Cisco Firewall :: Don't Want ASA5505 To Control DNS For Internal Client
May 28, 2012
We have an internal DNS server that all internal hosts do lookups to .. these requests are forwarded onto open dns for anything the dns server isnt authoritative for.. My question is we have purchased the botnet filter and this requires the asa5505 dns client to be active on at least one interface .. Should i point the asa dns to an external IP such as 8.8.8.8 and apply DNS enabled on interface outside ( am using asdm) I don't want the ASA to control DNS for our internal clients we already have a internal server for this, i DO want the asa5505 to check dns packets against its botnet filter, whilst still using open dns for forwarding.
View 1 Replies
ADVERTISEMENT
Oct 25, 2012
I have a cisco ASA5505, it runs a wide site to site VPN network and has 4 servers connected to it
10.50.15.4 > fileserver
10.50.15.5 > domain controller (exchange)
10.50.15.6 > terminal server
10.50.15.7 > terminal server
Now yesterday i removed 10.50.15.6 and replaced it with a new terminal server with the same ip address, ever since the ASA is blocking traffic between it and the domain controller (example)
2Oct 27 201214:51:0510600710.50.15.655978DNSDeny inbound UDP from 10.50.15.6/55978 to 10.50.15.5/53 due to DNS Query What has me baffled is the only thing different between today and yesterday is the new server is windows server 2008 and the old one was windows server 2003. The new server has the same LAN ip address as the old one to make the changeover seamless for the users.
why all the sudden my ASA has decided to block the traffic between those machines? all the other machines can talk to it fine just not the domain controller, and seeing that this is a terminal server naturally you can see the problem i face!
this router has worked flawlessly for 2 years now without any config changes and i cant work out why its blocking traffic between those 2 machines.
View 15 Replies
View Related
Dec 18, 2011
we have a cisco ASA5505 with base license and 3 interface configured. Internal 192.168.1.1/24 DMZ 172.16.0.1/24 Outside 20.20.20.20/24 The DMZ is configured to allow the traffic pass to the outside interface only (base license allow only traffic to one interface) in order to let clients on this network to browse internet. On the outside interface there's a nat configuration that let the port 443 to be natted to an in internal server. Is it possible to let the clients in DMZ to access to the internal server on port 443 from the outside interface?
View 3 Replies
View Related
Jan 10, 2013
we have a Cisco 2901 as a router on a stick for several vlans. Everything on the segment routes fine and accesses the internet just as they should. The 2901 connects to an ASA5505 on port 0/1. Any host connected to the ASA5505 can access the internet, but can not ping into any of the vlans off of the 2901. The strange thing is on either segement of the network I can ping all of the gateways. What is even more strange is when I run wireshark from behind the firewall going into the 2901 I can not see the packet on another wireshark instance behind the 2901. However if I start a ping for a host host behind the asa I can see the packet in wireshark on the host, which I am trying to ping, hit the gateway.
View 15 Replies
View Related
Nov 26, 2011
I am new to the ASA series and I am at a complete loss as to why I cannot configure this router to forward SMTP and RDP traffic to an internal host.
The packet trace tool in ASDM shows complete end-to-end connectivity for RDP but it still fails to connect from outside. This is my config file, what I need to change in order to make it work?
View 19 Replies
View Related
Jun 21, 2012
ASA 5505 Firmware 8.3(4), ADSM 6.4(2).I have a public IP address of 168.87.3.4.I need to forward ports (5060, 5080, etc.) to one internal address. (192168.1.1).I need to foward different ports (10020-10080) to a different internal address (192.168.1.2) Everything I read tells me how to do this in a 1 to 1 static NAT.
View 1 Replies
View Related
Oct 10, 2012
I'm able to build my tunnel but unable to RDP nor ICMP back to the internal network.
VPN Client IP: 192.168.200.200
INTERNAL IP: 172.17.130.200
my configuration is below:
HOME-ASAFW02(config)# wr t: Saved:ASA Version 8.4(4)!hostname HOME-ASAFW02domain-name hsd1.nj.comcast.netenable password ViPq56cvd3SGvB08 encryptedpasswd 8bcozHCAwCqA5BmN encryptednames!interface Ethernet0/0description OUTSIDE-Connectionswitchport access vlan 2switchport protected!interface Ethernet0/1description INSIDE-Connectionswitchport protectedspeed 100duplex full!interface Ethernet0/2description WiFi-LinkSYSswitchport access vlan 3switchport protected!interface Ethernet0/3shutdown!interface Ethernet0/4shutdown!interface Ethernet0/5shutdown!interface Ethernet0/6shutdown!interface Ethernet0/7shutdown!interface Vlan1description INTERNAL-Networknameif insidesecurity-level 100ip address 172.17.130.129 255.255.255.128!interface Vlan2description OUTSIDE-Link-to-ISPnameif
[code]....
View 12 Replies
View Related
Mar 28, 2012
I just setup my home network with Pix 515 acting as my router/firewall but I can't seem to ping my internal PC from my ASA. I can access the internet and ping my Pix 515 inside interface from my pc but I can't ping my pc from my Pix 515. I can also renew/release IP's from my PC. I also did a packet tracer and it says that it was dropped due to an access list but I have one in place. Also my switch has the default config. Below is my config
Internet <----> Comcast modem <-----> Pix 515 <-------> Cisco switch <-----> PC
MYFIREWALL# sh run
: Saved
[Code].....
View 4 Replies
View Related
Jul 28, 2011
I have the below configuration for a cisco asa 5505. There is a ADSL router in front of the ASA which has a static IP. I set up a remote-access VPN (using the wizard), but I cannot connect to the ASA firewall as the attached VPN client log shows. My only concern is that there might be something missing, ie a static route that goes to the inside interface. [code]
View 7 Replies
View Related
Jun 20, 2011
I have a XP workstation behind my ASA that can not connect to a client's network via Cisco VPN Client using IPSec...
In the logs it shows the translation is working on 500 but the VPN Client has the error 412, that the client is not responding.
Config below
ASA Version 8.2(1)!hostname RWFW1enable password encryptedpasswd encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address x.x.x.x
[Code].....
View 16 Replies
View Related
Mar 17, 2013
I have created a VPN connection for ASA 5512-X by using the wizards and nothing seems to be wrong on the wizards's config.I am able to connect to the network by using the VPN but unable to ping internal network.Below is my config for your reference:
Result of the command: "sh run"
: Saved
:
ASA Version 8.6(1)2
!
hostname FAA-ASA-1
enable password crzcsirI44h2BHoz encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
[code].....
View 6 Replies
View Related
Oct 29, 2012
I ve configures an asa 5505 for remote vpn with anyconnect. it works just fíne - from remote i can ping the Clients and Server inside, i can do RDP or Connect via SSH to any machine, map some volumes local and so on but: I can not connect microsoft sql server. It uses port 1433 for the first connect and establishes then a dynamic connection. So i am a Newbie - what rules or configs do i miss?
View 3 Replies
View Related
Apr 25, 2011
I enabled SBL on ASA 8.4, anyconnect client is Win-XP, everything worked as expected, but some users do not want to see SBL logon screen before windows logon because often times they will need to login before they can get network connection. So I modified profile.xml's following line from
UseStartBeforeLogon UserControllable="false">true</UseStartBeforeLogon
to
UseStartBeforeLogon UserControllable="true">true</UseStartBeforeLogon
the new profile is downloaded to client machine's anyconnect vpn profile fine, yet still users see VPN logon screen before Windows log on, "Connect on startup" is un-checked on Anyconnect VPN client, client machines rebooted multiple times, Anyconnect VPN client was removed and re-downloaded from scratch, no change ... What else do I have to do? I certainly can create a new group-policy/tunnel-group for those users without SBL, but that is far from an elegant solution.
View 7 Replies
View Related
Sep 15, 2011
The problem is that the PABX is sending out an internal address in it's INVITE messages and the ASA5505 isn't changing the internal address to the external address.We need> From: Calling Number <SIP: SIP Username@Public IP Address>However our PABX sends out> From: Calling Number <SIP: SIP Username@Private IP Address>. How to translate the internal IP address to the external IP address on an ASA 5505?
View 1 Replies
View Related
May 12, 2013
I have configured a Cisco ASA 5505 to allow VPN access from outside to my LAN using Cisco VPN Client software. The connection is establishing properly with the ip address from my VPNPool. From outside (on VPN connection) I can ping the interface e0/0 (outside) and the interface e0/1 (inside) of the firewall, but I cannot ping the layer 3 switch interface to which the ASA is connected ( int gi1/0/22 ip address 192.168.1.2/30 ) and I cannot ping any vlan interfaces inside my switch. Therefore, I cannot connect to any server on my internal LAN. I am available at any time if further information is needed. find attached my ASA config.
View 7 Replies
View Related
Feb 9, 2012
I have just purchased an ASA 5505 for my remote users to access our internal network. I have followed all the setup instructions I can find. I am able to establish a VPN connection using the Anyconnect client and can see some of my internal network. (Basically, only the subnet of the internal interface) However, I have several subnets inside my LAN which are routed by another switch inside my LAN. I have built in the correct static routes so that the ASA will send traffic to that intenal routing switch for any subnets not part of it's inside interface subnet. I can see and ping those subnets from the ASA itself but the AnyConnect clients cannot.
View 9 Replies
View Related
Mar 20, 2013
I have an internal DVR system that I am trying to share to the outside world. We recently put in an ASA5505 and I am having trouble getting the settings correct.I want to use an external IP to access the DVR system from anywhere and have my ASA5505 redirect the traffic to the internal IP address. I assume I need to use a NAT and a route policy however can not figure out how it would be.
View 11 Replies
View Related
Jun 3, 2011
I am using a win server 2008 in my company, recently my staff have being using internet a lot for downloading and many other unnecessary software therby redusing overall bandwidth.Is there any software solution i can use for controlling bandwidth of my client computer from server2008 computer.
View 3 Replies
View Related
Feb 15, 2012
We have been using the VPN client for a very long time. Our most current VPN setup is using an ASA 5510, without split tunneling. We tunnel all traffic. We are using IPSec group authentication off of an AD domain controller.
Recently I have been having some issues with some of the client machines, and I can't for the life of me figure out what the issue is. Some machines will not respond to pings, and I cannot remotely access the machines (using Dameware Remote Control) while they are connected to the VPN. Other client machines work fine. In fact there have been a couple instances where I have two machines in a remote office, using the same internet connection, both connected to the VPN, where I can ping and remotely manage one machine, but not the other. If RDP is enabled, I can sometimes get into those problem machines via RDP. But this is crippling our ability to remotely support many of our VPN users, and I just don't know what to look for.
I have tried disabling Windows firewall completely, and that does not seem to work at all. The only other thing I can think of is I recently upgraded our McAfee software. But it does not prevent us from getting connected to or pinging any of the systems on our physical network, nor to half of our VPN users. Most of our clients are running Windows 7, or Vista, and using the client version 5.0.07.0290, or 5.0.05.0290. Most of the clients using 5.0.07.0290 are using the 64-bit version.
View 10 Replies
View Related
Nov 17, 2011
Completly new to Cisco ASA and need to get this working ASAP.ASA 5505 8.4(1) is the secondary FW and I need for it to allow everything going out and block everything coming in but for the VPN clients. Since a Cisco moron, I used the ASDM and it's wizards to make this work, which might explain my situation.
[code]....
My Cisco VPN Client connects to the ASA and receives 10.10.101.1 IP address, but I get no connectivity to the ASA or any other 192.168.101.x server or service (tried telnet, RDP, ping, etc.)
View 2 Replies
View Related
Apr 23, 2013
I did some searching and the answers said it was supposedly possible but no info on how to do it. I am wondering if it is possible to configure a Cisco ASA 5505/10/20 to be a client to an existing (in this case) cisco client vpn. The reasons why are complicated (and imo irrelevant) but basically I need to be able to make a small network that can be on this vpn rather than individual machines.The client vpn is a basic IPSec over UDP Cisco VPN to an ASA5505.So how would I configure another ASA to connect to this like its a client?
View 3 Replies
View Related
Dec 12, 2012
, I have ipsec vpn setup on an asa5505 at one of my office locations but when I try to log in to the vpn with the vpn client it just dont work but I have a Linux laptop with vpnc loaded and that connects just fine no problems there ? by the way on my windows system i Have vpn client 5.0.07 asa5505 8.0.(4) asdm 6.1.(3)
View 5 Replies
View Related
Apr 12, 2011
I want to set up our ASA5505 firewall to allow access from the Cisco VPN Client software.I have nstalled the client software then tried using the VPN wizard to set up the connection without success, I am running Windows 7 32 bit and Cisco client 5.0.03.0530. [code]
View 22 Replies
View Related
Jul 20, 2011
I installed on 2 different PCs (Win7 64-bit) the Cisco VPN Client 5.0.07 with the same VPN profile for 2 different users. We use an ASA5505 (8.0(5) sec plus license) as the VPN end point for the clients. The VPN Clients can connect simultaneously to the ASA, they receive the split tunnel infos but only ONE client can ping the internal network ip range. The other one has no access to the internal resources! When they separately try to connect, there is no problem. Each of them can reach the internal net.On other 2 PCs (Win 7 32-bit) the clients have no problem reaching the internal net (simultaneously connect).
View 0 Replies
View Related
Sep 18, 2011
I have just purchased and setup a vpn on my ASA5505 and now I wish to setup a Windows VPN client to use it. Does CISCO have any free vpn clients for Windows?I tried to download a client from the CISCO downloads area, but it's for some kind of purchase agreement. I would have thought that the vpn client was free to download given my ASA comes with two free vpn licenses.
View 5 Replies
View Related
Oct 4, 2011
when it comes to IOS based SSL VPN setup, so have run into an issue which I can't seem to find an answer for.
What i'm after is a way to restrict access to an AnyConnect authenticated and connected client, on a specific profile, to a list of specific websites (all on the Intranet). Everything else must be blocked.
On the IOS device, I had it fudged to pretty much retstrict access to a certain IP and port, and used a mod rewrite in Apache to re-write a URL from that IP to the host the site actually resided on. It's cludged together and working, but it's not ideal (and it's not going to allow for scaling up to what I need).
I can find plenty of references here and on the net to using regex to create block lists based on a global policy to disallow specific URLS, but I need the inverse of that, and, only applied to a specific policy group.
Is this possible on an ASA5505? Is it possible on *any* ASA?
View 11 Replies
View Related
Feb 24, 2011
I use VPN Client 5.0.06.0110 to connect my home computer to my office, which has an ASA5505. If my immediate network connection to the PC client is lost while the VPN is active, I get a BSOD. There's no problem if my DSL drops or a cable beyond my router is unplugged. It only (and always) fails if the network cable to the PC running the VPN Client is diconnected (or if my router loses power) while the link is connected.
View 6 Replies
View Related
Feb 1, 2012
I have a PCF file that works fine on Windows XP. The tunnel to the ASA5505 comes up, and I can ping my server at 10.1.1.2.
I take the same PCF file and put it on a Windows 7 machine client version 5.0.07.0440 and the tunnel comes up. But I'm unable to ping my 10.1.1.2 server.
Does something in the pcf file need to change for this version of the client?
View 1 Replies
View Related
Oct 31, 2011
I have configured Clientless SSL VPN for access to ASA 5540 internal network. Still I am unable to take ssh to my core switc [code]
View 5 Replies
View Related
Mar 11, 2013
How to configure Belkin N (F5D8636-4) Client IP Filtering so that a range of client IP' deny access to the internet using the following blocked time ranges e.g. Mon 5:00pm to Tues 2:00pm, Tues 5:00pm to Wed 2:00pm, Wed 5:00pm to Thur 2:00pm, Thur 5:00pm to Fri 2:00pm, Fri 5:00pm to Sat 10:00am, Sat 1:00pm to Sun 10:00am, Sun 1:00pm to Mon 2:00pm - BTW - this access regime is to deny internet access for my teenage son?
View 3 Replies
View Related
May 24, 2011
I am working with an ASA5505. I have configured a Remote Access IPsec Connection profile. This profile is configured to give clients a virtual ip address via DHCP as shown in this configuration example: url...When the DHCP request is sent from the ASA to the DHCP server, the hostname in the request is set to the name of the IPsec connection profile and a number. Is it possible to have the hostname set to the host name of the client that initiated the connection?Does the ASA support receiving a hostname as part of a IKE Mode Config Request?
View 9 Replies
View Related
Mar 24, 2013
I've deployed AnyConnect on Windows 7 clients, and they are throwing this message after few days of usage: "The VPN client driver has encountered an error."
-Version: anyconnect-win-2.4.0202-web-deploy-k9
-OS: Windows 7 Pro 64-bit
-FW: ASA 5505
What seems to fix it:
1. Uninstall Any Connect Client then,
2. Remove C:UsersUserAppDataLocalCisco folder
View 4 Replies
View Related
Sep 28, 2011
We have two sites connect with an IPSec L2L VPN.
-Site A: 192.168.13.0/24
-Site B: 192.168.2.0/24
On both sites we have a ASA5505(Base license) to terminate the tunnel.On Site B we also got a remote access vpn to which we can connect using the vpn client.The lan2lan tunnel works fine and so the remote access vpn.Now i want to connect to Site A using my vpn client connected to Site B. [code] There are no vpn-filters or other special policys in place..If tried to ping from my vpn client to Site A while i was debugging ipsec 255 on site B: the asa matched the l2l-tunnel for traffic sourced from 192.168.25.x to 192.168.13.x but when im doing a show crypto ipsec sa detail there are no packets getting encrypted..so of course no packets reaching my asa on site a.
View 9 Replies
View Related
