Cisco Firewall :: ASA5510 - Contacting Host Through VPN Failed

Apr 27, 2009

I would swear this worked at one point.  I have a corporate office, and I have IPSec tunnels out to my outside offices.  The corporate office has an ASA5510, and most of the remote offices are running off of Pix506s, one office has an ASA5505.
 
When anyone connects through WebVPN, using AnyConnect or not, they can contact any of the cifs shares for servers inside the corporate office.  They cannot, however, contact cifs shares on servers that are in the remote offices.

View 4 Replies


ADVERTISEMENT

Cisco Firewall :: ASA5510 / IPS SSM Could Not Connect To SMTP Host

Sep 3, 2011

We have an ASA5510 with the IPS ASA-SSM-10 module installed. All is working well except event notification. When sending a test email from the SSM IPS, we get the error "could not connect to SMTP host". The Exchange SMTP host does allow traffic from the IPS and ASA. I can ping to the SMTP host by IP and name. What am I missing here?

View 3 Replies View Related

Cisco Firewall :: ASA5510 Doesn't Shun Host From Outside Interface

Sep 13, 2011

I've been trying to configure the threat-detection scanning-threat shun feature on my ASA5510 running 8.4(2) for some days now. From searching the support community I can see that I'm not the only one having a problem with this feature. The problem I'm having is that after configuring scanning-threat shun, no outside attacking hosts are being shunned. I'm using nmap to simulate a scanning attack. [code]
 
Is this the expected behavior of scanning-threat shun? If so this feature is of very little use to me as blocking my inside LAN is not my goal. I'm trying to protect my LAN from Internet attack. I can add the except command and exempt my LAN, but this still doesn't fix the problem of outside hosts not being shunned.

View 2 Replies View Related

Cisco Firewall :: ASA5510 SMTP Traffic - Host Unreachable

Jul 8, 2012

Up until recently one of my sites was able to get to a postilion subnet. Then we started receiving "host unreachable" e-mails. Posting told us SMTP traffic was not getting let in. I've compared the current config to a config that was saved before the issue popped up and found really no noticeable difference.
 
I tried a packet tracer trace with no luck: SiteB- Firewall# packet-tracer input outside tcp 11.2.2.36 12345 65.19.0.0 25.
 
Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow
 [code]...
 
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
 
Attached is a sanitized config. I'm not entirely convinced it's a firewall issue, but I need to some successful testing to prove otherwise.

View 19 Replies View Related

Cisco Firewall :: ASA5510 Routing Failed To Locate Next Hop

Jun 14, 2012

I have two interfaces connected to two different subnet -  interface 0/1 = 10.100.1.0/24 , interface0/2 = 10.100.113.0/24 as they are direct connected to the ASA i assume i dont need to add an static route but when i try to ping from one interface to the other (ping inside 10.100.113.1) i get "Routing failed to locate next hop". [code]

View 1 Replies View Related

Cisco Firewall :: Create Static PAT To Allow Host Address To Access Network Through ASA5510

Aug 23, 2012

The old syntax that I am much more familiar with has been deprecated.  On older IOS it would have been something like static (inside,outside) tcp 209.114.146.122 14033 192.168.30.69 1433 netmask 255.255.255.255  Plus an extended ACL to allow the traffic.I am trying to create a Static PAT to allow a host address to access our Network through an ASA.  I have external address 209.114.146.122 that I want to hit the external interface on an obscure port (say 14033) and translate that traffic to an internal host address on  port 1433.

View 11 Replies View Related

Cisco Firewall :: DNS ASA5510 - Portmap Translation Creation Failed For Udp

May 22, 2012

See the error below on my ASA5510.
 
305006 200.200.0.34 53 portmap translation creation failed for udp src inside:192.168.1.4/1047 dst outside:200.200.0.34/53
 
The first two computers work normally( IP 2 and 3) , but the third computer gets ip does not work on the Internet.

View 2 Replies View Related

Cisco Firewall :: ASA5510 - LU Allocate Xlate Failed / Add More Memory

Sep 13, 2011

I got an asa5510. After problems with ipsec connections the log said :
 
LU allocate xlate failed this error repeats every minute. At the cisco site i found the following :
 
explantion : stateful failover failed to allocate a translation (xlate) slot record recommended Action : check the available memory by using the show memory command to make sure that the security appliance had free memory in the system. If no memory is available, add more memory
 
But when i do there is free memory. (about 54%)
 
What can i do to fix this ?

View 2 Replies View Related

Cisco Firewall :: Replacement Of Primary Unit Failed ASA5510

Sep 7, 2011

I have an issue bringing up my RMA'd primary ASA unit.
 
So what happened so far:
 
1. primary unit failed
2. secondary took over and is now secondary - active (as per sh fail)
2. requested RMA at Cisco
3. got ASA and checked that Lic (SSL), OS (8.2.2) and ASDM are at the same level as the secondary
4. issued wr erase and reloaded
5. copied the following commands to the new (RMA) primary unit:
failover lan unit primary
failover lan interface Failover Ethernet3
failover interface ip Failover 172.x.x.9 255.255.255.248 standby 172.x.x.10
int eth3
no shut
failover
wr mem
6. installed primary unit into rack
7. plugged-in all cables (network, failover, console and power)
8. fired up the primary unit
9. expected that the unit shows:
Detected an Active mate
Beginning configuration replication from mate.
End configuration replication from mate.
10. but nothing happened on primary unit
 
What is a valid and viable approach in replacing a failed primary unit? Is there a missing step that hinders me to successfully replicate the secondary - active config to the primary - standby unit.
 
I was not able to find anything related to ASA55xx primary unit replacement with a clear guideline or step by step instructions.

View 10 Replies View Related

Linksys Wireless Router :: E3000 - Host Migration Failed On Call Of Duty By MW3

Nov 8, 2011

I just bought mw3 but when I try to start multiplayer the game direct me to this, [URL]. I don't know how to fix it, and my UPnP is enable

View 6 Replies View Related

Cisco Firewall :: Difference ASA5510-BUN-K9 And ASA5510-Sec-Bun-K9

Jun 6, 2012

ASA 5510 have two model Bun-K9 and Sec-Bun-K9 from the datasheet find out difference Port related and Redundancy. My questions is : Have any major difference for Security service between two model ?

View 3 Replies View Related

Cisco Firewall :: ASA5510 - Unable To Ping From User Desktop To Firewall Inside IP

Jun 11, 2012

I am able to ping from Switch to firewall inside ip and user desktop ip but unable to ping from user desktop to  FW Inside ip.. config is below for both switch and FW Cisco ASA5510....
 
TechCore-SW#ping 172.22.15.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.22.15.10, timeout is 2 seconds:

[Code].....

View 7 Replies View Related

Cisco Firewall :: ASA5510 Secondary Firewall Crashes After Upgrade To 8.4.1

Jun 29, 2011

I have two ASA5510's set up in failover, and the secondary keeps crashing after doing the interface checks when bringing failover up. This only happens if I try to upgrade the image on the secondary to anything newer than 8.4.1 (I've tried with 8.4.1-11 and 8.4.2). The primary one run just fine with new images.
 
I don't have the exact error right now, as I need to do a screen capture from console. It's just a huge crash dump.Are there anything I might have missed during the upgrade? Should I cold-boot both the firewalls in the correct order?

View 7 Replies View Related

Cisco VPN :: Pix 515e - Remote Host Cannot Ping Any LAN Host

Jun 27, 2011

I have a host that can successfully connect to a PIX 515E (7.x OS) via VPN Client; however, I have no IP routing to the LAN from the remote host.The VPN IP pool works finem,The LAN default gateway is the inside interface on the PIX; the network is flat L2 behind it.The default route on the PIX points out; no other routes are defined,The VPN remote host can be pinged from LAN hosts, but the VPN remote host cannot ping any LAN host, not even the PIX inside interface.

View 2 Replies View Related

Cisco VPN :: ASA 5510 Ping / Communication Host To Host

May 7, 2012

ASA 5510
Ver 8.2(5)
 
I have been looking all over the place for the answer of how to allow clients on an IPSEC VPN to ping from host to host.

View 4 Replies View Related

Cisco Firewall :: Two Host With Same Nat On ASA 5505

Mar 22, 2011

I have 2 web servers that replicate between them (two different internal ip). My idea is that if one of them will not work, the other to do the relay.I have a Cisco ASA 5505 I can do a nat for each machine. How should I set ?

View 3 Replies View Related

Cisco Firewall :: 5505 - Host In DMZ Cannot Get Outside

May 13, 2012

Based on the configuration pasted below, we believe the host (10.0.2.200 / 255.255.255.0 GW: 10.0.2.1 with external DNS servers configured) should have access to the web. However, it cannot resolve any names nor can it connect outside.

[code]....

View 19 Replies View Related

Cisco Firewall :: ASA5510 Firewall Transparent Mode

Sep 10, 2012

i have a ASA5510 in the office, that already configured 3 context, namely, admin, user, server.in the server context, the last running config was not saved, and there was a power trip last friday night. 1 of the sub interface was affected, and i need to recreate that interface.I am getting the below error, it only allow me to do changes those pre-defined interface.how to I create extra sub interface?

View 3 Replies View Related

Cisco Firewall :: ASA5510 Firewall Interface Speed

Jul 21, 2011

I have a ASA5510 and I have a question about the speed the ports can handle, here is one port:
 
-interface Ethernet0/2
- speed 100
-shutdown
- no nameif
-no security-level
-no ip address
 
it's ethernet and not fastethernet so I figure it will only go to 10Mbps, but at the same time I can hard code the speed to 100.

View 2 Replies View Related

Cisco Firewall :: Memory Upgrade Of ASA5510 Firewall

Feb 22, 2012

i have cisco ASA 5510 Firewall using  in my network, i have  planning  to upgrade the Flash  memory  from  256 mb  to  512 mb  and   the RAM  from 256 mb to  1GB.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / PAT Different WAN IP Tp Internal Host?

Dec 14, 2012

We just changed ISPs and now have a /29 routed subnet to be used on our ASA 5510 (8.4) instead of the one public ip we had before.There are a couple of PAT translations that were previously setup on the "interface" address which i now want to assign to a different ip address further in my subnet.

So i just changed this:

object network BMMM
nat (inside,outside) static interface service tcp smtp smtp
 to:
object network BMMM
nat (inside,outside) static other.external.ip.in.subnet service tcp smtp smtp
 
And assumed that this would work,y it does not, and this leaves me unable to contact that machine from the outside.And shoud i also change my access-list?The relevant access-list rule is:access-list outside_in extended permit tcp any object BMMM eq smtp

View 5 Replies View Related

Cisco Firewall :: ASA 5520 - SSH From Internal To DMZ Host

May 13, 2012

I am not very familiar with ASA 5520 yet.I have been able to allow the OUTSIDE world to connect via SSH to the intermal host 172.17.2.50 on my DMZ network. I've created a NAT rule and an ACL as written on the configuration below.
 
Now I need the INTERNAL network to ssh 172.17.2.50 but ASA stops me with the following error: [code]

View 2 Replies View Related

Cisco Firewall :: ASA 5505 - Allow (outside) Host To (inside)

May 20, 2011

I have a ASA 5505 Sec Plus. I would like to allow outside hosts to our mail server and also our FTP server. So i would like to allow only SMTP, HTTP (for Outlook Web Access) and FTP.

View 10 Replies View Related

Cisco Firewall :: ASA 5505 10 Host Limit?

Feb 26, 2013

I updated an ASA 5505 to 50 users, but I still can only connect 10 hosts. In Licensing it show 50 insides hosts. I also tried to update to ASA 8.4.5 but that did not work. 

View 2 Replies View Related

Can Pure IPv6 Host Ping A IPv4 Host?

Feb 10, 2011

I'm just wondering if its possible to ping an IPv4 host using the IPv6 host assuming that the NAT64 has already been implemented?
[code]...

View 2 Replies View Related

Cisco Firewall :: Can Configure More Than One Syslog Host On ASA 5500

May 31, 2012

I would like to send my ASA 5500 logs to more than one syslog server - is this possible?  I can't seem to find it in the documentation.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 / How To Use A Host Instead Of IP Address For A NTP Server

Jul 8, 2012

Instead of using a IP address I would like to use a host address that points to a NTP pool.An example would be:ntp server 0.north-america.pool.ntp.org Can this be done on the ASA series?

View 1 Replies View Related

Cisco Firewall :: ASA5505 - Can't Ping Inside Host

Sep 29, 2012

I just try to ping a internal Host but it want to go.
 
Laptop<===>ASA5505
 
Connected is the Laptop at Ethernet 0/2 Inside
 
My running-config is a clear config, only VLAN 1 has a IP and Ethernet 0/2 is up.
 
But If I try to ping to the Laptop I get the followed:
 
asa5505# ping 192.168.1.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
asa5505#
 
From the Laptop to the ASA5505 I can Ping successfully.

View 6 Replies View Related

Cisco Firewall :: Host Cannot Browse And Allowed With Asa 5520

Apr 20, 2013

Port forwarding done to a DMZ located server on the cisco ASA 5520. Now this host cannot browse but allowed outside to inside access is possible Is there anyway i can give this system to browse internet? may be through the natted IP ( 94.20.*.*)

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Creating Host Objects Via CLI

Nov 3, 2011

I am trying to create host objects that I'll then add to network-object groups for use in ACL/ACEs.When I try to create a host I am having trouble adding the IP address.I then get an error saying the host name must start and end with letters or numbers and only contain letters or numbers. What do I need to do to create hosts from CLI?

View 2 Replies View Related

Cisco Firewall :: ASA (8.4) / Redirect Outside IP Request To Inside Host

Mar 27, 2012

Wondering if on the ASA (8.4) its possible to do something like what DNS rewrite does, but with IP requests.  Scenario.  Mobile phone accesses a web app inside our network fine over cellular.  Once it comes inside on to wifi it still has the public IP address cached so the ASA doesn't allow its request to loop around and the app appears broken.  We're considering lowering the TTL on the DNS host entry but I think we are battling phones/mobile OS's that don't have a strict adherence to name resolution standards.  A lot just seem  to refresh their caches every 10-15 minutes.

View 4 Replies View Related

Cisco Firewall :: NAT On ASA 5550 V8.3(2) Remote Host Not Accessible

Nov 9, 2011

Not very familiar with ASA and NAT'ing in general so hopefully, this will make sense.
 
I've created a Site-to-Site IPSec VPN tunnel with one of our clients (who uses a PIX).  The remote user can connect to our local, private LAN servers without a problem.  However, when the remote user tries to connect to servers on our corporate network (which is linked over WAN routers from LA to Dallas) they cant get through.
 
When I run Packet Trace in ASDM on our ASA all is well until the packet attempts to traverse from the Inside interface back through the Outside interface (back to the remote client side of the VPN tunnel).
 
I see the following "error" within the Packet Trace tool;
 
-----------------------------------------------------------------------------------------
Type - NAT    Subtype - rpf-check    Action - DROP
 
Config
 
object network obj_any
nat (inside,outside) dynamic interface
-------------------------------------------------------------------------------------------
 
I've attached my ASA config.  The remote client-side address is 74.8.221.195, its being PAT'd to 172.30.12.75 and the remote host/network its not able to reach is 172.30.101.20 ( /24 net mask).  The local segment in my LA network is 172.30.12.0/22 and the servers in this network are all able to communicate with the remote client-side user at 74.8.221.195.

View 2 Replies View Related

Cisco Firewall :: ASA5505 Cannot Ping Inside Host

Aug 2, 2011

I have Cisco ASA 5505  installed  and use as default gateway. I go to Internet through the ASA5505 Here is my Problem.I can not ping from ASA prompt(ASA#) to my Laptop connected to the ASA, but i can ping the ASA inside interface from laptop i can not use ASDM  and the VPN Tunnel is not working between the sie
  
ASA# ping 10.10.10.12
???????????
100% lost 
Laptop c
C:/ping 10.10.10.1
!!!!!!!!!!!!!!!!
 
Here is the Topology
 
INTERNET .<=========================>ASA<===============================> LAPTOP
  
I disabled window firewall on the Laptop , but no goof result.

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved