My customer has a 5510 with the inside interface connected to a routed port on a Cat3560G.When I look at the arp cache on the 5510 all inside IPs have the MAC of the 3560's routed port. [code]
View 6 RepliesI am able to ping from Switch to firewall inside ip and user desktop ip but unable to ping from user desktop to FW Inside ip.. config is below for both switch and FW Cisco ASA5510....
TechCore-SW#ping 172.22.15.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.22.15.10, timeout is 2 seconds:
[Code].....
I have a ASA 5510 with asa8.4(2) and asdm6.4(5)205. Have a new basic config, nothing special at this time. I just cannot seem to get from the inside to the outside. From the outside interface I can ping, so I have a good Internet connection. [code]
View 3 Replies View RelatedI cannot seem to determine exacly why I am not able to ping from the inside to outside using the standard 100/0 security levels respectively. I am dynamic natting the inside to the outside interface, something I don't usually do but cannot see why ICMP's are not passing through.
The Packet trace tool says there is something in the ACL but there really isn't.
Is there simply an issue of Natting to the WAN interface on a 5510?
We got an ASA5510 (8.2x) with an inside, guest and outside interface.On the guest interface, we have DHCP function on the ASA.On the outside, there is web-ssl vpn (dns hostname on a public isp-dns server) configured.
When an user on the guest net tries to get connected with the web-ssl dns-name, it resolves the public, outside interface-ip , the ASA dropps it.
I know, with static NAT it can be resolved url...but on this scenario, we are trying to build a connection from a guest inside IP to the public-ip form the outside ASA interface.If the guest users try an web-ssl connection on the guest-ASA IP, it works with a certificate error ( because there is no internal DNS on the guest net to resolve the dns name to the guest-interface IP).
So how can this be achieved? Can the ASA provide DNS server function? Can a NAT static entry (outside ip to interface guest) solve it? It's the only solution an inhouse DNS server in the guest-net?
We currently have a central hub using an ASA5510 and then a few site-to-site VPN connections to our support staff homes. The devices at the homes are Cisco routers. We were running version 8.25 on the ASA and all was working fine. We recently upgraded to version 8.42 and although all the functionality of the network is ok and it does what it should, our support staff cannot ping, ASDM or telnet to the ASA inside interface anymore whereas they could before the upgrade. The home VPNs all run on a 10.30 subnet (i.e. 10.30.1.x, 10.30.2.x etc etc). I can post our config (security edited of course), but it is quite a big config. The command management-access inside is specified and the 10.30.0.0/16 subnet is permitted to ASDM and Telnet. Are there any extra things that have to be done in version 8.42 to get this to work as the support staff do have to access the firewall for configuration purposes. At the moment, they have to telnet to one of the routers on the local LAN and then Telnet to the firewall from there.Prior to the upgrade, they were all able to ping the inside ASA interface and also telnet and HTTPS to it from their PCs at home. Now they cannot and the only change made was an upgrade to 8.42. Immediately after the upgrade none of them can ping the interface anymore and it seems it can only be accessed from the local LAN. I cannot find any access-lists that might be blocking the packets so can only assume it's something in the way 8.42 works.
View 8 Replies View RelatedWe have 2xASA5510. I have 2 Inside interfaces as INS_STAFF and INS_QUEST and two Outside interface OUT_STAFF and OUT_QUEST which is in sapareta ISP's. All interfaces is assinged to different vlans. now i want to nat INS_STAFF to OUT_STAFF and INS_QUEST to OUT_QUEST,because I'm having two default routes it gets impossible to do. Plus I want to make failover with my ASA's. I know that i can solve this problem with PBR on router.but I haven't it . make context's and separate each Inside and Outside alone?
View 1 Replies View RelatedI've been trying to figure this one out for quite a while. I currently have 2 inside interfaces (data, phone) and I am moving to 3 inside interfaces (servers, workstations, phones). I have not been able to get any traffic between the interfaces. With the current setup it was not a major problem. With the new setup it will be a major problem.
Below is a sanitized version of the config.
ASA Version 8.2(1)
!
hostname BOB
[Code].....
Today I run into a problem with enabling ICMP traffice between two inside interfaces on ASA5510 (version 8.2). I tried to ping from 192.168.1.2 to 192.168.2.2 Failed. But I can visit outside websites or ping from any of the two addresses above to 8.8.8.8 So I checked the configuration shown as follow
<omitted>
interface ethernet0/1
nameif inside
[Code]....
I need to connect from an inside host to a host located in the DMZ zone for DNS queries. The host in the DMZ zone has a static NAT to the outside. The point now is that I would like to connect from inside to the NATed outside address, means to the public Internet address.
Inside host: 10.0.0.1 -> PAT for 10.0.0.0/8 to 20.0.0.254 (Outside Interface)
DMZ host: 192.168.1.1 -> NAT to outside to 20.0.0.1
The traffic should be 10.0.0.1 udp>1024 to 20.0.0.1 udp=53. The source IP address on the outside interface now is 20.0.0.254 (according to the PAT), the destination IP address 20.0.0.1. The DNS reply from 20.0.0.1 should go back now to 20.0.0.254 and then to the inside host 10.0.0.1.
I know that on the PIX it was not possible, to have outgoing traffic on the outside interface which immediately enters again the same interface. Can I realize this scenario with the ASA 8.4(3) release now?
I have a cisco asa 5505 and i need a public ip address on the inside of my network without NAT. for example: I can create a static nat translation rule, but this is not what i need.
isp -> x.x.x.1 /29 (outside asa) (inside network) x.x.x.2 /29
Is this possible?
I am trying to get two external addresses to PAT to different ports on the same address in the dmz.
Object NAT is configured as follows:
object network Obj-192.168.1.20-1
nat (dmz,outside) static Obj-External-1 service tcp https https
object network Onj-192.168.1.20-2
nat (dmz,outside) static Obj-External-2 service tcp 2000 https
Obj-192.168.1.20-1 and Obj-192.168.1.20-2 contain the same host address.
The idea being that traffic destined for Obj-External-1 on port 443 will be forwarded to Obj-192.168.1.20-1 on port 443. Traffic for Obj-External-2 on port 443 will be forwarded to Obj-192.168.20-2 on port 2000.
Traffic for the first object, Obj-192.168.1.20-1, works but traffic for the second does not.
I have a handheld device that will be used for inventory outside of our office. It has 3g capabilities. Is there anyway I can permit traffic from this device from the outside world coming into my network? I need to open a couple of ports so it can hit the server. But I have no intention to open these ports up to the entire world. I use an ASA 5520 with a managed router from our provider. I looked around on the Cisco site and the only information I found was for permitting and denying traffic from devices that are within the network.
View 2 Replies View RelatedWe've had issues with our Exchange 2010 server (running on ESXi 4.1) since its default gateway was changed to our new ASA 5510. They manifested as frequent Outlook client connection dropouts or as IP address conflicts whenever Exchange was rebooted. The temporary fix was to disable the Exchange server NIC, bounce the ASA and enable the server's NIC again. We saw poor performance from Exchange after a while again, but after some research and testing I realised that disabling proxyarp on the inside interface fixed the problem permanently.
However I've now realised that the client VPN no longer routes properly because proxyarp is disabled on the inside interface, so I still have a problem.
customer has a server which located in inside interace. and an outside interface connected to ISPA. cu config a static nat map inside server address to ISPA address, one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.
View 3 Replies View Relatedi have a problem customer has a server which located in inside interace. and an outside interface connected to ISPA. cu config a static nat map inside server address to ISPA address one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.
View 6 Replies View RelatedJust want to know if there is a way to configure secondary IP address on the outside/public interface of ASA/PIX.One of our clients have used most of their IP on the subnet given by their ISP. They use those IP's for staticallymapping to Servers inside their local LAN. Thus, they requested another block/subnet from their ISP. They will also use this for static mapping/port forwarding to other servers in their network. The current UTM they are using is allowing this but they would like to use ASA/PIX as their main Firewall. Is this even possible or is there a workaround for this kind of scenario?
View 5 Replies View RelatedI am configuring ASA 5510.
My ISP given /28 pool of public IP's. So i had total 14 available IP addresses.
I configured one IP to the my firewall outside interface. I want assign remaining IP's to the my Servers, which are located inside to the firewall.
We have ASA 5550, I have a portal server in the dmz which is natted statically to a public ip address for port 443. The application works fine from outside world. The server is also nated with a dynamic nat from inside to dmz and when I hit on the dmz ip from my inside it works fine.
The requirement for us is that the users sitting behind the inside (i.e. LAN) should access the server on the public ip address and not thru the dmz.
Recently, I've been having significant problems with denial of service on our ASA-5510. Two IP addresses in particular attack my ASA regularly. What kind of rule do I need to create to deny these IP's access to my firewall?
View 4 Replies View Relatedwe have two Cisco ASA 5510 in failover configuration.We tried to change the public IP address on the Outside interface of the primary device but it didn't works. The new IP is not reachable from Internet nor pingable from device on the same LAN.The new IP address is in the same subnet of the old IP.
From the switch on which the ASA is connected and from another Cisco PIX we can see the ARP entry. In the analysis, on the old public IP address there was a VPN site-to-site and Webvpn defined.We tried also to shut/no shut the interface and reboot the device.
The old syntax that I am much more familiar with has been deprecated. On older IOS it would have been something like static (inside,outside) tcp 209.114.146.122 14033 192.168.30.69 1433 netmask 255.255.255.255 Plus an extended ACL to allow the traffic.I am trying to create a Static PAT to allow a host address to access our Network through an ASA. I have external address 209.114.146.122 that I want to hit the external interface on an obscure port (say 14033) and translate that traffic to an internal host address on port 1433.
View 11 Replies View RelatedI am facing a problem with Cisco ASA remote access VPN, the remote client is connected to VPN and receiving IP address but the client is not able to ping or telnet any internal network.I have attached running configuration for your reference.
-FW : ASA5510
-Version : 8.0
Site to Site VPN is working without any issues
I have a Cisco ASA 5510. I am trying to copy large files between DMZ and INSIDE network and it is copying at awfully a slow speed. I thought it might have been related to duplex mismatch but it doesn't seem to be. DMZ interface is set at 100 full duplex. I programmed the port on the managed switch where the DMZ uplink is connected to be 100 full duplex. I even hard set the NIC on server to be 100 full. Nothing worked. So, I come to a conclusion it isn't the duplex mismatch but there gotta be something else on Cisco ASA. I was googling for this issue and came across it could be a QoS policy. Now, checking my ASA I see a any to any global service_policy where it is defined to inspect certain protocols where 'netbios' is one of them (among others such as 'ftp', 'tftp', etc. Could the slow copying be related to the above policy? Could there be a bandwidth limitation between DMZ and INSIDE interface? How do I check?
View 5 Replies View RelatedASA 5510 have two model Bun-K9 and Sec-Bun-K9 from the datasheet find out difference Port related and Redundancy. My questions is : Have any major difference for Security service between two model ?
View 3 Replies View RelatedI am using 2 vpn-routers RVS4000, to interconnect 2 hybrid telephone IP-PBX. After configuring the VPN the head offices are not seen in network. The VPN is active in windows.
IP-PBX works correctly in te same LAN. I understand that the problem is that I do not find how to indicate the router to send de UDP packets to the correct IP thought the VPN.
I guess I'll start with the easy stuff, Cisco ASA 5520 ver 8.2, ASDM ver 6.2, IPSec L2L tunnel with overlapping private IPs.
I have about a dozen L2L connections on our 5520 but never had to do one with overlapping IPs. I have two that I have to build and one definitely overlaps our inside locals, and the other is requesting that we NAT our inside locals to a 10.x.x.x.
I've searched the board and found several good posts including document 112049, but I just don't seem to be able to get my head around how to translate one inside address to another. It would seem like is would be as easy as doing an (inside,inside) static NAT, but most everything has the solution as a policy NAT or doing an (inside, outside) but in the less secure address space place the name of an ACL. I have ordered that brick of a book on ASAs from Cisco Press, but need to get something going and I'm not having much luck getting this thing up and running.
Perhaps my basic understanding of NAT rules is wrong. I thought that when using NAT the command speaks to the interfaces and the direction of travel, (inside,outside). I also thought that the IP adresses used must be valid on the interface refferenced, so any refference to "inside" would have to be an address on the "inside interface of the FW and likewise for the "outside" interface. Finally, to be sure I'm not calling a duck a goose my understanding is that the following are correct; "inside local" = my private, "inside global= my peer, "outside local"= their private, "outside global"= their peer.
So if I'm translating say a 192.x.x.x on my inside local and wanted to present them a 10.x.x.x, wouldn't I need an (inside,outside)? And even though I'm translating my private IP into a different private IP, the translated IP must be on the "outside" interface because that is the interface that I want to present the new private IP on?
So for the scenario I suggested at the top where I need to translate my private 192.x.x.x into a 10.x.x.x and present that 10.x.x.x to the other side, I need something like NAT Static (inside,outside) 10.x.x.x 192.x.x.x?
I have an ASA5505 with 8.4 software used on a business DSL account.This means I am running PPPoE session to the provider and am then given an Inside Global subnet /29.I have various servers NATed to specific IP's then have the DHCP users NAT with overload to another of my inside global addresses. When I try to establish an IPSEC tunnel to any of my inside globals and monitor I get an access denied message but there is nothing that is blocking.If I determine my PPPoE IP address I am able to extablish a IPSEC session to that but cannot exchange traffic. Not that I want to use that IP anyway because that PPPoE Session IP changes and only my inside globals are static.I spent several hours on this and cannot put my finger on it. Do I need to allow VPN to the INSIDE interface?
View 2 Replies View RelatedI have a newly aquired asa 5505 that I just set up to the bare minimum configurations. I followed a cisco paper on how to create a "remote access vpn" setup for ipsec. I can sucessfully connect and establish a VPN, but when I try to access an inside resource from the vpn address, the asa blocks it.
Specific error is:5 May 09 2012 15:17:48 305013 192.168.1.2 80 Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:192.168.1.220/53101 dst inside:192.168.1.2/80 denied due to NAT reverse path failure
Here is my config.
: Saved:ASA Version 8.2(2) !hostname asawooddomain-name wood.localenable password W/KqlBn3sSTvaD0T encryptedpasswd W/KqlBn3sSTvaD0T encryptednamesname 192.168.1.117 kylewooddesk description kyle!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0 !interface Vlan2nameif outsidesecurity-level 0ip address dhcp setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!boot system disk0:/asa822-k8.binftp mode passivedns server-group DefaultDNSdomain-name wood.localobject-group service rdp tcpdescription rdp accessport-object eq 3389access-list outside_access_in extended permit tcp any interface outside eq 3389 access-list outside_access_in extended permit tcp any interface outside eq 8080 access-list outside_access_in extended
[code].....
I'm trying to translate my inside network of 192.168.20.0 to my outside ISP address on ASA 5505. The ping from all hosts to 4.2.2.2 works, but it still only let's one address out to translate.My configuration is:
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
still doesn't work.
I'm trying to translate my inside network of 192.168.20.0 to my outside ISP address on ASA 5505. The ping from all hosts to 4.2.2.2 works, but it still only let's one address out to translate.My configuration is:
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
still doesn't work.
Recently I've installed this particular cisco ASA5510 at a client site (Head office), along with remote access VPN setup. All most 32 branches(one user from each branch) connect to the head office via remote access vpn.
Further I've used the "vpn-framed-ip-address" command along with a dedicated ip address, under each "user attributes", so every time when a user connect, he used to get the same ip address from the VPN pool.
My problem is sometimes this setup works fine, but once in a while the same ip address will be assigned to two different users at the same time, despite of the "vpn-framed-ip-address".
I know the CSS is too old but I have one in production environment and I was asked if it is possible to CSS to make NAT from inside addresses and translate them into one external IP address to diferent kind of communications, for example: 172.16.4.9 and 172.16.4.10 (inside addresses) should start connection to external IP addresses destinations 50.50.50.50 / 60.60.60.60 70.70.70.70 / 80.80.80.80 and so on, the default gateway to those Servers is the CSS and I would like to know if it is possible that all connection to external world to be translate into one IP address 172.16.4.100.
My CSS is 11503
Version: sg0810106