Cisco Firewall :: NAT For A Private IP 2911

Dec 20, 2012

We have some Cisco 2911's that we are configuring 2 VPN's ( second is for redundancy) We are pretty confident on the failover VPN setup using SLA monitoring.
 
One thing we are stuck on is the redundant VPN will be setup over a 3G connection provided by verizon. Verizon issues a Private IP ( 192.168.100.X) the far end device terminating the VPN has a public ip of 183.172.22.XX , what kind of NAT translation do I need to make this work ?  Also does Cisco have any good configuration examples for VPN Failover setups for Cisco 2911's?

View 4 Replies


ADVERTISEMENT

Cisco Switching/Routing :: Telnet Can't Login 2911 Router With Private Address

Jan 7, 2013

We have a cisco 2911 router configured with password for telnet login, but I always failed to login use telnet, does any one know any place need to be modify?

View 6 Replies View Related

Cisco Firewall :: 2911 Router Zone Firewall And IP NAT Enable

Mar 20, 2013

I have a simple setup where I have a 2911 router with three interfaces, Inside, Outside and a second "Inside" interface which is labelled as a DMZ. The Zone Firewall applied to the "DMZ" is actually Inside (until I can work through problems). I need to be able to access a device on the DMZ via its external IP so I have designed NAT to use IP Nat Enable commands. This is now working for me fine. However, since utilising IP Nat Enable, my zone firewall now denies return TCP / UDP traffic and consequently I no longer have any internet access. Looking at the syslog messages, the reason for this is that the router is denying these return flows not because they are matching the outside-to-inside policy, but rather they are matching the outside-to-SELF policy. The router seems the detect that the internet traffic is being returned to SELF, when in reality the NAT rule should pick this up and forward it to inside. I can understand why this is happening, because I am NATting all private / inside traffic behind the external IP of the router, which is assigned to the Gi0/0 interface. [code]

View 1 Replies View Related

Cisco Firewall :: ASA 8.4 NAT Internet IP To Private

Mar 22, 2013

I have a server with IP address 10.10.10.10/24. I have two ISPs and their public IP address subnets are 1.1.1.0/25 and 2.2.2.0/25. The gateways are ASA 8.0 and ASA 8.4.I am getting rid of the 1.1.1.0/25 ISP. However I will need the Internet users to be able to access the server via both ISPs at the same time.The only way I can think of is to do policy based dynamic PAT so the Internet user IPs will be translated into an internal IP. Idealy, users connecting on 1.1.1.10 will be PAT to 10.1.1.10 and users connecting to 2.2.2.10 will be PAT to 10.2.2.10. When the server responds to them, it will then route to the correct ASA..

View 7 Replies View Related

Cisco Firewall :: 2911 Difference Between The Firewall Areas

Oct 4, 2011

I recently inherited a Cisco 2911, that appears to have had Firewall rules imported into Externally Defined Rules. ACL's are currently allowing/disallowing traffic. However, there are no firewall rules configured. To meet compliance we need to have Packet Lavel Inspection (Firewalled) rules. There are two areas in the router, under ACL area, and under Security. What is the difference between these two Firewall areas?Are both areas providing packet level inspection?Can I build Firewall rules (within the Security area) to replace the ACL's?

View 2 Replies View Related

Cisco Firewall :: Map Public IP To Private In DMZ In ASA 5510?

Jul 22, 2012

I am now using ASA 5510 as a firewall device.I have configured 3 interfaces ethernet 0/0,ethernet 0/1,ethernet 0/2 as Wan interface, DMZ interface and Internal Lan interface. Internet is working fine from LAN as well as DMZ.The WAN interface use the Public Point 2 point IP(/30) Provided by the ISP and  another pool of Public Ip is also provided by the ISP (/28). Now I want to Map the /28 IP to some servers in DMZ . DMZ servers currently have 192.168.101.0/27 private IP . Now the problem is how to Map the Public IP to those Private IP in DMZ servers.

View 9 Replies View Related

Cisco Firewall :: 5510 NAT Public Ip To Private

Sep 5, 2012

We have the setup as shown above, our requirement is to access mail server via ports smtp and pop3.But as the mailserver is hosted at internet users at site were not able to aceess. we need to nat a intranet ip with mail server ip and mail server ip back to intranet ip and provide the access.We use ASA 5510 firewall.

View 7 Replies View Related

Cisco Firewall :: ASA5510 SIP Invite Showing Private IP

Mar 3, 2011

I'm having an issue with out going sip traffic showing my private IP in the header instead of the public IP. I have a cisco asa 5510 and everyone seems to think the issue resides on the firewall.

View 4 Replies View Related

Cisco Firewall :: 5520 - Two Private To One Public Email NAT Going

Nov 8, 2011

How to setup this Nat on an ASA 5520 running 8.3.2 code? I know this must be possible as I can do the same thing on my Check Point with no issues. I need to Nat two dmz mail servers to one public mx record. I will have an F5 to load balance inbound and outbound traffic from the mail servers. So I need to Nat two private IP’s to one public.

View 1 Replies View Related

Cisco Firewall :: 5540 - NAT / PAT Two Private IP's To One Real On Same Port

Nov 25, 2012

I have the following situation. A colleagues installed a spam block (Norton something) and he put two ip's on itsinterfaces. 192.168.2.20 and 192.68.2.21. One will be used to receive and one to send mail but both on port 25. They use a sinlge real IP 175.75.67.32. I am using a 5540 ASA with 8.2 IOS.
 
I am pretty sure this cannot happen but i got some advice to NAT the outgoing IP/Port and then PAT the incoming port to both IP's and it will work. I tried to do it with no success. I know that  ASA 8.4 changes everything in NAT/PAT but is there any way with the newer OS my setup can work or not?

View 2 Replies View Related

Cisco Firewall :: Two Private Networks On ASA5510 With Default ISP Gateway?

Mar 11, 2013

Currently a network consists of two subnets, one subnet is behind a ASA and the other behind a PIX, both connecting to the ISP's routers. If the PIX is retired, is it possible to create/consolidate the two networks protected by the ASA5510 with the default gateway being the ISP?
 
How can two private networks be protected by the ASA5510? One conceptual way is to create the VLANS on a layer 3 switch, on the "inside" interface of the ASA. In this senario what would the "inside" network's IP address?  If the above is possible, how would natting occur?
 
Is there an efficient configuration to protect two networks protected by the 5510, other than creating a DMZ?
 
Is it possible to create two private networks with same level of security, 100 on a three network interface connections?

View 12 Replies View Related

Cisco Firewall :: ASA 5520 - IPSec Tunnel Without Private Network

Apr 11, 2013

I'm trying to achieve a site-to-site ipsec tunnel to a Cisco ASA 5520.  Most examples feature the ASA with a public interface that terminates the tuennel and a private network on another interface that the tunnel interacts with.  Where my scenario differs is that the interface that accepts the tunnel is part of a public /29 network where I want the remaining hosts on that subnet to be able to route thrugh to the other end of the tunnel.  My tunnel gets established, but any attempts to route via the IP assigned to that one interface result in the ASA rejecting traffic. If so, what configuration options should I consider?

View 5 Replies View Related

Firewall Is Deep Inside Private Network PIX515

Jan 7, 2011

I am having a spot of bother with a Cisco PIX515, I have posted the current running config below, now I am no cisco expert by any means although I can do basic stuff with them, now I am having trouble with traffic sent from the outside to address: 10.75.32.25 it just doesn't appear to be going anywhere.

Now this firewall is deep inside a private network, with an upstream firewall that we don't manage. I have spoken to the people that look after that firewall and they say they they have traffic routing to 10.75.32.21 and 10.75.32.25 and thats it (although there is a website that runs from the server 172.16.102.5 which (if my understanding is correct) gets traffic via 10.75.32.23. [code]

View 2 Replies View Related

Cisco Firewall :: Using VLANs With ASA5505 For Private And Public Internet Access

Oct 2, 2012

I am trying to provide internet access to public and private SSID's on Cisco AP541n using VLAN's connected directly to ASA5505.  VLAN1 is inside interface (private) and VLAN12 is wlan interface (public SSID). The AP541n is plugged into switch port 0/7 on an ASA 5505.Port 0/7 is configured as trunk mode.  I have internet access when connected to private SSID but no internet access when connected to public SSID. why I can't access internet on public SSID? 
 
logging class ip history emergencies
mtu inside 1500
mtu outside 1500

[Code].....

View 5 Replies View Related

Cisco Switching/Routing :: CBS30X0 - Private VLANs Interaction With Firewall

Nov 29, 2011

We currently have a HP blade platform which has two Cisco CBS30X0 switches built into it running Version 12.2(55)SE. These are connected to two Cisco C2960 aggregation switches running Version 12.2(44)SE6. According to this article I need to upgrade these to 12.2(25)FX: url...
 
1.)This will according to that article only allow me to create edge ports on them, is this a hardware limitation or am I just not finding what firmware I need to upgrade them to, in order to allow the creation of community VLANs? We have these aggregation switches conncted directly to multiple types of firewalls which take care of each of our clients networks including internet access etc. We are wasting many VLANs and IP addresses with our current setup so I am hoping to move over to using private VLANs. The setup of the private VLANs looks simple enough.
 
2.)When the private VLAN's try to communicate, all info will be sent directly to the layer 3 device I gather, which will not need to know anything about the private VLANs?

View 12 Replies View Related

Cisco Firewall :: Possible For 5505 To Route / Map Renaming Private IP Addresses Through Its External Port

Jul 25, 2011

I have purchased a subnet of 8 private IP addresses from my ISP. 109.x.x.128/29.The ISP has placed a juniper router within our data centre which is routing purely from 109.x.x.206/30 to 109.x.x.128/29 with the ip of fa0/1 set to .129.
 
I have linked a cisco 5505 to fa0/1 of the juniper from fa0/0 and configured its IP to .130. I have configured NAT to translate our client pool 192.168.16.x /24 address' to the internet.
 
Is it possible for the 5505 to route / map my remaing private IP addresses through its external port? I have tried creating a seperate VLAN for a DMZ for our servers to sit within but am returned with a subnetting error as VLAN for my external port is all ready configured within the same subnet.

View 2 Replies View Related

Cisco Firewall :: EIGRP Metrics On ASA 2911

Aug 4, 2011

I have two 2911 routers running 15.0(1)M4 in a redundant topology connected to an ASA 5520 firewall running 8.4 version. All gears are running EIGRP. In order to distribute the incoming traffic between the two 2911 routers, I am using 'offset-list out' on them, but in the ASA's routing table I see updates from both 2911 with the same metric, i.e. the offset-list is not working. What are the default metric weights on ASA? How can I change them? I couldn't find any known bug.

View 14 Replies View Related

Cisco Firewall :: Enabling IPS On 2911 Router?

Sep 20, 2012

I enable the IPS  on the 2911 router .  I am using the Basic IPS signatures that are inbulid on the routers . But sill it showing , that no signature is active .
 
ip ips signature-category
  category all
      retired true 
ip ips signature-category
   category ios_ips basic
      retired false

[code]....

View 1 Replies View Related

Cisco Firewall :: 2911 - NAT Any Source Address From Internet

Mar 21, 2011

I'm using a 2911 as our Public Internet Edge Router. I have 2 public sub net blocks from Sprint, we are in the process of migrating. What i need to do is NAT any source address from the Internet from an address on one of our public blocks to the other.
 
Example:
 
Source Address 11.10.10.10 ==> Destination 64.165.123.10 (nat this to 64.165.54.10) inbound.
 
So if from the internet tries to hit 64.165.123.10 we want to nat that to 64.165.54.10 both of which sit on our public space.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 / 2911 - TCP Reset-O Message

Oct 30, 2011

Here's the current scenario:
 
[LAN] <---> ASA 5520 <---> Cisco 2911 <---> [Internet] <---> Server A
                         |
                         |
                     [DMZ]
 
Whenever I access a website running in "server A" (only HTTP traffic) everything works fine. The problem is that when I try to access a different service on the same server but listening on port 2000/tcp I get the TCP Reset-O message on the ASA and the workstation's browser says that "Internet Explorer cannot display the webpage".
 
A weird thing: if I access this service from a machine on the DMZ, it works fine. From the LAN (Inside) it does not work. The main difference is that from the LAN to OUTSIDE the ASA does NAT. From the DMZ to OUTSIDE it's just routed. I did another test from the LAN and the captured traffic is attached. I've been messing around with protocol inspects and firewall + NAT rules on the ASA but no luck at all.

View 5 Replies View Related

Cisco Firewall :: 2911 - Immediate Gateway Dropped Ping Traffic

Jun 13, 2011

I have a a firewall policy on a Cisco 2911 - the zone policy from OutZone>InZone basically drops everything apart from inspected traffic on the opposite direction and a few essential traffic generated externally (such as Outlook web access and E-mail exchanging). However, I seem to be getting a lot of firewall drops coming from the immediate gateway of the ADSL WAN address to the internal IP range on port 3. I get about 10 hits every 5 seconds.
 
Policy:

policy-map type inspect FWPol_Out-In
class type inspect CCP_PPTP
  pass
class type inspect FCMAP_In-Email
  pass
class type inspect FCMAP_In-OutlookWebAccess
  inspect(code)

 %FW-6-LOG_SUMMARY: 1 packet were dropped from IMMEDIATE WAN GATEWAY:0 => INTERNAL IP ADDRESS:3 (target:class)-(FWPair_Out-In:class-default), the immediate gateway would ping an internal IP address? Keepalive? Could this be stemming from another problem? The traffic  wasn't generated internally as all InZone>OutZone is inspected.

View 1 Replies View Related

Cisco Firewall :: 2911 - IOS Content Filtering Using Trend Micro

Apr 26, 2012

I have IOS content filtering using the Trend Micro subscription service working on a 2911 running 15.1.(3)T3 with the security license option and a 30 day demo Trend subscription. Once I figured out that the content filtering for Trend appears to be completely broken in 15.2 (even using docs for 15.2) I went back to 15.1 and it works great.
 
Everything seems great so far except I would like to have a more 'fancy' or custom blocked page where a user can have a couple links to either go to the trend micro reporting page [URL] or some other page, and maybe some branding so they know the page is coming from our network and is not some fake security thing or phishing attempt or whatever.
 
I know I can use the 'parameter-map type urlf policy trend ' section to do a tiny bit of customization of the text that appears on the default blocked page display and there is an option for it to go to a simple redirect instead ('block-page redirect -url') but how to do more with either the built in page or the redirect- url to keep the information of what page the user was trying to access and why it was blocked (category etc.) while adding more features.
 
Oh, one last thing, this doesn't support any kind of 'user override' or anything like that does it? So that a network can have a filter applied but an admin could override the filtering to allow temporary access to something?

View 1 Replies View Related

Cisco Firewall :: Block Gtalk On New 2911 Security Enabled Router?

May 8, 2010

I want to block gtalk on my new cisco 2911 security enabled router.

View 3 Replies View Related

Cisco WAN :: 2911/K9 And 2911-Sec/K9 - BOM For Upgrade?

Dec 25, 2011

I am having one router CISCO2911/K9 (Cisco 2911 w/3 GE,4 EHWIC,2 DSP,1 SM,256MB CF,512MB DRAM,IPB). But now my management asking me to upgrade this router as CISCO2911-SEC/K9.
 
What will be the BOM for this up gradation.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 - Proxy Server Send Register To Hosted Server Private IP Changed

Aug 23, 2011

We have Cisco ASA 5505 with ASDM 5.2 We have one Proxy server in our Local Lab and pointed to Hosted service(Simple Signal)issue is, When our proxy server send register to hosted server, ASA change private IP and post with outside IP and src port as 1063 every time.

Here is debug log on real time monitoring.
 
Aug 24 2011    05:21:19    302015    203.xxx.xxx.226    192.168.1.51     Built outbound UDP connection 3774 for outside:203.xxx.xxx.226/5060 (203.xxx.xxx.226/5060) to inside:192.168.1.51/27014 (99.119.161.107/1142)
Aug 24 2011    05:21:19    607001    203.xxx.xxx.226         Pre- allocate SIP Via UDP secondary channel for inside:192.168.1.51/27014 to outside:203.xxx.xxx.226 from REGISTER message
Aug 24 2011    05:21:19    710005    203.xxx.xxx.226    99.xxx.xxx.107     UDP request discarded from 203.xxx.xxx.226/5060 to outside:99.xxx.xxx.107/1063

Here 99.xxx.xxx.107 is Our ASA Outside IP address 203.xxx.xxx.226 is Hosted server IP address. My ASA config is attached.

View 2 Replies View Related

Cisco Firewall :: Mask DMZ Servers From Private Servers And LAN ASA 5520

Jun 11, 2013

We are planning to split the Private servers from the DMZ Servers and configure an additional Interface and segment for this purpose.
 
Private Servers Segment: 192.168.4.0/24 (there is no DHCP all servers' IPs are statically configured)
DMZ Segment: 192.168.3.0/24 (This is a future deployment)
LAN Segment: 172.17.0.0/16
 
Both, Private Servers and DMZ Servers are in a collocation as well as the ASA5520. There are multiple Branch offices that uses subnets within the 172.17.0.0/16 Network and they are connected to the ASA5520 via Metro-E.
 
I do not know if this is possible but what I want to do is this:
 
In order to avoid the change of internal DNS records I want to mask the DMZ servers with a Private Server IP when a Private server or LAN host wants to access it like this:
 
The FTP server in the DMZ has the IP address: 192.168.3.100. But when a PC from the LAN wants to reach the FTP server it should points to its old IP: 192.168.4.100. This way the PC sends a packet to the ftp.corporate.net (192.168.4.100) the ASA recieves the packet and translate it to the (192.168.3.100) and send it out through the DMZ Interface.
 
Also if the Private Servers wants to reach the same FTP the ASA will act like a proxy-ARP and send the paquet to the DMZ by means of the translation of the IP.

View 6 Replies View Related

Cisco Firewall :: 2911 - Control Link In Zone-Based Policy High Availability

Jun 26, 2012

I have set up a zone-based policy firewall with HA on two 2911 routers as per the Cisco security configuration guide, for an active/passive LAN-LAN cluster. All works as expected, but there is one problem I find: when the control link between the two devices fails, they go into an active/active state as each member assumes it's the last surviving member. The ARP entries for the Virtual IPs on the neighboring devices point to the device that last claimed the active role (usually the standby device). This works in a way, just sessions don't get synched anymore (control link is the same as data link). Now when the link comes back up, the preemtion works and the active, former standby device goes back to standby. But the ARP entries on the neighboring devices still point to the standby device and nothing goes (also sessions established during the active/active state are lost due to resync with the now active member).
 
This is a single point of failure and what I need is a way to mitigate that. Under:

redundancy
application redundancy
group 1
control <interface> protocol 1

only one control interface is allowed. Other manufacturers with similar functionality provide for the possibilty of a backup control link, for example the internal LAN interface or a dedicated backup link.
 
How would I go about that? Maybe use a port-channel for the control/data link (but I'm out of interfaces)?

View 1 Replies View Related

Cisco Firewall :: Configure 2911 ISR To Block Peer-to-peer Traffic?

Jul 25, 2011

I see that Application protection - blocking peer-to-peer file sharing traffic is a capability of Cisco IOS Firewall. How do i configure my Cisco 2911 ISR to block peer-to-peer file sharing traffic?

View 1 Replies View Related

Cisco :: CISCO Advanced Firewall On 2911 Router Using CCP?

Dec 29, 2012

Guys I am using a cisco 2911 router with three interfaces: Gi0/0 connected through a switch to all my servers and Gi0/2 which will connect to another server, and Gi0/1 is my outside interface connecting through a switch to two ISP's.I have webservers and Terminal servers/File Servers with 10.0.0.0 network address connected throught My Gi0/0 interface.Now I want to implement a Cisco Advanced firewall for security on my router using CCP.I want the firewall to work such that it allows external users to access the servers on Gi0/0 through ports 0,23,25,20,21,53, 110,3389. and to access the SIP server on Gi0/2. My issue is can i just create two DMZ's for both interface Gi0/0 and Gi0/2 without creating an inside zone and Gi0/1 as outside zone as my internal traffic is mostly server based and the users connect remotely through terminal server to access resourcess using RDP, secondly how do I open the relevant ports.I have checked alot and all I have seen is just basic process on using the wizard I have no idea how to go about this issue.

View 19 Replies View Related

Cisco Firewall :: 2911 / Site To Site VPN Using 3G USB Modem?

Sep 26, 2011

Using 3G USB modem on a Cisco router 2911 can you establish site to site VPN?

View 3 Replies View Related

My Private Ip Add Is Been Hacked

Mar 12, 2011

my private ip add is been hacked by someone, I have chk from various sites but the host name is unavailable so pls let me know how to get the host name of that pc & how can i get my ip 10.62.11.33 back to my org

View 1 Replies View Related

Cisco :: Private Address Block 172.16.0.0 - 172.31.0.0?

Apr 11, 2011

how the address stops at 31 in the second octet. I'm not even completely sure how it starts at 16 for the first address (172.16.0.0). are we dealing with subnets?

View 10 Replies View Related

Cisco :: Possible To Use 1 Private IP Through VPN And Same Mapped With Public IP?

Aug 25, 2011

Is it possible to use 1 private IP through VPN and same private IP mapped with Public IP? For example 192.168.0.1 is configured in VPN tunnel. i m able to ssh on both ends. ( VPN phase 1 and phase 2 gets completed)But when i map 192.168.0.1 with some public IP problem starts. when i try ssh i see public IP in my destination firewall logs. IPSEC: Received an ESP packet xx.xx.xx.xx "mapped public IP". The decapsulated inner packet doesn't match the negotiated policy in the SA, The packet specifies its destination as

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved