Cisco Firewall :: Packet Flow In 8.4 Ios?

Oct 17, 2012

I think packet flow is changed in 8.3 IOS and above.We are using private NAT for ouside traffic.why we are using private IP for outside traffic?

View 1 Replies


Cisco Firewall :: ASA5505 IP FLOW TOP Or IP Accounting

Nov 8, 2012

How does one find the top user or IP accounting with this ASA5505 v7.22 device?
-With 1841 ISR:
-sh ip accounting
-sh ip flow top
Very lame if they don't have similar commands or capabilities on the ASA series.                   

View 1 Replies View Related

Firewall Access Traffic Flow

Aug 30, 2012

I've been thinking about this for a while and I can't seem to find a comforting answer: Assume you have three datacenters connected over a WAN. Each datacenter has its own Internet and firewall, and each firewall has a trusted network, untrusted network (Internet), and DMZ: [code]

-DMZhostA has inbound access from the Internet over port X.
-DMZhostB has outbound access to DMZhostC over port Y.
-DMZhostC has outbound access to the trusted network over port Z.

If DMZhostA gets compromised from the Internet, the attacker can indirectly access the trusted network through DMZhostC, assuming the services running on the given ports are vulnerable/poorly secured.How do you track this web of access? This is a simple scenario with just three firewalls and datacenters, but it gets proportionally more complex and harder to track as the network gets larger. Manually tracking the traffic flow seems tedious, slow, and inefficient.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Traffic Flow Between Interfaces

Jun 13, 2012

I am fairly new to configuring ASA's. I have an ASA 5505 with one outside interface and three inside interfaces (inside1, inside2, and management). I need inside1 and inside2 to be able to talk to eachother but cannot work out how to make this happen. They are both configured to the same security level and the 'Enable traffic between interfaces with same security level' box is ticked. I have also tried adding appropriate NAT and Access rules. The packet tracer suggests the rules are correct for allowing traffic flow between interfaces but obviosly this may not be the case.

View 14 Replies View Related

Cisco Firewall :: Flow Export From ASA5505 To Netflow Collector

Mar 21, 2013

I have three ASA5505, two firewalls connected to central VPN hub. the central inside network is,Network A is,Network B is,In one of this site (central), I have server with NetFlow collector.,I will collect the traffic information from all ASA at the my one serverCan I configure source IP address (or source interface - inside) for NetFlow packet, originate from ASA? (for example from site A)If it is not possible I think, I can rewrite my access lists and permit udp traffic from outside interface to server IP like this:access-list VPNACL permit udp host <Outside IP site A> host <Inside IP the Server> eq 9996,But I do not understand, what port I must be use in access list on Central site ASA. ,access-list VPNACL_A permit udp host <Inside IP the Server> host <Outside IP site A>  eq 9996 ? or, in this place, must be source port in the udp netflow packet?

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Ports Available For Traffic Flow In Router

Oct 21, 2011

I am in search of a new routers. I don't have any special task to do. Just the flow of maximum 2mb/sec data and some times video conference. However I need the Voip solution as well. I just got excited on the cisco ASA 5505 product. Can this fulfill my requirements. Can this work as the router 1841. Does this support DMVPN, SSL VPN and dynamic routing. Can I upgrade the IOS for dynamic routing purpose. Do you recommend to purchase this produe act or not instead of router ? What are the limitations of this product. If I purchase this I can use this as an router as well as strong security solution. How many ports are available for traffic flow in ASA 5505. Are all routed mode or some of them switch port.

View 1 Replies View Related

Cisco Firewall :: 5510 - Http Connection With Video Flow

May 4, 2011

I am using ASA 5510 and I have a specific problem with Http Connection to receive a video Flow ( RSTP protocol ) in the LAN. Some Pc users (,in the log)  with ASA Lan Interface as gateway can ping the Camera but don't receveive the video flow.Some Pc users (,in the log) using another gateway can ping and receive the video flow. I used Whireshark  to capture traffic between camera and Pc using the 2 gateway. I joined Logs with this message.It seems to be a problem of TCP segments on the ASA, I try to changed some TCP options but it's still the same:- Disable Force Maximum Segment Size- Enable Force TCP Connection to Linger in TIME_WAIT State for at Least 15 Second.

View 7 Replies View Related

Cisco Firewall :: ASA 5520 Flow Is Denied By Configured Rule

May 28, 2013

I am attempting to allow traffic from one vlan to another.Vlan 1 is on Interface 0/2.vlan1Vlan 2 is on int 0/3.vlan2Each vlan can communicate inside it's own vlan, and the gateway on each responds to vlan specific clients My problem is that I am unable to communicate between the two vlans.  Using the ASDM packet tracer tool, I find that packets are denied by the default rule (on the second Access List lookup).  It appears as if the packet never reaches the other interface.  The access rules are set up to allow traffic from one vlan to another (inbound), on both interfaces.  Testing from either vlan to connect to the other fails.  Below are the accee-rules for each vlans.  Once I get basic connectivity working.
access-list aVlan1; 3 elements; name hash: 0xadecbc34
access-list aVlan1 line 1 extended permit ip any (hitcnt=0) 0xeb0a6bb8
access-list aVlan1 line 2 extended permit ip any (hitcnt=0) 0x3a7dfade
access-list aVlan1 line 3 extended permit ip any (hitcnt=0) 0x93302455
access-list aVlan2_access_in; 3 elements; name hash: 0x6dc9adc7
access-list aVlan2_access_in line 1 extended permit ip (hitcnt=0) 0x054508b7
access-list aVlan2_access_in line 2 extended permit ip (hitcnt=0) 0xc125c41e
access-list aVlan2_access_in line 3 extended permit ip host (hitcnt=0) 0x4adc114c

View 19 Replies View Related

Cisco Firewall :: ASA5580 - How To Configure Traffic Flow Idle Time-out With CSM

Feb 16, 2012

I am looking for the way to define an idle timeout for specific flows on an ASA5580 by using Cisco security manager. For ex I needed to define a specific idle timeout for connections beetween specific devices (Devices in vlan1, Device2 in vlan2).To test it I did following changes by CLI and it works fine.     access-list L1 extended permit ip <@IP1> <mask1> host <@IP2>    class-map CM1        match access-list L1    policy-map PM1        class CM1        set connection timeout idle 02:00:00
I try do do the same configuration with CSM in order to be able to manage each changes only by using CSM.So I defined  Access control list, Traffic flow and then I define timeout in CSM --> PIX/ASA/FWSM Platform --> Service Policy Rules  --> IPS, QoS and Connections Rules -> connections settings -> Traffic flow idle time-out. The problem is that each time I deploy the configuration with CSM I loose the timeout config line which is the most important for my application..

View 2 Replies View Related

Cisco Firewall :: ASA5525X Crash During Packet Trace

Dec 16, 2012

Our Firewall is just new. ASA5525X
Today, during a packet_trace to debug a routing problem, the active ASA
- thsasaprd02 - crashed suddenly. 
I was able to copy-paste the console - including the command that triggered it - After the reboot I ran the command again, on the same ASA - after doing a manual failover - the command succeeded normally.

View 2 Replies View Related

Cisco Firewall :: ASA5580-40 Deep Packet Inspection?

Jan 18, 2012

I am having issues with PXE boot images for PCs cannot be loaded from remotely.The diagnosis revealed that SunRPC & TFTP were being inspected by ASA causing drop of packets.So I excluded these two inspections for the particular server behind the firewall. It seem to resolve the issue for instance but it crawled back again.
Is there a way that the inspection can be turned off for that particular server at the IP level?

View 1 Replies View Related

Protocols / Routing :: How To Use Firewall In Packet Tracer

Apr 5, 2013

I have a project about ISP in packet tracer,I want to know how to make firewall configuration and steps I don't know how to use firewall in packet tracer at all.

View 1 Replies View Related

Cisco Routers :: RV082 And Packet Loss On PBX With Firewall Enabled?

Aug 28, 2012

Recent incountered an issue with our elastix pbx and packet loss. Noticed this morning that when I turn on the firewall on our RV082, packet loss begins around the level 3 servers I see in my traceroute, and then slow spread out to all hops. When I turn the firewall back off, all hops have no packet loss or less than 1%. The weird part is, previously, I had the firewall enabled, and never had this issue.

View 2 Replies View Related

Cisco Firewall :: 887VA-W Keep Getting Drop Packet Error Message

Jul 13, 2012

I have an 887VA-w connected at home. I am using ip virtual-reassembly an all interfaces (dialer and all internal VLANs), I am also using CBAC (currently setting up ZBF). The issue I am having is that I keep getting drop packet error messages and the reasons can differ. Below are some of the outputs I recieve: [code] I have done a show ip virtual-reassembly on all the interfaces and the counter is shown as 0.

View 6 Replies View Related

Cisco Firewall :: PIX 525 - Windows Server 2008 And PIX Packet Dropping?

Sep 6, 2011

I came across a situation where a client had an old PIX 525 running PIX 6.2.  There was a Windows 2008 R2 server running Exchange 2010 that was having trouble delivering email to a handful of email servers.  We then found out that we could telnet to these servers on port 25 but got no return traffic.  We then went back the old email server that was running Windows 2003 Server and could telnet to port 25 on these email servers and got a response, saw the banner and could issue commands.  The first thought was reverse DNS which we thoroughly checked and it was not.  I turned off the smtp fixup protocol and that didn't fix it either.  From workstations on the network running XP or Windows 7 or Linux you could telnet to these servers and you would get a response but just not with 2008 server.  I spent hours on the phone with Cisco support and it was determined that the packets were returning and we could capture the packets on the outside interface but they were then dropped by the firewall.  Using the 6.2 version of PIX we could not determine why the packets were being dropped.  I suggested upgrading to the next major version to be able to troubleshoot the issue further.  We then upgraded the PIX to version 7.0(8).  After the upgrade we were able to telnet to the problem mail servers from Windows 2008 Server and there were no issues. Is there a know issue with Windows 2008 Server and PIX 6.2? 

View 1 Replies View Related

Cisco Firewall :: Intermittent Packet Loss Between Router And ASA 5510

May 11, 2013

We have Cisco router 2800 router which is directly connected to ASA 5510, till now there was no issue every thing was working fine, but from past 2 day's we are facing a problem, when we try to ping to any outside public IP their is a intermittent packet loss & same issue to the remote office through IPSec tunnel, We are able to reach our ISP router from outside whithout any issue & there is no packet Loss, if we try to reach the ASA their is a intermittent packet loss.

View 5 Replies View Related

Cisco Firewall :: ASA5505 - Packet Tracer Output - Access Denied

Mar 16, 2013

I am trying to troubleshoot a problem where in one of my remote site is not able to access some networks at HQ over Site to SIte VPN ( asa 5505 at Remote and 5520 at HQ). I ran packet tracer and HQ ASA looks clean as everything came out as ALLOW. Remote site ASA packet tracer give me DROP out at Phase 9 (VPN). I am not very sure what to look in ASA for resolution now. Is it an access list that is blocking the traffice or VPN setup.

View 5 Replies View Related

Cisco VPN :: ASA 5505 - Remote Firewall Does Not Receive Single Packet From Source IP

Jun 3, 2012

I have setup an asa 5505 with multiple sub nets (plus license) and a vpn tunnel (ipsec) between this and an other asa on a second branch office (multiple vlans) . Now I need to route only two vlans from the first site to reach some of the second branch networks
let's call them: 1 branch
2 branch 
the tunnelis ok From A to CDE . but from B to CDE won't come up. pinging is unsuccessful as well as all other traffic. the connection profile is setup to have both A and B as local networks and A and B by the moment share the same access rules configuration.
logs show firewall 1 let pass and build connections, without denies, but remote firewall does not receive a single packet from the source ip from network B.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Not Giving Out DHCP To Clients / Only Discovery Packet?

May 3, 2012

My ASA 5505 has stopped giving out DHCP address to my machines.Everything was working fine and nothing has changed in the network. I've reloaded the firewall and clear all DHCP on the firewall I've even re-entered the cmd on the ASA.
I'm able to staticlly assigned address to the clients and all is way. When I do a DHCP debug on the ASA I don't see any events relating to the DHCP service apart from checking for lease expiry.
I've also tried to plug a machine straight into the ASA and no result. I finally did a packet capture and I am seeing the client machine sending out a DHCP discover packet and nothing else is responding.
My ASA config is:
dhcpd address inside
dhcpd dns interface inside
dhcpd option 3 ip interface inside
dhcpd enable inside

View 7 Replies View Related

Cisco :: ASA5540 - Run Firewall To Display MTU Packet Size Being Received On Interface?

Jul 5, 2012

I have a ASA5540 firewall set-up with an interface MTU of 1500.  
I suspect that we are receiving packets with a larger MTU but have not found an easy way of confirming this.  Any command that can be run on the firewall to display the MTU packet size being received on an interface?
We are also running Solar Winds so could query an OID if such a variable exists.

View 1 Replies View Related

Cisco Firewall :: 5550 ASA (8.3) - Packet Tracer / Multi-Context Classification

Nov 22, 2011

I've been using packet-tracer for some time on and off with mixed results.
I'm running a multi context firewall with over 10 of the contexts sharing the same outside interface / network. All interfaces obviously have valid, unique IPs and also unique MAC addresses as mac-address auto is enabled in the system context.
This is an ASA 5550 running 8.3(2.10) interim so includes the fix for the well known packet-tracer classication failed bug.
So in theory, with firewall contexts on a shared interface the ASA should use the firewall MAC address to classify incoming traffic to the correct firewall and as far as I am aware, only fall back on using NAT to classify if the interface MACs are the same. In reality on my platform this doesn't seem to be happening and the classifier is using NAT to determine the destination context. I'm seeing this with live traffic (i.e. not generated by packet-tracer) in logs and can prove it by disabling certain NAT rules (there is some overlap with the IP addressing behind each firewall).
My question regarding packet tracer is this - in the above scenario with a shared outside interface, does packet tracer ALWAYS use NAT to determine the destination context? Or does packet tracer look up the MAC address of the ingress interface according to what context you are running packet tracer from? It appears that packet-tracer is using NAT in my case which could be just symptomatic of the potential bug I've described above rather than by design.

View 2 Replies View Related

Cisco Firewall :: ASA5585X - Packet Rate On Inside And Outside Interface Doesn't Match

Oct 24, 2012

I am doing some per-deployment testing with a ASA5585X and noticed that when I feed it a stream of SYN packets on the outside interface the measured traffic rate on the inside interface going out is about 10x the rate of the outside interface going in.
laptop ---  ASA --- PC
I send 6k TCP SYN pkt at interface rate from the laptop targeted at PC. No packets are dropped by Ac Ls or policies and can be sniffed at the PC.
Show interface commands show:
sh int inside:
... ...
  Traffic Statistics for "inside":
1 minute input rate 23 pkt/sec,  1303 bytes/sec
1 minute output rate 4454 pkt/sec, 820757 bytes/sec
sh int outside:
... ...
Traffic Statistics for "outside":
1 minute input rate 885 pkt/sec,  70847 bytes/sec
1 minute output rate 7 pkt/sec,  425 bytes/sec
I would expect that if 885 pkt/sec enter the firewall on the outside interface the same amount or less would exit it on the inside...? Why this is not the case? The packet rate is about 5x and the data rate is about 10x greater.

View 6 Replies View Related

Cisco Firewall :: 5520 - Inside Server To See Actual Outside Host Source IP In Udp Packet

Mar 3, 2013

I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server.   The server can get to outside hosts OK, and the traffic is being NATed  properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send  'announcement' UDP packets to the inside server.  I thought this might be an  outside-NAT-required issue to get the traffic routed, but I need the inside server to see the  actual outside host source IP in the UDP packet, so I basically set the  outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the  destination (inside server) subnet, and its gateway is the outside  interface of the ASA, the same way the inside server is able to get to  hosts outside.  The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
I have the appropriate ACL's set up, and when I do 'show access-list' I  see policy hits for the 'permit' statements where the outside host is  generating the announcement and it's hitting the ACL.  I even duplicated  the ACL into list 101 and 102, and applied 101 for inbound traffic on  the outside int, and applied 102 for outbound traffic on the inside int,  and I'm seeing policy hits on both permit statements outside and  inside, so it looks like the traffic is being passed on to the inside  interface and permitted, but the server isn't seeing the packets.
I can ping the outside interface from the outside, but cannot ping the  inside interface or any inside hosts from the outside, even though I  have 'permit icmp any any' enabled on the ACL on both ints. When I  remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
I set up the same scenario in my lab with an ASA 5505, with the same results.  Below is the running config from the 5505 in the lab.  The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
: Saved
ASA Version 8.3(1)
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address
interface Vlan3
description Inside LAN Interface
nameif inside(code)

View 6 Replies View Related

Cisco Firewall :: ASA 5505 Using Logging & Packet-capture To Locate Virus Infected PC

Aug 2, 2011

ATT notified my company we have a virus infected pc on one our networks which sits behind a Cisco ASA 5505 running 7.2(4). The set up is a basic inside/outside NAT configuration. They gave us the destination ip address and port which the our pc is contacting.  I have been tasked to track down the infected pc.  I created the following access-list and applied to the inside interface:
access-list VIRUS extended permit TCP ANY host x.x.x.x EQ YYYYY log debugging interval 600 access-group VIRUS in interface inside
I enable logging to the console whose output did not list the IP address of the infected pc, only the ip address of the DNS servers we were using. I then used the following capture commands to try locate the internal ip address of the infected pc:
capture in-cap interface inside access-list VIRUS-CAP buffer 1000000 packet 1522 capture in-cap access-list VIRUS-CAP interface inside
Neither step worked and the resulting console output overwhelmed the firewall in a very short period of time. Before attempting this task again, I would like to know if I am going about this the right way or if there is a better methodology?

View 24 Replies View Related

Cisco Routers :: Net Flow On RV042G?

Sep 27, 2012

Is there anyway to monitor netflow on RV042G.  We have a network at a small school that will get bogged down during the day.               

View 1 Replies View Related

Cisco VPN :: Flow Is A Loopback ASA 5505

Feb 24, 2011

I have 2 ASA 5505, with a site-2-site vpn, I need to reach a server on network A on port 7887 from Network B.The 2 boxes are both on a public net and has a private net inside.When initiating a telnet session from a Host on network B, to a ip /24 (which is defined as my remote network in the connection profile)I can see the trafic arriving on the ASA on network A, but the trafic gets rejected with the following.

Built local-host outside:VPN-TEST_172.210.210.5602:     VPN-TEST_172.210.210.56    7887    Teardown TCP connection 398765 for outside:VPN-TEST_x.x.x.x/16698 to outside:VPN-TEST_172.210.210.56/7887 duration 0:00:00 bytes 0 Flow is a loopback03:     Teardown local-host outside:VPN-TEST_172.210.210.56 duration 0:00:00.I'm a newbee with the ASA 5505, and connot figure out why this is a loopback ?

View 2 Replies View Related

Cisco WAN :: Why IP Flow Egress Is Not Functioning On 7600

Jun 2, 2012

why ip flow egress is not functioning on 7600?When I do "sho ip cach flow",  I can see only inbound flows.

View 5 Replies View Related

Cisco :: 194 ToS Filed Change In Net Flow V9 Packets

Aug 28, 2011

Recently we have configured few of our routers to export FNF (Flexible NetFlow), some of our router are exporting NetFlow V9 packets with fields as mentioned in the NetFlow V9 RFC. We noticed that one router is exporting NetFlow V9 with the field value different from RFC. I have attached the screen shot which shows that Field 194 is assigned for TOS. Whereas according RFC it is 5. Is there any specifc reason begind this or this is an IOS related issue.

View 1 Replies View Related

Cisco VPN :: 5510 IPSEC No Traffic Flow

Jan 18, 2012

I am trying to pass Traffic thru the IPSEC tunnel but it does not work  ([Cisco Router 892] <---> [Cisco ASA 5510] <---> [Cisco Router 892]) The Cisco ASA 5510 doesn't pass traffic  UDP=500 & UDP=4500 ports...

View 1 Replies View Related

Cisco :: 2800 - Show IP Flow Top-talkers

Aug 8, 2011

I wish see the top talkers 10 at the my router 2800 IOS 12.4 (13a)
but when I run the command "show ip flow top-talkers" appear following:
% Top talkers not configured
I've set
Router(config)#ip flow-top-talkers
Router(config-flow-top-talkers)#top 10
I'm using the netflow version 9
maybe my router not support this issue ?? or it's missing some configuration.

View 2 Replies View Related

Flow Browser Traffic Through A Specific NIC?

Oct 14, 2011

My question is pretty straight forward but here is some background information. I would like my browsing traffic to funnel through my phone's 3G or WiFi connection. Is there any information out there on how to direct the browser to use the second internet connection? I was thinking about setting up a VPN using the second nic and somehow instruct the browser to use the specific proxy. I have no idea if that is even possible though.

The need for this is pretty simple. I do not want my browsing habits being logged by my company's network. Also while maintaining the current corporate connection so Outlook and RDP programs continue to function correctly.

View 1 Replies View Related

Cisco Switching/Routing :: ME3600X Ip Accounting / Net-flow

Jul 26, 2012

Struggling to find any documentation that states both "ip accounting & netflow" are supported on the new ME3600 switches. I have tried both a 12 and 15 release of software. Netflow produces no data what so ever, ip accounting only produces data (of the global network) when configured on my uplink (running MP-BGP network) unable to get specific data for user networks in seperate VRFs. Is this a case of the commands being there but not being supported?

View 0 Replies View Related

Cisco :: 1841 / Ip Flow-cache Timeout Active 2?

Aug 17, 2011

On my 1841 when i enter the "ip flow-cache timeout active 2" command it accepts this command with no errors.  But when i look at my running-config this does not list.I did the same thing on my 2811's and 3745 and it shows up in the running-config.  Should I assume if it doesnt' show up in my config file than it is not applied?  How can I verify that it is or isn't?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved