:
%ASA-3-313001: Denied ICMP type=8, code=0 from monitoring_station_adress on interface outside. I'm trying to directly monitor ip on ASAs interface outside.
I have access-group tied to "in" direction on interface outside. Do I still have to put "permit icmp" rules despite the fact that icmp permit outside command is set?
Cisco Routers :: RV220W - Feature Request - IPv6 Firewall?
Jan 19, 2012At this moment (firmware 1.0.3.5) the router has no IPv6 firewall and therefore when used in a typical dual stack IPv4/IPv6 network it has no protection regarding IPv6 traffic. Hopefully this will be fixed with a firmware update before the World IPv6 Day on the 6th of June 2012.
View 1 Replies View RelatedCisco Firewall :: 5510 Inspect SIP Dropping Request Message Packets
Mar 17, 2011I have 2 ASA 5510 firewalls at 2 different sites. Both running on version 8.0.4. Users are using an Instant Messaging type of application provided by a local telco here which is able to send and receive SMS using SIP (from the packet capture that I've done).
When users use the IM in site A, they are able to send and receive text messages via the IM from behind the firewall. However, when the users are in site B, users are able to send out text messages but not able to receive them.
I noticed that when I remove "inspect sip" from site-B's global policy map, users from site-B can successfully receive text messages. I have confirmed that it is the firewall that drops the packets as I have captured the inside and outside interfaces of site-B's ASA and I can see the incoming sip "request: MESSAGE" packet on the outside interface but I do not see the packet exiting the inside interface.
I have cross check both firewall configurations, and I do not see anything suspicious commands relating to sip that might cause this issue. Is there any command to troubleshoot why the sip inspection is dropping the sip packets on site-B?
Linksys Wireless Router :: WRT120N Disable SPI Firewall Protection And Anonymous Internet Request
Oct 14, 2009I'm about fed up with with having this issue that no one can seem to solve. It dates back to when I owned a WRT54G router. I started experiencing random disconnects with the router, both wired and wireless. I only owned the router a year and figured it was going bad.
So I purchased this WRT120N router late August. Soon after I set the router up, low and behold the same problem started. I've called my ISP a couple occasions and they tell me that everything is fine from their end. I've spoken with Linksys tech support on 3 seperate occasions. I have changed the MTU to 3 different values and upgraded the firmware. The 2nd support tech suggested that I do those two things. To my surprise this worked for 2 or 3 weeks with no problem. The same problem started again just last night disconnecting intermittingly. I spoke with another support tech and they suggested that disable the SPI Firewall protection and Anonymous internet request. That did not work for the brief time I had this disabled.
More into the problem, when it disconnects the modem seems fine but the activity light on it stops as it should. The router itself appears to reboot, then when it comes back up the connection restores. What could possibly cause this? I currently have version 1.0.02.This is getting very frustrating and I am getting very near not using Linksys/Cisco products any longer.
Home Network :: Is Blocking Echo Request To Prevent Ping Sweep Same As Having Firewall In Stealth Mode
Jul 19, 2011Is blocking echo request to prevent ping sweep the same as having a firewall in stealth mode? And how could someone ping sweep from outside if you had a firewall at all?
View 3 Replies View RelatedCisco VPN :: Exclude IPs To Port Forwarding On 877 To ASA5505
Feb 13, 2012I have the following setup:
ADSL ---> Cisco 877 with connected site-to-site VPN's ---> Cisco ASA 5505 with Remote VPN enabled
I want to connect my Android phone to the Cisco ASA 5505 with Remote VPN. When I forward port 500 and 4500 on the Cisco 877 to the Cisco ASA5505 I can connect with the phone.
But as expected, the site to site connections are lost because now they try to reach the ASA 5505 also.
I want to exclude the site to site external IP addresses from doing static NAT to the ASA 5505...how can I accomplish this ?
Cisco Firewall :: Users Behind ASA5505 Firewall Are Unable To Access Internet
Feb 24, 2011I have a normal setup of ASA5505 (without security license) connected behind an internet router. From the ASA5505 console I can ping the Internet. However, users behind the Firewall on the internal LAN, cannot ping the Internet even though NATing is configured. The users can ping the Inside interface of the Firewall so there is no internal reachability problem. In addition, I noticed that the NAT inside access list is not having any hit counts at all when users are trying to reach the internet.
When i replace the ASA5505 with a router with NAT overload configuration on it, the setup works normally and users are able to browse the internet.
The ASA5505 configuration is shown below.
hostname Firewall
interface Ethernet0/0
description Connected To Internet Router
switchport access vlan 10
[Code].....
Cisco Firewall :: ASA5505 Lose Configuration If Upgrade Firewall
May 17, 2011i have asa 5505 with the asdm v5.2 (4), and the asa v7.2(4). This platform has a base license. if i upgrade adsm and asa on v6.2(1) and v8.2(2) if I lose my license and that you need to activate them? i configured site to site vpn (this firewall and the another) that i lose my configuration if i upgrade my firewall.
View 2 Replies View RelatedCisco Firewall :: ASA5505 Can't Ping New Firewall On Inside Interface
Jul 14, 2011I've recently upgraded my old firewall from a PIX to an ASA5505 and have been trying to match up the configuration settings to no avail. I have is that I can't ping the new firewall on it's inside interface, despite having "icmp permit any inside" in the running config. Secondly, the server I have on there ("Sar") can't connect out to the internet.I've included the ASA's running config incase anybody can see if something stands out. I have a feeling it's either not letting anything onto the inside interface, or there is no nat going on. Lastly (and possibly relevant), the firewall is actually going at the end of a vlan, which is different to the firewall's inside vlan number. I don't know if this is actually the problem because the server can't connect out even if connected directly into the firewall.
View 32 Replies View RelatedCisco Firewall :: Unable To Ping Internet IPs From ASA5505 Firewall
Jan 9, 2013Internet ISP -> Juniper SRX 210 Ge-0/0/0
Juniper fe0/0/2 -> Cisco ASA 5505
Cisco ASA 5505 - >Inernal LAN switch.
1. Internet is connected to Juniper Ge0/0/0 via /30 IP.
2. Juniper fe0/0/2 port is configured as inet port and configured the Internal public LAN pool provided by the ISP. And this port is directly connected to Cisco ASA 5505 E0/0. Its a /28 pool IP address. This interface is configured as outside and security level set to 0.
From Juniper SRX, am able to ping public Internet IPs (8.8.8.8).
Issue:
1. From ASA am unable to ping public ip configured on Juniper G0/0/0 port.(/30)
2. From ASA no other Public internet IP is pinging.
Troubleshooting Done so far.
1, Configured icmp inspection on ASA.
2. Used the packet tracer in ASA, it shows the packet is flowing outside without a drop.
3. Allowed all services in untrust zone in bound traffic in Juniper SRX.
4. Viewed the logs when I was trying the ping 8.8.8.8 in ASA. It says "Tear down ICMP connection for faddrr **** gaddr **
Cisco VPN :: ASA5505 Random Destination Port And Implicit Rule
May 4, 2012I have an ASA5505 that I am setting up behind another firewall. The external firewall has all ports forwarded to the ASA which is fine as I can see the traffic getting to the ASA in the log. However when the traffic trys to return to it's destination the ASA assigns a random port number. For example for VPN the source port is 443 but when the ASA trys to go back to the public IP addess it is using port 52857 which is obviously blocked on the external firewall. The Packet Tracer also says the the traffic is blocked by an implicit rule on the ASA which denys all ip traffic however I can't delete this rule and as I test I have created another rule allowing all IP traffic.
View 2 Replies View RelatedCisco WAN :: ASA5505 And Router 3825 - Double NAT With Port Forward?
Apr 26, 2013This is my Cisco LAB environment used for study but also in production for daily use. I am trying to setup a double-NAT network with just one IP from my ISP through the ASA & 3825 going to (2) end nodes and multiple ports for port forwarding. It is currently working but only as simple PAT and I cannot initiate FTP from the outside. removing the router, but this is my study LAB and it's a bit unconventional for learning purposes. I attached the diagram and need parts of the config.
View 14 Replies View Related