Cisco Firewall :: Communication Between Interfaces Of ASA 5510?

Mar 12, 2011

I configured ASA 5510 ...
 
Totally it had 5 ports..
 
How to provide communication between two different interfaces which had configured as same security level?
 
How many trunks will support ASA 5510 with base-license?
 
How to configure trunk to an interface with different VLNs( Router on a stick).

View 6 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5510 Communication Between Two Internal Interfaces

Jun 11, 2013

I've been following most of the comments in regarding how to allow communication between two internal networks on a ASA5510 8.2.5 But I am still a little confused about to how to set my firewall. I made chages to it and still do not have the desired results.
 
I need to allow comunication between Interface 0/1 and Interface 0/2. See configuration file with fake or dummy ip address below.
 
ASA Version 8.2(5)
!
hostname ciscoasa
domain-name lxx.com

[Code].....

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / Provide Communication Between Two Different Interfaces

Mar 12, 2011

Is it possible to provide communication between two different interfaces which had configured as different security level in ASA 5510?

View 3 Replies View Related

Cisco Firewall :: Communication Between 2 Inside Interfaces On ASA 5510

Oct 23, 2011

I have a Cisco ASA 5510 configured to access the internet, with an:

inside interface (ethernet 0/1) 130.130.0.254 and outside interface (ethernet 0/0) x.x.x.x
 
I have now configured another inside interface (ethernet0/2) on ASA with the IP 172.16.0.254 and I have connected it directly to another switch with a management IP 172.16.0.5.
 
The problem is that the two inside interfaces (130.130.0.254 &172.16.0.254) cannot communicate with each other thus the e0/2 172.16.0.254 interface cannot access the internet.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 - Inside To Dmz Communication

Mar 5, 2011

configure ASA 5510 as below
 
inside users should communicate with Hosts on the DMZ Zone and at the same time they should go for internet towards outside interface
 
ASA with 8.3(1)
default security levels
 
attached is the digram for your reference need communicate form inside to DMZ

View 1 Replies View Related

Cisco WAN :: 1941 - ASA 5510 Via VPN Tunnels For Communication Back To Servers Behind Firewall

Jun 20, 2012

I am setting up a network that will use the 1941 router with a cellular card (HWIC) to connect to the Internet for communication with remote stations in the field. The 1941 has a static IP address (166.142.xxx.yyy) on the Internet provided by the ISP (Verizon). The 1941 is connected via ethernet to the ASA5510. The end goal is to have the field cell routers (Digi Transport WR-44-R, also static IP) connect to the ASA5510 via VPN tunnels for communication back to the servers behind the firewall. I'm not sure exactly how to configure the 1941 so that the remote router can connect to the ASA using the public IP of the 1941 router. I have the 1941 working stand alone and can connect to the Internet and pass traffic, but I tried a static NAT to translate the public IP to the private IP of the ASA and cannot pass traffic. below is part of the 1941 configuration: [code]
 
Do I need to use VLAN bridging to accomplish the task or am I missing something with the NAT?

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - IP Sec VPN On Sub-interfaces

Jun 20, 2012

Can  ASA sub-interfaces run separate IP Sec VPN tunnels eg
 
There are 02 sub-interfaces of 01 physical interface of Cisco ASA5510 [ASA Version 8.2(5)] and I need to run 01 IP Sec VPN tunnel on each of these

View 1 Replies View Related

Cisco :: FWSM Communication Between Same Security Level Interfaces

Sep 21, 2012

I have 2 dmz interfaces(dmz1 and dmz2) with security level 50. I am able to ping the hosts on dmz2 from dmz1. I am running a service on a dmz2 host on port 82 but i am not able to access that service from dmz1. Also, i have an inside interface at security lever 99 which is able to access that service.

Also, i have defined the following command to allow same security level communication.

same-security-traffic permit inter-interface

View 2 Replies View Related

Cisco Firewall :: ASA 5510 With Two Outside Interfaces Which Is In Separate ISPs

Jan 5, 2013

I have ASA5510 with PLUSE License.I have 2 Inside interfaces as STAFF and MAIL and two Outside interface OUT_STAFF and OUT_MAIL which is in separate ISP's.now i want to nat STAFF to OUT_STAFF and MAIL to OUT_MAILbecause I'm having two default routes it gets impossible to do.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 And Having Two Outside Interfaces For Voice And Data

Feb 13, 2012

I have a question regarding firewall configurations. Is it possible to have two interfaces ( for two internet service providers) one for voice and one for data. Can I have two Outside Interfaces that one will apply to a pppoe client group and the other will apply to a static IP? Is this possible and if so What would be the steps on applying this connection? Also to note I have a point to point connection already established for the pppoe. I also have another point to point connection for data, but however I do not know how to apply this to the firewall.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - 2 Internet Interfaces Without Traffic

Jan 15, 2013

I need to route to sub nets form 2 different ASA interfaces. The ASA also has an outside interface works like gateway for internet access. Here is my configuration:

ASA Version 8.2(1)
host name ICE3
names
interface Ethernet0/0
name if outside
security-level 0
ip address 201.199.xxx.xx 255.255.255.248
[Code]....

View 9 Replies View Related

Cisco Firewall :: 5510 ASA Cannot Create Sub Interfaces For Intervlan Routing

Apr 8, 2013

I am trying to setup intervlan routing with a Cisco ASA 5510 and two 2960-S switches. The 5510 currently is using ASA Version 7.0(2) and has a base license. I tried to create a sub interface today based on some info I found regarding the routing piece and it didn't recognize the command. I'm thinking I may need to update the IOS code or the license on the firewall. I know the syntax was correct because I looked it up and found it in a Cisco document.

View 15 Replies View Related

Cisco Firewall :: ASA 5510 Redundant Interfaces With Stack Switches

Jun 10, 2013

we have two ASA 5510 connected in failover, and a pair of cisco 2960s switch connected in stack. Currently one interface of primary ASA is terminated on switch1 and a interface from standby is connected to switch2 as Inside, and switch1 and switch2 are in stack. for redundancy purpose i want to use multiple interfaces of ASA for inside , so first i thought to use etherchannel , but it has a limitation that , it cannot be terminated on stack switch(as per cisco document [URL]
 
So my question is :
 
1. can we use redundant interface feature where  2 physical interfaces combined to a redundant interface (eg interface redundant 1) for inside redundancy purpose.

2. Can these ports from primary/standby ASA terminated on stack switches (2960s), will this work (if the switch with active port goes down, will the other port take over in the redundant interface with the other switch).

View 1 Replies View Related

Cisco Firewall :: 5510 - Get Internet Connectivity On ASA Inside Interfaces?

Dec 30, 2012

I have a Cisco ASA 5510 with 3 inside interfaces each connected to a 3750X switch port in a vlan. Outside interface is connected to external router with 209.155.x.x public IP. Static route exists for outbound traffic on outside interface.
 
3750X is configured for inter-vlan routing. VLANs 10, 20, and 30 have 172.16.x.1 IP address with static routes pointing to the each of the ASA inside interfaces - 172.16.x.254. Connected hosts are configured with gateways pointing to the appropriate vlan interface IP - 172.16.x.1.
 
Inter-vlan routing appears to be working - I can ping back and forth between hosts on different vlans, and I can ping each vlan IP.I can also ping each ASA inside interface from a host in the appropriate vlan, but I cannot ping internet sites (4.2.2.2 or 8.8.8.8) from hosts on the inside interfaces.
 
I can ping 4.2.2.2 from the ASA CLI. I can ping internal hosts on vlans 10,20,30 from the ASA CLI. But, no luck with pinging from inside host to internet hosts

View 12 Replies View Related

Cisco Firewall :: Unable To Create VLAN Interfaces In ASA 5510

Nov 13, 2011

Unable to create VLAN interfaces in ASA 5510

View 1 Replies View Related

Cisco :: Communication Between Subnets On 5510

Sep 13, 2011

I am working on a Cisco 5510 with multiple interfaces and requirements. I have experience with Cisco IOS, but not too much with the ASAs. I seem to be getting a bit confused on the NATing and ACLs on a firewall that was started by another employee, who is no longer here. With my current config I can get the firewall in place (we are currently using an older PIX) and most basic functions work except for two key things: 1) communication from the finance interface to the inside interface. The finance subnet has some restrictions that you will see in the ACL- we are trying to limit connections to the those systems, but they need to be able access an e-mail server on the inside. 2) communication from the DMZ interface to the inside interface. Maybe related to the first problem?

View 2 Replies View Related

Cisco VPN :: ASA 5510 / Two Branch Communication?

Nov 10, 2011

I have an ASA 5510 configured with two L2L VPNs from the headquarter to two different branches.I m using the ASA “outside” interface which is connected to the internet in order to establish and configure the 2 VPN connections.  Branch 1 could communicate with branch 2 through the ASA?

View 1 Replies View Related

Cisco Firewall :: Make Communication Between 2 Vlans On Firewall 5520 ASA 8.2

Jan 1, 2012

communication between 2 vlans.i have 2 vlans
 
Vlan 100
ip add 1.1.1.1
!
!
!
Vlan 200
ip add    2.2.2.2 
 
i want to make communication between 2 vlans on firewall 5520 ASA 8.2.

View 1 Replies View Related

Cisco :: ASA 5510 Ping Between Inside Interfaces

May 4, 2012

I have two inside interfaces (both security level 100) inside and inside110. Inside is 192.168.105.3/24 and inside110 is 192.168.110.3/24. I have a PC on the 192.168.105.0/24 network. I cannot ping the 192.168.110.3 IP of interface inside110.

View 2 Replies View Related

Cisco WAN :: ASA 5510 ASDM 6.1 - Getting Multiple WAN Interfaces?

Aug 20, 2012

I am trying to enable a second WAN interface on our ASA.the end goal is to move all internet traffic to the new connection, but first i want to test it working.I have setup my computer as an object in the ASDM and the interface is configured correctly (same settings on a different router and that was working)I setup a route with a lower metric ( 1 lower than the default route which routes everything through current main internet interface) to route traffic from my computer out through the new interface but i am still connected on the old interface.I duplicated some of th NAT rules  (but i would have thought if these werent working then i would have no internet connection anyway)

View 5 Replies View Related

Cisco VPN :: Remote User VPN Across Interfaces 5510

May 5, 2013

I have a client that wants to segment their wireless network behind their ASA.  We currently have a normal setup, 5510, 2 interfaces, outside, inside.  On the inside network there are Cisco Wireless APs that allow for internal access to the network.  We want to move the APs to a new interface on the ASA and only allow traffic bettwen this new "Wireless" network and the internal network by using remote user VPN.  So my question is, can you use remote user VPN from the new Wireless network to the inside network?? 

View 1 Replies View Related

Cisco Firewall :: Allow Passive Ftp Communication In PIX 6.3(5)106?

Nov 11, 2012

How can I allow passive ftp communication in PIX 6.3(5)106.

View 5 Replies View Related

Cisco WAN :: Forcing Traffic Through Specific Interfaces ASA 5510

Mar 6, 2012

How to force traffic back out the same interface from whence it entered.  Review the following topology.
 
Internet ---> ASA 5510 ---> Static IP1 ---> F3.1 ---> 1811 F0
                             |-------> Static IP2 ---> F3.2 ---> 1811 F5 ---> VLAN Int
 
ASA F3.1        10.1.254.9/30
ASA F3.2        10.1.254.13/30
1811 F0          10.1.254.10/30
1811 F5          10.254.1.14/30
 
When pinging the public IP of ASA F3.2 from the internet a reply is never received because the default route on the 1811 points to ASA F3.1.
 
How do I get the replies from the 1811 to go back out the same interface from whence it entered ? I am sure the answer is policy-based routing, but not sure how to write the config.

View 1 Replies View Related

Cisco Firewall :: VLAN Communication On ASA5510?

Aug 10, 2012

I have a working environment but wondering if there is just a better way to accomplish what I am trying to do (without a layer 3 or 4 switch). Basically I have a few sub interfaces on my Cisco ASA5510.
 
Now what I do need is some of the VLANs to communicate with specific devices on the different VLANs. So for example I need computer 1 from VLAN 5 to communicate with 192.168.10.5 from VLAN 10 on ports 80 and 443.
 
What I am currently doing is settings the security level to 100 on each interface (including the DMZ).
 
Here is what I have:
 
interface Ethernet0/1.5
vlan 5
nameif Sub5

[Code].....

View 5 Replies View Related

Cisco Security :: ASA 5510 / Routing Http Flow On Two Different Interfaces?

Jun 21, 2012

I use 3 interfaces on an ASA 5510. First interface is Lan, Second interface is Outside, Third interface is ADSL The Outside interface is used for VPN L2L and smtp traffic. (Leased line on router managed by ISP)The Adsl interface is used for Http traffic. (Adsl Cisco router) I use this configuration found on another forum subjet for routing.route outside 0.0.0.0 0.0.0.0 x.x.x.x 1route adsl 0.0.0.0 0.0.0.0  y.y.y.y 2 nat (inside) 1 0 0global (outside) 1 interfaceglobal (Adsl) 1 interface static (Adsl,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0 The problem is now I have an www intranet server on the VPN remote site. How i can exempt the http traffic to the intranet server routed through Adsl interface?

View 7 Replies View Related

Cisco VPN :: Separate L2L VPN Tunnels On Multiple External ISP Interfaces With ASA 5510

Oct 18, 2012

Due to special circumstances we have 2 ISP links on an ASA5510. I am trying to terminate some L2L VPN tunnels on one link and others on the second ISP Link, eg below:
 
LOCAL FIREWALL
crypto map outside-map_isp1 20 match address VPN_ACL_Acrypto map outside-map_isp1 20 set peer 1.1.1.1crypto map outside-map_isp1 20 set transform-set TS-Generic
crypto map outside-map_isp2 30 match address VPN_ACL_Bcrypto map outside-map_isp2 30 set peer 3.3.3.3crypto map outside-map_isp2 30 set transform-set TS-Generic
crypto map outside-map-isp1 interface ISP_1crypto map outside-map-isp2 interface ISP_2
crypto isakmp enable ISP_1crypto isakmp enable ISP_2
route ISP_1 0.0.0.0 0.0.0.0  1.1.1.254route ISP_2 3.3.3.3 255.255.255.255  2.2.2.254
 
Establising the VPN tunnels in either direction when using ISP_1 works fine establishing in either direction from remote access users and multiple L2L tunnels (only showing one for example).
 
On ISP_2
1. Peer 3.3.3.3 device establishes a VPN tunnel, but the return traffic does NOT get back to devices on 3.3.3.3 tunnel.
2. The local firewall does NOT establish a VPN tunnel going to 3.3.3.3
It would seem to indicate that the problems lies with this multihomed firewall not directing the traffic correctly to either return down and establised VPN tunnel (point1) or to intiate a tunnel if none exists (point 2).

Reconfiguring the VPN tunnel peer for 3.3.3.3 to be on ISP_1 of the local firewall, all springs into life! There are sufficient license etc...

View 4 Replies View Related

Cisco VPN :: ASA 5510 Ping / Communication Host To Host

May 7, 2012

ASA 5510
Ver 8.2(5)
 
I have been looking all over the place for the answer of how to allow clients on an IPSEC VPN to ping from host to host.

View 4 Replies View Related

Cisco Firewall :: ASA5520 Intra-interface Communication And DNS Rewrite?

May 29, 2011

Recently, I deployed ASA 5520 as our company firewall, everything was working fine except two main problem I still can not resolve them after I did a lot of research.
 
1. DNS rewriting - The internal user can not access the DMZ or internal server by put in the domain or external ip address. such as [URL] will resolve our wan ip address 210.0.0.83 ( internal ip address is 192.168.1.21 ).I used static (inside,Outside) tcp 210.0.0.83 https 192.168.1.21 https netmask 255.255.255.255  dns, but it will not work. We have our internal DNS server, but don't want to just add the domain as a record. Is there anyway to get the internal user to access Internal server and DMZ server through the public domain?
  
2. We also have an internal multiple subnet, another router was conneting to ASA firewall inside interface and using ip address 192.168.1.223, another subnet 10.1.15.16/28 is behind the this router, for the users in subnet 192.168.1.0/24, they connect firewall inside interface directly.I added an static route and intra-interface permit route inside 10.1.15.16 255.255.255.240 192.168.1.223 1same-security-traffic permit intra-interface I also added access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.1.15.16 255.255.255.240access-list inside_nat0_outbound extended permit ip 10.1.15.16 255.255.255.240 192.168.1.0 255.255.255.0nat (inside) 0 access-list inside_nat0_outbound The internal users on 192.168.1.0/24 can ping 10.1.15.18 but can not telnet to 10.1.15.18 22. If I set 192.168.1.223 as one of the workstation on 192.168.1.0/24 default gateway, it can telnet to 10.1.15.18 22 without any problem.

View 2 Replies View Related

Cisco Firewall :: ASA5505 Alias Secondary Subnet / No Communication Between Them?

Aug 17, 2011

As this is an ASA 5505, unlimited users, I must use arp alias to allow a secondary network.
 
Inside network: 10.200.31.0/24.Additional inside network: 10.200.12.0/24
 
Clients in both networks can reach internet, but they can't communicate with eachother. Hosts on the additional network can ping the ASA inside network IP, but nothing else. I get incomming hitcount for inside interface when 10.200.12.x tries to ping 10.200.31.x. In the error log, I see: [code]

View 7 Replies View Related

Cisco Firewall :: ASA 5505 - Configure Communication From Inside Network To DMZ

Nov 30, 2011

ASA 5505 and DMZ, I have a Base License.
 
What do I need to do for access inside network to DMZ?
 
I successfully configure, internet Access for DZM and inside network, web server can be accessed from internet, but I have problem to configure communication from inside network to DMZ.

View 14 Replies View Related

Cisco Firewall :: Redundant Interfaces In ASA 8.0?

Aug 3, 2009

In ASA 8.0,I have following queries related to redundant interfaces
 
a)While configuring redundant interface can the redundant interface again be divided into logical interface like red1.1 , red1.2 ?

b)Is Redundant interface supported in the Multiple context mode

View 4 Replies View Related

Cisco Firewall :: How To NAT To Multiple Interfaces In 8.3

Jan 15, 2013

Having upgraded to 8.3 from 8.2 I and read much about the differences , it seems that 8.3 deals with NAT in a much more managed method.However I am confused on how one would NAT a network object to multiple interfaces? i.e I know you can specficy a NAT adddress within the network object howeveer this only allows you to specific a single IP address.What if I want to talk accross multiple interfaces how would I specify this?

View 5 Replies View Related

Cisco Firewall :: 5520 - ASA Sub-interfaces NAT

Sep 7, 2011

i have an ASA 5520 running ver 8.4(1). have attached my interface config below and need to do the following, NAT traffic coming on GigabitEthernet0/2.101 to GigabitEthernet0/1, i.e. packets with destination 10.21.110.25 will be forwarded to 10.11.21.25, will a  nat (Production,Advocate_MPLS) static ... statement work ?
 
------------------------------------------------------------------------
interface GigabitEthernet0/1
description Production
nameif Production
security-level 100(code)

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved