Cisco Firewall :: NAT - Multiple Ports Translated To Single Port - ASA 8.4

May 21, 2013

We are migrating from a nother brand to an ASA Cluster running 8.4.5
 
We have a web-server on an inside interface listening on a non standard port - 20111. We have created a static NAT translating the public ip to the private, so If I do http://public-ip:20111 it works. (we are using a seperate public IP for this service only).
  
Now I need to create a NAT rule that will forward requests on BOTH port 80 and 443 to the same private ip and the same port number (20111)
 
The Private address is 10.99.250.20 and the "public" (I've replaced it in this example) is 172.16.16.16 I have managed to create a NAT that will translate 443 to 20111:
 
object network 10.99.250.20 nat (Private-DMZ,Outside) static 172.16.16.16 service tcp 20111 https

But if I try to add another rule like:  nat (Private-DMZ,Outside) static 172.16.16.16 service tcp 20111 http It will simply replace the first one.
 
Is it possible to redirect both 80 and 443 from outside to the same port number and same IP on the inside?

View 1 Replies


ADVERTISEMENT

Cisco Switching/Routing :: Does Nexus 7K Support Multiple VDCs Sharing Ports On Single Line Card

Mar 19, 2013

Does Nexus 7K support Multiple VDCs sharing ports on a single line card. One of our cisco parnter engineers stated that cisco doenst recommend using same line card for multiple VDCs.The second VDC (Non-Default VDC) will be used four our Outside, and DMZ Segment, and to phyiscally segregate our Firewall from our Internal/Inside Core Switch without using a physical DMZ Switch.I know Cisco used the Nexus in this way in their PCI DSS 2.0 Compliance Document. Module is N7K-M148GT-11L
 
Mod  Ports  Module-Type                      Model              Status
---  -----  -------------------------------- ------------------ ------------
1    48     10/100/1000 Mbps Ethernet XL Mod N7K-M148GT-11L
Mod  Ports  Module-Type                      Model              Status
---  -----  -------------------------------- ------------------ ------------
1    48     10/100/1000 Mbps Ethernet XL Mod N7K-M148GT-11L

View 7 Replies View Related

Cisco :: Manage Multiple Vlan From Single Port?

May 11, 2012

I have Cisco L3 3560G switch which directly connected with router . i have configured Vlan 2,3 on the switch and assign port 2 & 3 respectably. I want to management both vlan 2 & 3 from from L3 port g0/10 .

View 6 Replies View Related

Cisco WAN :: 2911 - Physical Single RJ45 Port To Handle Multiple WAN IPs?

Nov 7, 2011

I am learning the 2911 router. Is there a way to set a physical single RJ45 port to handle multiple WAN IPs? Or do I need to buy a port expansion module.

View 12 Replies View Related

Cisco Switching/Routing :: 3750 - Configuring Multiple VLANs For Single Port

Apr 11, 2012

I would like to configure a 3750 switch port to be able to use two vlans. I know you can do this with a voice and data vlan, but what about two data vlans ? Say I have two devices, one on a 10 subnet and the other on a 172 subnet, but i only have one wall jack for both devices to plug into. So I use a mini switch to connect both devices and connect the switch to the wall jack; and of course this all leads back to one switch port. When I go to enter the switchport access vlan 172 cmd, how would I also make it so the device on the 10 subnet could route out ?

View 9 Replies View Related

Cisco Firewall :: ASA 5510 / Multiple VLANs Behind Single Firewall Segment?

Feb 5, 2012

I need to create a firewalled segment that not only separates hosts from general population, but also from each other.  The solitary confinement of firewalled segments.I know that I could create a bunch of sub-interfaces, one for each host or group that needs to be isolated, but I'd really rather not have to do that if possible.  1) It could become a management nightmare between ACLs and sub-interfaces and 2) it's a waste of IP addresses.s there any way that I can create a bunch of separate VLANs behind the firewall and have them all terminate at the firewall, using a single firewall IP address for the gateway?
 
VLAN 1 - hosts 1.1.1.5 and 1.1.1.6VLAN 2 - hosts 1.1.1.7
Firewall DMZ Interface - 1.1.1.1VLAN 3 - hosts 1.1.1.8 and 1.1.1.9 

This way, the hosts are isolated and can't talk to each other unless they're on the same VLAN.I'm working with an ASA 5510 running 8.2.4(4).

View 1 Replies View Related

Cisco Switching/Routing :: Configuring 1941 With 8 Port EHWic Switch Module And Onboard GE Ports In Single LAN?

Jul 1, 2012

Can you configure a Cisco 1941 to use an 8 port EHWic module and the 2 onboard GE ports in a single LAN?

I've discovered you can't have the on GE ports associated with a VLan, and I'm when I've previously researched for a solution, bridging was mentioned but I cannot seem to get it to work (or completely understand it)The reason I would like to use all 10 ports on for the LAN is becuase I have 10 devices I need to connect to the 1941?

View 2 Replies View Related

Cisco Firewall :: PIX 501 - Allow Traffic From Single Citrix CAG Across Variety Of Ports

Dec 12, 2011

I have a question around pix 501 (6.3) configuration. I am trying to allow traffic from a single Citrix CAG across a variety of ports (80,443,9001-9005,27000,7279,1494,2598) from external (dmz) interface through to multiple addresses (on the same ports) on the internal (secure) network and dont know how to best approach it or if its possible. The only way I have found to allow traffic through is via Static Nat entries which I cant see will work for this requirement as we need some ports to be allowed into multiple addresses.

View 6 Replies View Related

Cisco Firewall :: IPTables Command Translated ASA 5540 Ver 9.0

Nov 19, 2012

I would like to have these commands on our Firewall to avoid at least several students to use this service. How to translate this? It's apparently working great if I will use an Linux box or another firewall compatible with iptables.
 
iptables -I INPUT -s hotspotshield.com -j REJECT
iptables -I INPUT -s hotspotshield.net -j REJECT
iptables -I INPUT -s anchorfree.com -j REJECT
iptables -I INPUT -s anchorfree.net -j REJECT
iptables -I INPUT -s openvpn.net -j REJECT
 
iptables -I OUTPUT -d hotspotshield.com -j REJECT
iptables -I OUTPUT -d hotspotshield.net -j REJECT
iptables -I OUTPUT -d anchorfree.com -j REJECT
iptables -I OUTPUT -d anchorfree.net -j REJECT
iptables -I OUTPUT -d openvpn.net -j REJECT

View 1 Replies View Related

Cisco Firewall :: 5550 Migrate From Multiple Context To Single

Aug 12, 2012

I have a Failover pair of ASA5550's running ASDM 6.2(5) and ASA 8.2(2).  Originally they were setup with 2 context's and an admin context but one of the contexts has now been removed.  I would like to now migrate to single mode before I go about patching them to the latest software.

View 4 Replies View Related

Cisco Firewall :: 2121 / How To Nat Multiple FTP Local Servers From One Single IP

Apr 24, 2013

I have a FTP server at my local network and i have natted the private IP with my Public IP using default FTP Port ( 21) , now i have created Diffrent FTP Account in my server using port 2121 and i am able to login using the private IP with port 2121 , now i want to nat with my public IP with port 2121 and i failed,

1) 125.x.x.x --------- 10.10.1.x : 21 ( Able to access from external network)
 
2) 125.x.x.x ---------- 10.10.1.x : 2121 ( not able to login from external network and able to login internally )

View 7 Replies View Related

Cisco Firewall :: ASA 5550 - Migrate From Multiple Context To Single

Jun 13, 2012

I have a Fail over pair of ASA5550's running ASDM 6.2(5) and ASA 8.2(2).  Originally they were setup with 2 context's and an admin context but one of the contexts has now been removed.  I would like to now migrate to single mode before I go about patching them to the latest software. 

View 2 Replies View Related

Cisco Switching/Routing :: ASA-5525 - Connecting Multiple Switches To Single Firewall?

May 28, 2012

Could I configure and connect 3 Dell switches to an ASA-5525 Firewall which has got 8 interfaces.

View 7 Replies View Related

Cisco Firewall :: 6513 - FWSM Multiple Security Zones On Single Context

Nov 7, 2012

My corporate internal network is currently fire walled by an FWSM module on a 6513 switch.  We have each security zone (we have eight) assigned to a FWSM context and have ACLs set up between the contexts and the enterprise LAN/WAN.  Is it possible to support fire walling between these zones within a single security context?  The reason I am asking is that we would like to purchase a second FWSM for use as a standby, but do not want to cough up the ~ $12K for the context license.  We will ultimately be transitioning to ASAs for internal security, so do not want to spend more than we need to.

View 3 Replies View Related

Cisco Firewall :: Allow SIP On Multiple Ports Not Only 5060 (ASA 5505)

May 14, 2012

We've read everything about inspecting SIP packets and allowing them to pass through on port 5060, the default SIP port. However, our setup requires the ASA 5505 to allow SIP on ports 5060, 5160 and 5260.
 
Is this possible with the ASA 5505? If it's not, it would be a blocking issue for us to move forward with ASA appliances. We are currently investigating in a lab environment and really having difficulties configuring it to facilitate full SIP functionality.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Always Allow Traffic On A Single Port

Feb 1, 2012

I have a private network behind a configured Cisco ASA 5510. I need to send data back and forth between a server on the inside network and a device on the outside network on port 44818. No amount of configuration is allowing this to happen. The packet tracer always fails on of the implicity "deny" rules, even though my other rule should explicitly permit it. I also realize I need to set up routing from my outside network to the inside network, but I cannot see from the documentation how to do that on this particular port without simultaneously breaking my outside connection.
 
The inside IP for the ASA is 192.168.25.1
The outside IP for the ASA 192.168.11.54
 
Here is my current configuration:
 
: Saved
: Written by enable_15 at 08:49:25.956 UTC Thu Feb 2 2012
!
ASA Version 8.2(5)

[Code]....

View 6 Replies View Related

Cisco Firewall :: 4443 Forwarding A Single Port

Jan 22, 2012

Is there a way to forward a single port, while leaving the others alone?  For instance I want to forward all https traffic on a public IP to an internal server on port 4443. At the same time traffic on all other ports for this IP needs to be forwarded on the original port.  It looks like creating a Network Object will allow a single port to be forwarded, but what happens to the remaining traffic?  I attempted to create Service Objects that I then assigned to NAT statements.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 8.4(1) - Map Multiple Inside Hosts Ports To One Public IP?

Jun 22, 2011

I'm stuck at asa 5505 nat, port forwarding configuration Here is what i need:

host1: 192.168.1.1 service tcp/100 >>>>> public ip 1.1.1.1 service tcp/100
host2: 192.168.1.2 service tcp/200 >>>>> public ip 1.1.1.1 service tcp/200
host3: 192.168.1.3 service tcp/300 >>>>> public ip 1.1.1.1 service tcp/300
 
So people from remote just need to use 1.1.1.1 public ip to access all the ports on three different inside server.I can do this on my old ASA 5505 with 8.0(4). Looks like there're lots of change from 8.0 to 8.4.

View 7 Replies View Related

Cisco Firewall :: 3074 Port Forwarding For A Single IP Address

May 28, 2013

I need the following ports forwarded for a single ip address Port 88 (UDP)Port 3074 (UDP and TCP)Port 53 (UDP and TCP)Port 80 (TCP) .Is there an easy way to to it with service objects/groups?

View 7 Replies View Related

Cisco Firewall :: ASA 5505 - Setup Single Port Exclusion For Static NAT?

Sep 20, 2012

I have been using static NAT to map between a single server behind an ASA 5505 and a single public IP address. In other words, I've been doing this:
 
object network NAT_ME
nat (inside,outside) static interface
 
Now I would like to start using the clientless VPN feature of the ASA, so I of course don't want that particular port forwarded to the server. Is there a way to define such an exclusion? I've tried several things, including setting up a separate NAT rule to direct that port back to the ASA's interface, without luck.
 
If that is not possible, what configuration would I need to move to in order to get the behavior that I want? It is important that all (non-VPN) traffic is passed exactly as it arrives at the firewall (whether it is coming from internal or external), with the exception of changing the IP address (i.e., I need static port mappings for some of my services).

View 5 Replies View Related

Cisco Firewall :: ASA 5510 - Time Range / Allow Single Port During Business Hours Only

Apr 1, 2012

I'm new to an ASA 5510 running 8.4(3) and am trying to figure out something regarding time ranges in ASDM. I simply want to allow a single port during business hours only (I'm not concerned about open sessions needing to be closed). So as an example I add a rule something like:
 
(RULE1 on the internal interface) SRC=INTERNAL DEST=ANY SERVICE=RDP ACTION=PERMIT with a time range set for weekdays 8:00-16:59. I did a test after 5pm on a weekday and was still allowed to do RDP to a server (from INTERNAL), and after using the packet trace tool saw it was still passing through due to a rule a couple lines down (rule 4) that allowed a port range that happened to include port 3389. So my question is if I specify an "allowed" time range and someone attempts access outside that time range, why doesn't it drop it right there? I guess I'm assuming that anything outside the "allowed" time range would be dropped but that doesn't seem to be the case. I'm also assuming the rule base is processed top to bottom.

View 2 Replies View Related

Cisco Firewall :: Port Forwarding A Range Of Ports (PIX 6.3)

Dec 5, 2012

I have a network with multiple servers behind a PIX with 6.3 on it. I have one public IP address, and I'm using NAT. I'm currently trying to port my Exchange server to a cloud host, and the vendor is requiring I open up a wide range of ports for MAPI, basically ports 1024 on. What would be the command to forward all of the trafic cominto/from that broad range? if I could simply route all trafic to and from their two IP addresses to my email server, that would accomplish the same end goal.

View 3 Replies View Related

Cisco Firewall :: Multiple Static Port Translations On ASA5505

Aug 15, 2011

I am at a loss on configuring a new ASA5505 for multiple static port translations.I would have expected to simply add several service command to a network object to complete the task, however, the service command overrides the previous and replaces rather than adds to the translations. [code] However, if entered in that order the 8443 overwrites the 8080 static translation.What is the correct procedure to establish multiple translations? If someone could also provide the "old" style for pre 8.2 release, I'd like to compare because I thought I used to do this with an access-list somewhere.

View 4 Replies View Related

Cisco Wireless :: 5508 Assign Single Ssid To Multiple Interface Groups By Assigning Ssid To Multiple AP Groups

Aug 26, 2012

Is it possible to assign a single ssid to multiple interface groups by assigning the ssid to multiple AP groups? 
 
I have buildings geographically dispersed that are configured with multiple vlans in interface groups so that I can maintain an addressing scheme of dhcp assigned addresses per building.  Each building is also further grouped as AP groups.  I'd like to know if by assigning the same wlan ssid to each of the AP groups, will I maintain addressing integrity for each building?  I'm thinking it will work.
 
Do the buildings have to be outside AP range of each other to avoid problems?

5508 controller
7.2.110.0  code
6 buildings
6 interface groups
1 ssid

View 4 Replies View Related

Multiple IPs On A Single NIC?

Nov 9, 2011

Am trying to understand how we can have multiple IP addresses on a single NIC and what are the restrictions on the same. If i can have two IPs from two different networks present on a single NIC, then why would i ever get a new NIC?

Also, i want to understand the concept of virtual IP and how it fits into this picture.

View 6 Replies View Related

Single NIC For Wan Multiple For LAN?

Nov 2, 2012

I have an older DELL power edge 2800. Currently we have 2 NIC's one for the WAN one for the LAN. I wish to increase my users access speed. Can I team and or bond up to Four NIC's on the LAN side and leave the single NIC for the WAN? I am having trouble finding any info on the net for pulling this off. I have 67 users and throughput is getting a little rough.

View 1 Replies View Related

Cisco Firewall :: ASA5505 Configure Port Forwarding To Multiple Internal IP Addresses

Jun 21, 2012

ASA 5505 Firmware 8.3(4), ADSM 6.4(2).I have a public IP address of 168.87.3.4.I need to forward ports (5060, 5080, etc.) to one internal address. (192168.1.1).I need to foward different ports (10020-10080) to a different internal address (192.168.1.2) Everything I read tells me how to do this in a 1 to 1 static NAT.

View 1 Replies View Related

Multiple LAN IP Addresses On A Single WAN Address?

Feb 14, 2012

I need to put a few cameras, without a server, on a static WAN ip address. Do I just assign them a static LAN ip address(for example 192.168.1.200), make sure the port they use is open, then type the WAN static ip address then colon and the last address? Like this.....I'm making up the WAN address....45.34.55.334:200

View 1 Replies View Related

Showing Multiple MAC's On A Single Interface?

Mar 31, 2011

some of the servers are not pinging from one switch but they are pingable from other redundant distribution switch. So I took the IP addresses from the redundant switch, with that I found MAC addresses from the access switch.But when I tried to see to which ports these MAC are addresses are connected to, multiple MAC addresses are resolving to the same switchport. like 5 MAC's are showing to 1 port and other 3 MAC's are showing to other port, like this there are many. All these MAC's belong to virtual servers.

View 11 Replies View Related

Multiple Clients On Single Server?

Mar 30, 2012

I just want to keep one PC as a server and one switch connect to it (For LAN). I want to connect multiple client/screen to that server, so I can use single servers for multiple screen/client.(Client machine will not have any CPU, they will utilize servers memory.)

View 1 Replies View Related

Login To Multiple Computers With Single One?

Jul 22, 2012

I currently have mutiple computers at my place. Once the computer turned on i want the option of which login for the current computer to use, it can login it current computer or the mutiples computer with their content/data all inside. So more like an computer linked. Example, it can only to A or B, A is the current computer data, while B have all the data of the different computer monitor datas, and if i login B it will show that current computer info. And same goes to the B computer, i can login to A or B on the B computer. What makes this very good is that, both the computer logins are sort of connected, for example if im on actual computer A, but logined to computer B and downloaded/changed some files/data on the B login, once i login on computer B to login B, the changes will apply even tho the changes are done in computer A.

View 1 Replies View Related

Cisco :: OSPFv3 Multiple Instances On A Single Interface

Aug 4, 2012

I am Implementing Cisco IP Routing (CCNP ROUTE FLG) book and right now I am reviewing IPv6 chapter. This part of OSPFv3 multiple instances over a single physical interface caught my attention

View 6 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 - AD Integrate With Single Domain Name With Multiple ADs

Sep 3, 2011

We having ACS version 5.2 0.26 with Active/Standby. We need to integrate active directory with ACS. Domain name given by Server team was as xyzcompy.local. When I tried to resolve the same domain name I got five servers ip address against the same domain name. however we given the ip reachability to only for two servers. We we try to save we get error saying that "Can not resolve the network address".
 
So my questions are;

- does ACS should have ip reachaibility to all five servers

- does the username/password we entered in the ACS should have domain admin rights?.

- the given AD is configured with windows NTP [URL] but when we configured ACS as windows NTP it was taking  local server as active NTP..?
 
When we check the ACS logs, we saw the following error;

in acsLocalStore:
AdminName=acsadmin, DomainName=qatarconvention.local, ADOperationResult=unable to create secured connection against AD server, switching to non-secured connection. javax.naming.CommunicationException: simple bind failed: qnccad02.xxxxconvention.local:636 [Root exception is java.net.SocketException: Connection reset],
in ACSADAgent;
32484]: INFO  dns.findsrv FindSrvFromDns failed: res_query failed _ldap._tcp.xxxxconvention.local
Sep  4 12:43:20 acs01-cc4 adjoin[32484]: INFO  cli.adjoin Join to domain 'xxxxconvention.local', zone 'null' failed.
 
I attached some screen print which saw the error and output of nslookup for the domain name.

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved