Cisco Firewall :: Getting Internet Access On ASA 5510

Feb 27, 2012

the set-up is: a DSL modem in half bridge (it does all the PPPoE connection) passes our static IP (55.167.x.x) to the ASA's outside interface ... (the modem has an IP of 192.168.1.1, but not sure this matters)
 
then I have one inside interface on 192.168.43.1, which connects to a server and we have a working site-to-site VPN between this server and a client.. so I know most of it's set up right ... nothing else is on the 192.168.43.0/24 network.
 
the management interface is on 200.200.1.0/24 so it's out of the way and incidentally connected to a dedicated PC, which also has console access via the blue serial cable.
 
the last interface Main_Network is on the 192.168.0.0/24 network and it's this that I'm trying to get to work... at the moment I just have one Windows PC connected directly (does it need to go through a switch?) into the ASA for testing with a static IP (192.168.0.72), but I can't ping anything outside from the PC... only the ASA's interface (at 192.168.0.30).. I have the gateway on the PC set as 192.168.0.30 by the way.
 
The ASA can ping all the inside machines and anything I like outside.
 
Here's my config ... the static routes are there for when this replaces the current modem/router and the whole network plugs into the ASA.
 
ciscoasa(config)# show running-config
: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa

[Code]......

View 4 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5510 - Users Unable To Access Internet Through Firewall

Feb 26, 2013

I have some problem with the ASA 5510 ver 7.0(6). My manager wants to keep this as backup. tried lots of things but still users not able to access internet nor can i ping anywhere.For example when i ping 4.2.2.2 i dont get any reply.The runing config is below for ur ref :
 
HQ-ASA-01# show  running-config
: Saved
:

[Code]......

View 9 Replies View Related

Cisco Firewall :: ASA 5510 - Get Internet Access From DMZ

Nov 14, 2011

I can't seem to get internet access working from the DMZ network through our ASA 5510. PCs on the DMZ can ping the ASA but can't get out to the internet.I will attach a (cleaned) configure.

View 3 Replies View Related

Cisco Firewall :: No Internet Access On ASA 5510?

Oct 29, 2012

I can get access to the internet from the ASA 5510 itself and that is confirmed via pings. However, anything behind the ASA does not have internet access, on any VLAN/sub-interface. I've attached my running-config.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 8.4 DMZ Cannot Access Internet

Dec 1, 2011

I lost the ability for my Web server (or any servers in the DMZ) to access the Internet. However, the Web server is still being used fine from the Internet. Here is my config
 
ASA Version 8.4(2)
!
hostname xxxx
domain-name xxxxx
enable password xxxx encrypted
passwd xxxx encrypted
names

[code].....

View 3 Replies View Related

Cisco Firewall :: ASA 5510 First Setup Can't Get Internet WAN Access

Dec 18, 2011

I have an ASA 5510.  I am doing a new install at our new data center.  I am having trouble getting internet access from an inside LAN interface to the outside WAN interface.Our colo center has given us the below IP info. [code]If I do a static config on my laptop of IP 198.145.XXX.82 Mask 255. 255. 255. 240 DG 198.145.XXX.81 I am able to get the web fine from the line in our rack.  I used the ASDM software to setup the ASA. I set its WAN IP of 198. 145. XX X. 82 and mask as 255.255.255.40 for interface 0/0.  For interface 0/1 I made a management LAN of 192.168.180.1 with mask of 255.255.255.0.I can connect to my LAN ok but do not have outside internet access.  I have also tried .80 and .81 for the WAN IP of the ASA. [code]

View 8 Replies View Related

Cisco Firewall :: Configure Internet Access - ASA 5510

Dec 9, 2012

I have to configure a default-factory firewall (ASA 5510) in a simple scenário like this image represents:At this moment i have configured the interfaces as represented above and at this moment what i want is grant access from a LAN computer (10.10.0.0/24) to the internet.
 
Should i configure some acl? I read that all traffic from an interface with a superior security level to other interface is allowed, so since my inside interface has a security level of 100 and the outside 0, it should be possible access to internet from an inside computer?!
 
From all configurations and examples i have seen around, they all contemplate a fixed IP address from the ISP, but in my scenário i have a dynamic one. This fact matter for the configuration i want to do?

My firewall is running the software version 8.2(5).

View 7 Replies View Related

Cisco Firewall :: Configure ASA 5510 For Internet Access

May 10, 2013

Cisco ASA 5510 and I want to configure it as an access gateway following this .[URL] the basic configuration steps on what to do on ASDM.

View 2 Replies View Related

Cisco Firewall :: Can't Access ASA 5510 By Public IP Behind Internet Router

Feb 5, 2012

We need to deploy a Cisco ASA 5510 behind the Internet facing router for Remote Access VPN (RAVPN). We bought the block of 16 IPs (in a different subnet) which is routed through the main router (69.x.x.x)and configured the outside interface of ASA with a public IP 64.x.x.x and subnet mask 255.255.255.240. Below is the network structure.

But, we can't access the ASA by it's public IP.

DSL Modem → RV082 router → Switch → LAN
(69.x.x.x)              ↑           (192.168.0.0)
Cisco ASA 5510
(outside: 64.x.x.x, inside: 192.168.0.172)

View 16 Replies View Related

Cisco Firewall :: 2901 / ASA 5510 Guest Internet Access?

Jan 15, 2012

I have a subnet for guest network access, both wired and wireless.  We have a Netgear ProSafe that is trunked to a Cisco 2901 performing 'Router-on-a-Stick'.  For most internal traffic, it all stays behind the ASA.  But for guest traffic, I have a route-map that sets the next-hop address as the outside interface of the ASA.  The question is, how can I still permit those users to access our internal DNS servers?  Do I need any particular NAT translations, exemptions, DNS doctoring, hairpinning, etc.?  I have an ACL on the inside interface that permits traffic from the guest networks to our internal DNS servers, and then the next ACL line denies any other traffic from the guest networks to any of our internal networks.

View 7 Replies View Related

Cisco Firewall :: Asa 5510 Blocks HTTPS Access To Internet Websites

Jan 20, 2013

I have installed a new ASA5510 with CSC, and everything is working properly except the access to websites using https. All sites/access to them seem to be blocked by the ASA. I have read that this access is by default enabled and I have tried to add configuration to allow https access to the firewall but without success. [code]

View 6 Replies View Related

Cisco Firewall :: ASA 5510 / Internet Access For Remote VPN With Split Tunneling

Jun 23, 2011

I have a remote VPN with split tunnelling enabled. Currently, users connected to this VPN browses internet with his/her internet connection. Now, my requirement is that a roaming user connecting to the vpn must use our company's internet connection for his browsing purposes. How can I do this?Equipment we are using: ASA 5510

View 3 Replies View Related

Cisco Firewall :: ASA 5510 / Outbound Internet Access Not Allowed When Syslog Server Is Rebooted

Jun 27, 2011

I have recently setup Splunk to receive my syslog messages from my ASA 5510.  In the past I used kiwi without observing this issue, but I needed more features than kiwi had available.  Anyway, anytime I stop the splunk service my asa does not allow any outbound connections to be established. 

View 2 Replies View Related

Cisco Firewall :: How To Configure Firewall Access For ASA 5510

Nov 4, 2012

This is my first time to use the Cisco ASA 5500 family. I have a request from a user to create an access rule, to allow all LAN traffic to Destination IP address 165.241.29.17, 165.241.31.254 with Destination TCP port 5060,5061,5070 and UDP port 50000-52399.

View 9 Replies View Related

Cisco Firewall :: ASA 5510 - Cannot Access To Dmz From Outside

Jun 26, 2012

I have a new ASA 5510 firewall, the objective is to set up a DMZ zone. my problem is I can't access to the web server in the DMZ from outside
 
DMZ ==========> outside OK 
INSIDE ==========> DMZ OK 
DMZ ============> Inside OK 
OUTSIDE ==========> DMZ  NOK "FAIL"
  
I put in attachment the running-config file.

View 6 Replies View Related

Cisco Firewall :: ASA 5510 - Cannot Access Asdm

Oct 5, 2012

Recently powered down device (transformer overhaul) and when it booted back up, unable to access with ASDM, SSH...can access directly using HyperTerm, but have only limited commands...will not accept known user/password credentials. When I issue 'show flash' I can see that there are upgrade_startup_errors.log files, but cannot access them.

View 5 Replies View Related

Cisco Firewall :: Access Of Asa 5510 In Standby

Feb 28, 2013

Is there a way to access the asa in a failover pair that is in standby mode from the primary asa? IE I am logged into the primary asa via command line and was hoping to access the other asa from here.

View 1 Replies View Related

Cisco Firewall :: SSH Access On Outside Interface On ASA 5510?

Oct 5, 2012

I need the ssh access on my ASA outside interface and have added
 
ssh ipremoved 255.255.255.255 outside access-list acl_outside extended permit tcp host ipremoved any eq 22 but this is the log i get from ASA
 
Oct 06 2012 16:10:04: %ASA-3-710003: TCP access denied by ACL from ipremoved/39884 to outside:ipremoved/22
 
Cisco Adaptive Security Appliance Software Version 8.2(5) Device Manager Version 6.4(5)

View 7 Replies View Related

Cisco Firewall :: ASA 5510 Need To Allow Public IP (OWA) Access To DMZ

Mar 3, 2013

I have DMZ n/w 192.166.0.0/24 on which i have nated on public ip
 
-private ip : 192.16.0.201 (OWA)
-public ip : 61.x.x.x.
 
when i try to access owa(public ip ) from dmz it is not allowing , From what rules i need to set to get work ASA 5510 8.2

View 13 Replies View Related

Cisco Firewall :: ASA 5510 - Cannot Access Web Server

Mar 23, 2013

I bought ASA 5510 about a week ago, very basic configuration and my priority was and still to get access list inbound the outside “Security Level 0 “so I can access my web server from the cloud but unfortunately I could not make it work (((TCP access denied by ACL from 92.40.X.X/52511 to outside:81.108.X.X/80))). ••à>> 92.40.X.X is a pc from the cloud that I used to access my web server and the 81.108.X.X is my public ip address My recent Conf is as follow:

Nat Section:
==================================================================================
Dynamic:
nat (inside,outside) source dynamic any interface <<<To have the PCs that inside the Network to have access to Internet>>>>

[Code].....

View 4 Replies View Related

Cisco Firewall :: ASA 5510 - Access Rules

Aug 13, 2012

When i create a rule and enable icmp in ASA inside to outside direction to testing purpose, but I can't ping outside address ,  

access-list ICMP extended permit icmp any any 
access-group ICMP in interface inside
 
LOGG:::
ping 8.8.8.8
%ASA-3-106014: Deny inbound icmp src outside:122.255.3.1 dst inside:202.124.160.1 (type 0, code 0)
%ASA-3-106014: Deny inbound icmp src outside:122.255.3.1 dst inside:202.124.160.1 (type 0, code 0)
  
then I have permitted icmp for return path then it works, configs and logs are followed,
 
access-list ICMP extended permit icmp any any 
access-group ICMP in interface outside
 
LOGG:::
ping 8.8.8.8
 
%ASA-6-302020: Built inbound ICMP connection for faddr 122.255.3.1/0 gaddr 202.124.160.1/14 laddr 192.168.1.1/14
%ASA-6-302021: Teardown ICMP connection for faddr 122.255.3.1/0 gaddr 202.124.160.1/14 laddr 192.168.1.1/14

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Static NAT For Outside Access Not Working?

Sep 19, 2011

I've got an ASA 5510 that has been working like a charm for some time now. Until now we've not had to nat any resources to the outside. I created network objects for an internal host and an external host. The internal host has to respond to requests on tcp/2001.
 
The internal host has no problem accessing the internet, but when I attempt to access the internal host from the outside, I get the following:
 
4    Sep 20 2011    16:20:33        fw_outside_ip    62678    outside_host    2001    Deny tcp src outside:outside_host_ip/62678 dst inside_host:inside_host_ip/2001 by access-group "outside_access_in" [0x0, 0x0]
 
When I try to use the packet tracer to simulate the outside traffic, I get the following
 
5    Sep 20 2011    16:17:41        inside_host    2001            Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:outside_host/1065 dst inside_int:inside_host/2001 denied due to NAT reverse path failure
 
I've got over my NAT statement and access rule and can't find anything wrong with either.
 
Here are the pertinent NAT and access rule...
 
static (inside_int,outside) tcp interface 2001 inside_host 2001 netmask 255.255.255.255
 
access-list outside_access_in extended permit tcp host outside_host host inside_host eq 2001

View 5 Replies View Related

Cisco Firewall :: ASA 5510 / User Access To One Website Only

Apr 25, 2012

We currently have one Cisco ASA 5510 firewall at our mailn office. Our firewall does not let users access the internet. We currently have a web proxy that lets users access this. I need to let users access one website through the firewall without going through the firewall. I believe this is possible if I use dynamic NAT.

View 1 Replies View Related

Cisco Firewall :: Allow Outside Access To Inside Device Using ASA 5510?

Apr 22, 2013

I have a mail archiver (hardware device) in my network that I need to access to from the Ipad/iphone. There is an app for it but I have to allow the access on the ASA. I created an 'object' for the device and added a Static NAT entry for it, then added an access rule. Its not working so I am guessing I did it wrong. The device uses port 8000 which I also added to the object. correct commands, or using the ASDM works too.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - ASDM Access From Specific IP

Jan 24, 2013

I do have one other question first.  What's the effect of the crypto key zeroize rsa command, and then crypto key generate rsa modulus 1024 while I'm SSH'd to the ASA?  Can I do it?  Or do i need to be consoled in or connected a different way?
 
ASA 5510:
ASA Version 8.4(1)
asdm image disk0:/asdm-641.bin
asdm history enable
http server enable
http 10.1.1.83 255.255.255.255 inside
http 10.1.1.82 255.255.255.255 inside

Shouldn't that right there be enough to access ASDM from either host .82 or .83?  Because I cannot.  But if I add http 0.0.0.0 0.0.0.0 inside, then I of course can.

View 2 Replies View Related

Cisco Firewall :: 5510-K8 Why Can't Access Same Websites On Restricted PC

Nov 18, 2012

Has ASA5510-K8 as firewall, has access rules setup for restricted PCs: [code] permitOn those PCs, users can only browse the websites that are in favorites, but some of them are working, some are not.Test on unrestricted PC, websites that can’t be accessed from public PCs can be access on regular PCs , either by address or IP.Checked GPO setting, don’t see anything wrong there.

View 4 Replies View Related

Cisco Firewall :: ASA 5510 Ssh Access After Nessus Scan

Apr 20, 2011

I have an 5510 running 8.4(1) I can ssh into the system with no problems until I scan the device with Nessus security scanner. After that I just get timeouts from the client when I try to connect and the only way to fix the problem is to reload the device. I have included 2 syslog dumps one showing ssh into the device before(working) the scan and one after(not working).I do not have any acls on that int and I have turned off basic threat detection. The devices is still running I can login via the serial console and via ASDM it just appears ssh is someone shutdown or hung.
 
WORKING

4/21/2011 11:33:43 AM    192.168.11.108    Debug    %ASA-7-609002: Teardown local-host testing:192.168.65.106 duration 0:00:104/21/2011 11:33:43 AM    192.168.11.108    Informational    %ASA-6-302014: Teardown TCP connection 50 for testing:192.168.65.106/4462 to identity:192.168.11.108/22 duration 0:00:10 bytes 3691 TCP Reset-O4/21/2011 11:33:43 AM    192.168.11.108    Informational    %ASA-6-315011: SSH session from 192.168.65.106 on interface testing for user "test" terminated normally4/21/2011 11:33:40 AM    192.168.11.108    Informational    %ASA-6-605005: Login permitted from 192.168.65.106/4462 to testing:192.168.11.108/ssh for user "leeh"4/21/2011 11:33:40 AM    192.168.11.108   

[code]....

NOT WORKING

4/21/2011 12:38:17 PM    192.168.11.108    Informational    %ASA-6-302014: Teardown TCP connection 86 for testing:192.168.65.106/1954 to identity:192.168.11.108/22 duration 0:05:01 bytes 0 Connection timeout4/21/2011 12:38:17 PM    192.168.11.108    Debug    %ASA-7-609002: Teardown local-host testing:192.168.65.106 duration 0:05:014/21/2011 12:33:15 PM    192.168.11.108    Debug    %ASA-7-609001: Built local-host testing:192.168.65.1064/21/2011 12:33:15 PM    192.168.11.108    Informational    %ASA-6-302013: Built inbound TCP connection 86 for testing:192.168.65.106/1954 (192.168.65.106/1954) to identity:192.168.11.108/22 (192.168.11.108/22)

View 4 Replies View Related

Cisco Firewall :: ASA 5510 / ASDM Access With Remote VPN

Apr 18, 2012

I have a cisco ASA 5510 that I have set up currently to access via ASDM through the Inside interface. When I VPN in using our older VPN server I can connect to it fine.  I recently set up the ASA to also be a VPN server which will eventually replace the older server for our HQ.  I noticed that when I'm VPN using the ASA as the VPN server, I can only ASDM to the public which I prefer not to allow.  Access to the inside doesn't seem to work this way. What configurations if any would be causing this.  I'm assuming it's some thing I need to adjust in the VPN configuration.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - Can't Access Server On Different Subnet

Sep 7, 2011

First off, let me preface this by saying that I'm a novice when it comes to firewalls and more specifically, the ASA.  I do however, have an above average understanding of switches/routers.
 
We have an ASA 5510 running 8.3 and recently I've decided to clean up the last admin's mess.  All hosts and servers are on the same subnet, multiple subnets on the same VLAN... and a slew of other problems.  Anyway, I recently placed the IT department on another subnet to test some things out before I migrated other departments to different networks.  Everything seems to be working as it should be with the exception of one of our servers.  The IT subnet is 192.168.150.0/24 and the problem server is on the 192.168.10.xxx network.  I'm guessing the issue lies somewhere in the fact this server does have a static NAT and is accessible from the public.  Let me give you an overview of what our network looks like:
 
ISP ---->ASA----->3750----->2960
 
My workstation is directly plugged into the 3750 switch, and the server is plugged into the 2960.  I'm able to ping this server by both IP and hostname.  However, I cannot access port 80 by IP or hostname.  The users that are on the 192.168.10 and 192.168.11 (sadly both of those are on the same VLAN) network are able to access this server without a problem.  Thinking logically, I thought I would send a packet from my workstation, it would head to the layer 3 switch's VLAN interface corresponding to my subnet, realize the .10 network is directly connected and then forward the packet straight to the server.  However, it doesn't seem to be working that way.  It look like it's being routed to the ASA then being dropped.  I guess there's an access rule or firewall rule preventing me from getting to the server.  Is there a specific part of my config you will need to see...

View 15 Replies View Related

Cisco Firewall :: ASA 5510 8.2(1) Using Hostnames In Access-lists?

Jul 12, 2012

I need to allow a specifc hostname through my firewall. I found this article: [URL] But it's only for 8.4 updated ASA's and above.
 
Doing more research, I found this article: [URL] And have been trying to reverse engineer it. Am I on the right track?

View 3 Replies View Related

Cisco VPN :: ASA 5510 / Cannot Ping Or Access Anything On The LAN Past The Firewall

Jan 9, 2012

The VPN will connect.I can ping and connect to the ASA 5510 on it's LAN interface.My problem is that I cannot ping or access anything on the LAN past the firewall. What am I doing wrong?
 
Here is my config.Result of the command: "show config"
 
Saved
: Written by enable_15 at 22:55:02.299 UTC Tue Jan 10 2012
!
ASA Version 8.2(5)
!
hostname ********

[code]....

View 1 Replies View Related

Cisco Firewall :: Can't Access ASA 5510 / Page Cannot Be Displayed

Aug 23, 2011

When i web browse to the ASA i get the certificate warning page, when i click to continue to the website it loads the normal "this page cannot be displayed"..
 
I use to have the ASDM software on my computer to manage the device however its been uninstalled now.. can this be downloaded somewhere? i have already tried upgrading the asdm and asa files on the asa?

View 6 Replies View Related

Cisco Firewall :: ASA 5510 - PCI Scan For Remote Access VPN

Jul 2, 2012

We got the below alert when we ran the PCI scan on our VPN firewall (use it for remote access VPN).
 
OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Ciphersuite Disabled Cipher Issue
 
Solution- Upgrade to OpenSSL 0.9.8j or later.
  
ASA 5510 running  8.2(2)

View 6 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved