Cisco Firewall :: DMZ Setup Using 2811 Router
Aug 11, 2011
I am pretty new to the configuration of a DMZ and I have the task of setting one up.I have a Cisco 2811 Router running Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 12.4(24)T1, RELEASE SOFTWARE (fc3), 2 FE interfaces.One FE is connected to the WAN, with a loop back interface configured with the public IP for Internet access in the office.The other FE has 2 sub interfaces configured, one for data and the other for voice traffic.Users within the office are configured to use the data VLAN to access the internet through the WAN.
Now we are setting up some new services and we require to have DMZs setup.I want to setup 3 zones now that the different servers would reside in. How can i achieve this using the existing infrastructure I have?I have an idea to create more subinterfaces and assign them to the zones, but I am still not sure how this would play out. I have been on this for the whole day and unable to make significant progress.
View 5 Replies
ADVERTISEMENT
Jan 6, 2011
I got connected ASA ----- ROUTER 2811) to metroethernet switch from my ISP , with a 4MB of bandwidth but the internet connections to all my LAN has been frozen and we lost connection to the internet, to restart the internet service I need to boot the ROUTER 2811 - and ISP switch to rollback the internet operation,My ISP support tell me if is possible to set up the traffic bandwidth in one or both borders devices, ( ASA 5510 or ROUTER 2811)
View 3 Replies
View Related
Mar 19, 2012
i have a branch router that connects to mpls WAN. Also has a second interface that is used for dmvpn failover in case WAN goes down.We want to use this second interface also as the primary internet circuit for the branch. I changed the default route to the next hop address on the other side of the second interface and expected this to work.But i was told i need to set up NAT for this to work, and set up an ACL for NAT to use. how to set up NAT?
View 1 Replies
View Related
Nov 29, 2011
I'm looking into upgrading my WAN link to 100Mb via Fast Ethernet link. I'm waiting to hear from ISP about what exact technology they use, but according to my manager they will be coming in over fiber and then terminate to copper. I currently have 2811 in production with two T1 cards bundled together. 2811 has basic configuration with only 2 ACLs. I have ASA 5510 for NAT, Ipsec and other services. What router or networking device (layer 3 switch, such as 3560G perhaps??) should I use to accomodate 100Mb link? It seems that 2811 will not handle that kind of bandwith..In short the max recommended bandwidth limits for the 28xx series are as follows:
2801--2 Mbps
2811-4 Mbps
2821-8 Mbps
2851-12 Mbps
I don't want to create a bottleneck and am looking for appropiate solution to accomodate 100Mb link. Also, could ASA 5510 become a bottleneck in my scenario?According to Cisco docs ASA5510 can handle 300Mbps of firewall througput, but I'm not sure how it'd work in production...
View 1 Replies
View Related
Sep 30, 2012
I've setup a NTP service by using Cisco 2811 routers. This works fine at the moment, but in the end there are some questions left.
1. I'm using two 2811 Routers, one for primary, which is resceiving the time from PUBLIC NTP 1, and one for backup, which is resceiving the time from PUBLIC NTP 2. Is it possible to compare these to times an check if the match? And if not, generate an alarm via e.g. SNMP
2. Is it possible to check via SNMP, if the routers are reaching PUBLIC NTP 1 and PUBLIC NTP 2 for sync?
View 3 Replies
View Related
Mar 7, 2011
I'm trying to setup a SSL VPN on a 2811. I believe I have the SSL VPN portion understood, but I can't tell because I keep getting stuck on the Certificate Server, ca trustpoint and identity trustpoint configuration.
guide that walks you through the CA cert, Cert Server, ca trustpoint and identitiy trustpoint to ios SSL VPN?
View 6 Replies
View Related
Sep 10, 2012
I am lacking experience in BGP and now I am trying to figure out what should be the ideal and recommended design.
Scenario:
- Having two Internet Service Provider with two ASN
- Having one idenpendant IPv4 public address
- Having two Internet Cisco Router e.g. 2811
- Having two Cisco ASA Firewall e.g. 5510
View 3 Replies
View Related
Feb 22, 2011
I am trying to setup a L2L IPSec VPN between cisco VPN3020 concentrator and Cisco 2811 something is not working and I don't understand why.I describe my situation in detail my router has 2 interfaces
External interface Fa 0/1 ip 193.P.Q.R
Internal interface Fa 0/0 141.G.H.254
Lan on internal interface is 141.G.H.0/24
remote VPN concentrator has 2 interfaces
Public interface 131.A.B.C
Private interface 131.A.I.E
I have to set up L2L so that host 141.G.H.10 can talk to host 131.A.H.D whici is behind the VPN concentrator my router config:
crypto isakmp policy 3 encr 3des hash md5 authentication pre-share group 2crypto isakmp key * address 131.A.B.C!crypto ipsec transform-set presid-set esp-3des esp-md5-hmac !crypto map presid-map 5 ipsec-isakmp set peer 131.A.B.C set transform-set presid-set match address presid!interface FastEthernet0/1 ip address 193.P.Q.R 255.255.255.252 duplex full speed 100 crypto map presid-map!interface FastEthernet0/0 ip address 141.G.H.254 255.255.255.0 duplex auto speed auto!
ip access-list extended presid permit ip host 141.G.H.10 host 131.A.H.D
ip route 0.0.0.0 0.0.0.0 193.P.Q.S
Then I configured VPN3020 accordingly creating a lan to lan profile with the proper IKE proposals ecc ecc when interesting traffic is matched by VPN acl (presid) I see this messages in the VPN concentrator logs:
57101 02/23/2011 15:49:05.310 SEV=4 IKE/119 RPT=4033 193.P.Q.R Group [193.P.Q.R]PHASE 1 COMPLETED 57102 02/23/2011 15:49:05.310 SEV=4 AUTH/22 RPT=3935 193.P.Q.R User [193.P.Q.R] Group [193.P.Q.R] connected, Session Type: IPSec/LAN-to-LAN 57104 02/23/2011 15:49:05.310 SEV=4 AUTH/84 RPT=11 LAN-to-LAN tunnel to headend device 193.P.Q.R connected 57110 02/23/2011 15:49:54.820 SEV=4 IKE/123 RPT=1093 193.P.Q.R Group [193.P.Q.R]IKE lost contact with remote peer, deleting connection (keepalive type: DPD) 57112 02/23/2011 15:49:54.820 SEV=5 IKE/194 RPT=3778 193.P.Q.R Group [193.P.Q.R]Sending IKE Delete With Reason message: Connectivity to Client Lost. 57114 02/23/2011 15:49:54.820 SEV=4 AUTH/23 RPT=14 193.P.Q.R User [193.P.Q.R] Group [193.P.Q.R] disconnected: duration: 0:00:49 57115 02/23/2011 15:49:54.820 SEV=4 AUTH/85 RPT=11 LAN-to-LAN tunnel to headend device 193.P.Q.R disconnected: duration: 0:00:49
and from router side I See this with show crypto isakmp sa
131.A.B.C 193.P.Q.R CONF_XAUTH 5 0 ACTIVE
but the status got stuck in CONF_XAUTH state and then disconnects?
View 1 Replies
View Related
Jun 17, 2012
I would like to set up a POTS Dial connection between 2 Cisco routers, using the modem card WIC-1AM-V2. I'd like to use this as an out-of-band connection to a remote site, if the primary internet connection fails. So, this setup will only be used in one direction, 1 router placing calls, the other one receiving calls.Here's my config of the receiving router:
chat-script dial "" ATZ AT OK "ATX3D T" ATS0=8 TIMEOUT 120 CONNECT C
interface Async0/2/0 description out of band for network no ip address encapsulation slip async mode interactive
line 0/2/0 session-timeout 5 absolute-timeout 10 script connection dial login local modem InOut transport input all escape-character BREAK autoselect ppp stopbits 1 speed 115200 flowcontrol hardware
[code]....
This config is working fine, when dialing in via a Windows Hyperterminal Dial connection. After a while of dialing I get the login prompt of the router.Now I want to have a router placing calls instead of a Windows Server. I can't figure out how to tell a router to place calls to a POTS phone number.
Receiving router: 2811, WIC-1AM-V2, IOS c2800nm-ipbasek9-mz.124-25a
Calling router: 1841, WIC-1AM-V2, IOS c1841-advsecurityk9-mz.124-25a
View 5 Replies
View Related
Apr 18, 2012
I try to implement the url filtering feature on a cisco 2811 router and whenever i enable the parameter map patterns the router retuns (after some time)
%Unable to compile obj regex.[code] The result is that the router blocks ALL webpages without giving a block page message.
View 2 Replies
View Related
May 26, 2012
I have a 2811 ISR configured to provide the following services to my network:
Internet access to LAN users Cisco Call Manager ExpressSite-to-stie VPN to 3rd party networksVPN server to provide VPN access to remote usersSecurity Zone configurationsStatic NAT configurations Now I recently just got the ASA5510 device and I am not sure how to go about with the setup, whether to put the ASA in between the internet and the ISR (Internet - ASA - ISR - LAN), or put the ISR in between the internet and the ASA (Internet - ISR - ASA - LAN)?
While i know I can move most of the config unto the ASA, i know that the CME cannot be moved, hence I would like to do the setup such that users on the network still have access to CME.
View 5 Replies
View Related
Jun 27, 2011
I just purchased thie Cisco 2921 router and have all the configuration completed except the Firewall and NAT. We have 4 supnets at our location on the router each with a DHCP handed from the router to our network. Any examples for the Firewall and Nat configurations?
View 6 Replies
View Related
May 17, 2011
I have attached a drawing of our network. We have two 6509's connected to two Cisco 2811 (onsite) that the ISP owns. I am trying to get one side up and running before I worry about redundancy and so forth. For this reason I have set all the HSRP priorities to 110 on the left 6509. I have HSRP running between the ISP routers and V LAN 101 of the 6509's. This works as I can ping yahoo and Google just fine from the 6509 switch. I can't get from my laptop connected to V LAN 23 to the internet.
It doesn't even attempt to NAT as there are no translations. I have public address assigned by my ISP configured between the ISP routers and my 6509 on V LAN 101. I then have the public address assigned to V LAN 100. I configured V LAN 100 on the switch and V LAN 100 on the FWSM with the IP address in the drawing. I have my NAT statements and route in my FWSM according to the drawing as well. On the switch, I have a default route to X.X.12.19 which is the VIP between the ISP routers. I can reach anything on the inside of my network, including the old network addresses from V LAN 23.
1. Is it best to do NAT at the FWSM or should I do it on the MSFC connected to the ISP routers?
2. If I have to configure NAT at the FWSM, does this requires me to extend the public network down to the FWSM?
3. I'll take any examples you may have as I am stuck.
View 2 Replies
View Related
Jul 31, 2012
I'm trying to run ZBFW on a 2811 with IOS version 15.3(T4) and I'm running into a strange issue I'm not quite sure how to troubleshoot.
I have 3 zones, internet, local, and ssl-vpn.The rules I'm trying to enforce are: all traffic from SSL-VPN can go to anywhere, anywhere can go to SSL-VPN. Anything originating from local can go out. Certain ports can come in for DMZ services (http, https, imap/s, pop3/s, submission).
After rebooting the router and applying f0/0 and tun0 to internet, f0/1 to local, and virtual-template 1 to ssl-vpn things work fine. But after a while I stop being able to connect to servers at the high end of the subnet. (I have .20 to .26 configured with the services, .20, .21 work fine always, .22 and up stop responding). Remove interfaces from the ZBFW, no problem at all. Apply ZBFW, traffic stops.
I'm seeing dropped sessions in the log on zone-pair local-to-internet , invalid flags with ip ident 0 which I think is outbound traffic attempted for no inbound inspect entry, but everything should be allowed out, and the traffic is to port 80 which is allowed by 'match protocol http' on the inbound policy.
Edited config attached (remove passwords and stuff) Last few log lines are at the bottom.
View 3 Replies
View Related
Nov 2, 2011
I'm generally pretty good with VPN issues and with SSL certs, but this is my first rodeo with VPN and certificates together. I've got a Cisco 2811 router running IOS Firewall (12.4(25)) and for a while now, I've had VPN clients connecting using PSK's and XAUTH. In order to tighten security, we'd like to move away from PSK's with Aggressive Mode and use certificates with Main Mode.I've been trying to use the Cisco 2811 as the CA, rather than use a Microsoft server or third-party provider. I think I'm pretty close to getting this to work, but something isn't quite right. My VPN client software does connect to the 2811, and I get prompted for the XAUTH creds. If I supply the right creds, I do see in my VPN log window that I've gotten assigned an IP address from the inside VPN pool, my split tunneling rules come through, but the VPN disconnects almost immediately and I never get a chance to try any pings or to send any other types of traffic. [code]
I have attached a sterilized copy of the 2811's current config (2811_sterile.txt), a copy of the 2811's debug output when the VPN client tries to connect (vpn_client_connect_sterile.txt), and a copy of the VPN client's log with IKE on High and Certificates on High (vpn_log_sterile.txt).FWIW, the 2811 is NOT behind NAT, but my VPN client IS behind NAT. However, I have tried using a direct connection with the VPN client and it didn't seem to change much so I'm not convinced this is a NAT issue.Again, I've never used a Cisco router as a CA and I've been battling this problem for several hours now so the 2811's config may have a lot of unneccessary lines in it at this point.
View 1 Replies
View Related
May 31, 2013
Attached is our network diagram showing the details of our remote office and the corporate side which are connected via private fiber. The workstation (10.10.102.84) can ping the 10.20.0.31 IP address of the PBX but not the .30 address and I know if we can’t ping it we can’t remotely manage it. The 2811 router, ASA 5510 and the 6509-E can ping both IP addresses on the PBX. The ASA logs the error "Denied ICMP type=0, from laddr 10.20.0.30 on interface inside to 10.10.102.84: no matching session" when the workstation pings the .30 address.
We changed the default gateway of the PBX from 10.20.0.2 to 10.20.0.1 (2811 router) and we were able to ping both IP addresses from the workstation but the SIP trunks from the Internet stopped working (they NAT to the .30 address). Because calls may be forwarded from the PBX to the corporate network (via IP phones) we will eventually need to change the default gateway to10.20.0.1 and still need the Internet SIP trunks.
My two questions are, how do we resolve the issue of pinging the .30 address from the workstation and then when the time comes how do we resolve the issue with the SIP traffic reaching the .30 address when we change the default GW of the PBX to the 10.20.0.1 address of the 2811 router.
View 9 Replies
View Related
Sep 20, 2011
I came across this site. I wanted to produce a better incoming ACL at home and work to prevent known bad sites
Here is their list of the Top 10 Global Spammers is out. The biggest surprise on the list is Korea, as it takes over the number one global spammer spot from China. With the improved high speed internet infrastructure in Korea and ease of network access, who knew Korea would be on the rise.
Here is the complete Global Spanner Top Ten List for the first quarter
[URL]
Korea
China
India
Russia
Turkey
Viet Nam
Ukraine
Brazil
Venezuela
Pakistan
When I sort the list, it is over 16k lines of ACL!
My question relates to what performance limits I would find.
Can I actually put that many lines in an ACL?
Will the router choke and do any other work
I have attached the sorted ACL list for you to review
Any of the following router lines will accept a list that large and still run acceptably?
2811
2911
3925
2945
View 1 Replies
View Related
Jan 7, 2012
I have a Cisco 2811 running Advance Enterprise v 15.1-2. I've just configured it using ccp for internet access (on 2 lines) and a firewall. The configuration is pretty much all default and I used the ccp wizard to create a 'medium-secure' firewall. I have 2 blocks of public IP addresses for my internal network and for the DMZ. The 2800 is configured as follows:
- 2 x default routes. one to each dialer.
- 6 zone pairs as follows:
- ccp-zp-self-out (seems to mostly work... I can ping any IP address from a console but not a hostname)
- ccp-zp-in-out (works fine, both interfaces seem to be in use)
- ccp-zp-in-dmz
- which by default set to ccp-permit-dmzservice
- which inspects ccp-dmz-traffic
- which matches group dmz_traffic and has a class map dmz-traffic
- cnc-zp-dmz-out which is set to ccp-inspect. (my own zone pair to allow systems in the DMZ zone to see the internet. This works fine.)
- ccp-zp-out-dmz (works fine. I can see my web server from any system outside my own network)
- ccp-zp-out-self (which, I guess allows anything permitted to get to the 2811)
Internet works from within the DMZ and in-zone. The outside can access my dmz servers. The inside can access most things on the outside using the firewall rules.
1) Although I have the zones set up to allow the same access from in->dmz as I do from out->dmz and out->dmz seems to work, I cannot seem to access anything in the dmz from the inside.
2) When setting up the firewall I ticked the box for 'allow PPTP clients to make connections from the inside' (or something like that). I cannot seem to make a PPTP connection from my workstation.
I have scoured the internet for guides, looked through these forums & the cisco configuration guides and experimented all day but still cannot figure this out.Do I need a special route between the inside and dmz? I have seem references to static routes on ASA firewalls but the command 'static (inside,dmz)...' does not work on a 2800 series router.
View 7 Replies
View Related
Mar 8, 2013
I have a Cisco 2811 router and i want to experiment on the IOS firewall.The thing is, none of the commands that are proposed in online guides - like ip inspect, ip audit, etc. - seem to be working. I just get "unrecognized command" on a router that is supposed to support such features. I'm wondering if it has something to do with the IOS image.
My show version output is this:
Cisco IOS Software, 2800 Software (C2800NM-SPSERVICESK9-M), Version 12.3(11)T9, RELEASE SOFTWARE (fc3)
Technical Support: [URL]
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Tue 13-Dec-05 08:24 by ccai
[code]....
View 5 Replies
View Related
May 26, 2013
We have a setup of a firewall in between my Cisco 1841 router and Switch.
Cisco Router --> Meraki Firewall--> Switch
Client VPN is configured on the Meraki Firewall but then for the outside users to client vpn in to the network, I have to port forward or open the ports 500 and 4500 to the IP address of the Meraki Firewall 192.168.1.90. [code]
View 4 Replies
View Related
May 6, 2011
I can't find any specific information on the implementation of packet inspection in a zone based policy firewall. In other words, is there a specification or even just a set of values that define the default inspection parameters for all protocols? With DPI I can manage 'some' of the inspection capabilities but I have some fairly rigorous and specific requirements to meet and I need to validate that the IOS ZBFW will meet those requirements. Specifically, I'm interested in HTTP, DNS, and ICMP but all other protocols would be useful as well.I'm working with basic routers; 871's, 2811's, 1841's, etc. The IOS in use in most cases is adventerprisek9-mz.151-3.T.
View 4 Replies
View Related
Feb 19, 2012
I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?
View 1 Replies
View Related
May 9, 2011
I am familiar with the PIX and ASA's. We have two Cisco 6509's with a FWSM installed in both. Our network is shown in the diagram. We use Blue Coat Packetshapers and Barracuda Proxy appliances. I plan on setting up HSRP on both 6509's for traffic coming from our ISP Cisco 2811's as well as use HSRP for our DMZ and internal network. I would like to setup the firewalls for statefull failover. We will be using PAT for our internal users and one-to-one static NAT for our DMZ.
Is it better to setup the firewall's as transparent or routed?
Since the firewall is built into the switch, how do I insert the Barracuda proxies? I can configure them as transparent or routed proxies.
View 2 Replies
View Related
Nov 8, 2011
I want to configure BGP but i am finding it very difficult to know BGP as I am new to this concept.
What is theoretical and practical approach to configure bgp??
I have to configure my office router 2811 for two ISPs which will be acting as fail-over.
I have to start it from scratch.
View 5 Replies
View Related
Jan 3, 2012
I just bought an additional router for my network and I'm in the process of setting it up.I have however hit a snag with enabling ssh on the device. It is a cisco router 2811 running IOS 15.0 (refer below to my attempts)
View 3 Replies
View Related
Jun 14, 2012
how many extra interface port can be plugged in to the 2811 router ,there are 2 fixed FE port on this router and i have 3 connection i.e one mpls link , one internet link and one sip trunk .. some body confirm me that i can insert module in 2811 ?
View 5 Replies
View Related
Nov 12, 2011
How to replace fan incisco 2811 router in live or down condition?
View 2 Replies
View Related
Aug 25, 2012
when I got past my current hang up, I marked the thread as answered, so I wasn't sure if I should start another or continue on...
I've tried going through that troubleshooting doc, but I still can't figure this out.
When turning on debug for the 2811, I'm not seeing any thing.
show debug
Cryptographic Subsystem: Crypto ISAKMP debugging is on Crypto ISAKMP Error debugging is on Crypto IPSEC debugging is on Crypto IPSEC Error debugging is on
#show crypto sessionCrypto session current status
[Code].....
View 3 Replies
View Related
Mar 6, 2013
I configured Any Connect SSL VPN on Cisco 2811 router. It works perfectly when I lo gin via web and run secure mobility client. However, when I connect directly from the mobility client connection fails. It does not even ask me for username and password.
----------------------------------------------------------------------------------------------------
Mar 7 21:36:47.613: %SSLVPN-5-SSL_TLS_CONNECT_OK: vw_ctx: UNKNOWN vw_gw: VPN_GATEWAY i_vrf: 0 f_vrf: 0 status: SSL/TLS connection successful with remote at
Mar 7 21:36:47.617: WV: sslvpn process rcvd context queue event
Mar 7 21:36:47.621: WV: sslvpn process rcvd context queue event
Mar 7 21:36:47.745: WV: sslvpn process rcvd context queue event
Mar 7 21:36:47.749: WV: Entering APPL with Context: 0x49233618,
[Code]........
--------------------
I have not figured out yet, why mobility client works when launched from the web and why it does not work directly.
View 5 Replies
View Related
Sep 19, 2011
I have cisco 2811 router and two ISP copper line. How can configure it as BGP router.
View 11 Replies
View Related
Feb 10, 2013
We currently are using 2811 router for internet Via IPSEC tunnel.Download speed is 30 Mbps and Upload speed is 6 Mbps.
But we are getting not more than 4 Mbps download speed. We did open Tac case and as per Tac 2811 router is not for 30 Mbps.Can any suggest proper model. We need 2 FastEthernet/Gig and one serial port.
View 2 Replies
View Related
Jan 9, 2012
I am looking to upgrade a 2811 router to 15.1.2T and see in the release notes that this image is only compatible with the "C Series" older ISR routers? What is a "C Series" ISR and how do I know if I have one?
View 4 Replies
View Related
Nov 10, 2011
I need to upgrade a router from a 2811 to a 3945.
2811 has the following modules:
View 1 Replies
View Related
