Cisco Firewall :: Configure Dmz On ASA5505

Dec 20, 2011

I have a asa 5505 Sec plus with 3vlan, inside, outside and dmz.
 
On the outside i have 5 ip's for my use, and in the dmz i have a webserver that need to communicate with one sql server on the inside.
 
The "sql" also needs to be accessible from outside and thus has a static nat with a dynamic nat so it replies from same ip as on nat ie 72.72.72.5 webserver is natted with 72.72.72.6
 
sql inside ip is 192.168.1.2, gw 192.168.1.1
webserver ip is 192.168.2.100 gw 192.168.2.1 
sec lvl on inside is 100 and on dmz 50
 
with a dynamic policy  running inside-net/24 to dmz-network/24 translagt to dmz 192.168.2.2 i can get it to ping 1 way from inside to dmz, but not the other way around...
 
All i need is to open 1 port  ie 6677 both ways for this communication to work.
 
I'm not very familiar with the CLI and do most stuf in GUI  (know i should learn CLI, but time doesnt let me)...

on access rules i have just added everything from any to any using , ip, icmp, tcp and udp just to be sure...  :-)

View 47 Replies


ADVERTISEMENT

Cisco Firewall :: Configure ASA5505 To Allow CTIW On SBS 2008

Apr 18, 2011

When using the connect to the internet wizard in SBS 2008 (CTIW) the server comes back with an error that it cannot communicate with the router.Are there any settings that need to be configured in the ASA 5505 to allow communications with SBS 2008 using Exchange Server 2007?  I am using ASDM 5.2 at this time.

View 3 Replies View Related

Cisco Firewall :: Possible To Configure Bridge Mode In ASA5505

Aug 1, 2011

Is it possible to configure bridge mode in asa 5505 if it is can u provide me a config.

View 1 Replies View Related

Cisco Firewall :: How To Configure The ASA5505 For Iphone Vpn Access

May 16, 2011

I just started at a new company and they want to use iphones in place of blackberry's, what a surprise.  We have a exchange server and blackberry enterprise server.  My question is how do I configure the cisco ASA to allow for iphone vpn connection and start replacing our blackberry's.

View 1 Replies View Related

Cisco Firewall :: Trying Configure ASA5505 (8.4) To Allow HTTPS On Two WAN Ports

Sep 14, 2012

I have an ASA 5505 running 8.4.4.1. I've configured three WAN interfaces and have assigned failover on one of them (we have two ISP's, and a total of 3 static IP's in 3 different subnets).  I've noticed that all the traffic is flowing through only one of the three interfaces, but I need to allow incoming https traffic on the second WAN port so I can access our Exchange server (we already use https on the first WAN port to access another server).
 
[code] WAN1 is the default outgoing route and we've configured several incoming services on it (smtp and https for example) and appears to be working properly as mail is coming and going and users can access the RDS gateway.I need to configure WAN2 to accept https traffic and send it to our Exchange server to enable OWA (webmail) access.I've configured the same Access and NAT rules on all three WAN interfaces  for smtp (but I suspect only the first one is currently functioning at  this point, I'll test it next chance I get). I thought all I'd have to do is configure an access and NAT entry on WAN2 (same as on WAN1), but direct the traffic to the OWA server instead of the rds gateway server, but it is not working.
 
In the realtime log I can see that it appears to be receiving the traffic on the WAN2 IP, but seems to be passing this through to the inside via the WAN1 interface.

View 5 Replies View Related

Cisco Firewall :: ASA5505 - How To Configure Port Forwarding For All Devices

Apr 18, 2012

How to configure this setup.I have an ASA5505 with dual wan failover, FiOS (eth0) & Cable (eth1). how to configure the port forwarding for all my devices so it doesn't matter what external interface the traffic is coming from. For example, I need web traffic on port 80 forwarded to 192.168.1.150 regardless of whether it is coming through eth0 or eth1.

View 2 Replies View Related

Cisco Firewall :: ASA5505 Configure Port Forwarding To Multiple Internal IP Addresses

Jun 21, 2012

ASA 5505 Firmware 8.3(4), ADSM 6.4(2).I have a public IP address of 168.87.3.4.I need to forward ports (5060, 5080, etc.) to one internal address. (192168.1.1).I need to foward different ports (10020-10080) to a different internal address (192.168.1.2) Everything I read tells me how to do this in a 1 to 1 static NAT.

View 1 Replies View Related

Cisco VPN :: ASA5505 Configure ASA For IPSec And SSL VPN

Jun 10, 2013

I currently have my 5505 setup for AnyConnect SSL VPN connections.  Is it possible to also configure the 5505 for IPSec VPN connections? So, essentially my ASA will be capable of running SSL and IPSec VPN tunnels, concurrently.

View 2 Replies View Related

Cisco VPN :: Configure ASA5505 As VPN Client

Apr 23, 2013

I did some searching and the answers said it was supposedly possible but no info on how to do it.  I am wondering if it is possible to configure a Cisco ASA 5505/10/20 to be a client to an existing (in this case) cisco client vpn.  The reasons why are complicated (and imo irrelevant) but basically I need to be able to make a small network that can be on this vpn rather than individual machines.The client vpn is a basic IPSec over UDP Cisco VPN to an ASA5505.So how would I configure another ASA to connect to this like its a client?

View 3 Replies View Related

Cisco WAN :: ASA5505 Configure To Outside Interfaces And Have Inside

Nov 1, 2012

I have an ASA 5505 with 3 host license.I want to configure 2 outside interfaces and have inside interface. The outside interface going to a separate ISP.Will this work or do I need more licences?

View 3 Replies View Related

Cisco VPN :: Configure AnyConnect (Mobile) On ASA5505

May 14, 2012

how to configure AnyConnect on an ASA5505, but I wanted to check before to make sure I was going the right direction. 
 
Setup: I have a very simple setup and basic goal.  I currently just have one laptop on E0/1 of my ASA5505 and then the ASA configured with a static IP plugged to the Internet.  I have the ASA correctly configured and can browse the web through the laptop. I also have the AnyConnect and AnyConnect Mobile licenses as well.
 
Goal: I want to set up AnyConnect on the ASA5505 and just establish a successful connection from an android mobile device running the necessary AnyConnect software from the market.

There are lots of guides for specifc set ups, but as described, I want to keep this as simple as possible.
 
[URL]
 
Also, I'm more comfortable with the CLI. Is it simpler to use the ASDM wizard for this?

View 2 Replies View Related

Cisco Infrastructure :: Configure ASA5505 Network With Split DNS

Mar 13, 2011

We have several branch offices that only have a Cisco ASA 5505 connecting clients to the Internet, our main office and other networks. Some of the branch offices uses Site-to-Site VPN to connect to our main Office, other uses a VPN-service delivered by our ISP.
 
The networking is working fine, but we are having problems with figuring out how to handle dns lookups. I see that the ASA DNS Client can use conditional DNS forwarding, but it cannot act as a DNS server for our clients on the inside network.
 
We want to do the following:
- Default dns quires should use the DNS servers for the site's local ISP (some sites also uses dual ISP, so we are using DNS1 and DNS2)
- The domain name: company.local should use our main office DNS server (acces by Site-to-Site VPN or our ISP's VPN)
- The domain name: sitea.company.local should use our SiteA DNS server (acces by Site-to-Site VPN or our ISP's VPN)
 
etc...
 
We have solved the issue by using Windows DNS server's conditional forwarding for the branch offices that has a local Windows 2008 domain controller.
 
our branch office's that only have a Cisco ASA 5505 Security Applience?

View 3 Replies View Related

Cisco :: Configure ASA5505 To Permit Access To Internal LAN?

May 12, 2013

I have configured a Cisco ASA 5505 to allow VPN access from outside to my LAN using Cisco VPN Client software. The connection is establishing properly with the ip address from my VPNPool. From outside (on VPN connection) I can ping the interface e0/0 (outside)  and the interface e0/1 (inside) of the firewall, but I cannot ping the layer 3 switch interface to which the ASA is connected ( int gi1/0/22 ip address 192.168.1.2/30 ) and I cannot ping any vlan interfaces inside my switch. Therefore, I cannot connect to any server on my internal LAN. I am available at any time if further information is needed. find attached my ASA config.

View 7 Replies View Related

Cisco VPN :: Configure ASA5505 For Remote User Using EasyVPN Client?

Jul 5, 2011

I need to configure our ASA5505 firewall for remote access to our network using EasyVPN software installed on a laptop. That laptop will be connected in the different places, using DSL or 3G toggle or Public Wi-Fi. For some people it's very easy, but I don't have any experience with firewalls.

View 9 Replies View Related

Cisco Switching/Routing :: How To Configure 1142N AP /  2960-S And ASA5505 With Wireless

May 20, 2012

I'm trying to configure an 1142N AP +  2960-S + ASA5505 with wireless, vlans and trunking with no success. DHCP is provided from my DHCP-server on the inside.

View 4 Replies View Related

Cisco Firewall :: Users Behind ASA5505 Firewall Are Unable To Access Internet

Feb 24, 2011

I have a normal setup of ASA5505 (without security license) connected behind an internet router. From the ASA5505 console I can ping the Internet. However, users behind the Firewall on the internal LAN, cannot ping the Internet even though NATing is configured. The users can ping the Inside interface of the Firewall so there is no internal reachability problem. In addition, I noticed that the NAT inside access list is not having any hit counts at all when users are trying to reach the internet.

When i replace the ASA5505 with a router with NAT overload configuration on it, the setup works normally and users are able to browse the internet.

The ASA5505 configuration is shown below.

hostname Firewall

interface Ethernet0/0
description Connected To Internet Router
switchport access vlan 10

[Code].....

View 2 Replies View Related

Cisco Firewall :: ASA5505 Lose Configuration If Upgrade Firewall

May 17, 2011

i have asa 5505 with the asdm v5.2 (4), and the asa v7.2(4). This platform has a base license. if i upgrade adsm and asa on v6.2(1) and v8.2(2) if I lose my license and that you need to activate them? i configured site to site vpn (this firewall and the another) that i lose my configuration if i upgrade my firewall.

View 2 Replies View Related

Cisco Firewall :: ASA5505 Can't Ping New Firewall On Inside Interface

Jul 14, 2011

I've recently upgraded my old firewall from a PIX to an ASA5505 and have been trying to match up the configuration settings to no avail. I have is that I can't ping the new firewall on it's inside interface, despite having "icmp permit any inside" in the running config. Secondly, the server I have on there ("Sar") can't connect out to the internet.I've included the ASA's running config incase anybody can see if something stands out. I have a feeling it's either not letting anything onto the inside interface, or there is no nat going on. Lastly (and possibly relevant), the firewall is actually going at the end of a vlan, which is different to the firewall's inside vlan number. I don't know if this is actually the problem because the server can't connect out even if connected directly into the firewall.

View 32 Replies View Related

Cisco Firewall :: Unable To Ping Internet IPs From ASA5505 Firewall

Jan 9, 2013

Internet ISP -> Juniper SRX 210 Ge-0/0/0
Juniper fe0/0/2  -> Cisco ASA 5505
Cisco ASA 5505 - >Inernal LAN switch.
 
1.  Internet  is connected to Juniper Ge0/0/0  via /30 IP.
 
2. Juniper fe0/0/2 port is configured as inet port and configured the Internal public LAN pool provided by the ISP. And this port is directly connected to  Cisco ASA 5505 E0/0. Its a /28 pool IP address. This interface is configured as outside and security level set to 0.

From Juniper SRX, am able to ping public Internet IPs (8.8.8.8).
 
Issue:

1. From ASA am unable to ping public ip configured on Juniper G0/0/0 port.(/30)
2. From ASA no other Public internet IP is pinging.
 
Troubleshooting Done so far.
 
1, Configured icmp inspection on ASA.
2. Used the packet tracer in ASA, it shows the packet is flowing outside without a drop.
3.  Allowed all services in untrust zone in bound traffic in Juniper SRX.
4. Viewed the logs when I was trying the ping 8.8.8.8 in ASA. It says "Tear down ICMP connection for faddrr **** gaddr **

View 2 Replies View Related

Cisco Firewall :: ASA5505 Firewall Rule Not Blocking

Apr 1, 2013

I'm trying to troubleshoot an ASA5505.
 
The original goal was to block "Mumble/Murmur" (a voip app) traffic, which runs on TCP/UDP 64738, both inbound and outbound, except to a certain host (63.223.117.170).
 
However, when nothing I tried seemed to make a difference, just to troubleshoot, I decided to try blocking all inbound traffic.  I first disconnected ethernet port 0/0 to ensure that it was cabled correctly and the outside interface went down when I did.  That worked as expected, so I confirmed I had the right interface and it was cabled correctly.
 
I then applied a "any any deny ip" rule as the first element in the outside interface access_list, as you can see below.  However, it appears to have had no real effect and the hit count is very low (it should be astronomical).
  
show ver 
Cisco Adaptive Security Appliance Software Version 9.0(2)
Device Manager Version 7.1(2) 
Compiled on Thu 21-Feb-13 13:10 by builders
System image file is "disk0:/asa902-k8.bin"

[Code].....

View 4 Replies View Related

Cisco Firewall :: Using IP Aliases On ASA5505

Nov 29, 2011

Is it possible to use IP "aliases" on an ASA5505 to use as static NAT public IPs to private IPs?  For example, I have int e0/0 connected to my ISP using a /30 subnet and I have my private LAN connected to e0/1 with a /24 subnet.  At the moment I can use the one usable IP from the /30 to NAT to the private LAN.  The ISP is also routing a /28 subnet to the one public IP of the ASA. I would like to use some of the /28 IPs for NAT also.  Can it be as easy as just adding the NAT commands? I figure I would have to add that subnet to the ASA somehow, no?  In other devices (including the SA520) they use a concept called IP aliases whereby you define what additional IPs the device can use in its NAT config.  Does the ASA support aliases?  Maybe I have to do something with VLANs?

View 2 Replies View Related

Cisco Firewall :: Use 1 / 2 Gb Memory With ASA5505 Only 512 Mb

Jun 15, 2011

it is possible use 1 or 2 Gb memory with ASA 5505 or only 512 Mb ?

View 3 Replies View Related

Cisco Firewall :: Routing Using ASA5505 And Pix 501?

Jun 16, 2011

I have 1 network that I'm trying to make secure, and it needs to access 2 seperate networks.   I tried using an ASA5505 that I had on the shelf to accomplish this but discovered that I had the basic license and that was prohibiting me from getting my connection to my 3rd network.  I scrapped that idea and grabbed an old pix 501 off the shelf to bring my connectivity to my 3rd network online since the 3rd network is only passing ip traffic to a small group of servers on the outside I figure the 501 should be just fine.
 
So, here's the problem I am running into:My internal network is 10.10.16.0/16, I have a new domain controller with DHCP on it handing out addresses in the 10.10.16.0/24 range.External Network 1 is 192.168.16.0/24.  The services I need from that network are primarily in 192.168.0.0 range, however there is a comcast router 75.123.123.123 (Changed of course) that provides high speed internet I need for my www traffic.External Network 2 is 10.1.1.0/16  I have about 4 servers I need to access on this network and that's it.   This network has it's own domain and DHCP controller and I've been given a range of ip's to use on this network of 10.1.3.180-10.1.3.189 My switch is just a plane jane 3com switch with minimal management so I am attempting to use my ASA5505 to handle my layer 3 routing. 
 
So here's my issue:ASA5505 (IN:10.10.16.1, OUT: 192.168.16.6):  Passes traffic to External Network 1 and to the comcast router, no problem.   All my computers on my 10.10.16.0/16 network have access to everything on 192.168.0.0/24 as well as getting full name resolution and www traffic across the comcast router.  Can NOT access 10.1.1.0/16 no matter what.  From inside the ASA or from on the inside LAN ports.  It CAN ping the PIX 501  PIX 501 (IN:10.10.16.3, OUT: 10.1.3.180)  Can ping EVERYTHING.  Can ping 192.168.0.0/24, can ping 10.10.16.0/16 and can ping 10.1.1.0/16.    Set to globally assign the other IP's in my range as addresses for outgoing traffic.Workstations (IN: 10.10.16.XXX DHCP, using 10.10.16.1 as gateway)  Can only access everything on External Network 1.  ZERO access to External Network 2. ATM I have both INSIDE and OUTSIDE ACL's wide open for both firewalls just to get connectivity going.  I will be tightening it up after it is operational.Attached find a log file (Sensetive data removed of course) that contains the sh run and sh ver for both the ASA5505 and the PIX 501.

View 1 Replies View Related

Cisco Firewall :: Asa5505 Do We Need Ios Update

Mar 14, 2013

I just got an ASA 5505 with Cisco Adaptive Security Appliance Software Version 8.0(4) alredy loaded on it.  Should I update/upgrade it to the newest IOS release, or is the 8.0(4) good and stable?

View 3 Replies View Related

Cisco Firewall :: Setup DMZ Using ASA5505?

May 3, 2012

I'd like to setup a DMZ network with the ASA5505. Do I need the "Security Plus Bundle"?

View 1 Replies View Related

Cisco Firewall :: ASA5505 With WRVS4400N On COX?

Apr 25, 2012

I've been trying to get my WRVS4400N connected to my ASA5505 on the internet through a Cox connection, but it isn't working. I cannot get the ASA to be the DHCP server for the wireless router. I've configured the wireless router as a gateway and pointed the DHCP server to the ASA but no addresses are being passed through to the wireless router. I've included a copy of my config.

ciscoasa# sh run
: Saved
:
ASA Version 8.4(2)

[Code].....

View 3 Replies View Related

Cisco Firewall :: ASA5505 With Multiple WAN IPs?

Jul 24, 2012

We are trying to utilize a 5 ip block of addresses provided by our ISP. What we have assigned from them is like this: 10.10.10.46 - 10.10.10.50 is our ip range. 10.10.10.45 is the gateway. Subnet is 255.255.255.248. If we assign 10.10.10.46 to the outside interface how do we accept inbound traffic from the other addresses?

View 6 Replies View Related

Cisco Firewall :: Can't Ping Or RDP ASA5505

Sep 4, 2012

I have Vlan 100 (inside) and Vlan 65 (Outside)I'm trying to configure RDP and ping traffic from Vlan 100 to Vlan 65 One way.If I connect 2 PCs on E0/0 and E0/1 they can happily ping the their own VLAN ip add 192.168.100.3 and 172.16.65.1I've copied my config,

ASA Version 8.4(4)1
!
names
!
object-group network A_Network
network-object 172.16.65.0 255.255.255.0

[code]....

View 9 Replies View Related

Cisco Firewall :: DNS Redirect On ASA5505?

Feb 29, 2012

I want to make it so if a user tries to use a different DNS server the request will be redirected to the one they should be using.I thought this might work but the ASA doesn't do PB routing
 
ip access-list extended transparent_dns
permit udp any any eq 53
route-map redirect_dns permit 10
match ip address transparent_dns
set ip next-hop ip.of.your.server
route-map redirect_dns permit 20

[code]....
 
The DNS server is windows 2003?Would policy based NAT or WCCP work for this? If so how would I go about it?

View 1 Replies View Related

Cisco Firewall :: ASA5505 As LAN Router?

Nov 22, 2011

I would like to use an ASA5505 as a simple LAN-to-LAN ethernet router.  My plan is to configure two interfaces with the same security level and then use the command that allows interfaces with the same security level to communicate with each other.  I can get this to work without having to setup and ACLs or NAT stuff.

View 5 Replies View Related

Cisco Firewall :: Use Dual ISP's With ASA5505?

Oct 1, 2010

for the purpose of a redundency, incase the primary ISP goes down the backup kicks in.Can this be done with the basic license (max 3 vlans) or you need to have the security plus license. (20 vlans) Currently not using the 3rd vlan (dmz)

View 5 Replies View Related

Cisco Firewall :: ASA5505 For Passive FTP?

Apr 18, 2012

setting up ASA to allow passive FTP connection! I can get the FTP client to connect but it does not pull the directories. I have opened 21 and range of 55536-55566. I had some trouble gettting the range opened and saved. Normally with other small business routers (GUI) I make sure those ports are forwarded and ftp works.
 
Is the ftp inspection killing connection or is it my config?
 
ASA Version 8.4(2)
!
hostname ciscoasa
enable password vRLm0eRL2O14iLM6 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted

[Code].....

View 3 Replies View Related

Cisco Firewall :: ASA5505 VPN Throughput

Jan 31, 2012

Do some have some realistic performance numbers for a ASA 5505 on a mixed setup with local internet breakout and site to site vpn ( and don't tell me 150 mbps 3des throughput on a 100 mbps ethernet) - what can be expected in a live environment where we f.ex feed it with a 100 mbps internet connection - with a site to site vpn with f.ex 20 office workers running office on a remote terminalserver and mixed local internet breakout.

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved