Cisco Firewall :: Configuring ASA 5510 From Scratch

Aug 19, 2012

I just upgraded an ASA-5510 from 7.0 to 8.4.4-1 and theres a lot of stuff in it I don't recognize that I never added, mostly because of new network objects, nat commands, and other migration stuff. Its been awhile since I've configured the ASA and I think I'd like to start from scratch and clean it up a bit because theres so many lines for so little that I really need.
 
I have a 5510 assigned an IP address on the outside interface with 3 inside interfaces and below are the only requirements I need.
 
Network-A (192.168.1.0/24)
   - incoming ssh port 2202 goes to node 192.168.1.2
   - incoming ssh port 2203 goes to node 192.168.1.3
   - handle incoming https (443) requests
   - handle incoming www (80) requests
   - cannot see Network-B or Network-C
 
Network-B (10.0.0.0/16)
   - ssh to nodes on Network-A
   - incoming ssh port 22 goes to node 10.0.0.20
 
Network-C (192.168.2.0/24)
   - ssh to nodes on Network-A
   - incoming ssh port 2210 goes to node 192.168.2.2
 
ASA-5510
   - sends logging to syslog node 192.168.1.3 on Network-A
   - there are DNS and NTP servers located outside

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: Configuring Failover For ASA 5510

Oct 16, 2012

I have two ASA 5510's that I want to setup in a Active/Standby configuration. My only question is on how to connect the inside ports to my LAN. I have 5 Catalyst 3750's stacked together that connect to the ASA's. Should I run the inside interface on ASA1 to a port on switch 1. Then run the inside interface on ASA2 to a port on switch2? And make sure both those ports are in the same VLAN? But, then when failover occured, how to I automatically make it clear the arp cache so the traffic starts flowing out of the right port?                   

View 1 Replies View Related

Building A Firewall From Scratch Using C?

Jun 30, 2011

I am trying to develop a firewall from scratch in linux environment using C. Actually its more of a Unified Threat Management sysytem .which features to include like antispam, content filtering, vulnerability analyzing,etc.I have exactly 1 year to complete this project which features can be coded completely in time. Actually I have broken the process of development in 4 stages namely :

1. Capture the packet (using libcap)

2. Break the packet into headers and data (using libpcap)

3. Analyze the headers and data and make a decision

4. ACCEPT or DROP the packet

Its the third step that will depend on the features which are included in the project. I plan to code using the UNIX Socket API.

View 1 Replies View Related

Building Open Source Firewall In Linux Environment From Scratch?

Jul 10, 2011

I have decided build an open source firewall in linux environment. I have exactly one year to complete this project. The firewall will be a stateful packet filtering firewall working at network, transport and application layers. I would also be provided log analysis features. What I want to know is whether this is a good enough project or put in other words, is it a worthwhile project to undertake?

View 13 Replies View Related

Cisco VPN :: ASA 5510 - Configuring With EzVPN?

Nov 1, 2012

I'm having trouble configuring with EZVPN on ASA5510. EZVPN uses the local LAN as the source IP, now since the EZVPN is configured on the ASA, it will use its local port 2.2.2.1 as the source local LAN. The actual local network is behind a firewall and i need the tunnel to extend to the 10.10.10.10 network. Is there a way to extend the tunnel to use the 10.10.10.10 as the source LAN? How to do it via the GUI?

View 3 Replies View Related

Cisco WAN :: Configure 1130AG From Scratch?

Feb 25, 2013

I'm trying to configure the 1130AG from scratch but I'm not having any luck. I tried using the IPSU utility and entered the MAC address but it errors, "The device does not answer". I have connected it to a network so it can get an IP from DHCP but it doesn't respond. And when it boots up from factory reset there is no SSID broadcast for me to connect to. I have tried connecting through the Ethernet port and the Console port to my computer but no luck.

View 3 Replies View Related

Cisco VPN :: ASA 5510 - Configuring Client To Site IP Sec VPN With Hairpin

Jan 15, 2013

Need configuring Client to Site IP Sec VPN with Hairpin on Cisco ASA5510 - 8.2(1).
 
The following is the Layout:

There are two Leased Lines for Internet access - 1.1.1.1 & 2.2.2.2, the latter being the Standard Default route, the former one is for backup.
 
I have been able to configure  Client to Site IP Sec VPN
1) With access from Outside to only the Internal Network (172.16.0.0/24) behind the asa
2) With Split tunnel with simultaneous assess to internal LAN and Outside Internet.
 
But I have not been able to make traditional Hairpin model work in this scenario.
 
Following is the Running-Cong with Normal Client to Site IP Sec VPN configured with No internal Access:

LIMITATION: Can't Boot into any other ios image for some unavoidable reason, must use 8.2(1)

running-conf  --- Working  normal Client to Site VPN without internet access/split tunnel:
ASA Version 8.2(1)
!
hostname ciscoasa
[ code ].......

Neither Adding dynamic NAT for 192.168.150.0/24 on outside interface works, nor does the sysopt connection permit-vpn works
 
What needs to be done here, to hairpin all the traffic to internet coming from VPN Clients. That is I need clients connected via VPN tunnel, when connected to internet, should have their IP's Nattered  against the internet2-outside interface address 2.2.2.2, as it happens for the Campus Clients (172.16.0.0/16).

View 7 Replies View Related

Cisco WAN :: ASA 5510 - Configuring Router To Access Two Servers With Same Name

Jan 25, 2012

I have a old server that has custom apps developed by a bankrupt company that we can't replace yet. We are being tasked with upgrading the Operating System and security patches, while preserving the existing live server. I was able to accomplish this by virtualizing it, then cloning the virtual machine. Where I got stuck was, the custom app requires a specific host name. So, I got the idea to have the two servers live on different sides of the firewall until the test platform is accepted and the old live one can be retired.
 
My problem is that I have no experience with configuring a real firewall like this asa5510.
 
Servers are:
CM1 live server
CM2 test platform
ADS Active Directory and File and Print

[code]....
 
I've started to carefully poke around in the Cisco ASDM-IDM, but haven't figured out how to access the DMZ from the outside (so far just testing with http as I don't have my certificate to setup https just yet). Am I missing something to get through to the DMZ from the WAN side?

View 2 Replies View Related

Cisco :: RV042G - Reconfigure Router From Scratch?

Nov 25, 2012

Today the power was fallen out in our area and the rv042g was turned off.After the power was back I was checking the router because some trafic didn't came through.Then I saw that all the services were messed up and also all the firewall rules were wrong.the lines were still there but it all was setup as [all 0-0].

After trying to restore a backup it gave me the same, even after resetting the router with the reset button for 30 seconds and doing a restore it didn't work.So I had to reconfigure the router from scratch.This services thing gives me a real pain in the *** because in a previous topic I also have mentioned that something is wrong with the services.

View 6 Replies View Related

Reset Network And Start From Scratch / Xp Pro?

May 30, 2012

I had my network running seamlessly for years, I set it up using a guide from a magazine and had both wired and wireless working A1 and originally it was all win xp pro, 2 desktops and a laptop but got a macbook pro and got that using printer, sharing fies etc. All no problem and it was all easy peasy BUT I have mucked up big time and I think it was because I downloaded some system cleaning software, advanced care, toolwiz and pc pitstop but I was not paying attention and I am sure I clicked a few buttons I should not have done. Result disaster, no longer can share files or print etc.ll I want to do is reset everything and start afresh but how do I do that? I use a netgear router with norton security on main desktop. I have a wii, an xbox, apple tv running as well along with 2 desktops, a laptop and a macbook pro. Tried a few things but nothing worked, when I click on network places I get a list of shared folders but end location shows internet! I have to use netgear switch boxes as well but should not have caused the problem.

View 4 Replies View Related

Cisco Switches :: SG-300 Haven’t Set Up A VLAN For Voice From Scratch

Sep 13, 2011

We are about to install a new VoIP system (Allworx, which I did not select) and need to set up a new VLAN with QOS quickly for my SG 300 and SG 200 switches.  I have the default VLAN1  at 10.0.0.0/24 and will be setting up VLAN10 at 10.1.0.0/24 for voice. There are a few other VLANS on the switches as well.  I really don’t get the particulars of using a Voice VLAN vs. Smartport, but is one better than the other for this and what would be some good default settings to start with.  I have command line and VLAN experience; I just haven’t set up a VLAN for voice from scratch.

View 1 Replies View Related

Netgear ADSL2 - Creating Network And NAS Sharing From Scratch

May 19, 2012

Our home situation is: We have 3 Mac computers, 2 PC's (all home/office use) and loads of phones and other equipment. Each computer stores files independently, there is peer-to-peer wireless sharing (through the OS) but no true central file sharing.Our existing network situation is: We have O2 Broadband but don't use the O2 equipment. We use a Netgear ADSL2+ modem (delivering 5/6-7meg) connected to a Time Capsule that offers us home backup for our Mac computers and also acts as our wireless router. We broadcast in dual-band 802.11b/g and 802.11n simultaneously (as there are a range of systems that need different bands). We then use 2 Apple AirPort Express access points around the house to extend and amplify the signal - although these can sometimes be temperamental.

View 12 Replies View Related

Cisco Firewall :: ASA Version 9.0(1) / Configuring NAT On Intranet Firewall?

Dec 26, 2012

configuring NAT on intranet firewall. here is the my topology:
 
  DMZ Network  - - - - - - - - - External Firewall   - - - - - - - - - Internet
                                                          |
                                                          |    
                                                          |
  Internal Network  - - - - - - - - - Internal Firewall  
 
1) I can Ping the intneral host from external firewall, internet firewall and DMZ network

2) Both ASA's are running OS Version 9.0(1)

3) ACL used permit IP any any, on both (i.e inside and outside)
 
NAT configuration on Internal Firewall  (Identity NAT)
 
object network MGMT-SRV-INSIDE           subnet 10.10.10.0 255.255.255.192
object network MGMT-SRV-identity
subnet10.10.10.0 255.255.255.192
 object network MGMT-SRV-INSIDE           nat (Inside,Outside) static MGMT-SRV-identity

[code]....

View 1 Replies View Related

Linksys Wireless Router :: WRT610Nv2 Setup From Scratch - Recovering Correct User Name?

Jul 26, 2012

I'm trying to access the web setup page and I'm being asked for the user name and password. I have the password from the initial setup written down but apparently didn't also record the (changed) user name. It's not "admin" (tried that - and just leaving it blank - already).
 
Is there any way to recover the correct user name short of resetting the router and setting it up again from scratch?

View 9 Replies View Related

Cisco Firewall :: Configuring ASA 5505 Firewall

Sep 21, 2012

I am configuring a Cisco ASA 5505 firewall.In the office there is 1 x SBS 2008 server and 5 x PCs, all sat behind a Netgear DGN1000 ADSL router.We want to implement a ASA 5505 for added security.I have configured the internal interface of the Cisco ASA 5505 to be 192.168.0.1 - this is connected to local switch. The client PCs use 192.168.0.1 as their default gateway.I have configured the external ASA 5505 interface to be x.x.x.217. [code]Change the current router status from Router/Firewall/Modem to Modem only (Bridge mode). The ASA 5505 has its outside interface connected into one of the LAN ports of the netgear. The lan port has an IP of 192.168.0.254.

View 3 Replies View Related

Cisco Firewall :: Configuring NAT In 8.3 Using DMZ 2

Sep 26, 2011

We have a requirement where we need to enable a dynamic NAT from DMZ-1 to Inside, I gave the command below, but for some reason it does not work.nat (DMZ-2,Inside) source dynamic any interface,NOTE: The access-list is permitting all the traffic from DMZ-1 and Inside (for test)

View 1 Replies View Related

Cisco Firewall :: Configuring NAT On ASA Running 8.3?

May 15, 2012

I'm having an issue configuring NAT on an ASA running 8.3. 've managed to configure NAT from the Inside interface to the DMZ, using PAT, so that the traffic is hidden behind the IP of the DMZ interface. This seems to work ok.
 
object network obj_any-18
subnet 0.0.0.0 0.0.0.0
 object network obj_any-18
nat (inside,dmz1.005) dynamic interface
 
The problem I have is when I try to configure a rule for traffic that originates in the DMZ back to the Inside. I can't seem to get any traffic to flow from the DMZ to the Inside, and sometimes I manage to stop traffic flowing in both directions!
 
What would be the best way to configure the return traffic from the DMZ to the Inside.

View 12 Replies View Related

Cisco Firewall :: Configuring VLANs On 5515-X Is It Possible

Mar 29, 2013

I am trying to connect 2 VMWARE servers directly to my 5515-X firewall. [code]ASDM will not let me assign the same VLAN to both Gi0/2 and Gi0/3. I dont want to connect my VMWARE servers to a switch first (that just adds one more component that can fail).

View 4 Replies View Related

Cisco Firewall :: Configuring New ASA 5520 With AIP Module?

May 14, 2011

I am configuring new ASA 5520 with AIP module for our network with HA (2 boxes), would be the best practice to configure in order to protect web servers and email server.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Loss On Configuring Twice NAT

Mar 30, 2012

There seems to be a large number of the subject queries in one form or another.  Having acquired an asa 5505 and using 8.43 firmware and the ADSM gui for router configuration it has not been an easy transition from other products.   I have come to understand embedded NAT objects for basic port forwarding but am at a loss on configuring twice nat or manual nat, not really ever dealing with it before, or in this manner.  
 
What I would like to suggest to the experts, is to include far more ADSM web gui examples and discussion for manual nat.   The tools are all there - in the nat rules editing page,  the display of the rules pictorially and the packet flow at the bottom of the page (and finally thru packet tracing).   What is needed is more on the actual entries on the nat editing pages and the logic and explanation of those entries.   In this forum what I would like to see is when there are responses that they include both the CLI recommended entries b AND the associated adsm web gui pics.  With good documents for reading and examples in the forum, I think there should be much less confusion allowing more attention to some very complex scenarios. At the very least I and others like me will get better edumecated.  I am looking to understand CIsco packet routing through explanations of the web gui entries. In fact, I am learning far more by trying to understand the web gui vice simply copying and entering CLI commands.  In terms of documents, for example, there should be a very thorough explanation of the relationship between "Translated Addr:" in the first NAT editing page with "Destination Inteface" in the second Advanced page .I have added the packet tracing jpegs for further context.  There is an UNNAT lookup entry (first trace block, out of view on the pic) a concept which is missing in the documentation I've read that needs to be added but it is illuminating in how the router handles traffic.   What is also interesting is the fourth jpeg which also shows the flow designation of a packet and its handling internally (new packet or one that is associated with an existing packet (previously identified and put in an appropriate table xlate etc)).

View 2 Replies View Related

Cisco Firewall :: Configuring QOS On ASA 5520 Release 8.0(2)?

Jun 20, 2011

I present wish to develop a policy and template for QOS on our ASA 5520 release 8.0(2) we presently have wish to do server hosting in our network for other organization,which the they will be able to access their servers they have both public and private addresses. we do have our one servers also already in production all behind the ASA And therefore we wish to apply qos on the servers to be hosted and we wish to do this on the ASA. how to go about this to apply qos on the ASA?

View 3 Replies View Related

Cisco Firewall :: Command For Configuring NAT On ASA5505?

Dec 5, 2012

want to know the command for configuring NAT on My ASA5505.

Local IP - 192.168.1.0/241

Public IP - 182.73.109.118 255.255.255.252

View 4 Replies View Related

Cisco Firewall :: Configuring VoIP On ASA 5500?

Nov 20, 2011

We have to set up voip for our network(for 50 phones not he cisco phones).
 
I need to just the route the voip traffic to gateway address of telephonic company(1.1.5.7)  where they provide us the connectivity for the setination call.
 
What sort of protocols should i have to enable in pix i saw the concepts like sip, h323, ras, skinny.
 
We are using only voip for asa and no data or other traffic should be allowed.
  
inside adrees: 10.10.10.0/24 for all voip phones
outside:121.21.22.1
telephoneic gateway: 1.1.5.7

View 1 Replies View Related

Cisco Firewall :: Configuring ACLs 3560 In A Lab

Dec 27, 2011

In my lab setup i configured Cisco 3560 switch.

VLAN 20 and VLAN 30 i configured.
VLAN 20 interface IP : 192.168.20.1/24
VLAN 30 interface IP : 192.168.30.1/24.
Inter-vlan communication is happening fine.
 
For testing for purpose i configured extended ACLs. Here is my requirement: I want to stop communication from VLAN 30 to VLAN 20 but not vice-versa.
 
Here i configured like this:
 
access-list 111 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 111 permit ip any any
applied ACL in VLAN 30 interface 'in' direction.
ip access-group 111 in
 
In this scenario, communication is stopping in both directions. If i ping from one of the IP VLAN 20 to one of the ip of VLAN 30, i was gettng Requested time out. And if i ping from one of the IP VLAN 20 to VLAN 30 interface IP, i was able get pinging.
 
From VLAN 30 to VLAN 20, i was getting destination host unreachable from VLAN 30 ip( Its fine as its my requirement). So, solution needed to communicate from VLAN 20 to VLAN 30.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - Configuring Dynamic NAT And PAT

Jan 13, 2013

To configure a dynamic NAT, PAT, or identity NAT rule, I need to perform the following steps: 

Step 1 From the Configuration > Firewall > NAT Rules pane, choose Add > Add Dynamic NAT Rule.
 
The Add Dynamic NAT Rule dialog box appears. However, when I click on Add I don't get the option to Add Dynamic Nat Rule. To see the options I get please see attachment.
 
The following is a capture of the show version:
 
ciscoasa# show ver Cisco Adaptive Security Appliance Software Version 8.4(2) <system> Device Manager Version 6.4(1) Compiled on Wed 15-Jun-11 18:17 by builders System image file is "Unknown, monitor mode tftp booted image" Config file at boot was "start up-config"
ciscoasa up 16 mins 57 secs Hardware: ASA 5520, 1024 MB RAM, CPU Pentium II 1000 MHz Internal ATA Compact Flash, 256MB
BIOS Flash unknown @ 0x0, 0KB  
0: Ext: GigabitEthernet0 : address is 00ab.a72f.0100, irq 0
1: Ext: GigabitEthernet1 : address is 00ab.a72f.0101, irq 0
2: Ext: GigabitEthernet2 : address is 0000.ab6d.9802, irq 0
[code]...
 
This platform has an ASA 5520 VPN Plus license. Serial Number: 123456789AB
Running Permanent Activation Key: 0x4a3ec071 0x0d86fbf6 0x7cb1bc48 0x8b48b8b0 0xf317c0b5
Configuration register is 0x0
Configuration has not been modified since last system restart.

View 8 Replies View Related

Cisco Firewall :: Best Practice For Configuring ASA 5505

Jun 6, 2011

I am planning on building the configuration on my ASA 5505, and then distribute that same configuration to several places on ASA5505's.

What is the best way to do this? Screen dumps of the ASDM. Copy the running-configuration from a text file into the ASA5505. TFTP the running-config.

View 2 Replies View Related

Cisco Firewall :: Configuring VLANs In ASA 5505 Switch

Apr 19, 2011

I have 2 ASA 5505 firewalls and 1 cisco 3560 switch.
 
One ASA 5505 firewall and cisco 3560 switch located at SITE-A. Another ASA 5505 firewall located at SITE-B. 
 
Below is the my connectivity:
 
Site-A                                       IPSec VPN                                       Site-B
cisco 3560 <----------------------------> ASA 5505<------------------------------------------------------------------------------------> ASA 5505
 
I planned to create 5 vlans in my cisco 3560 switch. these 5 vlans needs to have internet and needs to access Site-B.
 
I will write on dafault route to firewall in my cisco 3560 switch. Is ASA 5505 supports this scenario??? If it is then how to configure ASA 5505 firewall.

View 4 Replies View Related

Cisco Firewall :: 881W IP Configuring Auth Proxy

Apr 15, 2013

Platform: 881WIOS: C880-DATA-UNIVERSALK9-M 15.0(1)M3License:

I have tried both advsecurity and advipservices

Problem: Configuring an auth-proxy redirect on seccessful authentication,Cisco's documentation states that when you are configuring auth-proxy, you may specify a url in which the clients will be redirected to when successfully authenticated.

The command is:,ip admission proxy http success redirect <url-string>,However, the command does not seem to exist on many of the latter IOS versions. I am also unable to find any documentation with alternate methods of sending a redirection to the client after a successful authentication. Is this command depricated? Is there a more efficient method of redirecting?

View 6 Replies View Related

Cisco Firewall :: Configuring ASA 5505 With Base License

May 11, 2011

I have ASA 5505 with base licence. I configured NATing and VPN(site to site). All are working fine.My ASA is base license so i created 2 VLANS, one is inside and outside.Inside i am using 10.91.40.0/24 serie IP addresses.Below are the new requirements that i need to configre:
 
1. First 30 IP addresses only needs internet directly.( Servers and Management)

2. If remaining IPs likes to use web then traffic needs to forward one proxy server( where he gives user authentiation)

View 2 Replies View Related

Cisco Firewall :: Configuring Remote-desktop On ASA5505 8.4.1?

Oct 28, 2012

I am trying to configure RemoteDesktop on a home lab ASA5505 with IOS 8.4.1 and no matter what I tried, I am unable to remote into a local server behind the firewall. I've searched online and found several threads with solutions online including here at Cisco Support Community forum and have tried them all, but have no success. I'm sure it may be something very simple that I've missed.  
 
ASA Version 8.4(1)!interface Vlan1nameif insidesecurity-level 100ip address 192.168.148.5 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address 67.x.x.75 255.255.255.128!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2shutdown!interface Ethernet0/3shutdown!interface Ethernet0/4shutdown!interface Ethernet0/5shutdown!interface Ethernet0/6shutdown!interface Ethernet0/7shutdown!ftp mode passivedns domain-lookup outsidedns server-group DefaultDNSname-server 67.x.x.75domain-name demo.localobject network insidesubnet 192.168.148.0 255.255.255.0object network rdp-serverhost 192.168.148.105object service rdpservice tcp source eq 3389access-list outside_in extended permit tcp any object rdp-server eq 3389pager lines 24mtu inside 1500mtu outside 1500icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400nat (inside,outside) source static rdp-server interface service rdp rdpnat (inside,outside) source dynamic inside interfaceaccess-group outside_in in interface outsideroute outside 0.0.0.0 0.0.0.0 67.x.x.75 1

View 7 Replies View Related

Cisco Firewall :: Configuring ASA Simulation Interfaces On GNS3

May 25, 2012

I have managed to simulate to Cisco ASA's on GNS3 - ASA1 and ASA2. ASA2 is configured as multiple mode to enable contexts while ASA2 has been configured as single mode.
 
On ASA2 I can assign an IP address to its gigabitethernet interfaces as normal, however I'm unable to assign an interface to the gigabitethernet interfaces on ASA1.

View 2 Replies View Related

Cisco Firewall :: ASA5525 / Got Warning Message When Configuring Nat On 8.3 And Later

Jun 11, 2013

I'm configuring the nat on a ASA5525 running on 9.1.2 and got 2 questions, 1. Is the below overlap warning message normal and will not cause any issue? 2. Is there a simple way on 8.3 and later to fulfill the same functionality like 8.2 and earlier?
 
old config on 8.2 and earlier
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0
global (outside) 1 216.19.84.5

[code]....

View 4 Replies View Related

Cisco Firewall :: Configuring Virtual MAC Addresses On ASA 5520?

Jul 21, 2012

I configure the virtual MAC address for a interface on ASA 5520, will enter the following command on the active unit:
 
failover mac address Inside 0012.3456.789a 0023.4567.89ab
 
The active MAC address is of the same as the Inside's burned-in MAC address of the active unit.Similarly, the standby MAC address is of the same as the Inside's burned-in MAC address of the standby unit.Do I get the effect of failover mac address command?

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved