Cisco Firewall :: Allow Dmz Zone Server To Resolve Only Dns Query Through Nslookup On ASA 5540

May 2, 2012

How I can allow dmz zone server to resolve only dns query through nslookup on ASA 5540? What is the configuration required on ASA 5540 ?

View 13 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5540 Use For Protection From Internet Zone

Mar 7, 2012

-1x Cisco ASA5540
-1x Catalyst 3750x-48T (L3 Core Switch)
 
Id like to seek expertise on validating a simple firewall setup.
 
Do i trunk core switch traffic to the cisco ASA OR assign L3 link instead? It is basic understanding that the Cisco ASA is usually use for protection from our internet zone.A typical Cisco ASA setup would consist of outside, inside, dmz zone.
 
L3 core switch consist of 20 VLANS20 vlan needs to be blocked from each other. Eg Wireless Vlan does not have access to Server Vlan etc etc. 

what is the best practise to filter ip address within vlan from reaching each other.Should i trunk all my vlan to the Cisco firewall? (For easy vlan restrictions: but is that best practise?)Or do ACL on the core switch itself? but what if i have tons of servers ip that needs specific ports blocking or etc.How would i be able to manage all my ACL on the core switch. 

View 1 Replies View Related

Cisco Firewall :: 2901 / ZBFW - DMZ-Zone To In-Zone Access

Jun 9, 2012

I have a Cisco 2901 which terminates a Class C address pool. I have split the Class C address pool into 3 sub-nets and 2 zones and created a non-addressable pool (private pool):
 
dmz-zone : x.x.x.0 TO x.x.x.127 (x.x.x.0/25)
in-zone: x.x.x.128 TO x.x.x.159 (x.x.x.128/27) & x.x.x.160 TO x.x.x.191 (x.x.x.160/27)
private-zone: 192.168.x.0 TO 192.168.x.255 (192.168.x.0/24)
 
I have configured private-zone NAT to use address pool x.x.x.161 TO x.x.x.189 within the in-zone.
 
Within the:
 
dmz-zone - are servers for : DNS, Syslog, SIP & HTTP/HTTPS in-zone - is a SMTP mail server which is behind VPN Gateway/NAT, TomCat (Application Server) and PostgreSQL Server private-zone - is where all standard users are operating from and they can access the SIP & HTTP/HTTPS servers within dmz-zone My problem is that I cannot seem to configure the ZBFW to allow the dmz-zone HTTP/HTTP server to redirect to in-zone TomCat server.
 
I do not want to make the TomCat server generally visible and am instead using the Apache proxy/ajp13 to connect from dmz-zone server to in-zone server.However I cannot seem to get anything (including icmp) to work from dmz-zone to in-zone.
 
I have Policy:

POLICY-DMZ-IN (dmz-zone to in-zone) which has:
any any udp/tcp inspect
any any icmp inspect
unmatched traffic DROP/LOG
 
But I still cannot get anything from dmz-zone to in-zone...Could the POLICY-DMZ-IN be being overridden by other dmz-zone to out-zone policies?

NOTE: I have routing rules for each of various sub-nets and all out-zone to dmz-zone, out-zone to in-zone and private-zone to out-zone, in-zone and dmz-zone routing works ok, so it appears problem is with ZBFW not routing table.

View 4 Replies View Related

Cisco Firewall :: 5540 Http Failed To Send Data To Server

May 7, 2012

I have one server-A(windows 2008) installed one application called"host front" which gives athentication to connect Linux(mainframe console) server (SERVER B).These 2 servers are bihind the firewall.If one  internal user who has the athentication to logine server-B ,tried to login server A,will get the" username and password"screen and once they enter the username and password ,will get the server-B screen.But if somebody try to connet via MPLS(we need to test MPLS site customers) from outside via ASA 5540 ,to server-A will get the "username password" screen and once enter the credentials, after 1 minitue will get error"http server faild to send datas to the server" and will not move to server -B screen.

View 1 Replies View Related

Cisco Firewall :: ASA 5540 - Sending Logging Messages To Ftp Server Has Stopped Suddenly

Apr 21, 2013

on ASA 5540 ,   i configured the logging setup as following :
 
log in to the internal buffer : buffer size 1048576 bytes

Then i save the buffer to FTP server to save the log messages in continuously way everything was working fine but suddenly sending the ftp traffic to FTP traffic has stopped suddenly before in the live log viewer it was showing when ASA throws the ftp traffic to the ftp server but this stopped suddenly nothing has changed in the ftp server setting (same username and password and the connectivity is there) sending logging traffic to the ftp server came back just when i reboot the ASA.but this is not solution.

View 5 Replies View Related

Unable To Resolve Server's DNS Error

Apr 23, 2012

My laptop is connected to a router via wifi but it keeps getting a DNS fault. I have another PC linked to the same router via WiFi and that works perfectly all the time. I have the same problem on both google chrome and IE browsers where I just get the message telling me that the DNS look up failed. My internet is still connected as I can dial into my remote CCTV cameras and I can ping website ip addresses. Most times I can just turn off my wireless adapter and turn it back on and it works for another hour or so. But sometimes it wont work all day, unless I start my laptop in safe mode, when it works everytime! I have flushed the DNS cache several times but to no avail.

View 5 Replies View Related

Cisco VPN :: 5510 Unable To Resolve Server Address

Mar 27, 2011

I am using the Cisco VPN Client 5.0.06.0160 - and am having an issue connecting to my ASA 5510 via VPN.  This issue is happening on 1 of our laptops.  All other laptops connect just fine.  So the problem is not in the ASA.  I have double checked the client setup and config and it too is correct.  The interesting thing is, we are connecting to an IP Address and not a host name.

View 1 Replies View Related

Error 105 - Unable To Resolve Server DNS Address?

Jan 15, 2012

I have been trying to connect to the Internet via a wireless connection but keep receiving the above error. None of the Windows solutions resolve the problem. On Google Chrome I see a screen saying 'This web page is not available', and receive 'Error 105: Unable to resolve the server's DNS address'. I cannot access Internet Explorer either.The strange this is that this problem only seems to occur with some wireless networks, as I can connect fine at home. In certain places, however, I am told that I am connected but that accss is 'Local Only', and I cannot open any browsers. I need the problem resolved as soon as possible as I cannot access the internet where I need it most.

View -1 Replies View Related

Error 105 - Unable To Resolve The Server's DNS Address

Feb 8, 2013

Error 105 (net::ERR_NAME_NOT_RESOLVED): Unable to resolve the server's DNS address.

View 1 Replies View Related

Servers :: Failed To Send DNS Query To Server

Apr 21, 2011

Kerio Control with AD, DNS."Failed to send DNS query to server 127.0.0.1: 10049".

View 1 Replies View Related

Netgear WGR614 V9 Router - Unable To Resolve Server DNS Address / Error 105?

Dec 27, 2011

I'm connected through the router, a few times a day I cannot open web pages, getting error: Error 105 (net::ERR_NAME_NOT_RESOLVED): Unable to resolve the server's DNS address.Skype continues to work. Here are the results of pinging:

Quote:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:UsersSri Guru>ipconfig /all[code]....

One technician said that this is the providers problem, but I don't think so. When I restart the modem everything works.I have a Netgear WGR614 v9 router.I use ESET 5 security. Btw, connection drops on all computers connected through the router, so it's not my firewall.

View 3 Replies View Related

Cisco Firewall :: Getting PIX 506 (6.3) Configuration Query?

Jun 5, 2012

I inherited a PIX 506 with 6.3.  I will admit my background is more towards switching/routing.  But while I know it is dinosaur, I need to maintain for partner interoperability.  I just want to confirm that what I am thinking is correct and inf not how I can correct it.My thought is that since the access-list command doesn't list "eq" at the end, all ports and protocols are allowed?The other thing I am not used to is that the access-list has not id/number included in the command, so I assume that access-group specifies this functionality.
 
Here is a snippet of the current config:

object-group network Ext_Net   network-object 192.168.0.0 255.255.255.255
object-group network Int_Net   network-object 10.0.0.0 255.255.240.0
object-group network DNS   network-object 192.168.0.254 255.255.255.255   network-object 192.168.0.253 255.255.255.255
object-group network Servers   network-object 192.168.0.25 255.255.255.255   network-object 192.168.0.62 255.255.255.255   network-

[code].....

View 2 Replies View Related

Cisco Firewall :: 5505 DNS Does Not Resolve Inside DMZ

May 14, 2012

I have a 5505 that currently has inside/outside interfaces and everything is working just fine. I am trying to create a DMZ that will essentially be just for vendors/guests. the DMZ will have full access to the outside (Internet) but no access to the inside. I am using the FW for DHCP, and 8.8.8.8 and 4.2.2.2 for DNS. I currently have 1 laptop in the DMZ vlan, and it is getting a correct IP, and it is showing 8.8.8.8 and 4.2.2.2 in ipconfig. I can ping/tracert 8.8.8.8/ 4.2. 2.2/74.125.137.147(what url... resolved to on a laptop connected to the inside vlan), but I cannot ping nor browse to url.... [code]

View 1 Replies View Related

Servers :: Nslookup Shows All Ip Addresses Of A Nic?

Dec 20, 2011

nslookup shows all ip addresses of a nic. is this expected? i think it should just show the default IP

View 3 Replies View Related

Cisco Firewall :: How To Configure 5520 To Resolve Names In ASA

Feb 4, 2013

How to configure ASA 5520 to resolve names in ASA's. We are currently using ASDM to configure network objects with the hostnames in the internet and then specifying the IP address . But this is done manually. Is there a different way of setting it up on ASA. Also when getting reports from ASA, we see the IP's but is there a way that we could add an identity to the IP's (reverse lookup)

View 1 Replies View Related

Cisco WAN :: 1841 Router Can't Resolve DNS After Enable IOS Firewall

May 9, 2013

my 1841 router can't resolve dns after enable ios firewall, I try to ping google.com from router's console fail, but dns resolution is fine from lan side.
 
my partial config---------------------------------
!
ip name-server 8.8.8.8

[Code].....

View 10 Replies View Related

Cisco Firewall :: 2901 - How To Avoid SMTP Inspection On Zone Based Firewall

Aug 2, 2011

We had a problem with SMTP inspection dropping some regular emails (Cisco 2901 IOS 15.0). The original configuration.

View 2 Replies View Related

Cisco Firewall :: 2901 To Avoid SMTP Inspection On Zone Based Firewall

Jun 21, 2011

We had a problem with SMTP inspection dropping some regular emails (Cisco 2901 IOS 15.0).Incoming mails are going thru Spam and Virus Blocker so that bypassing SMTP inspection is not security issue in this case.

View 1 Replies View Related

Cisco Firewall :: IOS Zone Based Firewall Websense URL Filtering Feature On 881G

Jul 27, 2011

I've been trying to configured Websense urlfiltering using ZFW feature on my Cisco 881G router. The router is running on IOS 15.0(1)M with Advanced IP Services. And I have confirmed it supports urlfilter feature.
 
This is what I tried to accomplish but IOS version 15.0x seems to have different command set.
-----------------------
class-map type inspect httptraffic
match protocol http
parameter-map type urlfilter param
server vendor websense 10.20.30.40
[Code]...

View 2 Replies View Related

Cisco Firewall :: 1811 / Zone-Based Policy Firewall Configuration

May 16, 2011

I have two 1811's connected in a lab using a ipsec vpn tunnel (using a switch to simulate an internet connection between them).I am trying to configure one of the routers as a ZBPF just to allow a remote windows login (DC on the firewalled side, workstations on the other side).I'm trying to verify that the zbpf is working, but it doesn't seem to stop anything.  I had match icmp added to the class-map, but took it out to test if icmp would fail.  It didn't.  Basically, I don't think the firewall is working at all.  Any thoughts on how I can configure this so that the policies will work between zone-pairs?

Here's an quick drawing:

Here are the configurations:

 Local router:
 hostname sdc-1811-LocalLab
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
resource policy

[code]....

View 11 Replies View Related

Cisco Firewall :: 3945 / Zone Based Firewall And WAN Interface ACL?

Mar 16, 2011

I am getting ready to deploy a 3945 ISR to serve as an internet and core router for and remote site.  I will be terminating a site-to-site VPN tunnel on it and also configuring a zone based firewall config between my "outside" (internet link) and "inside" (all internal nets).  My question is about how to approach securing the WAN interface with the Zone based FW in place?what kind of ACL do I need beyond those allowing and restricting remote access to the outside ip? 

View 3 Replies View Related

Cisco Firewall :: 1841 - Which IOS Support Zone Based Firewall

Jan 3, 2013

I have a cisco 1841 router  , and i want to configure zone based firewall on it. But the document of zone based firewall only said that "after 12.4(6)T" can support zone based firewall. I use the ios  " c1841-ipbasek9-mz.124-15.T9.bin ", but it can't support ZFW. What kind of ios support ZFW. for example: ipbase, ent base, ip service ,advent etc.

View 2 Replies View Related

Cisco Firewall :: 2911 Router Zone Firewall And IP NAT Enable

Mar 20, 2013

I have a simple setup where I have a 2911 router with three interfaces, Inside, Outside and a second "Inside" interface which is labelled as a DMZ. The Zone Firewall applied to the "DMZ" is actually Inside (until I can work through problems). I need to be able to access a device on the DMZ via its external IP so I have designed NAT to use IP Nat Enable commands. This is now working for me fine. However, since utilising IP Nat Enable, my zone firewall now denies return TCP / UDP traffic and consequently I no longer have any internet access. Looking at the syslog messages, the reason for this is that the router is denying these return flows not because they are matching the outside-to-inside policy, but rather they are matching the outside-to-SELF policy. The router seems the detect that the internet traffic is being returned to SELF, when in reality the NAT rule should pick this up and forward it to inside. I can understand why this is happening, because I am NATting all private / inside traffic behind the external IP of the router, which is assigned to the Gi0/0 interface. [code]

View 1 Replies View Related

Cisco Firewall :: Zone Based Firewall Performance On ASR 1004

Sep 11, 2011

we are experiencing performance issues on ASR 1004 with ZBF as our campus edge router.Symptoms:

- sending small packets from inside zone to outside zone, for example UDP packets without payload
- this way I can generate up to 150.000 pps traffic (testing with packeth software, but we have had a real example with some kind of worm/virus)
- CPU load is about 1% (yes one!) to 2% all time !! (weird)
- ASR response to pings rises very quickly up to 5 seconds which makes box unusable dropping everything what goes through ZBF (so internet connection is gone)
- if I do the ping directly from box, it seems to work fine (no rules from self to outside zone in ZBF)
- if I remove interfaces from inside and outside zone (so disabling ZBF) and do the test again, ASR response goes from normal (0.2ms) up to 2ms (still sending 150.000 pps) and everything seems to work fine)
 
According to Cisco Datasheets: routing, Qos, Zbf ... on ASR 1000 with RP1, ESP10 should be done in hardware with up to 17.000.000 pps performance.

View 5 Replies View Related

Cisco Firewall :: 2951 Zone Based Firewall

Feb 16, 2011

I am confiuring ZFW on a Cisco 2951 Router. The router has the following interfaces: [code]Port Channel 1, 1.5, 1.10, 1.15, 1.20 have been added to the zone called IN-OUT. All the subinterfaces correspond to an internal VLAN.The router is connected to a MPLS network and has a BGP peer on interface MPPP. Over the MPLS network, an ecrypted DMVPN tunnel to HQ has been built (tunnel 0). EIGRP is the routing protocol running over the tunnel.Traffic coming in from HQ has to be firewalled on this router (don't ask me why!!). As a result, I am configuring ZFW on this router.
 
1-The router itself does not need to be protected, only the servers in the remote offices. That being said, I am not planning to create any self zone on this router. I don't want to break BGP, therefore the MPPP interface will NOT belong to any zone. Is this the correct way to do it?
 
2-The tunnel 0 interface will belong to OUT-IN zone that will protect all incoming traffic into this site from HQ. So when writing class-maps for the traffic coming INTO this site, do I need to write any class-maps for EIGRP or ESP? My guess is no, since that traffic will not be coming into the site, but rather just terminating on the router.

View 5 Replies View Related

Cisco Firewall :: CGR2010 - Using Zone Firewall Option?

May 25, 2011

I will be using a cgr2010 and want to use the zone firewall option. Can i configure sub interfaces on the same main interface to be in different zones

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - Unable To Resolve External Hostname Internally

Jul 1, 2012

I am working on adding a mapping to our external address for our mail server - let's call it mail.example.com
 
I would like to be able to access mail.example.com internally for our user's smartphones - if they access our company WiFi they are not able to get mail using the mail.example.com as the server name in their phone setups.  However, once they leave the office and use any other WiFi it works fine. Also, I am unable to ping that address from any internal device.  I believe also this is the reason Exchange accounts do not work on our site to site VPN connections.
 
I have a ASA 5520 and work primarily in the ASDM 6.4 to do configurations in the main office and have 5510 in our site to site connections.

View 6 Replies View Related

Cisco Firewall :: Zone Base Firewall NAT On 881

Apr 24, 2013

I am trying to understand zone base firewalls? I attempted to make the ip address 10.2.22.231 available to the outside world using port 80 and 443 on external interface(4) public IP address. I can see hits on the access list and Nat entries but it's not getting through.
 
Here is the config.
crypto pki trustpoint TP-self-signed
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-
revocation-check none
[code].....

View 3 Replies View Related

Cisco :: Zone Based Firewall Really Needed

Sep 18, 2012

I'm having a few problems at the moment with a zone based firewall setup. The more I looked into the problems the more I question whether I need the ZBF or not.My network is pretty simple. 1 Internet connection and 1 LAN interface and a few site to site vpns to the router.So what do people think to having this kind of set up and not using a ZBF?

View 11 Replies View Related

Cisco :: IOS Zone - Firewall Stateful Failover?

Aug 3, 2011

I've seen you can configure stateful failover between two routers running ip inspect classic firewall: url...Can the same be done yet for zone-firewall? I cannot find any documentation on it.

View 1 Replies View Related

Cisco WAN :: 2901 ISR - How To Do Zone Firewall Config

Sep 12, 2012

I'm sure this is simple to resolve.  I just bought a new Cisco 2901 ISR Router.  How do I configure the Cisco 2901 ISR Router for Zone Firewall?  The "zone" command is not recognized and does not show up in the "?" list in config or user modes -

View 4 Replies View Related

Cisco Firewall :: ASA5520 And Public IP Zone

Apr 5, 2011

I'm trying to setup a zone behind my firewall with complete publicly routeable IP addresses for 3 servers. The reason I'm doing this is I am in the network setup stage of an OCS implementation, and OCS connections don't behave well with NAT.
 
My device is a ASA5520. I have an internal zone, and a dmz zone. These are done via standard NAT configurations.
 
My question is this:
 
Is it possible to setup connectivity to the outside with internal servers that have Public IP's directly on their NIC's? Another little detail of interest is that this ip space is seperate than the one that's on current Outside interface facing our ISP. However we own both address space.

View 3 Replies View Related

Cisco Firewall :: Add IPS Or IDS Sensor On 5510 Before Installing DMZ Zone

Oct 30, 2012

I will like to know if I need to add a IPS or IDS sensor on my firewall 5510 before  i install a DMZ zone.?

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved