Cisco Firewall :: Basic ASA 5520 To Allow Access From Internet

Jan 17, 2013

I've got what is probably a very basic question - but i can't figure it out.I have: Internet (ADSL) -> 2851 (ADSL wic) -> 5520 -> internal LAN (192.168.1.x/24)
 
The asa has just replaced a Checkpoint firewall.I've set up the ASA to the point where all hosts on the internal LAN have internet access (using a dynamic PAT on that network).  This all works well.
 
The problem i have is i am trying to allow access from the internet to an internal host on a specifc TCP port (as i had done on the Checkpoint) but i'm getting:
 
Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:111.111.111.11/52135 dst inside:192.168.1.252/5555 denied due to NAT reverse path failure
 
From what i have read i need to add a NAT exemption for this particular use case - to avoid the dynamic NAT i have setup, but im not sure how to do so.I'm running 9.1 on the ASA, no VPNs yet.  Just this basic setup.

View 8 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5550 / Basic NAT From Outside Remote-access IPSec VPN To Inside?

Mar 16, 2012

I cannot get this to work properly and I've even had a Cisco engineer from TAC set-this up... and it literally broke my inside network.  I have a VPN range of addresses..x.x.x.x on the Outside that needs access to a server on the Inside at y.y.y.y.  HTTPS/443 connectivity.  I need to NAT my VPN subnet/pool in order to talk to the inside host, as that host will not accept traffic from my VPN subnet, but obviously, will accept traffic from Inside my private network.
 
The Cisco tech entered the following static NAT statement to "fix" the problem - nat (outside,inside) source static VPN Inside-Network destination static Host-y.y.y.y Host-y.y.y.y For whatever reason, whenever this is configured on my ASA 5550 v8.3(2)25 the Inside interface starts proxy arping and assigns all IP addresses on my private network with the MAC address of the Inside interface. 
 
The y.y.y.y is on a remote, routed network within my private, corporate MPLS network.  My Inside private network (Inside-network shown in the static NAT above) is x.x.x.x.  Not sure why this happens, but it kills my entire network and I have to jump through hoops to quiesce the network and get everything back to normal.I've tried to Dynamic-PAT/hide the VPN range behind the Inside interface through ASDM and that seems to do nothing.The NAT statement above will break my network. How to NAT this connection without killing my Inside network?  Or, on how to properly hide my VPN subnet/pool behind my Inside interface and back to the VPN subnet/pool.

View 1 Replies View Related

Cisco Firewall :: 5520 Cannot Able To Reach Internet Access

Mar 6, 2012

I have been configuring a cisco ASA 5520, everything is working fine but when i create an ACL:
 
-access-list OUT extended permit ip 172.16.x.x 255.255.255.0 any
-access-group OUT out interface outside
 
i added ports like www or 443 and it is not working to Internet access a router is before to my firewall connected to my headquater, i can see my private networks but i cannot able to reach Internet access,

View 3 Replies View Related

Cisco Firewall :: DMZ Access To Internet And See Inside On ASA 5520

Sep 23, 2012

I am new in ASA, I have the DMZ (10.1.1.0/24) configured on ASA 5520 and I achieve the reach Internet from DMZ (10.1.1.0/24), but now need reach DMZ from inside (172.16.12.0/24) and inside (172.16.12.0/24) from DMZ  (10.1.1.0/24), in other words round trip.

View 6 Replies View Related

Belkin Basic Router Is Connected To A Comcast Modem But No Internet Access?

Nov 27, 2011

My neighbor is using my Belkin Router the basic one and has comcast. We both use his internet and have had no problems until the past 3 days. He just got the home phone service from comcast and the phone line is setup through the modem. Ever since comcast came to his apartment and set this up the home phone service to his modem the router is connected but there is no internet access. What is going on and how can I fix this. He has an HP with windows Vista and I have a Toshiba Satellite L675 that has Windows 7 Home premium edition on it.

View 1 Replies View Related

Cisco Firewall :: 891 Setting Up Same Basic Firewall Attributes

Nov 29, 2011

In comparing the 891 (IOS 15.1) firewalling/security features to that of the small business routers, how does one go about setting up the same basic firewall attributes?  with the small business line, you have simple "enable/disable: SPI, DOS, Block WAN request, etc..."how do you go about enabling those same simple things in this router, in particular the "Block WAN request"?

View 3 Replies View Related

Cisco Firewall :: ASA 5520 - NAT And Firewall Access Control

Oct 4, 2012

I have an ASA 5520 in my company which does all our NAT and Firewall access control.  Currently there is a rule in place to allow an incoming connection on port 2222 from a specific ip address to allow access to a web app our developers created.  This is a test before the web app is released live.  Now the web app can communicate with the specific address and port but the incoming connection on port 2222 isn't getting through.  Everything looks great in the firewall but how can I log any hits this ACL takes to identify any potential problems?

View 2 Replies View Related

Cisco VPN :: ASA 5505 - Basic Web Access

Nov 27, 2011

I have a Cisco ASA5505 running the latest asdm and ios. 
 
[I]Cisco Adaptive Security Appliance Software Version 8.4(2) Device Manager Version 6.4(5)206[/I] 
 
I am trying to get basic web resolution and access but not having any luck. I just wanted to know if there is anything special that I needed to do with the ASA before I can do this. I've made a quick visio diagram of the network, see below: [URL]
 
The Vigor has a local sub net of 192.168.0.x/24 however there is also a "For routing use only" option. See below: {URL}. I'm hopeful that by configuring the "For routing use ip address" as one of my allocation of public ip's, that it should work okay. I can actually ping by IP and name from the interface of the ASA but can't do that or browse to websites from clients which have their default gateway set to 192.168.0.252. I was under the assumption web browsing should work out of the box almost as it's treated as an outgoing connection. Here is my config for you to look at: (note, I've tried to set the route outside to the local ip of the dray tek and also the "For routing usage only" IP address). 
 
ASA Version 8.4(2)
hostname gilwoodasa
domain-name gilwood.local
enable password 9PvFytIZ2Vpy8Gon encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
[Code]...
 
So, if you're still reading this - all I am after is a way to get basic web browsing working. Here are the logs which show the attempted web access. [URL]

View 7 Replies View Related

Cisco WAN :: 520 Basic Firewall Configuration With DMZ Required

Apr 19, 2011

I am trying to set up my Cisco 520 router with a firewall that will: Allow port 80 traffic to the vlan 20,Block all other incomming ports to vlan 20 (unless initalised from inside),Allow all outgoing ports on vlan 20,Block all access from vlan 20 to vlan 10 (unless initalised from vlan 10)

View 35 Replies View Related

Cisco Firewall :: Basic Setup For 5510?

Nov 27, 2012

basic configuration for setting up cisco ASA 5510 for NAT and DMZ.

View 9 Replies View Related

Cisco Firewall :: Basic DMZ Configuration On ASA 5510

May 8, 2011

creating a DMZ with my current configuration. Most of my configuration has been through the ASDM as I am still learning. I'm looking for a good tutorial through the ASDM to get me on my way. What I need to accomplish is this:
 
I have an internal GIS server which needs to have a constant database connection to an remote GIS Server which is already configured. I've got a separate VLAN setup on my 3750 switch which connects to the DMZ configured port on my ASA with a security level of 50. My GIS server has been placed in the DMZ VLAN which is accessible from my internal clients. I have a /30 Internet block which is being used for Internet and VPN. I have a separate /28 block that I'm assuming I'll need for the DMZ to work properly.

View 1 Replies View Related

Cisco Firewall :: Pix 515e Basic CLi Configuration

Oct 12, 2011

I dint have any experience in Using cisco pix firewall. i got this for home lab practice.the pix can be accessed and configured by web based and CLI mode right. basic configuariton tto configure pix 515e in cli mode.
 
as of now im using console( hyper terminal) to access the pix. in cli based commands  i need the following
 
1. how to assign ip address to inside ethernet and outside ethernet

2. how to enable telnet and after enabling it , can i connect my pc directly to the pix inside ethernet and do telnetting or if at all possible with (https enabled)web based config. any of these are ohk.
 
went at browsing to find these all i could find is web based configs. i need cli commands.

View 9 Replies View Related

Cisco Firewall :: ASA5520 Basic Configuration

May 21, 2012

This is my 1st time trying to configure an ASA.

I'm trying to establish a very basic connection (ping) between 2 laptops, one sat on the outside interface, and one on the inside as per the diagram below:
  
I can ping back and forth from the ASA to 192.168.1.4, and to 10.1.1.1. However, what I'm trying to achieve is to be able to ping from 10.1.1.1 to 192.168.1.4 and vice versa.

I have attached the configuration file with this post as well.

View 4 Replies View Related

Cisco Firewall :: 871 Configuration - Basic Rules

Jan 3, 2013

I have an 871 and all I need to do is some basic rules. Here is the config I am  having the issue with.

View 1 Replies View Related

Cisco Firewall :: Can't Access Web-server Behind ASA 5520 8.4(2)

Dec 13, 2012

How can I access my webserver (on my private LAN) from the internet? INTERNET------------(53.X.X.1 )ASA(192.X.X.X)DMZ-----------(192.X.X.80)HTTP SERVER. I can ping my public address on the ASA outside interface 53.X.X.1 form the internet, but I'm not sure how to do this. I tried to NAT, but I'm failing.

View 3 Replies View Related

Cisco Firewall :: 5520 Can't Access From DMZ To INSIDE

Mar 13, 2012

I have a cisco asa 5520 ios 8.2. This is my configuration [code] But i can not access from DMZ to INSIDE.

View 3 Replies View Related

Cisco Firewall :: ASA 5520 - Users Can't Access Through By Name

Mar 13, 2011

I just configure an ASA 5520, here is the config (the ip address of outside network if going to change from private direccion by reason security).
 
The problem that I have is the users can access to the web site through the public´s ip address but they do not can access through by name. We review all the config on the server DNS and with the command NSLOOKUP we can see that work fine. The client think that the asa is blocked the connnection.
 
[code]....

View 1 Replies View Related

Cisco :: Basic Ace30 Configuration For Management Access

Dec 13, 2012

in lab trying to run a test upgrade of an Ace30,can seem to get it right ace30 is in slot 1 of the 6500, management vlan 10

View 4 Replies View Related

Cisco Firewall :: ASA 5520 With Windows UAG Direct Access In DMZ?

Dec 16, 2010

I'm trying to set up Windows Server UAG for Direct Access in a Testlab. The UAG Server has two network nics. One in my Testdomain (internal) and the other one in a DMZ of our Cisco ASA (external).Our ASA dmz has subnet 192.168.3.x but UAG Direct Access needs public ip adresses.Is there documentation how to configure an ASA 5520 Firewall so i can use my Windows UAG Server with Direct Access?

View 7 Replies View Related

Cisco Firewall :: ASA 5520 Access To Portal Vpn Is Blocked

Mar 11, 2013

We have an ASA 5520 in HA. (version 8.X upgraded to 9.1 (1))We used Wizzard to configure VPN clientless and portal. Also, configured manually we have the same issue: We can access to the portal using IP address of Lan interface but not with outsides (2 ISP). The clientless VPN is enable on the public interface and no packets rejected in logs.We try to modify the Crypto map created by default to replace "any" to "any" by "any" to "our public IP" (We see that is recommended by Cisco) It works for 10 minutes.(strange..) but after 10 minutes the active member crashs.. only a reboot with previous configuration was good.We try to investigate but each time we modify Crypto maps, the firewall is going bad.

View 7 Replies View Related

Cisco Firewall :: ASA 5520 Difference Between Access Rules And ACL / ACE?

Nov 2, 2011

We are moving from a different vendor to ASA 5520s. So far my "training" for Cisco consists of s  Cisco press book, some white papers and guides, this website, and a bunch of mistakes. So, I have what is probably a pretty basic question for most folks.
 
What is the difference between Firewall Access Rules and ACL/ACE? And when to use which?
 
for example: on my ASA 5520s I've set up an Interface for my internal LAN: 172.16.x.x., a DMZ 192.168.2.0/24, and an interface for the Internet side. The 5520 is set up as a routing firewall betwen my internal lan, DMZ, and Internet.
 
If I want to allow my internal users Internet access for http and https would I use a Firewall Access rule?For most of my rules allowing outbound access from my 172 LAN and DMZ and inbound access to devices in my DMZ can I mostly utilize the Firewall Access Rules?

View 1 Replies View Related

Cisco Firewall :: Configuring Inbound Access On ASA 5520

Dec 18, 2011

I have successfully been able to allow outbound access from inbound hosts  on the appliance; however, I have only one outbound IP address and had to configure outbound access using static PAT.  What I need to do is to configure access to certain inbound hosts from outside.  What's wrong with my running config?  Below are the commands that I believe need to be changed from the configuration. [code]

View 14 Replies View Related

Cisco Firewall :: 5520 - Remote Access VPN Through A Tunnel?

Oct 17, 2011

I have a site to site VPN between SiteA to SiteB which is working fine. SiteA has an ASA5520 and SiteB Pix501. The ASA5520 is running version 804 with split tunneling. Users connect to SiteA using remote access VPN. Is it possible to setup SiteA ASA5520 so that when users connect to SiteA they can access servers located on SiteB through the tunnel? I know i can setup the Pix501 for remote access VPN but it is located in another country and i don't want to take a chance just incase i lose connectivity.

View 7 Replies View Related

Cisco Firewall :: Basic Config Transparent Mode ASA 5510

Apr 19, 2012

I m trying to set my friewall in my network. The network is very simple. I have my router in 192.168.16.1 255.255.255.0 (mac-address  58-98-35-2a-4c-39) I have my switch in 192.168.16.26 255.255.255.0 (mac-address 00-19-99-5d-1f-43) and i have my firewall ASA between the router and the switch in 192.168.16.250 255.255.255.0 (mac-address 64-9e-f3-ba-28-c9)
 
So i need to configure 3 interface in my ASA.
- OUTSIE e0/0(I call it INTERNET)
- INSIDE e0/1(I call it LAN)
- MANGEMENT m0/0(I call it MANAGEMENT)
 
[Code]....
 
But with this config when I plug the firewall, i dont have access to internet anymore.

View 7 Replies View Related

Cisco Firewall :: Creating Access Rules On ASA 5520 Platform

Aug 2, 2011

Our company has recently upgraded our firewall from a Borderware Steelgate v7.1 platform to a Cisco ASA 5520 platform.  Needless to say the interface on the Cisco platform is much more complex and I don't have much experience working with firewalls. Our other IT guy is out of town and this is the first time I have worked on this setup. 
 
I need to create the following access rule
 
I need to open port 4**0 to be allowed through the firewall from external ip address 10.XXX.XX.XXX only. Then forward port 4**0 to 10.XX.XX.XX port 80 tcp

View 9 Replies View Related

Cisco Firewall :: 5520 Can't Access Internal Web Server From Outside Network

Aug 23, 2011

I am using ASA 5520 with 8.2.4 IOS. I'm new to ASA/Firewall. I need to do access webserver from outside network.From Laptop (192.168.2.51), If I connect to url... it should open page from 10.10.10.50.I also need to ssh to webserver from laptop. If I ssh to 192.168.2.50 from laptop, it should connect to 10. 10. 10.50. [code]I can't get to webserver from outside network, so now, I connected laptop to directly ASA 5520 outside port with crossover cable.ASA Inside port connects to L3 switch. Webserver also connects to L3 switch. But still doesn't work.

View 9 Replies View Related

Cisco Firewall :: ASA 5520 Access Rule Duplicating Existing One

Jul 3, 2011

After upgrading to 8.4(2) and ASDM 6.4(5) I seem to have an extra access rule duplicating an existing rule, this is only visable through the ASDM. When using the CLI you can't see this duplicate rule.
 
I therfore get the following warning everytime I make a config change using the ASDM [code] If I delete this rule it returns everytime I launch the ASDM!
 
I also have extra config under Firewall>Configuration>Public Servers that I didn't have before. If I delete it, again it returns.

View 8 Replies View Related

Cisco Firewall :: ASA 5520 - How To Configure Logging For Remote Access VPN

Apr 16, 2012

i have cisco ASA5520 and i have a remote access vpn .I want to configure logging for this remote access vpn.
 
i want the time user connected .how log it is connected .If any error while connecting ?

View 4 Replies View Related

Cisco Firewall :: 5520 - Error Message When Trying To Access ASA (8.0(3)) With Asdm

Aug 26, 2012

When trying to access the asa (8.0(3)) with asdm the console send follwing error message:
 
vPif_isVpifNumValid: pifNum out of range!
vPif_getVpif: bad vPifNum(0xa6) from 87EBC81 from 83833B4
 
Have a strong suspicion that it is a hardware failure (since asdm has worked and have tried to restart the box) can not see any errors with any show commands, but could it be a RAM error .

View 1 Replies View Related

Cisco Firewall :: 5520 - Efficient Way To Organize ASA Access Rules

Nov 4, 2012

This is just a general question... is there a good way to organize the ASA's access rule list to increase its efficiency?  Maybe by service or hit count (Top 10).  I am using the Cisco ASDM 6.2 to manage our ASA 5520. 

Looking at it looks very unappealing and I'm in the process of adding names and descriptions to all the Network Objects.

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Filter Is Not Allowing To Access Certain Websites

Aug 20, 2012

We have a Cisco ASA 5520 and Web sense.  I added a filter but it seems like it is still not allowing us to access a certain website from most of the machines however some machines with the same configuration work on the DMZ. Accessing website tells us:

"Firefox has detected that the server is redirecting the request for this address in a way that will never complete". 

Filter I applied on the firewall:

filter url except 0.0.0.0 0.0.0.0 64.18.218.0 255.255.255.0 allow
filter https except 0.0.0.0 0.0.0.0 64.18.218.0 255.255.255.0 allow

View 9 Replies View Related

Cisco Firewall :: Basic Port Forwarding ASA5505 Version 8.4 ASDM 6.4?

Nov 24, 2012

configuring the ASA particulary after the change to how NAT is implemented.  What I am trying to accomplish logically seems fairly simple, yet I cannot get it to work.  I have a Synology NAS at home that I am trying to reach via the internet.  Prior to using my ASA, I had Verizon's FIOS router as my gateway and everything forwarded with no issues.  The ports I need forwarded or reachable via the internet are TCP port 80 and 5000.I can also configure it via command line if that's the easier/preferred method.

View 11 Replies View Related

Cisco WAN :: 5520 - ASA Internet Access

Oct 9, 2011

i have an ASA 5520 version 8.4(1) the wan interface is 216.41.115.33 and the internal subnet is 192.168.1.0 /24 what would be the exact nat command so users on the internal subnet can access the internet ?
 
e,g, object network internal_subnet
nat (Internal,WAN) static WAN_22

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved