Cisco Firewall :: Can ASA 5555 Translate To Secondary IP Address Block

Oct 14, 2012

I just purchased an ASA 5555 and started to configure.  I was successful in natting all the IPs that are on the same subnet as the ASA eth0.  I could not get the nat working for the 2nd address block.
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address

View 4 Replies


Cisco Firewall :: Secondary IP Address In ASA5510

Feb 7, 2013

Just want to know if there is a way to configure secondary IP address on the outside/public interface of ASA/PIX.One of our clients have used most of their IP on the subnet given by their ISP. They use those IP's for staticallymapping to Servers inside their local LAN. Thus, they requested another block/subnet from their ISP. They will also use this for static mapping/port forwarding to other servers in their network. The current UTM they are using is allowing this but they would like to use ASA/PIX as their main Firewall. Is this even possible or is there a workaround for this kind of scenario?

View 5 Replies View Related

Cisco VPN :: 5520 - How To Translate One Inside Address To Another

Oct 23, 2011

I guess I'll start with the easy stuff, Cisco ASA 5520 ver 8.2, ASDM ver 6.2, IPSec L2L tunnel with overlapping private IPs.
I have about a dozen L2L connections on our 5520 but never had to do one with overlapping IPs. I have two that I have to build and one definitely overlaps our inside locals, and the other is requesting that we NAT our inside locals to a 10.x.x.x.
I've searched the board and found several good posts including document 112049, but I just don't seem to be able to get my head around how to translate one inside address to another. It would seem like is would be as easy as doing an (inside,inside) static NAT, but most everything has the solution as a policy NAT or doing an (inside, outside) but in the less secure address space place the name of an ACL. I have ordered that brick of a book on ASAs from Cisco Press, but need to get something going and I'm not having much luck getting this thing up and running.
Perhaps my basic understanding of NAT rules is wrong. I thought that when using NAT the command speaks to the interfaces and the direction of travel, (inside,outside). I also thought that the IP adresses used must be valid on the interface refferenced, so any refference to "inside" would have to be an address on the "inside interface of the FW and likewise for the "outside" interface. Finally, to be sure I'm not calling a duck a goose my understanding is that the following are correct; "inside local" = my private, "inside global= my peer, "outside local"= their private, "outside global"= their peer.
So if I'm translating say a 192.x.x.x on my inside local and wanted to present them a 10.x.x.x, wouldn't I need an (inside,outside)? And even though I'm translating my private IP into a different private IP, the translated IP must be on the "outside" interface because that is the interface that I want to present the new private IP on?
So for the scenario I suggested at the top where I need to translate my private 192.x.x.x into a 10.x.x.x and present that 10.x.x.x to the other side, I need something like NAT Static (inside,outside) 10.x.x.x  192.x.x.x?

View 8 Replies View Related

Cisco WAN :: 1941 Cannot Translate Private To Public IP Address Using NAT

May 4, 2012

I have 5 workstations with 2 servers but the backup server (black) is shut down intentionally.I have 1 cisco gigabit unmanaged 8 port switch and 1 cisco 1941 vpn router.The cisco 1941 vpn router is configured for IPVPN connection to other branches.

1. Configure NAT to enable the 5 workstations to be connected to the internet thru the router to the ISP.
2. Configure NAT to enable the server to be accessed from outside using the public IP address provided by the ISP. [code]


1. I can ping other pc on network.
2. When I typed in the ISP's public ip address on the browser, i got into the modem user interface for configuration.
I still can't connect to the internet. When i do tracert, it stops on the hop and didnt continue. This shouldn't be the case since i want to connect using the GE0/1 outside port for the internet.

View 6 Replies View Related

Cisco Firewall :: Block Ip Address From CLI At PIX Firewall Version 6.3(4)?

Oct 11, 2011

I would like to know  how can I block a ip address from the  CLI at the Cisco PIX Firewall Version 6.3(4)

View 4 Replies View Related

Cisco Firewall :: 5555 ASA Disabling Proxy ARP

May 19, 2013

We just recently upgraded a 5540 ASA running 8.2 to a 5555 running 8.6.  I have a question concerning disabling proxy ARP with static nat rules in place.  We have several instance where devices in a dmz have a static nat entry to the outside and a static nat entry to the inside using the same IP.  My question is if we disable proxy arp on the inside interface would that cause device on the inside not to be able to reach the device in the dmz? From what I have seen you don't want to disable it on the outside interface due to all the static nat translations.  But we have some that are have nat translation going to the inside as well.  How does proxy arp come into play there?  Below is a diagram of an example of the setup I a referring to.  This is on the new 5555 running 8.6

View 1 Replies View Related

Cisco Firewall :: ASA 5550 To ASA 5555-X Migration

Apr 23, 2013

I am about to carry out a migration from ASA 5550 to ASA 5555-X, however I cannot find any detailed document or reliable tool for this migration.

View 4 Replies View Related

Cisco Switching/Routing :: Translate Inside Network Of To Outside ISP Address On ASA 5505

Oct 2, 2012

I'm trying to translate my inside network of to my outside ISP address on ASA 5505. The ping from all hosts to works, but it still only let's one address out to translate.My configuration is:
global (outside) 1 interface
nat (inside) 1
still doesn't work.

View 2 Replies View Related

Cisco Switching/Routing :: Translate Inside Network Of To Outside ISP Address On ASA 5505?

Oct 2, 2012

I'm trying to translate my inside network of to my outside ISP address on ASA 5505. The ping from all hosts to works, but it still only let's one address out to translate.My configuration is:
global (outside) 1 interface
nat (inside) 1
still doesn't work.

View 3 Replies View Related

Cisco Application :: CSS11503 / Make NAT From Inside Addresses And Translate Into One External IP Address?

Dec 8, 2011

I know the CSS is too old but I have one in production environment and I was asked if it is possible to CSS to make NAT from inside addresses and translate them into one external IP address to diferent kind of communications, for example: and (inside addresses) should start connection to external IP addresses destinations / / and so on, the default gateway to those Servers is the CSS and I would like to know if it is possible that all connection to external world to be translate into one IP address
My CSS is 11503
Version: sg0810106

View 2 Replies View Related

Cisco Firewall :: Block Website Or Ip Address From ASA 5505?

Apr 27, 2011

if it is possible to block a website or ip address from an ASA 5505? if it is possible, can you give me an example of the commands to get it done?

View 2 Replies View Related

Cisco Firewall :: ASA5510 - Block IP Address From Outside Interface

Jun 23, 2011

Recently, I've been having significant problems with denial of service on our ASA-5510. Two IP addresses in particular attack my ASA regularly. What kind of rule do I need to create to deny these IP's access to my firewall?

View 4 Replies View Related

Cisco Firewall :: 5512 Able To Be Field Upgraded To 5515 And Through 5555

Jan 10, 2013

Is the 5512 able to be field upgraded to a 5515 and so on through 5555?  I.E. Can I add ram and other hardware to make the boxes more powerful as my requirements increase?  I was hoping this would have been a new feature with the ngen firewalls.

View 3 Replies View Related

Linksys Wireless Router :: EA4500 - Translate Ipv4 Address And Port To Ipv6?

Nov 9, 2012

I have a virtual machine running in my desktop which connected on the gigabit lan port on EA4500 with firmware 2.0.37.What I want to be able to do forward a port that came from an external ipv4 address to the ipv6 address and a different port to my virtual machine (to remote desktop port 3389).The reason I want to convert the traffic to ipv6 is because virtual machine is running vpn and is not reacheable through ipv4 (unless bunch of routes are setup and things get complicated etc). I verified my phsical server and virtual server get both ipv6 ip addresses through ipv6 tunnel from comcast. Without tunneling I could not get ipv6 setup using automatic mode with comcast, it simply did not work for some reason.

View 1 Replies View Related

How Does Firewall Block Or Filter Traffic On Specific Port Or IP Address

Nov 15, 2011

How does a firewall block or filter traffic on a specific port or IP address?

View 1 Replies View Related

Cisco Firewall :: 870 - Possible To Do Static NAT Which Can Translate To A

Nov 30, 2011

I have a firewall which is conntect to a Cisco 870 router.
The router only allows one ip address to ssh into and it which is but the interface which is connected to the router is on the firewall is a and the router interface is a
I can ping the router from the inside of my firewall, but I can't ssh into it at is has a access list which will only allow ssh from the ip address
Would it be possible to do a static NAT which can translate the to a when I ssh into the router when coming from the inside?

View 11 Replies View Related

Cisco Firewall :: How To Translate Both Source And Destination In ASA 8.2

Apr 16, 2012

I have a internal subnet sitting behind an ASA firewal 8.2 and would behind accessing to web server which sits behind the outside interface of the ASA firewall.The access would be like this:
1) will be accesing to the web server
2) We would like to translate the source to the firewall outside IP address
3) We would like to translate the destination web server to as well

How to perform this simultaneous source and destnation address translation in ASA firewall 8.2? Could this be done in ASA firewall 8.2?

View 1 Replies View Related

Cisco WAN :: 2821 / Using Secondary IP Address For NAT?

Mar 16, 2012

On a cisco 2821 running 15.1(3)T1 From this cisco DOC, common use of secondary IP addresses on an interface are
•There might not be enough host addresses for a particular network segment. For example, suppose your subnetting allows up to 254 hosts per logical subnet, but on one physical subnet you must have 300 host addresses. Using secondary IP addresses on the routers or access servers allows you to have two logical subnets using one physical subnet.

•Many older networks were built using Level 2 bridges, and were not subnetted. The judicious use of secondary addresses can aid in the transition to a subnetted, router-based network. Routers on an older, bridged segment can easily be made aware that many subnets are on that segment.

•Two subnets of a single network might otherwise be separated by another network. You can create a single network from subnets that are physically separated by another network by using a secondary address. In these instances, the first network is extended, or layered on top of the second network. Note that a subnet cannot appear on more than one active interface of the router at a time.
On the WAN interface I've added two Secondary Public IP's (from the same subnet) to use for NAT to internal hosts.  Is this a common scenario or is there a more typical way to acheive this. This assumes, I do not want to put a Public IP on an interface on the internal server.
interface GigabitEthernet0/1
description WAN$ETH-WAN$
ip address x.x.x.1
ip address x.x.x.2 secondary
ip address x.x.x.3 secondary


View 2 Replies View Related

Cisco Firewall :: How To Forward Hit Request On 5555 Port To 80 Port

Nov 7, 2011

I have one server and i nat this server to a public ip X.X.X.5 and i open RDP for this public ip.Now when i access Remote desktop on this public ip x.x.x.5 it open perfectly.Now my senario is that i want to open a http url on port 5555,server ADMIN open port 80 for this URL on LOCAL lan( how can i map port 5555 to port 80 on ASA when i hit URL [URL]

View 5 Replies View Related

Cisco VPN :: 871 - Backup GRE Tunnel Using Secondary IP Address

Oct 3, 2011

Is it possible to setup a Backup GRE Tunnel using a Seconadary IP Address on the WAN interface.  The router is a Cisco 871. 

View 33 Replies View Related

Cisco WAN :: 1811 - NAT A Whole Subnet To Secondary Address?

Mar 23, 2012

I've got an 1811 router running 15.4 IOS and a cable modem with 5 static IP's attached to Fa0. I would like to dedicate one of those IP's to a dedicated internal subnet ( but I am not sure how to accomplish this?
What would be the best method to accomplish this? Unsure of where to begin..

View 3 Replies View Related

Cisco Switching/Routing :: HSRP On Secondary IP Address - 2900

Feb 21, 2013

I have a few old 2600 routers (2621, different IOS's) which I'm now replacing for new one's from the 2900 series (2901, Version 15.1(4)M4).In my configuration I have two IP addresses in my LAN interface and I have HSRP configured within the secondary IP subnet range. It would be something like this:
interface GigabitEthernet0/1
ip address 172.x.x.x x.x.x.x secondary
ip address 10.z.z.z z.z.z.z

Now, in the new 2900 routers, my interface configuration hasn't changed however I can see that the hello packets are now sent with the source within the respective HSRP IP subnet so I had to edit my acl for that:
permit udp 172.x.x.x x.x.x.x host eq 1985
Is there a way I can force the HSRP to work as it previously did in the old IOS's?

View 3 Replies View Related

Cisco Switching/Routing :: C6509 - Broadcast Not Working Between Primary And Secondary IP Address

May 11, 2012

I have recently configured secondary ip address on LAN Interface of Cisco C6509.. We have some application which needs to use broadcast traffic communication to communicate with client... Broadcast is working within subnet    & also working from broadcast server to primary subnet. But not working from secondary subnet.. I have checked broadcast within secondary IP range & it's working fine...  Secondary not working broadcast with primary and also with broadcast server... broadcast address is different for these subnet but both should be communicate since configured on same interface... When I went through Cisco website found that command "ip directed broadcast" which will pass broadcast to different subnet... But I'm not sure whether any other impact if I enable that command on particular Ethernet interface...

View 6 Replies View Related

Cisco Switching/Routing :: 6500 Shutdown Interface On One Router / Deleted Secondary Address

Jul 15, 2012

I have just updated a VLAN interface on my router. I have two 6500's with GLBP configured. The particular interface had a primary and secondary IP address. I shutdown the interface on one router and deleted the secondary address then assigned the orignal secondary address to be the be the only address associated with the interface and enabled the interface and it came right back up...all looks good. I proceeded to do the same thing to the other router and once again all looked good. Now, I am able to PING the devices in the subnet from router, but am unable to ping them from any place else. [code]

View 2 Replies View Related

Cisco Firewall :: ASA5510 Secondary Firewall Crashes After Upgrade To 8.4.1

Jun 29, 2011

I have two ASA5510's set up in failover, and the secondary keeps crashing after doing the interface checks when bringing failover up. This only happens if I try to upgrade the image on the secondary to anything newer than 8.4.1 (I've tried with 8.4.1-11 and 8.4.2). The primary one run just fine with new images.
I don't have the exact error right now, as I need to do a screen capture from console. It's just a huge crash dump.Are there anything I might have missed during the upgrade? Should I cold-boot both the firewalls in the correct order?

View 7 Replies View Related

Cisco Firewall :: ASA 8.4 / Translate Port 80 From Outside Connection On Port 85 In LAN Server?

Dec 27, 2011

i must translate port 80 from outside connection on port 85 in lan server? how can i configure the asa firewall rules for complete this task?

View 4 Replies View Related

Cisco Firewall :: Secondary ASA 5550 Firewall Getting Down Automatically?

Apr 17, 2011

I am having two ASA 5550 firewall running in active/standby mode. With in last two months our secondary firewall got down automatically 3 times. Firewall is running with IOS version 7.1.2. how to proceed further troubleshooting because there are not any logs on firewall.

View 3 Replies View Related

Cisco Firewall :: Asa5510 - How To Add Secondary Firewall

May 4, 2012

I have a cisco asa 5510 with security plus license in Live enviroment . I need to add a secondary firewall . I was planning to do in active /standby mode for failover .But i have a doubt , when i do "show version " on live asa output says Active /active failover , does this means that i can only configure failover in active/active mode not in active/standby (which i want to do )?

Maximum Physical Interfaces  : 8
VLANs                        : 20, DMZ Unrestricted
Inside Hosts                 : Unlimited
Failover                   : Active/Active
VPN-DES                      : Enabled
VPN-3DES-AES                 : Enabled
VPN Peers                    : 25
WebVPN Peers                 : 2
Dual ISPs                    : Enabled
VLAN Trunk Ports             : 8
AnyConnect for Mobile        : Disabled
AnyConnect for Linksys phone : Disabled
Advanced Endpoint Assessment : Disabled
UC Proxy Sessions            : 2

This platform has an ASA 5505 Security Plus license...

View 4 Replies View Related

Cisco Firewall :: Secondary IP Over 5505 Fastethernet

Jun 13, 2012

I would like to know if is possible to configure a secondary IP address in a 5505 interface ??

View 1 Replies View Related

Cisco Firewall :: Implement Secondary ISP To ASA 5510?

Aug 27, 2012

We are in the process of implementing secondary ISP to our ASA firewall and We would like to run both ISPs in parallel so we can test until we finally cutover?

View 2 Replies View Related

Cisco VPN :: IPSec Tunnels Between ASA 5510 And 5555

Nov 13, 2012

I have an ASA 5510 running ver 8.0(2) that has (4) Ipsec tunnels going from it to various other locations.  I am having an issue with data transfer speed on only one of the Tunnels.  This tunnel is between the 5510 and the 5555, on that link I am getting a dat transfer rate of a little over 120k a second, whereas if I pull the same set of files from another location I am seeing a transfer rate of 5m per second. 
I have verified that it is not a capacity issue on the Internet bandwidth on both locations, and I can pull the same data from the same location to various other locations via Ipsec tunnels, I am only having an issue with a specific tunnel going from the 5510 to the 5555. 
Since it is not affecting other tunnels on the 5510 nor is it affecting tunnels on the 5555 going to other locations, I am leaning toward a routing issue within the ISP?  I will say the ISP is taking me a long way around to stay in the same Metropolitan area.

View 1 Replies View Related

Cisco :: Private Address Block -

Apr 11, 2011

how the address stops at 31 in the second octet. I'm not even completely sure how it starts at 16 for the first address ( are we dealing with subnets?

View 10 Replies View Related

Cisco Firewall :: Assign Secondary ISP-2 Pool IP To DMZ Server?

May 15, 2011

Can we assign Secondary ISP-2 Pool IP to DMZ Server, network design attached for reference.

View 2 Replies View Related

Copyrights 2005-15, All rights reserved