What is the easiest way to restore my config? I backed it up yesterday with my tftp server. Today I made some changes and messed some things up and need to restore the config from yesterday.
View 1 Replies
I have the configuration file of the ASA 5505 I have another exactly model that asa is new but this my first time working with an ASA.
I going to configure it an ip address in the 0/0 interface and then use TFTP to upload the config to the start-up config and the save it and reload the ASA.
is that enough? or the ASA has extra steps??
Have a 5510 in Routed mode, simple Static NAT to interface two networks (inside_1 is my private space, and outside_1 the larger intranet that hosts heavy traffic). outside_2 faces internet via pppoe just for VPN purposes.
It was operating fine for one year then one port broke (outside_2, internet), leaving no vpn. We followed RMA service replacement and the new unit came with upgraded SW (8.0.4) than the one the original config was created on (8.0.2).
To ease the replacement, I did downgrade the sw boot image. Then I did restore the config by tftp to the startup-config and then a reload. Everything seems to load fine.
Problem is that testing reveals some sort of issue: I can ping some of the intranet hosts but can't reach gateway, thus larger segment of hosts become unreachable. It seems as if the NAT mechanism can't find the next gateway where to hop. For debug practice, I've enabled all the icmp stuff so ping wasn't being blocked by the device.
Being given the fact that this config was up and running prior to the replacement, I've no reason to suspect any mysconfigured items (ie routes, NAT, access-list), but obviously I'm obfuscated and can't see what else I'm missing.
How is that possible that the PING only reaches certain hosts? Pinging to 10.15.5.90 works (Route is 0.0.0.0 0.0.0.0 to 10.15.5.126 (gw)), but pinging to the gateway itself doesn't (10.15.5.126) and even worse, hosts like 10.15.167.210 do not respond either.
while configuring my ASA 5505 I changed the IP address range of the internal network. Obviously I made an error because I cannot reach the box neither at the old nor the new address. How can I restore the interface and firewall definitions or reset the box to its initial state ? I found a doc how to reset the password, but not explaining how to restore the complete initial config.
View 10 Replies View Relatedso we have been using our current ASA5505 for a long time. Since it only support up to 10 VPN licenses, so we buy a new ASA5505-SEC-BUN-K9(support up to 25 users).
the old ASA are running: 8.0.3 and ASDM 6.0.3
the new ASA are running: 8.2.5 and ASDM 6.4.5
I thought it would be simple as export and import the config file, but when i tried to restore, the new one is looking for a zip file but the old one doesn;t backup file in ZIP. It looks like i need to update the ASA version or/and ASDM?
I am pretty new to this and never upgrade any of these versions since I am aware of the upgrade may mess things up. So do I need to upgrade both the ASA version and the ASDM in order to restore my config? any effect if i do the upgrade? I also read some articles, we need to upgrade on the version one by one, like 8.0 to 8.1 then 8.2?
How to configure SSH access on my PIX 506e. I would like to use local authentication with no AAA server. Also I would like to have telnet disabled completely.
View 3 Replies View RelatedThere is a PIX 506E and ASA5510, with different connection to service provider. Problem is Apple remote users can't access resources protected by the PIX506E. Apple users can access resources protected by ASA5510. Physically the PIX and ASA are in close proximity with no physical connections. Is it possible for Apple users to authenticate with the ASA and the traffic get routed to and get authenticated by the PIX, inorder to access resources?Due to bandwidth restrictions, a DMZ on the ASA will not be created at this time inorder to consolodate firewalls. Currently 2 x T1 is the connection between ASA and ISP; 1 T1 connects PIX to ISP.
View 1 Replies View RelatedI have a PIX506E that was resently reset and it has version PIX Version 7.1(2) . It either uses some different commands or I am not using them correctly. [code]
View 2 Replies View RelatedSo i got a Cisco PIX 506e from a friend and want to set it up for a VPN. Though i cant download the PDM (PIX Device Manager) since i dont have a Contract or something like that. So i cant set it up.
View 1 Replies View RelatedI need to replace an ageing PIX 506e with an ASA 5505.The current setup looks like this: The PIX is used for site-to-site VPN connection via the WAN 2 link. The WAN 1 link is used for general Internet connectivity.I don't have access to the Draytek Router as it is supported by a 3rd party, but I believe it uses static routing to direct the relevant traffic to/from the PIX.
When I replace the PIX with the ASA, the inside i/f connection experiences dropouts - but no errors show in the logs.The only significant difference I can see in the config is that the ASA utilises VLans for the inside & outside interface configs - I used the PIX-to-ASA Migration tool to make the initial configuration on the ASA.In tests, if I only connect the inside i/f of the ASA, pings from the LAN are stable. Once I connect the outside i/f, pings timeout approx 80% of the time.
I am new to the PIX firewall. And recently implemented the PIX 506e in my network. I wants to know how we can monitor the system that is generating the more traffic on Network through Firewall.
View 4 Replies View RelatedI am trying to add a username to the local database for remote VPN connection but always i get this error when I add,Encrypted password is of incorrect lengthUsername addition failed.
View 1 Replies View RelatedI just got a PIX 506e from a friend that was not longer using it. I'm trying to get started with the configuration page. I've reset it to factory defaults, rebooted and connected up ethernet. I can ping the device at 192.168.1.1 and access it via console. I browse the site https://192.168.1.1/startup.html, get the invalid ssl certification, get a login prompt (user/pass) and as the document says I leave it blank. As soon as I hit ok it goes to the 404 error Page Not found.
View 4 Replies View RelatedI'm getting an error message on my 506E that is saying not enough flash space to install the new version 8 software. I did a clear flashfs command and then tried again but get the same error. Do the PIX 506E can be upgraded from version 6 to version 8? I am trying to install pix804-28.bin.
View 3 Replies View RelatedI have a problem with PIX 506E that meets the version 6.1, and in an simple computer network equipment seems to behave in strange ways because some web sites do not open or very open slow thereby its operation impracticable. On the other hand other web sites open normally.
Querying the web site of the Cisco, I found several documents discussing the same problem but in a later version ( 7.0 ), not in this version 6.1.
I've tried removing the pix from the network , not the error occurred, again insert pix however tested only with a machine, without the rest of the network and the problem persists
I recently tested the process for a customer of defaulting a Cisco WLC to factory configuration and then restoring the configuration from Cisco NCS. It was not seamless to say the least and I wonder if I have just gone about it the wrong way.
Have have set the NCS platform to configuration sync with the 5508 controllers at 04:00 every day and prior to the controller defaulting I ensured that NCS also reported that the config was in sync. I have also set NCS to complete a tftp backup of the controller every night 23:00 - interestingly though I have no idea where this is stored on the NCS platform ( a VM appliance ) or what it's file name is.
Anyway my experiences where as follows:-
1. defaulted WLC and via serial CLI ended up at the configuration wizard.
2. Set the correct LAG, management IP, host name that NCS knew this controller by.
3. To test things just created a dummy WLAN ( SSID ) as I assumed this would be overwritten ( big mistake ! ).
At this point I connected the controller to the network and tried to restore the configuration from the config sync version.
First problem - you have to remember to set up the SNMP community string you were using as it is needed by the configuration sync process. After adding this to the controller I could push the configuration to the controller.
Second problem - failed to add the first WLAN from the backup as I have added the temporary dummy W LAN via the wizard and NCS reported a conflict. So had to delete WLAN ID 1 from the WLC GUI directly and then the config push no longer reported this error.
Third problem - for some reason did not add the TACACS server details - reported the error that it could not added them. I manually added these via a template via NCS and all was well.
Fourth problem - all but the first WLAN was in the disabled state - had to re-enable all of the WLANs.
Fifth problem - any default items I had disabled or removed have not been saved - therefore I have removed the public and private SNMP communities - but these were still on the WLC after the restore. I have disabled unused ports not in the LAG as they show an error in NCS - these where not disabled after the restore.
So all in all not a very satisfactory restore process from NCS to an defaulted WLC ( meant to simulate to the customer what would be needed if they had to replace a controller due to hardware failure ).
I like to set up a pix and router for this network for a small buss, but I need to know what type of cable do I need to set this connection to work straight through or a cross over cable? also I need a subgestion if a nat would work better on the pix or leave it on the router?
View 4 Replies View RelatedSo I was doing some testing with my BB Playbook where I wanted to see what outside connections it tried to make during startup and whatnot. I have a pix 506e running 6.3(5). I created an simple 'deny ip any any' access list on the inside interface so that the Playbook doesn't actually make any connections, but I set up a 'capture' on the inside interface accepting 'ip any any' to see what kind of traffic I could see heading outbound from the Playbook. Well, it started off showing attempts to query DNS (and failed, naturally), but then after a couple of minutes, it tried to connect to a couple of IPs over port 443 and actually got a response!!! For the life of me, I can't figure out how this can happen. NO traffic should be allowed outbound due to my explicit 'deny' rule, but for some reason some traffic on port 443 made it past the firewall and got a response back. There are no other rules in the access list except the 'deny' rule. My PIX configuration is quite simple and I cannot see anything that would allow the Playbook traffic to circumvent the access list.
I've come to think that either RIM has found away around Cisco access-lists, or there is a bug in the Pix OS. I know it's an old appliance/OS, but still. I wouldn't think it could be THAT easy to bypass the firewall.
I messed up the IOS on the flash of CISCO881-SEC-K9. On reboot it booted to ROMMON which allowed me to tftp up a working IOS c880data-universalk9-mz.151-4.M3.bin. Unfortunately somewhere in my playing around the default startup configuration factory loaded on the routerhas been erased. I can load a new a config on the device but as I'm using the router to learn its useful to have the original config load when I factory reset the device. What is the factory start up config?
View 3 Replies View RelatedI have a WAG160N and its seems to have reset to factory defaults, no idea why, but when trying to restore the Configuration Backup all I get is "Restore Failure <Unmatched pid>"
View 2 Replies View Relatedit is possible to enable Xauth on pix. I have read multiple threads about using the following cmds:
username test123password testing privilege 2
aaa-server LOCAL protocol local
crypto map mycrypto client authentication LOCAL
However the f/w wont let me add the crypto map cmd, just comes back with the following:
PIX(config)# c.rypto map mycryptomap client authenication LOCAL
Usage: [ show ] crypto { ca | dynamic-map | ipsec | isakmp | map | sa } ...
show crypto engine [verify]
[ show | clear ] crypto interface [counters]
I also tried the following, but they dont work and I am not sure if they are meant for Xauth since I was under the impression that it had to be enabled globally.
PIX(config)# vpngroup test authentication-server LOCAL
Protocol "local" is not supported for authentication of remote users of a h/w client
PIX(config)# vpngroup test user-authentication
[code]....
I seem to be having an issue with my PIX configuration. I can ping the VPN client from the the internal network, but can cannot access any resources from the vpn client. [code]
View 4 Replies View RelatedI have 2 firewalls in my network: ASA 5505 and PIX 506E. Both firewalls's internal network is in the 192.168.0.0/24 subnet but their external addresses are different of course. The inside IP for ASA 5505 is 192.168.0.254/24 whereas the PIX is 192.168.0.1/24. I've successfully configured VPN on the ASA 5505. I'm able to VPN to the ASA and can ping / access hosts that have the 192.168.0.254 as their gateways.However, I'm unable to ping/access hosts behind the PIX. What do I need to do in order to allow access to the network behind the PIX after I VPN to the ASA? Also, I'm unable to ping 192.168.0.254 after I VPN to the ASA.
View 5 Replies View RelatedI am trying to give a vendor VPN access so that they can remotely monitor and diagnose their installed heating and cooling equipment. I dont know where to start and I apologize in advance for my ignorance. I am technically savvy but i have no Cisco knowledge base.
It is a PIX 506e firewall with PIX v6.3.
I trying to do password reset on a 506e that I got with the current password unknown. I've gone to the Cisco URL for the reset: [code]
I am using the correct bin file as I checked with my pix version. Also I CANNOT ping the firewall from a PCor system on the network, but CAN ping everthing from the PIX.I've tried using interface 1 but no go. Also I've checked the TFTP software (Solarwinds) is running fine and I've unblocked it in XP's firewall.
So I have a Cisco PIX 506e that I've modified a bit, but am quite happy w/ when it comes to performance and configuration (I can actually set up the VPN server w/o too much thought.) I also have a Mikrotik Routerboard 750, I'm no longer using it as my router due to a few config issues I had plus the fact I had to hard code my internet gateway's arp address into the device due to some issues.
What I am wanting to do, which I'm sure is possible and easily accomplished (I just don't have the time right now to try it) is set the routerboard up behind my pix and have it function as an ipv6 router, while the pix handles my ipv4 duties. I've already set up the routerboard w/ an ipv6 tunnel broker when I had it running as my router, I am just curious if it will work in a similar fashion when configured behind an ipv4 device.
i'm looking to change my pix 506e for an rv042,is it a bad move or a good move ? is the rv042 much better than the 506e? i want to change to an rv042 because it's easier to manage! 506e is currently doing this :
-firewall for a web hosting company (7 servers)
-2 vpn tunnel
-one-to-one nat.
performance side : is the rv042 much better than the 506e? should i pick up an rv082 or an rv016 ? are they much better than the rv042 ?
I have two 1811's connected in a lab using a ipsec vpn tunnel (using a switch to simulate an internet connection between them).I am trying to configure one of the routers as a ZBPF just to allow a remote windows login (DC on the firewalled side, workstations on the other side).I'm trying to verify that the zbpf is working, but it doesn't seem to stop anything. I had match icmp added to the class-map, but took it out to test if icmp would fail. It didn't. Basically, I don't think the firewall is working at all. Any thoughts on how I can configure this so that the policies will work between zone-pairs?
Here's an quick drawing:
Here are the configurations:
Local router:
hostname sdc-1811-LocalLab
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
resource policy
[code]....
i have asa 5505 with the asdm v5.2 (4), and the asa v7.2(4). This platform has a base license. if i upgrade adsm and asa on v6.2(1) and v8.2(2) if I lose my license and that you need to activate them? i configured site to site vpn (this firewall and the another) that i lose my configuration if i upgrade my firewall.
View 2 Replies View RelatedWe have an ASA with 8.4(5) version. we had detected that few ip's were getting shunned ,to overcome the problem no shun was used and the traffic normalised.But, the same problem re-occured a few days after that with logs showing traffic being shunned.
is there any fixed way to get rid of this. what commands can i use to verify related configuration on the firewall.
I have one firewall need to be configured in transparent mode. I have inside and outside router. What is the configuration of transparent firewall ASA8.2. I didn't find the configuration on Cisco site.
View 17 Replies View RelatedI am trying to set the PIX firewall to transparent mode.After I set it to transparent firewall, I allowed all icmp, tcp, udp traffics.Currently, any devices in the inside network can get the ip automatically from DHCP server in the outside network but cannot ping to any servers in the outside network either access the internet.Do I need additional confiration on the firewall?
Here's the configuration:
PIX Version 7.0(1)
firewall transparent
names
!
interface Ethernet0
[Code]....
I want to configure an ASA 5505 in transparent mode (7.x). Somehow, I got it to work.. but i need some kind of step by step description. I just want to connect it with outside on a route .. inside in my LAN. Its working now with one ASA. But in the Web Interface the Interfaces inside and outside are down.. but its working.
View 5 Replies View Related
