Cisco Firewall :: NAT On ASA 5550 V8.3(2) Remote Host Not Accessible

Nov 9, 2011

Not very familiar with ASA and NAT'ing in general so hopefully, this will make sense.
 
I've created a Site-to-Site IPSec VPN tunnel with one of our clients (who uses a PIX).  The remote user can connect to our local, private LAN servers without a problem.  However, when the remote user tries to connect to servers on our corporate network (which is linked over WAN routers from LA to Dallas) they cant get through.
 
When I run Packet Trace in ASDM on our ASA all is well until the packet attempts to traverse from the Inside interface back through the Outside interface (back to the remote client side of the VPN tunnel).
 
I see the following "error" within the Packet Trace tool;
 
-----------------------------------------------------------------------------------------
Type - NAT    Subtype - rpf-check    Action - DROP
 
Config
 
object network obj_any
nat (inside,outside) dynamic interface
-------------------------------------------------------------------------------------------
 
I've attached my ASA config.  The remote client-side address is 74.8.221.195, its being PAT'd to 172.30.12.75 and the remote host/network its not able to reach is 172.30.101.20 ( /24 net mask).  The local segment in my LA network is 172.30.12.0/22 and the servers in this network are all able to communicate with the remote client-side user at 74.8.221.195.

View 2 Replies


ADVERTISEMENT

Cisco Firewall :: 5550 ASA To Host On Sl100 For Internet Access

Apr 24, 2011

I'm working on setting up a new ASA 5550, and have run into a question that I hope is easily answered.I currently have 4 interfaces, SL100 Inside, SL80 DMZ1, SL50 DMZ2, and SL0 Outside.  I was under the impression that each interface, depending on security level would pass traffic from higher levels to lower, but not allow traffic being generated from SL80 to SL100.
 
What I would like to accomplish is that any hosts on my SL100 Inside interface can access the "internet" which is connected to my outside interface of the ASA, which was very simple, just a permit internal subnets eq www / https / etc...
 
My DMZ subnets need to access a few servers on my internal interface, and need outbound access to the world as well.  Thinking that all traffic from my lower SL interfaces on the ASA would be denied, I entered a permit IP / DMZ subnet ------> any.  This worked great for giving my DMZ hosts access to the internet, but it also permit traffic from the DMZ to hosts on my Inside interface as well.

View 2 Replies View Related

Cisco Firewall :: ASA 5550 / Basic NAT From Outside Remote-access IPSec VPN To Inside?

Mar 16, 2012

I cannot get this to work properly and I've even had a Cisco engineer from TAC set-this up... and it literally broke my inside network.  I have a VPN range of addresses..x.x.x.x on the Outside that needs access to a server on the Inside at y.y.y.y.  HTTPS/443 connectivity.  I need to NAT my VPN subnet/pool in order to talk to the inside host, as that host will not accept traffic from my VPN subnet, but obviously, will accept traffic from Inside my private network.
 
The Cisco tech entered the following static NAT statement to "fix" the problem - nat (outside,inside) source static VPN Inside-Network destination static Host-y.y.y.y Host-y.y.y.y For whatever reason, whenever this is configured on my ASA 5550 v8.3(2)25 the Inside interface starts proxy arping and assigns all IP addresses on my private network with the MAC address of the Inside interface. 
 
The y.y.y.y is on a remote, routed network within my private, corporate MPLS network.  My Inside private network (Inside-network shown in the static NAT above) is x.x.x.x.  Not sure why this happens, but it kills my entire network and I have to jump through hoops to quiesce the network and get everything back to normal.I've tried to Dynamic-PAT/hide the VPN range behind the Inside interface through ASDM and that seems to do nothing.The NAT statement above will break my network. How to NAT this connection without killing my Inside network?  Or, on how to properly hide my VPN subnet/pool behind my Inside interface and back to the VPN subnet/pool.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Connection Refused By Remote Host

Apr 26, 2011

I am trying to telnet to my asa 5510 from the core swith,however i received the below msg,how enable it?
 
 172.30.1.100 is the inside interface of the asa
 CITYCORE#telnet 172.30.1.100Trying 172.30.1.100 ... % Connection refused by remote host
CITYCORE#

View 8 Replies View Related

Cisco VPN :: Pix 515e - Remote Host Cannot Ping Any LAN Host

Jun 27, 2011

I have a host that can successfully connect to a PIX 515E (7.x OS) via VPN Client; however, I have no IP routing to the LAN from the remote host.The VPN IP pool works finem,The LAN default gateway is the inside interface on the PIX; the network is flat L2 behind it.The default route on the PIX points out; no other routes are defined,The VPN remote host can be pinged from LAN hosts, but the VPN remote host cannot ping any LAN host, not even the PIX inside interface.

View 2 Replies View Related

Cisco VPN :: Remote LAN Not Accessible After Connecting To ASA 5510 Using VPN

Sep 24, 2012

I  have a similar problem, I'm able to connect via VPN client and ping  only one host on the remote lan and nothing else.  I'm using both  split-tunnel and non-split-tunnel, but none has worked.  My main  objective is to make the remote user connect to office lan (remote lan  for him) and office Internet connection.

View 6 Replies View Related

Cisco VPN :: ASA5510 Remote Access / LAN Not Accessible Inside Network

Jan 6, 2013

I am facing a problem with Cisco ASA remote access VPN, the remote client is connected to VPN and receiving IP address but the client is not able to ping or telnet any internal network.I have attached running configuration for your reference.
 
-FW : ASA5510

-Version : 8.0
 
Site to Site VPN is working without any issues

View 10 Replies View Related

Cisco Switching/Routing :: Filter A Specific Host(s) From OSPF Routing Table On A ASA 5550 (ABR)?

May 22, 2013

I am attempting to filter a specific host(s) from my OSPF routiing table on a ASA 5550 (ABR) using LSA prefix lists.  However, when I look at the other routers in that area, I notice that ALL LSA type-3's are being removed (10 hosts are now missing from the routing table). I have verified the filter is working on the ABR, but I can't figure why ALL hosts/routes that were coming into the area are now being filtered instead of the specific one that I want to filter out.
 
Here is the config on the ABR:
 
prefix-list pdm_pl_000 seq 10 permit 206.253.180.137/32
!
!            
router ospf 1
network 10.0.0.0 255.255.255.0 area 0
network 10.150.10.0 255.255.255.0 area 10
network 10.150.252.0 255.255.255.224 area 10

[code]....
 
The 206.253.180.137 host is actually coming from Area '3'.  Am I doing something that is removing all type-3 LSA's?

View 3 Replies View Related

Cisco VPN :: ASA 5550 - Can Client Establish SSL To Remote Network

Mar 16, 2012

Device asa 5550 - But can a Client establish a SSL VPN  to remote network and devices on the remote network access local network printers? so you got one client one network A that creates a SSL VPN  to network B , can network B be configured so that automatic job come across the same ssl vpn to a Different IP?

View 5 Replies View Related

Cisco VPN :: Remote Access VPN Configuration On ASA 5550 Version 8.2

Oct 29, 2012

I have a problem relating to remote access VPN configuration on Cisco ASA 5550 verion 8.2(1). I used Cisco VPN client 5.0.03.0560 with a simple topology : laptop(client) -----( Internet) ------- (IP public) ASA. Now, I can ping from laptop to OUTSIDE Interface on ASA from Internet when I connect from Cisco VPN client to ASA , I was notified log on Cisco VPN client as below: [code]

View 1 Replies View Related

Linksys Wired Router :: RV042 - Remote Management Disabled But Interface Remotely Accessible

Feb 2, 2007

We have a RV042. remote management is set to DISABLE - but even after restarting the router i can access the interface remotely over the internet.even when i enable it and change the port to say 5555 i can connect to the web interface using either port 5555 but ALSO on port 80.what's wrong here?the only way to stop that was to create a rule that blocks port 80 on the WAN interface. (btw. could this rule affect LAN users when browsing the web?)

View 7 Replies View Related

Cisco VPN :: ASA 5550 - ASDM 7.0(2) Not Showing Bookmark Info For Remote Access VPN?

Nov 26, 2012

I have an ASA 5550 running 8.4(5) and have installed ASDM 7.0(2), but when I try to manage the bookmarks under the Remote Access - Portal when I try to edit an individual item in a bookmark list the screen does not display any information.  Is this a know bug, or do I need to have a specific java version for the new ASDM?  As a side note, I have not noticed any other issues with the new version of ASDM, only the bookmarks.  I initially tried to downgrade the ASDM version that I was using to connect, but it will no longer allow me to connect.

View 6 Replies View Related

Cisco :: Connection Refused By Remote Host?

Oct 26, 2011

i have to get a 2811 acting as a terminal server?

View 11 Replies View Related

Login Failure Due To Remote Host Not Responding

Nov 2, 2011

I am able to connect via VPN from my office wireless. In my home I am not able to connect. I got the error as Login Failure Due to Remote host not responding. I have wireless connection in my home. I am able to surf internet and also able to ping the ip mentioned in VPN.

View 3 Replies View Related

Cisco VPN :: 5505 / Remote Access VPN Allowing Only Since Host To Connect?

Jun 12, 2011

I have created a RA VPN with a 5505 using Anyconnect client.  My VPN functions perfectly, but now I am trying to limit access so that only one single host on my network can connect.  To do this I tried creating an ACL permiting the host and denying all other traffic, but it does not work it seems every one can connect.  how I can limit the outside access to a single host?

View 3 Replies View Related

Cisco VPN :: 2611xm - Unable To Ping Remote Host Through Tunnel?

Apr 20, 2012

I am in a test environment using an ASA 55005 and a Cisoc 2611xm router. ASA is running version 8.4 and router is running is ios12.4. My VPN tunnel comes up but I am unable to ping between remote hosts. I used the ASDM and SDM for the configuration. Attached is a copy of both configs.

View 8 Replies View Related

Cisco VPN :: ASA5505 Tunnel Some Traffic (public Host) From Remote Site

Feb 6, 2012

On remote site I have Cisco ASA5505, on cental site I have Cisco 2811 router, working site-to-site VPN tunnel. [code]

View 1 Replies View Related

Network Diagnostics Pinged Remote Host But Did Not Receive Response

Feb 23, 2011

I can connect to the free wireless with no problem on my company laptop. Last night, I was using my personal laptop (as I have been for 2 weeks) on the wireless internet when I suddenly lost connection. In the Network and Sharing center of Windows Vista it shows a connection to the router but an 'X' between the router and the internet. When I run the diagnostic I get "Cannot communicate with primary DNS server (4.2.2.1)" The it says "Network diagnostics pinged the remote host but did not receive a response".

View 14 Replies View Related

Cisco Switching/Routing :: Catalyst 4500-E / Found BUG Between EEM And Remote Host Logging In Various IOS?

Sep 29, 2011

I found a bug in Embedded Event Manager, on Catalyst 4500-E platform with supervisor V-10GE, on various IOS releases (in particular 12.2-50-SG IP BASE w/o crypto, 12.2-54-SG1 IP BASE w/o crypto, but also other releases included latest 15.0-2-SG1 ENTERPRISE SERVICES SSH).The problem is that when you set up a EEM applet that monitors syslog pattern matching, and you also configure remote host logging *with* the option "sequence-num-session", when the match occurs, the switch reboots with message:
 
Sw (sometimes prints a number instead)
VECTOR D00
 
and in some cases performs a second reboot with message:
 
VECTOR 0
 DOUBLE FAULT
 
The reload reason message is:
 
System returned to ROM by abort at PC 0x0
 
The problem does *not* occur if remote logging has not the option "sequence-num-session". I verified this behavior on various configurations (included our production 130K long *and* factory defaults after erase startup-config).The configuration statements that cause reload are, for expample:
 
event manager applet prova
event syslog pattern %SYS-5-CONFIG_I
action 1.0 puts "configurazione modificata"
!
logging host 172.30.10.1 sequence-num-session

View 1 Replies View Related

Cisco WAN :: C3750 - Mirror Switch Port Traffic To Remote Host IP Address?

May 31, 2013

Is there any way to Mirror a CISCO C3750 Switch Port Taffic to a remote Host IP Address?I know Port Mirror (SPAN/RSPAN) can copy one Interface Packet to another Interface. But I am looking for a way to miror Switch Port Packets to a remote Host (having Public IP Address and running Wirehark). Is it possible?

View 9 Replies View Related

Cisco Firewall :: 5550 Firewall Set Up For Redundant Purpose

Mar 3, 2011

i two 5550 firewall set up for redundance purpose . in failover we define two different ip add one for primary and one for secondary .interface Ethernet0/0 nameif outside security-level 0 ip address xxxx.0.0.0.1 255.255.255.0 standby xxxx.0.0.2!interface Ethernet1/0 nameif inside security-level 100 ip address 10.0.0.12 255.255.255.0 standby 10.0.0.11.default gateway for host will be 10.0.0.12 (primary fw address) however in case of failover , the secondary fw will be up with ip address that was assigned for primary .in this case the secondary ip add 10.0.0.11 is actually nerver used? similarly do i need to have two public ip address for outside (one for primary and one for secondary )   ? or in case if primary fails the secondary comes onlie and take the ip of primary fw . hence i only need to purchase just one ip address.

View 6 Replies View Related

Cisco Firewall :: 5550 Firewall Syslog Message

Feb 22, 2013

I have cisco 5550 Firewall, one messages appear in syslog server from Firewall, (warning) i want to stop this message from appearing syslog traps.

View 2 Replies View Related

Cisco Firewall :: Secondary ASA 5550 Firewall Getting Down Automatically?

Apr 17, 2011

I am having two ASA 5550 firewall running in active/standby mode. With in last two months our secondary firewall got down automatically 3 times. Firewall is running with IOS version 7.1.2. how to proceed further troubleshooting because there are not any logs on firewall.

View 3 Replies View Related

Cisco Firewall :: ASDM Not Accessible With ASA5510

Dec 25, 2011

i have ASA 5510 with firmware version 8.4.2 and ASDM firmware 6.4.5 , it is a new system and there is no configuration other than inside network and HTTP server enable , allow my ip address to access http server.i am able to ping the firewall but no access throguh ASDM
 
[code]....

View 5 Replies View Related

Cisco Firewall :: NATed IP Not Accessible Outside ASA 5505

Apr 28, 2011

I have made a Nat Rule  to access local IP in outer world with external IP on asa 5505 . Before creating nat rule external IP was directly given to server but after that I put server behind ASA. But now external IP is not accessible externally.

View 4 Replies View Related

Cisco Firewall :: Drop Rate-1 ASA 5505 Web Server Not Accessible

May 8, 2012

My web server was down for the day now it's back on but the ASA not accessible with error drop rate-1 exceed

View 3 Replies View Related

Cisco Firewall :: ASA5520 Unit Not Accessible On Network For Initial Configuration

Dec 15, 2011

We received an ASA5520-K8 through Cisco's Loan program so we could demo it as a replacement for our aging Cisco 3005 VPN appliances.  Given that we are a non Cisco shop (except for specific appliances like concentrators and wireless access points), I don't have a great deal of experience with Cisco gear.I started to set to setup the appliance this morning but immediately ran into issues.  The 5520 doesnt seem to be acting as a DHCP server, and worse yet, I can't access the unit even if I hard code the IP on the PC being used for configuration.  I have to say that I feel kinda stupid having to post this, since I actually followed the documentation avaiable for this menial task and I fully expect the problem to be a simple one.  Namely, I am using two specific sources of info for connections.

View 20 Replies View Related

Cisco Firewall :: ASA 5550 Two ACL From Outside To Inside

May 13, 2011

I have  ASA5550 ruuning Version 8.3(1) with inside and outside interfaces as below [code] On the inside : I have a server (10.20.10.36) that need to be accessed from an outside host (Y.Y.131.34) , so I have the below NAT/ACL  rules. [code] is it right that I have to add two ACL entry for outside host to the NATed IP of the inside server , then again add another ACL entry from the same outside host to the private IP of my inside server o get this communication done?

View 7 Replies View Related

Cisco Firewall :: ASA 5550 With IOS 8.0(2) Crashes

Jan 31, 2012

we had just installed our ASA 5550 with IOS 8.0(2) a couple of week ago.
 
2 interfaces from each slot are being used ie 0/0 for Branch users comming via MPLS cloud ,  0/1 for internal LAN users comming form Core Switch  & 1/0 for Server farm LAN   , 1/1  for Internet (outside)
 
the first 3 interface are considered inside with sec set at 100   while the 1/1 is outside with sec at 0.
 
Last night it suddenly started dropping all connections without any warning  or any noticible log form the ASDM logging.
 
the connection drop would happen for 2 - 3 minutes and would work fine for the next 15 minutes or so..
 
after conencting the console , we found out that the IOS would suddelny go abrupt and show this display ...
 
TP-ASA(config)# TP-ASA(config)# TP-ASA(config)# Thread Name: Dispatch UnitPage fault: Address not mapped    vector 0x0000000e       edi 0x24d184b0       esi 0x0000000d       ebp 0x1c6ceaf8       esp 0x1c6ceae0       ebx 0x09e965e0       edx

[Code]....

View 2 Replies View Related

Cisco Firewall :: 5550 - How To Do NAT Exemption With V8.4

Oct 4, 2011

I have looked in the books I have (Cisco ASA, PIX and FWSM; ASA 8.0) and googled a good bit but can't seem to find any specific mention of how to do NAT exemption with v8.4. It seems NAT exemption (NAT 0 access-list) was deprecated. Using ASDM, there's no corresponding menu item for this that is obvious.
 
We have public addresses inside the ASA and want to allow in/outbound connections using these IP's without NAT. The ASA is a 5550.

View 7 Replies View Related

Cisco Firewall :: ASA 5550 IPv6 Compatibility?

May 21, 2013

I need to understand if ASA 5550 ver 8.2(1) is comptible with IPv6, if not what is the upgrade path to make it IPv6 compatible. The requirement is dual stack of IPv4 and IPv6 should run in the same HA cluster and later will shift IPv6 completely.
 
The existing infrastructure is equipped with ASA with HA Active/Active mode. The command output for required details are attached here in txt mode.

View 2 Replies View Related

Cisco Firewall :: High CPU Utilization On ASA 5550?

Mar 10, 2013

I have Active Standby ASA5550 setup with VPN premium license. A few days back we had a requirement of SSL VPN connection for and we got a temporary from Cisco for same, this license expired and the ASA reverted to it's original license. 3 4 days after this we saw a sudden increase in CPU utilization (upto 90% + -5%) on the ASA during production hours but were not able to figure out the reason, in order to restore the services we failovered the firewall to secondary and everything worked fine. We were suspecting one of the following but there were no logs for any of this
 
1. The ASA hardware was haivng problem

2. Some client was doing a DoS attack to bring down the ASA (no logs for this as well).
 
We took a downtime to look further by failovering the ASA back to primary and it worked fine without any issues ruling out the 1st option. We also came across a licesing doc [URL]
  
Downgrading any license (for example, going from 10 contexts to 2 contexts).
 
# Note If  a temporary license expires, and the permanent license is a downgrade,  then you do not need to immediately reload the security appliance; the  next time you reload, the permanent license is restored.
  
As per this doc, sooner or later a restart was required on the ASA. We restarted secondary ASA and everthing was fine but when we restarted the primary ASA by swtiching over to secondary some of the server (not all) in the DMZ stopped working (even ICMP unreachable) and only came back to normal when the primary ASA was restored and working fine (with failover).
 
The reboot was done by shuting down the physical link between the Core switch and ASA inside individually.
 
I am not sure what could be the issue that the servers in the DMZ wen unreachable.

View 0 Replies View Related

Cisco Firewall :: ASA 5550 - Two Different Syslogs Servers?

Aug 9, 2010

In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it?

View 6 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved