I would just like to to open UDP port 123 in the ASA 5510 Firewall so that our Primary Domain Controller could use this port to sync time with an external time source. We have already added an access rule for this port under the firewall configuration in ASDM 6.4 and this port was also allowed in the inbound and outbound rule of the PDC's Firewall but it seems that it was still blocked.
View 23 RepliesWe are running a Cisco ASA 5510 in our district. We have been using it for about a year and a half after an upgrade from our PIX. I have been using the CLI to manage it but I wanted to start using the ASDM. I installed the ASDM Launcher last Friday but could not access it. I have enable the http server on the ASA, assigned an IP to the interface, and granted my machine's IP inside access. On Friday I was unable to launch the ASDM. I then downgraded Java. I came in this morning and was able to connect through the launcher. However I could not make any changes as it would give me an error message and often popped up with "lost connection" type messages. I then closed the ASDM but could not reconnect after that. When I try to connect through the launcher I receive the message "Unable to launch ASDM from 172.16.5.1: Connection reset". When I try https://172.16.5.1/admin/ from a browser I simply receive "page cannot be displayed". I'm not sure why I can't connect.
[Code] ........
I am attempting to block outbound traffic for a specific PC on my LAN using the ASDM.
View 2 Replies View RelatedWe have an ASA5510 that we need to open port 25 to allow mail traffic to our internal Exchange server.We have 2 interfaces defined... one named Internal on eth0/3 ip 10.1.x.x and one named Internet on eth 0/0 ip 96.56.x.x.We followed the instructions in ASDM for allowing access to a public server but confusion over definitions have stopped us.ASDM asks for the internal interface and the internal server IP... no problem there because the internal interface and server have two different IP addresses. The Internal interface is eth 0/3 (10.1.1.1) and the server is 10.1.1.2.
However, when we get to the External interface (eth 0/1) there is only a single IP address 96.56.x.x but the ASDM asks for an Interface IP and the IP people would use to get to the mail server from the outside. Inasmuch as we have only 1 external IP address (which connects to our upstream Cisco router which in turn connects to the ISP modem) we used the same IP for both but the ASDM returns an error indicating they must be different.
Apparently we do not have a clear understanding of what the ASDM is actually asking for. When the ASDM asks for the external interface we assumed it was asking for the named value we gave the interface (which is Internet). The named value "Internet" has an ip associated with it 96.56.x.x. But when the ASDM asks for the ip people on the outside would use to get to the mail server (we created a named value called "mail server" and gave it the same ip address as the external named value. This duplication of ip address causes the ASDM to return the error stating that external Interface to be used and the external ip to be used cannot be the same.Have we made an error when we assumed that when the ASDM asked for the external interface it meant the ip of the external interface or was it asking for the eth number (as in eth 0/0) for the interface?
We have a ASA5510 and I need to open port 22 for a speacific IP in our LAN outbound only.
View 15 Replies View RelatedI have an ASA 5510 in a live environment. Up til a short while ago I could access this via the ASDM and ssh. However I can no longer connect to it via eithier. When I access It via SSH I get a disclaimer saying the following
*** You have entered a restricted zone! Authorized access only!!! Disconnect immediately if you are not authorized user! ***
It then cuts me off.
When I try to access the ASDM I get the following
The firewall is running all its services without a problem and I can ping the device without any issues. Also none of the config (to my knpowledge has been changed). I set up a console session and http server enable is still there with
http 192.168.200.0 255.255.255.0 inside
We have setup new ip camera system and as per our vendor to access the camera from outside we need to open,TCP ports and in firewall and forward to our camera server.
Let say our public ip address is 207.114.111.22 and our local ip address for the camera is 11.11.1.30. We have cisco asa 5510.
Recently powered down device (transformer overhaul) and when it booted back up, unable to access with ASDM, SSH...can access directly using HyperTerm, but have only limited commands...will not accept known user/password credentials. When I issue 'show flash' I can see that there are upgrade_startup_errors.log files, but cannot access them.
View 5 Replies View RelatedCustomers ASA 5510 and they are using the default "pix" login. I can log into the command line with pix just fine. I created a user account, call it:username jsmith password Passw0rd priv 15,I'm unable to log into the command line with jsmith. I can get into ASDM with it.
View 6 Replies View RelatedI have just erased an ASA and upgraded the firmware and then added an IP. How can I enable the ASDM as I can't get on it, here is the config:
ASA Version 8.4(3)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
dns-guard
[code]....
Running Asa5510, 8.2.5, with asdm 6.4.5 and I am looking for a graph in asdm that will show me what protocols and internal ip addresses uses the most traffic. Maybe a bit like "Top 10 protected servers under SYN attach". My reason for this is of cause I see a very high traffic pattern from one of my interface during the day and need to identify what is using bandwidth, protocol and source address.
I could use Net Flow feature in the Asa, but it´s not "real time" and forces me to setup a net flow collector. Can 8.2.5 not give me this information with built-in graph/tools?
I do have one other question first. What's the effect of the crypto key zeroize rsa command, and then crypto key generate rsa modulus 1024 while I'm SSH'd to the ASA? Can I do it? Or do i need to be consoled in or connected a different way?
ASA 5510:
ASA Version 8.4(1)
asdm image disk0:/asdm-641.bin
asdm history enable
http server enable
http 10.1.1.83 255.255.255.255 inside
http 10.1.1.82 255.255.255.255 inside
Shouldn't that right there be enough to access ASDM from either host .82 or .83? Because I cannot. But if I add http 0.0.0.0 0.0.0.0 inside, then I of course can.
I have a cisco ASA 5510 that I have set up currently to access via ASDM through the Inside interface. When I VPN in using our older VPN server I can connect to it fine. I recently set up the ASA to also be a VPN server which will eventually replace the older server for our HQ. I noticed that when I'm VPN using the ASA as the VPN server, I can only ASDM to the public which I prefer not to allow. Access to the inside doesn't seem to work this way. What configurations if any would be causing this. I'm assuming it's some thing I need to adjust in the VPN configuration.
View 3 Replies View RelatedI copied a Cisco 5510 startup-config to an identical Cisco 5510.After copying through tftp, I executed a reload. Everything looks good. Line by line compare results are the same.The problem is I can no longer use ASDM or ssh to interface with Cisco 5510.
View 25 Replies View RelatedI was able to connect to my ASA 5510 with a browser, install ASDM, and configure my ASA 5510 with my Windows 7 laptop. Since I needed the laptop for another task, I am now trying to connect using a Linux laptop to do the same, but without success.
I can ssh into the firewall using the management port (192.168.1.1) from the Linux command line. However, I cannot connect using a browswer (192.168.1.1) to install ASDM.
When i tried to login through ASDM at Cisco ASA 5510, it ask for the username and password and after that nothing comes up. I am able to login through ssh. [code]
As per my knowledge show bootvar and show version, should shows the same IOS version. But here it's showing different. Is asdm-523 is compatible with IOS asa708.
Is there a way to create an account for the ASA using ASDM that is only read only and cannot make firewall changes?
View 1 Replies View Relatedi have an issue with ASA 5510.
I connect to the device - https:/interface
I see the options such as download launcher etc.
But.. whenever I click on this I get stuck
Internet Explorer gives "page not found"
Or at the foot of the page it says "unable to download statup_lr"
Firefox says cannot connect
It is running 6.2.5.53
I can connect if I go to a PC where I have already downloaded the ASDM launcher (from many years ago)
Tried Win 2003, 2008 and Vista, and Windows 7
Tried downgrading to Java 6 r 7. Can I download the launcher from the Cisco website rather than the device? If so where?
On our ASA 5510 we have two security contexts. After opening ASDM I can see and manage admin context, but cannot see second context. I can do changes to second context via CLI but as probably you know it's easier and quicker doing it via ASDM.
View 7 Replies View RelatedI've recently switched to an ASA 5510 on 8.4(3) coming from a Checkpoint NGX platform (let's say fairly quickly and without much warning ). I have a couple questions and they're kind of similar so I'll post them up. I've read docs about regex and creating them both via command line and ASDM, but the examples always seem to include info I don't need or honestly something I don't understand yet (mainly related to defining classinspect maps). If someone could provide a simple example of how to do these in ASDM that would be useful in understanding how regular expressions are properly configured. So here we go.
I know this is basic but I need to make sure I understand this properly - I have a single web server (so this won't be a global policy) where I need to allow access to a specific URL pathfile and that's it. So we'll call it est estfile.doc. Any other access to any other path should be dropped. What's the best way to do this in ASDM (6.4)? I think if I saw a basic example for this I could figure out next few questions but I'll post them as well just in case.
I have another single public web server (again this won't be a global policy) where I'd like to specify blocking file types, like .php, .exe., etc... again a basic example would be great.
Lastly, and this is kind of related, but we have a single office/domain and sometimes we get spam from forged addresses appearing to be from our domain. On Checkpoint I used to use its built-in SMTP security server and could define if it received mail from *@mydomain.com to drop it because we would never receive mail externally from our own domain name. I saw something similar with ESMTP in ASDM and it looks kind of like how you set up the URL access mentioned above. Can I configure this in ASDM as well, and if so how?
I have purchased a Cisco ASA 5510 & want to block all social networking websites (https) either using CLI or ASDM.
View 1 Replies View RelatedSo I've run into a problem on my ASA5510, post-upgrade I can no longer connect to the inside interface from across our L2L VPN. I've tried both ASDM and SSH and the connections fail. I see in the logs that the attempt is being made, but it will eventually time out. There have been no problems with this type of connection with any previous upgrades, just this particular upgrade, I went from 8.4(1) to 8.4(2). I don't see much in the release notes or anything in a pre/post config diff that jumps out as a cause to this behavior. The only thing I did see in the release notes "CSCtg50770 Mngt-access (ASDM,SSH) to inside intf of 5580 fails over RA VPN session" which sounds like it could be my problem, but that was in the "Fixed in 8.4(2)" section and says it's for a 5580, maybe the fix for the 5580 broke it on a 5510??? I hope not and that I'm simply missing some new setting that I need to enable for this type of connection as this device is in a remote office.
View 2 Replies View RelatedThe ASA 5510 is working with asa8.3.1 and asdm 6.3.1. ( with factory default config )i ve upgraded to asa8.4.1 and asdm 6.4.1.Now the asdm launcher is frozen after username/password. The asdm upload the software and write that "software update completed".After it the hour glass or sand-glass is visible over the asdm window.
View 2 Replies View Relatedi am unable to launch ASDM, and access https:// to run Asdm..everything worked find yesterday but now for some reason it wont work?When i am trying to log in with the asdm it just hangs on the connecting to device... please wait...When i am tryng access the https://... i get the ssl do you want to trust.. and i press proceed anyway and i get an error
Asa 5510
Device manager version 6.1
System image file is "disk0:/asa804-k8.bin
Also i am accessing the asa with ssh without any issues
I created some acess-lists, and you can assign a logging level to this access-list. Now this ACL has a lot of hits, so i want to see whats happening. Only the log I then see is completely empty. I cannot figure out how to get some info in that log.
I think there is some global logging setting i probably need to enable in order to get anything logged at all, but i cannot figure out which.
We have a new installation of a ASA 5505 and are trying to get some NAT issues straightened out. On our internal network, we have two servers running Filemaker Server, a relational database server that clients connect with using port 5003. Our goal is to be able to allow users from the outside to access either of these servers as needed. I know how to set up a simple static NAT rule and matching Access rule in ASDM which would be fine for a case in which only one server using a given port is running on a network, but for simple static rules I seem to be blocked from entering a different translated port number from the orginal port number, which becomes a problem when two servers we need to access from the outside are running software using the same port number.
What is the simplest way to address this need? I am guessing that I need to set up a scenario like this, where port 5004 (or any arbitrarily choosen unused port, can be used to access the second server: [code]
how to totaly disable Admin/ASDM access on our public interface of our 5510. I don't want to change IPSec or SSL access to the outside interface. Just totaly disable access to Admin/ASDM from the outside without halting all other access.
View 3 Replies View RelatedI just finished implementing a VOIP install and I am trying to setup some softphones and in order to allow the softphones to work I need to open some specific ports for outbound. I am not a Cisco guy, I am a Windows Administrator that also has to maintain my Cisco infrastructure.
View 3 Replies View RelatedI have a new ASA 5510 running 8.3(1) and ASDM 6.4(5)
I am trying to use the real time log viewer to troubleshoot some access issues, but I am getting delays of up to 30 seconds or more between my client connecting to the ASA and the corresponding events showing in the RT Log viewer. I am using a simple filter for source IP as it's quite a busy device.
I've seen an article that says to turn off certain logging IDs (such as 304001 from memory) which I have done, but no different.
configuring the ASA particulary after the change to how NAT is implemented. What I am trying to accomplish logically seems fairly simple, yet I cannot get it to work. I have a Synology NAS at home that I am trying to reach via the internet. Prior to using my ASA, I had Verizon's FIOS router as my gateway and everything forwarded with no issues. The ports I need forwarded or reachable via the internet are TCP port 80 and 5000.I can also configure it via command line if that's the easier/preferred method.
View 11 Replies View RelatedI got a situation here for Nat-ed IPs i configured. I expected to open some ports on the interface to allow certain traffics to pass through, yet there are some of them are failed. Down is my current config.
object-group service DM_INLINE_SERVICE_1
service-object icmp
service-object tcp destination eq https
[Code]....
The only ports opened are 443, www, 3389 while ports domain, 5061,3478,3389. how to open domain, 5061, 3478, and 3389 ports on my ASA .
Is there a way of ascertaining whether my 5510's have 1 memory slot or 4 memory slots without having to open the chassis?
View 6 Replies View RelatedI travel a lot and use wifi in a lot of different places (hotels, airports, etc.)My apps don't always work and I suspect that in some instances the broadband provider is blocking some of the ports I need.I don't need a port scanner like NMAP since that scans a target IP for listening ports.What I need is a way to figure out whether some firewall between my PC and the Internet is blocking specific UDP or TCP port ranges.
View 2 Replies View Related