Cisco Firewall :: HTTPs Access From DMZ To Inside On ASA 5505

Jan 5, 2012

We have an ASA5505 UL bundel, updated with this license "L-ASA5505-SEC-PL=" to enable traffic from DMZ to Inside. No NAT or rules deployed for that yet.

On the Inside we have Exchange 2007 in a single server installation. The public url for smtp, ActiveSync, OWA and Outlook Anywhere is mail.company.se. There is a static NAT for outside traffic to access above mentioned services on inside. Now, on DMZ there is the WLAN for guests to access the Internet. How ever, our Smart Phones with WLAN turned on, cannot sync to the Exchange Server on the Inside! The DMZ gets IP-addressen from ASA on DMZ Interface with external DNS configured. How can I configure the ASA to achieve the function of ActiveSync from DMZ to Inside with the public URL from the phones?

View 15 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 8.42 Need To Access Https Server On Inside Via Outside Interface

Nov 24, 2011

Configuring an asa 5505 with 8.42 software.I need to access an https server on the inside via the outside interface. have moved the http server enable to port 10443.Tried to make a "network object nat rule"

object network Vejrstation nat (any,outside) static interface service tcp https https object network Vejrstationnat (any,outside) static interface service tcp https https.

View 21 Replies View Related

Cisco Firewall :: ASA 5505 - How To Configure DMZ Access For Ftp / Https Without NAT

Nov 18, 2012

I have a closed network that is not connnected to the internet, just other sites that we want to communicate with.  We have a cisco router connected to the outside interface on an ASA5505 and a cisco router connected to the inside interface on the same ASA5505.  I have an inside interface that connects our management LAN, five separate DMZ interfaces with a separate LAN (VLAN) on each DMZ interface and the outside interface that connects to the other sites.  Data is not allowed to mingle between the five DMZ's. 
 
Alll connections to the other separate nodes are handled with the router on the external interface.  IPSEC GRE tunnels have been established between all sites and BGP routing has been verified.  Pings are good between inside, dmz and external interfaces and between the DMZ's and the other sites, to include hosts on our local networks and hosts at the remote sites.  Inter and intra traffic is enabled.
 
When a remote site attempts an https connection, the initial ACK handshake makes it through the ASA5505, but the return SYN/ACK is being knocked down and I don't understand why (it is not because of ACL's, they are any any at this point).
 
Why the return SYN/ACK to the remote site isn't getting through the ASA5505 outbound.  Will probably have the same issue with FTP, but right now, just trying to solve one problem at a time.
 
ASA5505 is in routed mode, not looking to NAT since the IP addresses in the DMZ need to be reached by their real IP address.

View 3 Replies View Related

Cisco Firewall :: 5505 Remote VPN Clients Cannot Access Inside LAN

Apr 15, 2012

I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable. [code]

View 1 Replies View Related

Cisco Firewall :: ASA 5505 / Cannot Access Internet Or Ping From Inside Interface?

Jul 26, 2011

I am having a problem configuring my ASA 5505 for NAT.

View 3 Replies View Related

Cisco Firewall :: Setup ASA 5505 Access Or NAT Rules To Inside Server / IP Cam

Oct 25, 2012

I'm having trouble setting up the correct rules on an ASA 5505 I'm using in my home office.  I have a couple of IP Cams I need to access remotely.
 
I've tried setting up simple NAT(PAT) and/or Access Rules, but it hasn't worked.  I have a single dynamic IP for the Outside interface.  Call it 77.76.88.10 and I am using PAT.  The CAM is setup to connect on port 80, but could be configured if necessary.  I've tried setting up NAT Rules using ASDM as follows:
 
Match Criteria: Original Packet
Source Intf = outside
Dest Intf = inside

[Code]....

I'm afraid to use CLI only because I am not confident I'll know how to remove changes if I make a mistake.

View 9 Replies View Related

Cisco Firewall :: ASA 5505 Firewall To Filter HTTPS Websites?

May 28, 2012

I have a cisco asa 5505 firewall. Is it possible to block secure websites in it like [URL]? I have already tried regular expression filtering but it filters only http traffic.

View 4 Replies View Related

Cisco Firewall :: Cannot Connect To ASA 5505 Using HTTPS?

Jan 6, 2011

I'm trying to access my ASA 5505 by https://192.168.1.1 but I can't. I'm using Windows 7.  I already have installed ASDM and I can enter in the box by ASDM.  I am preparing to reformat my PC and I'm afraid that I won't be able to access my ASA if I do.
 
The Mozilla show the message: An error occurred during a connection to 192.168.1.1.Cannot communicate securely with peer: no common encryption algorithm(s).(Error code: ssl_error_no_cypher_overlap)

View 18 Replies View Related

Cisco Firewall :: Single Session HTTPS Offload On ASA 5505?

Jan 14, 2013

I have an ancient Alteon load balancer which only supports HTTP and telnet access. Our management people only allow HTTPS through the management firewall farm, and don't want to change this policy.  So I need a low cost HTTPS to HTTP conversion, ideally on Cisco hardware like an ASA5505. It only needs one concurrent user. Is there a way to configure an ASA 5505 to terminate the inbound HTTPS seession and re-originate a HTTP management session to the Alteon? It looks to me as if the Clientless SSL VPN might do the job.Is there a way to do a SSH to telnet conversion on the ASA, or on a router?

View 1 Replies View Related

Cisco Firewall :: Failover ASA 5505 - Setup Second Inside Interface On Firewall?

Feb 19, 2012

I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 SSL / HTTPS / ASDM Won't Work / Cipher Fail

Nov 21, 2010

Does my device not support enough encryption to get ASDM/SSL/HTTP working?
 
First time I've ever seen this...: 
 
%ASA-7-609001: Built local-host inside:192.168.1.10 %ASA-7-609001: Built local-host identity:192.168.1.1 %ASA-6-302013: Built inbound TCP connection 13 for inside:192.168.1.10/61194 (192.168.1.10/61194) to identity:192.168.1.1/443 (192.168.1.1/443) %ASA-6-725001: Starting SSL handshake with client inside:192.168.1.10/61194 for TLSv1 session. %ASA-7-725010: Device supports the following 1 cipher(s). %ASA-7-725011: Cipher[1] : DES-CBC-SHA %ASA-7-725008: SSL client inside:192.168.1.10/61194 proposes the following 11 cipher(s). %ASA-7-725011: Cipher[1] : DHE-DSS-AES256-SHA %ASA-7-725011: Cipher[2] : AES256-SHA %ASA-7-725011: Cipher[3] : DHE-RSA-AES256-SHA %ASA-7-725011: Cipher[4] : DHE-RSA-AES128-SHA %ASA-7-725011: Cipher[5] : DHE-DSS-AES128-SHA %ASA-7-725011: Cipher[6] : RC4-MD5 %ASA-7-725011: Cipher[7] : RC4-SHA %ASA-7-725011: Cipher[8] : AES128-SHA %ASA-7-725011: Cipher[9] : EDH-RSA-DES-CBC3-SHA %ASA-7-725011: Cipher[10] : EDH-DSS-DES-CBC3-SHA %ASA-7-725011: Cipher[11] : DES-CBC3-SHA %ASA-7-725014: SSL lib error. Function: SSL3_GET_CLIENT_HELLO Reason: no shared cipher %ASA-6-302014: Teardown TCP connection 13 for inside:192.168.1.10/61194 to identity:192.168.1.1/443 duration 0:00:00 bytes 7 TCP Reset by appliance %ASA-7-609002: Teardown local-host inside:192.168.1.10 duration 0:00:00 %ASA-7-609002: Teardown local-host identity:192.168.1.1 duration 0:00:00

View 7 Replies View Related

Cisco Firewall :: ASA 5505 - Can't Reach FTP Site While Inside Firewall?

Feb 26, 2011

I am trying to configure our ASA 5505 so that our users can access our ftp site using [URL] while inside the firewall. Our ftp site is setup so that you can reach it by either browsing to the above url or by browsing to ftp://99.23.119.78 but we are unable to access our ftp site from either route while inside the firewall. We can access our ftp site using the internal ip address of 192.168.1.3.
 
Here is our current confguration:
 
Result of the command: "show running-config"
: Saved:ASA Version 8.2(1) !hostname ciscoasaenable password qVQaNBP31RadYDLM encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0 !interface Vlan2nameif ATTsecurity-level 0pppoe client vpdn group ATTip address pppoe setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!ftp mode passiveobject-group service DM_INLINE_TCP_1 tcpport-object eq ftpport-object eq ftp-dataport-object eq wwwaccess-list ATT_access_in extended permit tcp any host 99.23.119.78 object-group DM_INLINE_TCP_1 access-list ATT_access_in extended permit tcp any interface ATT eq ftp access-list ATT_access_in extended permit tcp any interface ATT eq ftp-data access-list ATT_access_in extended permit tcp any interface ATT eq www access-list 100 extended permit tcp any interface ATT eq ftp

[code]....

View 6 Replies View Related

Cisco Firewall :: ASA 5505 - HTTPS Traffic Through DMZ Interface To Internal Exchange Server?

Apr 23, 2012

I have an ASA 5505 with the base license,When I setup the DMZ interface I had to add the deny access to the inside VLAN.  The DMZ works fine with WiFi on it, but user's iPhones can't get email unless they turn WiFi off.Is there a simple way to allow HTTPS traffic through the DMZ interface to our internal Exchange server which is NAT'd on the 5505's external IP?

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Redirecting Http And Https Traffic To Proxy Server

Aug 5, 2008

I have an ASA 5505 that I am using to connect my contractors to via an inside interface, the outside interface is my private LAN. I have setup on our corporate Proxy server to allow traffic from my outside interface of my  ASA to go to the internet without credentials BUT log internet activity. The question is I want to know if the ASA can send that http & https traffic to my proxy server and all other traffic to my default route? I want to be able to send all internet traffic to my proxy server. This will avoid me asking the contractors to place proxy credentials in their browsers.

View 6 Replies View Related

Cisco VPN :: 5505 - AnyConnect Access To Inside IPs

Sep 13, 2011

I'm having problems getting AnyConnect clients to reach a server (192.168.139.3) on the Inside interface of my ASA 5505.  Ideally, this would be accessible from the DfltAccessPolicy or another dedicated policy, but right now I'm happy with any access.  Everything else seems to be working as expected.  I've rebuilt this config a number of times without success.  I can ping the IP from the ASA itself.

View 2 Replies View Related

Cisco Firewall :: 5505 DNS Does Not Resolve Inside DMZ

May 14, 2012

I have a 5505 that currently has inside/outside interfaces and everything is working just fine. I am trying to create a DMZ that will essentially be just for vendors/guests. the DMZ will have full access to the outside (Internet) but no access to the inside. I am using the FW for DHCP, and 8.8.8.8 and 4.2.2.2 for DNS. I currently have 1 laptop in the DMZ vlan, and it is getting a correct IP, and it is showing 8.8.8.8 and 4.2.2.2 in ipconfig. I can ping/tracert 8.8.8.8/ 4.2. 2.2/74.125.137.147(what url... resolved to on a laptop connected to the inside vlan), but I cannot ping nor browse to url.... [code]

View 1 Replies View Related

Cisco Firewall :: Enable SIP From Outside To Inside (ASA 5505)

May 14, 2012

We recently purchases the Cisco ASA 5505 to get familiar with it, possibly buying more appliances for our branch offices. However, since the appliance is installed, our SIP telephones no longer register with our SIP service provider.
 
The SIP phones are all on 10.0.1.0/24 while the SIP provider is external via the outside network. I copied our configuration below. how to enable SIP for all 10.0.1.0/24 hosts and ports 5060, 5160, 5260, 5360?
 
gcxfw# show running-config
: Saved
:
ASA Version 8.4(3)

[Code].....

View 2 Replies View Related

Cisco Firewall :: 5505 DMZ To Inside ASA 8.4 / ASDM 6.4

May 21, 2012

I have a standard ASA 5505 with inside, dmz and outside with the default security levels, 100/50/0. we have an email server inside which has been NATed and is working fine. However users accessing the wireless on the dmz are unable to access their emails on https (443). How do I allow SSL access ONLY to users on the dmz using ASA 8.4 commands or ADSM 6.4?

View 10 Replies View Related

Cisco Firewall :: ASA 5505 Ping Inside To Outside Don't Go

Sep 29, 2012

I have 2 ASA and would like to build a Side-to-Side VPN between these ASA. So I can learn something about configure a ASA for different thinks. But now I don`t can Ping from a Client to the Internet-Router.My Configuration is:
 
Client IP 192.168.1.100 <===> ASA Inside 192.168.1.1 /Outside 192.168.178.254 <===> Router 192.168.178.1
 
Is there something wrong at my config? or do I need inside private Adresses and at the Outside Global IP`s.
 
At the Router I have a Static Route that the 192.168.1.0 / 24 ist to find over Gateway 192.168.178.254

View 2 Replies View Related

Cisco Firewall :: ASA 5505 - Allow (outside) Host To (inside)

May 20, 2011

I have a ASA 5505 Sec Plus. I would like to allow outside hosts to our mail server and also our FTP server. So i would like to allow only SMTP, HTTP (for Outlook Web Access) and FTP.

View 10 Replies View Related

Cisco Firewall :: NAT With Inside / DMZ VLANs On ASA 5505 V8.4(2)?

Sep 16, 2012

I have a 5505 with Base license running ASA software v8.4(2) that has been working happily for a while with an inside and an outside VLAN.
 
The outside has a single statically configured public IP, and I have a number of static NAT rules to expose a few internal servers as well as Dynamic-NAT for all devices on inside to gain access to the Internet... the main bits of the config are below:
 
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2

[code]....

I now have a requirement to add a "dmz" VLAN for guests to have access to the Internet using a dedicated wireless AP, but not to any of the inside resources. As the ASA has a base license I have configured "no forward interface" to the inside vlan, which suits the purpose fine
 
interface Vlan12
description Used only for guests access to the Internet - no access to the corporate resources
no forward interface Vlan1
nameif guests
security-level 20
ip address 192.168.2.1 255.255.255.0
 
My problem is that when I try to add NATing from the dmz to the outside I get a:
 
     ERROR: Address a.b.c.d overlaps with outside interface address.
     ERROR: NAT Policy is not downloaded
 
with either:
 
object network guests_subnet
subnet 192.168.2.0 255.255.255.0
nat (guests,outside) dynamic interface

[code]....
 
Having had a look at the ASA Configuration guides, all the examples I can see with several "internal" VLAN's being NAT'ed use one external IP per VLAN - is this a feature/restriction of the ASA software? Are there any workarounds? Or is the overlap in the error message really about the current NATing to the inside VLAN which is done on the "any" 0.0.0.0 subnet - would the following then work:
 
object network obj_any
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) dynamic a.b.c.d
object network guests_subnet
subnet 192.168.2.0 255.255.255.0
nat (guests,outside) dynamic a.b.c.d

View 5 Replies View Related

Cisco Firewall :: Connect Inside To Outside In ASA 5505?

Apr 2, 2013

I have a test ASA 5505 with the setting below:

How can I connect to the internet (Vlan 1 to VLan 11)
 
[code]....

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Router In Second Inside

Jul 19, 2011

I have an ASA 5505 with the typical inside/outside interfaces.  I also have a DMZ that I've named remote for all of my ISP VLAN'd remote offices to connect.  I've set the security levels on both the inside and remote interfaces to 100.  From remote 192.168.71.0 network I can ping to the remote interface on my ASA, 12.230.129.66/8, but can't ping anything on the inside network, 192.168.1.0, or the web. From my ASA I can ping the router directly attached to the remote interface, 12.233.136.162/8.  From my inside 192.168.1.0 network I can hit the web fine, but cant ping the remote router 12.233.136.162 or the remote network..
 
I dont' know if I missing something with routing, or with the two interfaces w/ same security...or what?
 
Here's my config. I've also attached an awesomely bad network map.
 
Result of the command: "wr t"
: Saved:ASA Version 8.2(5) !hostname ciscoasadomain-name wec.wnetenable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2switchport access vlan 3!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!interface Vlan1nameif insidesecurity-level 100ip [Code]...

View 6 Replies View Related

Cisco Firewall :: New ASA 5505 / Can't Ping Inside Interface

May 10, 2011

I have a new ASA 5505 and all is working fine, I can CLI and ASDM into it, but just can't ping the inside interface, do I need to enable a feature to make this work somehow?

View 1 Replies View Related

Cisco Firewall :: 5505 Inside Interface To Another Switch?

Apr 23, 2012

I am connecting the inside interface to an upstream switch and therefore will need to assign a static IP address to the inside address as I did below:
 
#sho int ip brief 
Vlan1                      123.123.123.123  YES manual up                    up
 
I will also use this to manage the ASA. I am having a problem with the network configuration of the inside interface as I can't ping the gateway and/or the in IP of the inside interface.Do I need to add any routes?

View 3 Replies View Related

Cisco Firewall :: Unable To Telnet / SSH / RDP From Inside DMZ / ASA 5505

Oct 31, 2011

I am unable to Telnet/SSH/RDP from my inside network to my DMZ. I am not sure where the problem lies, I am able to use VNC from the inside to the DMZ (ports 5800, 5900), and also establish connection on Ports (26700-26899). I have a computer connected directly to the DMZ and those services work to all networks on the DMZ.I have attached Logs of successful VNC connections, unsuccessful RDP and Telnet sessions, and the running config.

View 23 Replies View Related

Cisco Firewall :: 5505 / Can't Connect To All Sites Outside From Inside

Dec 20, 2012

For some reason there are some sites that I cannot access websites from inside interface.One such example is lxer.com where I am receiving this message in the browser:The connection has timed out   The server at www.lxer.com is taking too long to respond.This has "suddenly" happened, and so I am wondering what others have done when such things has happened. My outside has a dhcp-IP, and I have noticed that this address had changed, so I corrected this in my router settings.ASA version is 5505
 
These are my settings:

: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
domain-name example.no
enable password 123412321 encrypted
passwd 1231231 encrypted
names

[code]....

View 4 Replies View Related

Cisco Firewall :: ASA 5505 - Allow Traffic Between Inside Interfaces

Nov 9, 2011

I trying to allow traffic between 2 inside interfaces with the same security level.  VLAN1 and VLAN15.  The are on different physical ports on the ASA.  I tried to configure this through the GUI Web interface and checked ' enable traffic between two or more interfaces with the same security levels'.  With this ASA version, I do not need NAT to allow this, correct?
  
ASA Version 8.2(1)
!
hostname ciscoasa

[Code].....

View 1 Replies View Related

Cisco Firewall :: ASA 5505 - Forward Address Outside / Inside?

Feb 27, 2011

I have a cisco asa 5505 and i need a public ip address on the inside of my network without NAT. for example: I can create a static nat translation rule, but this is not what i need.
 
isp -> x.x.x.1 /29 (outside asa)  (inside network) x.x.x.2 /29
 
Is this possible?

View 1 Replies View Related

Cisco Firewall :: 5505 - Can't Ping ASA Inside Interface

Dec 12, 2011

I have an ASA 5505 that I'm trying to set up a guest network on.  I've configured an interface as a trunk and allowed the 2 vlans but I'm not getting any layer 3 to it.  The switch connected to it is a 3560 and port is configured as a trunk with the same vlans.
 
I can't ping the ASA inside interface but I see its MAC address in the swtich's table.
 
[code]....

View 4 Replies View Related

Cisco Firewall :: ASA 5505 Multiple Inside Interfaces And NAT?

Sep 23, 2011

I have an ASA 5505 running 8.2(1), that is configured with three interfaces as follows:

Inside (security 100) 10.0.0.0 /24
Inside 2 (security 100) 192.168.0.0 /24
Outside (security 0) internet
 
Inside is connected to my internal network, inside 2 is connected to the network of a sister organization, outside is outside.
 
I'd like to be able to route between from inside to inside 2, and have NAT translate me to inside2's address.
 
I have inter-interface traffic configured, and when I use a NAT exemption, I can route fine. But the resources on network 2 must see my request as coming from the inside2 interface IP.

View 2 Replies View Related

Cisco Firewall :: Redundant Inside Interfaces On ASA 5505

Mar 6, 2011

My customer is running an ASA5505 with 8.3 code.
 
The have a somewhat flaky proxy between their inside LAN and the firewall.  I'd like to have a configuration as follows:
 
 LAN   > Proxy > VLAN 1 (eth0/2) on ASA
 
and
 
LAN > VLAN 1 (eth0/3) on ASA
 
So that in the event of Proxy failure (let's just say it loses power) the eth0/3 interface will kick in.
 
This appears to be easily configured according to the documentation:
 
"The following example creates two redundant interfaces:
 
hostname(config)# interface redundant 1
hostname(config-if)# member-interface gigabitethernet 0/0
hostname(config-if)# member-interface gigabitethernet 0/1
hostname(config-if)# interface redundant 2
hostname(config-if)# member-interface gigabitethernet 0/2
hostname(config-if)# member-interface gigabitethernet 0/3"
 
But these commands don't seem to be available on a 5505.

View 7 Replies View Related

Cisco Firewall :: Restricted Inside Users Of ASA 5505

Jul 6, 2011

i have an asa 5505 firewall with asa version 8.2(1). my asa connected on wan port over isp router on internet.inside users connected over dlink switch and the allied telesis 24 ports switch on this asa. the inside users are blocked and they can't communicate. all inside ports of asa 5505 are in one vlan and all ports are switch ports. the configuration of my firewall is 
 
: Saved : Written by xxxxxx at 11:26:22.109 CEDT Thu Jul 7 2011 ! ASA Version 8.2(1) ! hostname asa5505 domain-name dri.local enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface Vlan1 no

[Code].....

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved