Cisco Firewall :: Asa 5510- 2 IP's Outbound Fail-over With RTR Inbound Possible?

Jan 30, 2012

I know I can use the RTR statement to determine when the primary ISP circuit goes down via this technote: url...My question can I assign static Nats on the backup ISP connection to the same inside servers in the dmz.?Example 10.1.1.11 is mapped to ISP1 ExternaIP of 65.217.77.11. Can it 10.1.1.11 also be mapped to ISP2's 208.217.77.11?This way I can get my DNS changed and my inbound traffic to servers in my DMZ on the asa 5510 running 8.0.3 code can continue to receive Inbound traffic.

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5510 7.2(3) - Inbound And Outbound TCP And UDP Access

Nov 20, 2011

I'm running a Cisco ASA 5510 with version 7.2(3) and I've been tasked with permitting some inbound & outbound TCP & UDP ports to/from a specified address space on the internet. 

In looking at my current ASA config I see other access lists already configured so I'm assuming I can just set up a new access list in similar fashion, but I wanted to verify here first.

View 6 Replies View Related

Cisco Firewall :: 2195 Open Inbound And Outbound Ports On PIX

Feb 5, 2013

-I need to configure the following on my PIX:
 
TCP port 2195 - outbound
-TCP port 2196 - inbound
 
How would I configure this via ASDM?

View 3 Replies View Related

Cisco Firewall :: ASA5505 - Configuration To Allow Inbound / Outbound Mail Communications

Dec 26, 2011

I’m trying to configure my ASA 5505, in order to allow my inbound and outbound mail communications. Here with this mail I’ve attached a diagram which illustrates my exact network setup along with ip addresses.

In this setup I’ve enabled port forwarding on my ADSL router (port 25 and 110) and configured the ASA accordingly, and my mail server is located inside my network.

My problem is currently I can send mails from my inside network to outside but my not receiving any mails which originate from outside. I’ve attached my current ASA configuration as well,

C:UsersSuthakarDocumentsOffice_DocsThakralABC Computers

Final config on ASA5505

host name Cisco
enable password 8Ry2YjIyt7RRXU24 encrypted
password 2KFQnbNIdI.2KYOU encrypted
names
!interface Vlan1
nameif inside
security-level 100
ip address 192.168.155.201 255.255.255.0
[Code] ......

View 3 Replies View Related

Cisco Firewall :: UDP Port 9500 Open Inbound / Outbound To Specified IP Addresses

Feb 28, 2012

I have a weather station at our high school that needs UDP port 9500 open inbound/outbound to specified IP addresses.

Cisco PIX Security Appliance Software Version 8.0(4)
Device Manager Version 6.1(5)57

View 1 Replies View Related

Cisco :: Inbound And Outbound Traffic In BGP?

Dec 6, 2012

I have two ISP, I want to divide Inbound to ISP1 and Outbound to ISP2.

View 3 Replies View Related

Cisco Firewall :: 5510 - Inbound NAT On ASA 8.4?

Aug 6, 2012

I am trying to setup an inbound NAT on an ASA5510 running 8.4 code.
 
object network obj-192.168.1.2
host 192.168.1.2  (internal web server)
 object network NAT-external IP
host ** external IP ** 
object network NAT-external IP
nat (outside,inside) static 192.168.1.2 service tcp https https
 access-list outside_access_in extended permit tcp any host 10.2.0.10 eq https
 
This seems to be setup now?
 
sh nat
2 (outside) to (inside) source static NAT-*.*.*.*  192.168.1.2   service tcp https https
translate_hits = 0, untranslate_hits = 0
 sh access-l
access-list outside_access_in line 2 extended permit tcp any host 192.168.1.2 eq https (hitcnt=27) 0x59383a04
 
When I try to connect to the external IP using https I get hits on the access list, however the nat translate hits do not go up?Do I need to allow the 192.168.1.2 server back out again?

View 1 Replies View Related

Cisco Routers :: RV 220W - Create Matching Inbound And Outbound Rules

May 15, 2012

RV220W - I'm trying to create a one-to-one NAT connection to a PC on my network. I have 5 static IP's assigned by my ISP. I've gone through the step of 'registering' each IP in turn on the WAN port, and pinging that IP from an external device until it starts to respond, then I set the WAN IP back to the one I want to use to manage the device.
 
I think what I want to do is simple. I simply want to NAT ALL traffic hitting my 2nd IP address, let's call it 24.15.120.73 (not the real value) to 192.168.1.10 internally. I want ALL ports both UDP and TCP to be forwarded. This Server is then going to be one end of a VPN tunnel going to another site, but I don't want to complicate things with that for now. So I can't even seem to get one-to-one NAT working! I created the one-to-one NAT on the Advanced tab of the firewall and created rules for all ports for UDP and TCP, but I can still never 'see' the internal server from the Internet. Also, the server will not get out to the Internet (can't hit Google, etc).

View 2 Replies View Related

Cisco Firewall :: ASA 5510 ACL For Blocking Outbound SMTP

Jan 30, 2013

I'm trying to configure a simple ACL to block smtp traffic from leaving my LAN -- basically prevent internal users from setting up internet email accounts in their email clients and sending through that smtp server. i want my Exchange server only to send smtp traffic. here's what i have:
 
-access-list 102 extended permit tcp host 10.10.1.29 eq smtp any eq smtp <===10.10.1.29 is Exchange
 
-access-list 102 extended deny tcp any eq smtp any eq smtp
 
-access-list 102 extended permit ip any any
 
-access-group 102 in interface inside
 
after i apply this ACL to the ASA, i am still able to send from my internet email address setup in Outlook using my "foreign" smtp server.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Reverse Or Outbound NAT Redirect?

Jan 24, 2012

I have the need to do an outbound NAT redirection.  So what I mean is this.  I have a custom program that uses SSH to port 22 from a server inside the ASA firewall.  This goes out to a server on the Internet over port 22.    The ISP of the SSH server told me that they changed their SSH port from 22 to 2102.  So instead of changing the custom code on the developed application on the server... I thought it would be easier to do a OUTBOUND NAT redirection for the ASA to see port 22 from the server and redirect it OUTBOUND to port 2102. 
 
so for example:

The server is at 192.168.0.2 and it uses a program to initiate SSH traffic to 205.246.1.1. The server sends to port 22 but I need it automatically changed on the firewall to port 2201 at 205.246.1.1. 
 
It is a Cisco ASA 5510.   The server at 192.168.0.2 does have a fixed IP address on the outside with INBOUND NAT for things like port 25 (mail) traffic etc.  Lets pretend that was at 64.18.23.60.

View 1 Replies View Related

Cisco Switching/Routing :: Inbound And Outbound Per Port Bandwidth Limitation 3560

Feb 21, 2013

I'm intending to purchase a switch for work,and I need to limit the bandwidth of one of the ports to 25 Mbit upload and 25 Mbit download (we have 100/100 Mbit connection and the customer is only paying for 25). I been trying to find information on how this could be "properly" done and what kind of switch I need to buy. As far as I have understood, most L2+ switches support outbound rate limiting, but not inbound, and as I only want the customer to have 25 mbit up and down, I need both.
 
I been looking at a Cisco Catalyst 3560 switch, and I'm first and foremost wondering if I can limit the inbound AND outbound bandwidth on this switch? Perhaps it can even be done on a simpler, cheaper, switch - as I rather not spend more money then necessary?
 
Lastly, how to do it, limit the inbound and outbound bandwidth on a single port (perhaps on the above mentioned switch, if possible), to 25 Mbit?

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - Open Outbound Port For Specific IP

Dec 6, 2012

We have a ASA5510 and I need to open port 22 for a speacific IP in our LAN outbound only.      

View 15 Replies View Related

Cisco Firewall :: ASA-5510 Dropping Outbound SMTP Traffic?

Aug 21, 2011

A recently added outbound rule has left my SMTP communications broken. I have since removed the rule, and had Cisco do some damage control, but it's still dropping some of the SMTP traffic. I get a number of NDR messages each day like the one below:Your message did not reach some or all of the intended recipients. Subject: RE: Christopher, Curt Sent: 8/19/2011 9:38 AM The following recipient(s) could not be reached:
  
[URL]
on 8/21/2011 9:49 AM
Could not deliver the message in the time limit specified. Please retry or contact your administrator.
<630.SM.Local #4.4.7>
 
Your message did not reach some or all of the intended recipients. Subject: RE: Christopher Curd Sent: 8/19/2011 9:38 AM The following recipient(s) could not be reached:   JWillar@email.com on 8/21/2011 9:49 AM  Could not deliver the message in the time limit specified. Please retry or contact your administrator.  <630.SM.Local #4.4.7>
 
I've attached an image of my configuration (ASDM GUI). The part of the image highlighted in green are the SMTP rules. The part highlighted in yellow is another rule that I added about a month ago to block a SYN attack. This rule may be part of the problem because of the order it is in the list. Not sure, though.
 
I have had two Cisco techs Putty into my ASA to check things out. I think they've done all they can. I wonder at this point if it be wise to just reload the last good running-config I have prior to the Outbound rule being added.

View 13 Replies View Related

Cisco Firewall :: ASA 5510 Dynamic NAT Inbound Translation

Jun 1, 2011

I have ASA 5510 and public FTP server from my local network to external IP address, with static nat translation. All works, but I need request to ftp come from internal ASA interface (need use gateway different ASA). How configured ASA for forwarding request?

View 4 Replies View Related

Cisco Firewall :: 5510 Inbound To Partner Network

Feb 26, 2012

I have been asked to create an inbound connection on the ASA from the internet to a part of the network that is accessible over the Wide area network eg
 
-Internet address  94.175.x.100 goes to 151.5.3.100,
-The internal network is 10.42.15.0/22, and connects to the 151.5.3.0/24 network over a private MPLS.
 
Is this possible with the ASA5510 and if so can you give me a clue how to pass the traffic

View 6 Replies View Related

Cisco Switching/Routing :: Outbound Versus Inbound Access Lists On Catalyst 3750X?

Mar 17, 2013

I want to configure accesslists on my Catalyst 3750X-switches to protect different VLANs/networks. Any best-practices about inbound versus outbound accesslists? In my head it is more readable and easier to understand the config when accesslists are assigned outbound on the VLAN to protect instead of assigning them inbound on all possible source-VLANs. But of course, from a performance point-of-view it is better to use inbound access-lists to avoid un-necessary routing etc.

View 1 Replies View Related

Cisco Firewall :: Blocking Outbound Port 80 Traffic Using ASDM On ASA 5510

Nov 26, 2012

I am attempting to block outbound traffic for a specific PC on my LAN using the ASDM.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 Static Map - Outbound Flows Through Global Address

Nov 30, 2011

I have an ASA 5510 running version 7.0. I have a problem with an exchange server using a static map and its outbounc connectivity. It connects outbound through the global address even though inbound connectivity works fine through the static mapping. The recent changes are changing of the zero route through a different interface (there are to circuit connected to this ASA on different interfaces). So the idea was to get all workstations in the office using the global address and routing out through one circuit, and the servers connecting in/out through the other circuit. Shouldn't a static mapping ignore what the zero route is?
 
Here are what I believe to be the relevant configs.
 
interface Ethernet0/0
description New 6mb circuit
speed 100

[Code]....

So exchang2 server can be connected to from the outside properly via IP xxx.207.51.231/exchange2-outside, but all outbound connections from this server are going out via IP xxx.122.47.218/circuit-6mb as do all the workstations due to the global address statement.

View 2 Replies View Related

Linksys Wireless Router :: E2500 Block Outbound And Inbound Traffic On TCP 5222 / 5223

Oct 23, 2012

I am trying to block outbound and inbound traffic on TCP 5222 and 5223 on E2500 but cannot figure out how. The reason is I have kids in my house using KiK (texting app) on iPads, iPods etc.  My goal is to eliminate this applications ability to function for ANY wireless device connected to my WLAN. 

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / Outbound Internet Access Not Allowed When Syslog Server Is Rebooted

Jun 27, 2011

I have recently setup Splunk to receive my syslog messages from my ASA 5510.  In the past I used kiwi without observing this issue, but I needed more features than kiwi had available.  Anyway, anytime I stop the splunk service my asa does not allow any outbound connections to be established. 

View 2 Replies View Related

Cisco Firewall :: FW ASA Fail Ssh Or Telnet Using SSL VPN AnyConnect 5510

Jul 7, 2011

I have a vpn ssl remote access with a fw asa 5510 version 8.02. When users use any connect vpn ssl they in the Lan can access to the servers,but they can not access using ssh or telnet to inside fw asa.

aaa authentication ssh console LOCAL
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Dual ISP Active / Standby Fail Over

Apr 2, 2013

I have a dual ISP, 1 primary and 1 secondary terminated on fa0 and fa2 on our ASA respectively. ASA was configured so that, when the primary fails, the secondary kicks in.  [code]
 
It was until yesterday that we experienced downtime on the primary ISP that the secondary doesn't do the fail-over. I have to manually configure the device to use the secondary ISP. Currently, I'm looking at maybe this has something to do with the licensing.We are currently using a Base License, should we be upgrading to Security Plus?

View 10 Replies View Related

Cisco Firewall :: 5510 - Connections Routing Between Two Internal ASAs Fail

May 19, 2012

We have a site with two inbound circuits, one for internet and one for our MPLS.  Each circuit is being terminated by a 2921 Router and matching ASA 5510 Firewall.  For the internal network, the Internet ASA's inside interface (172.16.0.1) is the default gateway for all hosts.  OSPF is the routing protocol between all the routers and ASA's and routing is working.  In fact, ICMP is working as well.  From an inside host (172.16.0.81), we can ping anything on the MPLS network.  But when I try to use telnet (for example), the connection fails.  If I add a route to 10.10.10.0 to the host, or re-configure the host to point to the MPLS ASA (172.16.0.254) as it's default gateway, connections will establish.
  
Both ASAs are running 8.4(3), and have the following commands:
 
same-security-traffic permit intra-interface
interface Ethernet0/0
nameif outside

[Code]....

And from the MPLS nodes, I can see a tcp request is made. 

View 6 Replies View Related

Cisco Switching/Routing :: ASA 5510 Securing Inbound Traffic On VPN Using ACL

Nov 1, 2012

I have a VPN on my ASA 5510 between (A)192.168.255.0/24 and (B)172.20.2.0./24. The purpose of the tunnel is to send kerberos tickets from our domian controller on the A side, across to a server at B, and receive a respose. I want to lock down inbound traffic to the A network, but not sure of best method.
 
I initially tried using an ACL filtering on ports, but soon realised the incoming traffic uses a wide range of ports so this is not really possible.Seeing as the A side will always be initiating the conversation, I was wondering if I could use the 'established' option on the inbound ACL for the ASA at A side, so that it would block any flows that are not initiated by the A side.

View 3 Replies View Related

Cisco Firewall :: Outbound ActiveFTP On ASA 5505

Oct 5, 2011

I'm having some issues getting ActiveFTP to pass through an ASA 5505, I finally found out when I tested the FTP via cmd on windows(after the major hassle of getting credentials out of the software co) that it does open the connection on the control port, but whenever I try to send/recieve data the connection is dropped, for troubleshooting purposes I've even gone as far as opening up all ports 1-65535 with an acl to no avail, I believe the FTP traffic is encrypted with SSL(can't get a solid Y/N from the company).

View 1 Replies View Related

Cisco Firewall :: ASA 8.4 - Static NAT With Outbound SMTP

Mar 30, 2011

Below is the interesting part of my config.  I have static NAT configured and working inbound for the Exchange Server and the Barracuda, however outbound traffic from those hosts comes out as the interface IP.  Thoughts?  I've tried a number of things (outside, inside), etc.
 
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network DSN-EXCH01
host 10.250.231.51
object network MAIL-IN
host 10.250.231.50(code)

View 3 Replies View Related

Cisco Firewall :: Inbound UDP Connection 684?

Apr 25, 2012

Trying a simple Easy VPN connection and getting the following in the error logs:
 
Built inbound UDP connection 684 for outside:xx.xx.xx.xx/1106 (xx.xx.xx.xx/1106) to identity:xx.xx.xx.xx/500 (xx.xx.xx.xx/500)

View 1 Replies View Related

Cisco Firewall :: PIX 515 Blocking Outbound Traffic To Certain Sites

Oct 14, 2012

I have a LAN with several linux boxes (Fedora 17, both 32 and 64 bits),  as well a a WInXP box. All of these are connected to the same switch,  which is connected to the inside port of my PIX 515.
 
For a few sites (mozilla.org happens to be one of them), for http access, the tcp connection is established, but the "GET" request - or anything else for that  matter - will not go through the PIX (from inside to wan). I have  verified this by first, using wireshark to watch the packets being sent  out from the client box, then by using the trace function in the PIX to  see that the packets ARE arriving at the inside interface, but ARE NOT  sent out of the wan interface.
 
This is for the linux boxes ONLY. When I do the same thing with my WinXP  box, all works: in the PIX trace, I see the packets arrive at the  inside interface, and leave the wan interace. And access to these sites  are okay.
 
(What's a bit weird, although somewhat expected, when I connect my android phone to my LAN via WiFi, it too is unable to reach those sites - but then again, android is linux, right?)
 
In addition to the tracing, I have narrowed this problem down by connecting a linux box directly to my DSL router, then replacing the PIX with a simple router/gateway. Both of those solutions work.
 
Some background:
 
I have been using this PIX for about 10 years now, with the same  configuration (except IP addresses). Only in the last several months has  this problem started to show up.
 
I got this pix from a dead company at a really great price (free), so I'd like to keep it, and not have to spend money on something  else. I don't have any support license, and have not been able to get  any software upgrades. Here is its version info:
 
taz(config)# sho ver
 
Cisco PIX Firewall Version 6.2(2)
Cisco PIX Device Manager Version 2.0(2)
 
Compiled on Fri 07-Jun-02 17:49 by (code)
 
Serial Number: 405200362 (0x1826ddea)
Running Activation Key: 0x38ac31f3 0x0630df47 0x9a77b805 0x8bc39a60

PS: Since this PIX is at its end of life, I was wondering if any of the  software upgrades would be now available without a license?

View 2 Replies View Related

Cisco Firewall :: Enabling Outbound Traffic Through ASA 5520 8.4(4)1

Apr 4, 2013

We've got a proyect that requires a few thin clients to connect to a remote PCoIP server.
 
Looking to the documentation, the only port required to be open through Firewalls is TCP/UDP 4172, however, we've seen (making interface captures) that it somehow also uses ESP (IP protocol 50).
 
We've got a static NAT translation translating those thin clients to a public IP address, we've created ACLs to allow inbound (shouldn't be necessary as our user is connecting to a remote server) and outbound traffic for TCP/UDP 4172 and ESP and I cannot make it work.
 
I've also enabled IPSec pass-through Inspection to no avail.
 
how should we configure our ASA to enable this kind of traffic?

View 4 Replies View Related

Cisco Firewall :: Opening Outbound Ports On ASA5505

Oct 2, 2012

I need to open some outbound ports in order for our CCTV company to receive alarms from our internal CCTV Machine.
 
The ip addresses of the company who access the CCTV are as follows:

213.130.134.56
81.130.198.97
 
The above are fixed IP addresses. The internal machine is on 192.168.204.170
 
The outbound ports that I need to open are the following:
 
TCP
21
23
80
5201
 
UDP
1025
2074
2075
 
I have access to the current config if needs be.

View 8 Replies View Related

Cisco Firewall :: ASA5505 - ACL For SMTP Inbound

Dec 29, 2011

I am trying to configure my ASA5505 to allow SMTP relay and the ACLStatic I created is not working.

View 1 Replies View Related

Cisco Firewall :: Dual ISP And Inbound NAT ASA5505 8.2

Oct 30, 2012

I have setup an ASA5505 running 8.2 with dual ISP's
 
Primary link is the current live static route out and the backup picks up if the primary fails. That all works great However I have an issue with inbound NAT rules
 
I have configured an inbound static on the primary which works great
 
static (inside,primary) *.*.*.* 10.1.1.1 netmask 255.255.255.255 access-list outside_access_in line 2 extended permit tcp any host *.*.*.* eq 3389 (hitcnt=4)
 
Question? With the primary link active and the default route pointing out through the primary, am I able to configure an inbound NAT to the same inside host 10.1.1.1
on the backup link?
 
If the primary fails users will need to be able to connect inbound to this service
 
When I try to set it up I got this error ERROR: Static PAT using the interface requires the use of the 'interface' keyword instead of the interface IP address
 
So I tried that and got this error WARNING: All traffic destined to the IP address of the backup interface is being redirected. WARNING: Users will not be able to access any service enabled on the backup interface.
 
So what is the best practice for configuring inbound NAT for a dual ISP configured ASA

View 1 Replies View Related

Cisco Firewall :: To Put In ACL To Limit Inbound 2621

Apr 20, 2013

I have a 2621 router - old. but works well.Need to put in an ACL to limit the inbound SMTP traffic to be FROM a specific set of IP's, and deny all others.

I have tried various combinations with no luck.  Something obvious, I am sure.
 
When I do a show access lists 160 it shows all SMTP traffic being snagged by the SMTP deny statement.  All other traffic works correctly.
 
Here is my config so far...
 
 Current configuration : 3093 bytes!version 12.2no service single-slot-reload-enableservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname xxxxxxxxxx!logging rate-limit console 10 except errorsenable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx!ip subnet-
[Code] ....

View 6 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved