Cisco Firewall :: Opening Outbound Ports On ASA5505
Oct 2, 2012
I need to open some outbound ports in order for our CCTV company to receive alarms from our internal CCTV Machine.
The ip addresses of the company who access the CCTV are as follows:
213.130.134.56
81.130.198.97
The above are fixed IP addresses. The internal machine is on 192.168.204.170
The outbound ports that I need to open are the following:
TCP
21
23
80
5201
UDP
1025
2074
2075
I have access to the current config if needs be.
View 8 Replies
ADVERTISEMENT
Mar 26, 2013
I just bought a Cisco ASA5505. I'm trying to opening a port range through CLI, but it doesn't seem to be working.
Background:I have an FTP Server running behind the firewall and need to allow port ranges 30000-30100 for data connections. I have been using FTP through the command prompt and its working. However, I cannot use it through the FileZilla client as it fails to query the directories. I have the ASA forwarding to port 1125 from 21 in passive mode.
Access-List:
access-list Outside_Access_In line 3 extended permit tcp any any eq ftp-data (hitcnt=0) 0xfa8ed43d
access-list Outside_Access_In line 4 extended permit tcp any any eq ftp (hitcnt=17)
[Code].....
View 14 Replies
View Related
Jun 20, 2011
I have a XP workstation behind my ASA that can not connect to a client's network via Cisco VPN Client using IPSec...
In the logs it shows the translation is working on 500 but the VPN Client has the error 412, that the client is not responding.
Config below
ASA Version 8.2(1)!hostname RWFW1enable password encryptedpasswd encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address x.x.x.x
[Code].....
View 16 Replies
View Related
Mar 10, 2011
I've had a Cisco ASA 5505 firewall connected to a cable modem (Virgin Media, UK) for the past 3 years. In the last 6 months or so I have noticed that the ASA would drop the outside (internet) connection intermittently, usually at least once every 1-2 weeks - the interface still shows as being up but no traffic crosses it, and computers on the inside network abruptly lose internet connectivity. Rebooting the ASA or administratively shutting down the interface and bringing it back up again would cure the problem straight away until the next time it happens.
In the last couple of days however despite nothing having been changed in the configuration the frequency of this connection drop has increased to the point where I would lose access to the internet within an hour of rebooting the ASA. It does not seem to matter whether or not there is traffic currently going out or not, inside computers just appear to suddenly lose internet connectivity.
I have tried the following without success:
1) I completely wiped the configuration (configure factory-default)
2) I changed the port the cable modem was connected to (eth0/0 -> eth0/7, changing switchport vlan accordingly)
I thought perhaps 2) had fixed it but it lasted a whole 2 hours before I woke up this morning to find that none of the internal equipment had internet access despite the fact eth0/7 was showing as up/up in ASA CLI.
This morning I manually set the eth0/7 port to "speed 10" (10Mbps, full duplex). It was previously set to be auto-negotiation (default) on both speed and duplex. As of this post it has managed to keep the outside connection up for 3 hours - but I'm not optimistic that it is fixed.
Interface counters have never shown any collisions, errors, etc - only packets input and output as expected.
Since the problem persisted across ports (eth0/0 -> eth0/7) I'm wondering whether or not the problem could either be faulty memory, or some kind of speed/duplex incompatibility between the cable modem and ASA.
View 13 Replies
View Related
Apr 24, 2012
We have a DVR here at work that has a web interface on port 100. From our internal network we just use http:192.168.100.40:100. What is the best way to set that up on cisco 5510 firewall. I have cisco asdm and set a access rule: enabled=checked ; source=any ; destination= 192.168.100.40 ; service= tcp 100 ; action=permit. It shows a couple of hits when I go to [URL]
View 7 Replies
View Related
Dec 26, 2011
I’m trying to configure my ASA 5505, in order to allow my inbound and outbound mail communications. Here with this mail I’ve attached a diagram which illustrates my exact network setup along with ip addresses.
In this setup I’ve enabled port forwarding on my ADSL router (port 25 and 110) and configured the ASA accordingly, and my mail server is located inside my network.
My problem is currently I can send mails from my inside network to outside but my not receiving any mails which originate from outside. I’ve attached my current ASA configuration as well,
C:UsersSuthakarDocumentsOffice_DocsThakralABC Computers
Final config on ASA5505
host name Cisco
enable password 8Ry2YjIyt7RRXU24 encrypted
password 2KFQnbNIdI.2KYOU encrypted
names
!interface Vlan1
nameif inside
security-level 100
ip address 192.168.155.201 255.255.255.0
[Code] ......
View 3 Replies
View Related
Jan 2, 2013
I am trying to configure a new 5505 but I am having difficulties opening ports that allow traffic in from the outside. My setup is Comcast Business Modem (w/ single static IP) -> ASA (10.0.0.1) -> (dumb) Switch -> NAS (10.0.0.10). I am attemping to open port 5001 to the NAS. I am very new to IOS so I have mostly been working in ASDM. Not sure if I am overcomplicating this for myself or what but I am stuck.
My running config is -
ASA Version 8.2(5)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
[Code].....
View 4 Replies
View Related
Feb 5, 2013
-I need to configure the following on my PIX:
TCP port 2195 - outbound
-TCP port 2196 - inbound
How would I configure this via ASDM?
View 3 Replies
View Related
Nov 7, 2011
We have just acquired a cisco profile 42 video conferencing equipment and am required to open ports for SIP and H232, any pointers on hw that can be acquired i have a cisco ASA 5510, Some one told me to open port 16384 but i need pointers on how to do it becuase I already set an access list to any.
the config
Internet -> ASA 5510 -> Switch -> Profile 42 and other devices
View 5 Replies
View Related
Jun 20, 2011
I am trying to open up 3 TCP ports in Cisco ASDM Launcher:
16000
16001
8098
And have a Cisco ASA 5505 Router. I need these ports open in order for a software that I have installed on the server to communicate with my local client computers for my business, The software is installed on Windows 2008 Server Standard Edition and was installed with MicrosoftSQL 2005. The software and Microsft SQL 2005 is pretty much installed and just requires this last step in order for the server to be connected to the local computers. In order to resolve this, I have gone to.
View 1 Replies
View Related
Feb 25, 2011
I am used to setting up access-lists on outside interfaces with ip addresses that are static. I have recently been given a site that is using a dyndns.org client for name to ip address resolution on an outside interface that is dhcp assigned. I created an access-list to open up ports 41794 and 41795 to an engineering application but everytime I try to connect from the outside I get a syn timeout. The application works when inside the lan. Basically I want to allow outside connections from anywhere on the outside to go to ports 41794 and 41795. I am running a Cisco ASA 5505 on version 7.2(4) Below is my conifg. what I may have misconfigured?
: Saved:ASA Version 7.2(4)!names!interface Vlan1 nameif inside security-level 100 ip address 172.31.2.1 255.255.255.0!interface Vlan2 nameif outside security-level 0 ip address dhcp setroute!interface Ethernet0/0 switchport access vlan 2!interface
[Code].....
View 5 Replies
View Related
Mar 18, 2012
I wish to set up a ASA5505 with QoS, and to allow specific port numbers to have priority going through compared to rest of the traffic. Eg ports 21, 80, 443. So for example if im maxing out a torrent, it doesnt impact web traffic etc.The current link its connected to is 100mbit/2.5mbit connection..
View 1 Replies
View Related
Sep 14, 2012
I have an ASA 5505 running 8.4.4.1. I've configured three WAN interfaces and have assigned failover on one of them (we have two ISP's, and a total of 3 static IP's in 3 different subnets). I've noticed that all the traffic is flowing through only one of the three interfaces, but I need to allow incoming https traffic on the second WAN port so I can access our Exchange server (we already use https on the first WAN port to access another server).
[code] WAN1 is the default outgoing route and we've configured several incoming services on it (smtp and https for example) and appears to be working properly as mail is coming and going and users can access the RDS gateway.I need to configure WAN2 to accept https traffic and send it to our Exchange server to enable OWA (webmail) access.I've configured the same Access and NAT rules on all three WAN interfaces for smtp (but I suspect only the first one is currently functioning at this point, I'll test it next chance I get). I thought all I'd have to do is configure an access and NAT entry on WAN2 (same as on WAN1), but direct the traffic to the OWA server instead of the rds gateway server, but it is not working.
In the realtime log I can see that it appears to be receiving the traffic on the WAN2 IP, but seems to be passing this through to the inside via the WAN1 interface.
View 5 Replies
View Related
Jan 28, 2013
i've a cisco asa5505 on adam 6.4 and a dvr i would like to forward the ports 9000 and 85 in order to monitor the dvr from outside?
View 1 Replies
View Related
Oct 21, 2011
Both of these ISDNs are up, this gives us 4 channels. Someone said they recieved a busy tone when they attempted to dial out. I looked over the system and seen there are two outbound pots dial-peers. Each dial-peer references one of the BRI ports. The preferences are the same on each dial-peer. I think what is happening is that the system is randomly selecting one of the dial-peers due to the preference, even if both channels of the BRI are in use. How does the system know if that port has both channels in use? I've not used ISDN before, so tried to enter the B-channel sub interface and the system (UC500) tells me I cannot do this. I was thinking about adding each channel into a trunk group and then referencing the trunk group in the dial-peer. I can obviously add both BRI's into one trunk group.
View 2 Replies
View Related
Oct 16, 2012
I have been asked to open some ports in order for a CCTV company to connect to an internal CCTV server on our LAN.
We have a Pix running PIX Version 6.3(5) I am ok configuring an ASA for the above but not a Pix.
View 2 Replies
View Related
Apr 20, 2012
What I'm trying to do is to get my Xbox connected to the internet through my router (wired connection), but I want to have my NAT open also. But when I put in a static IP into the Xbox manually and open the ports in my router, it makes it so my Xbox can't connect to Xbox Live at all. Although, if I just leave it to the automatic setting on my Xboxs network options, I can connect just fine. But, I end up having a strict NAT type, unless I restore to factory defaults in the networking options on the Xbox.
View 2 Replies
View Related
Jan 16, 2013
how can I open my port 80, 5000, and 22 in my modem.
View 1 Replies
View Related
Mar 23, 2012
I need opening up some ports for a sftp client at work. software version 8.0 (3) device manager version 6.1 (1)
View 4 Replies
View Related
Jan 25, 2013
I've had this router for a few months after my last one died and I'm now completely unable to port forward. I follow all the steps to port forward but alas the port is still closed every single time. I've tried a few fixes in the past including disabling UPnP, using those auto port forwarding programs, and creating an exception for the port in my fire wall. Nothing has worked!
View 14 Replies
View Related
May 25, 2012
I just purchased a cisco ea4500 I have set up port forwarding for http, https, rdp. however when I run zenmap and port check it fails says port in use. I have set it up in sigle port forwarding, rang and port trigging. I tried RDP and VPN to machine that is hard wired and it fails as well. My windows server is connected as well however RDP fails on there to
View 9 Replies
View Related
May 12, 2012
Any simple way of opening ports on a 1841 router.I have a working config for internet traffic. I am looking to boot up my Windows Server and Run IIS.
View 1 Replies
View Related
Mar 10, 2011
I've installed XAMPP on one of my Vista computers, and intend to use it as a server. The internal IP address of the server is A.B.C.D. The internal IP address of the DIR-615 is A.B.C.E. whatsmyip.com says that external address of the server is F.G.H.I (and so is everything else inside my network). I have Filezilla listening on port 21. I've turned Windows Firewall completely off on the server, and my ISP (Time Warner / Road Runner) says that they never block any port.I tried going to the DIR-615 using Port Forwarding, and set ports 21 & 90 to forward to A.B.C.D, for both UDP & TCP, Allow All, Always. That didn't work.I tried going to the DIR-615 using Virtual Server. I set a virtual server on port 21 to A.B.C.D, for both UDP & TCP, Allow All, Always. It made me turn off Port Forwarding, and it wouldn't let me use both 21 & 90 on the same rule, so made two rules. That didn't work either.
I tried setting A.B.C.D as a DMZ host. That still didn't work.I can ftp connect into A.B.C.D from one of the other computers in the network. People outside the network can't connect to F.G.H.I. I can't connect to F.G.H.I. from inside the network. The same is true of Apache (but ports 80, 81 & 443), Ventrilo (but ports 3784 & 6100) and MySQL (but port 3306). I figure that FTP is the easiest to test, so I've been just trying to get that to work.In FileZilla Server Options, I am bound to *, I have no filters, and my passive mode is set to "Retrieve external IP"As far as I can tell, if I've ruled out anything inside my network (by connecting internally), and I've ruled out my ISP (they don't block), then it must be the router. I think I've done port forwarding according to [URL], and it seems like it should be easy, but I've been trying forever and I can never get it to work.
View 3 Replies
View Related
Dec 27, 2011
I'm trying to get the silly iTunes Wi-Fi sync to work , and I've been told to ensure that these ports are open:5297 TCP 5298 TCP/UDP and 5353 UDP in the hardware router. How do I do this with the DIR-655 (HW version A3, FW version 1.35NA)?
View 1 Replies
View Related
Dec 4, 2012
I have a Belkin F5D8233-4v3 N Wireless Router. To get the wireless Directv connection, directv told me I have to get 2 ports open on my router.1701 and LT2P.
View 1 Replies
View Related
Nov 20, 2011
I have a cable modem hooked up to a Linksys WRT54G2 wireless router, which is hardwired to the computer I use.
I go into the router's menu by going through the standard 192.168.1.1 in the browser, and then go to Applications and Gaming. The port I am trying to open is port 25565 for both TCP and UDP. In the Start and End ports I put 25565, and for the end of the IP Address, I put the last digits of my IPv4 address (10). I used a couple of port checker tools, and it is reporting as still being closed.
View 9 Replies
View Related
Oct 5, 2011
I'm having some issues getting ActiveFTP to pass through an ASA 5505, I finally found out when I tested the FTP via cmd on windows(after the major hassle of getting credentials out of the software co) that it does open the connection on the control port, but whenever I try to send/recieve data the connection is dropped, for troubleshooting purposes I've even gone as far as opening up all ports 1-65535 with an acl to no avail, I believe the FTP traffic is encrypted with SSL(can't get a solid Y/N from the company).
View 1 Replies
View Related
Mar 30, 2011
Below is the interesting part of my config. I have static NAT configured and working inbound for the Exchange Server and the Barracuda, however outbound traffic from those hosts comes out as the interface IP. Thoughts? I've tried a number of things (outside, inside), etc.
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network DSN-EXCH01
host 10.250.231.51
object network MAIL-IN
host 10.250.231.50(code)
View 3 Replies
View Related
Jun 21, 2011
I'm having an issue on my Pix 501- ver. 6.3(5) firewall when host 192.168.1.2 accessing any website, no website is opening and when i issue command sh xlate so don't see anything and i think i must enable natting on this firewall as same as on ASA nat-control
[code]....
View 5 Replies
View Related
Jan 30, 2012
I know I can use the RTR statement to determine when the primary ISP circuit goes down via this technote: url...My question can I assign static Nats on the backup ISP connection to the same inside servers in the dmz.?Example 10.1.1.11 is mapped to ISP1 ExternaIP of 65.217.77.11. Can it 10.1.1.11 also be mapped to ISP2's 208.217.77.11?This way I can get my DNS changed and my inbound traffic to servers in my DMZ on the asa 5510 running 8.0.3 code can continue to receive Inbound traffic.
View 1 Replies
View Related
Jan 30, 2013
I'm trying to configure a simple ACL to block smtp traffic from leaving my LAN -- basically prevent internal users from setting up internet email accounts in their email clients and sending through that smtp server. i want my Exchange server only to send smtp traffic. here's what i have:
-access-list 102 extended permit tcp host 10.10.1.29 eq smtp any eq smtp <===10.10.1.29 is Exchange
-access-list 102 extended deny tcp any eq smtp any eq smtp
-access-list 102 extended permit ip any any
-access-group 102 in interface inside
after i apply this ACL to the ASA, i am still able to send from my internet email address setup in Outlook using my "foreign" smtp server.
View 1 Replies
View Related
Oct 14, 2012
I have a LAN with several linux boxes (Fedora 17, both 32 and 64 bits), as well a a WInXP box. All of these are connected to the same switch, which is connected to the inside port of my PIX 515.
For a few sites (mozilla.org happens to be one of them), for http access, the tcp connection is established, but the "GET" request - or anything else for that matter - will not go through the PIX (from inside to wan). I have verified this by first, using wireshark to watch the packets being sent out from the client box, then by using the trace function in the PIX to see that the packets ARE arriving at the inside interface, but ARE NOT sent out of the wan interface.
This is for the linux boxes ONLY. When I do the same thing with my WinXP box, all works: in the PIX trace, I see the packets arrive at the inside interface, and leave the wan interace. And access to these sites are okay.
(What's a bit weird, although somewhat expected, when I connect my android phone to my LAN via WiFi, it too is unable to reach those sites - but then again, android is linux, right?)
In addition to the tracing, I have narrowed this problem down by connecting a linux box directly to my DSL router, then replacing the PIX with a simple router/gateway. Both of those solutions work.
Some background:
I have been using this PIX for about 10 years now, with the same configuration (except IP addresses). Only in the last several months has this problem started to show up.
I got this pix from a dead company at a really great price (free), so I'd like to keep it, and not have to spend money on something else. I don't have any support license, and have not been able to get any software upgrades. Here is its version info:
taz(config)# sho ver
Cisco PIX Firewall Version 6.2(2)
Cisco PIX Device Manager Version 2.0(2)
Compiled on Fri 07-Jun-02 17:49 by (code)
Serial Number: 405200362 (0x1826ddea)
Running Activation Key: 0x38ac31f3 0x0630df47 0x9a77b805 0x8bc39a60
PS: Since this PIX is at its end of life, I was wondering if any of the software upgrades would be now available without a license?
View 2 Replies
View Related
Apr 4, 2013
We've got a proyect that requires a few thin clients to connect to a remote PCoIP server.
Looking to the documentation, the only port required to be open through Firewalls is TCP/UDP 4172, however, we've seen (making interface captures) that it somehow also uses ESP (IP protocol 50).
We've got a static NAT translation translating those thin clients to a public IP address, we've created ACLs to allow inbound (shouldn't be necessary as our user is connecting to a remote server) and outbound traffic for TCP/UDP 4172 and ESP and I cannot make it work.
I've also enabled IPSec pass-through Inspection to no avail.
how should we configure our ASA to enable this kind of traffic?
View 4 Replies
View Related
