Cisco Firewall :: Route To Internet Through Old PIX515 Firewall

Jun 10, 2012

We have a wifi network for guests, that we route to internet through an old PIX515 Firewall. We recently tuned the timers to lower values in order to "save" on resources and publix address usage.
The timers we use are:
-timeout xlate 0:30:00
-timeout conn 0:30:00 half-closed 0:05:00 udp 0:02:00 icmp 0:00:02
Through verifying the new timers, we noticed at some xlate connections (TCP PAT) that are idle for ever!!In the connection table, I cannot find an idle connection for longer than 1h....

View 1 Replies


Cisco Firewall :: VPN Concentrator On PIX515 DMZ

Feb 7, 2011

I'm  planning connect VPN concentrator in our company to PIX515 DMZ interface.At the moment , VPN concentrator(used for remote access VPN for laptop users) is connected directly to core switch so as PIx515. Having VPN Concentrator connected directly to LAN is security risk .SO i want to connect VPN concentrator to DMZ of the Firewall(pix515).
We don't have any test environment and we are not allowed to have downtime of more than 10 minutes in production network ,I want to make sure my design and commands would work without problem .I've attached  doigram of our curernt setup and new setup I'm planning to work on as well as commands . Does this design will work .Nat , routing everything .

View 15 Replies View Related

Cisco Firewall :: Can't Ping PC From PIX515

Jun 14, 2012

I am unable to ping my computer (attached via crossover). I can ping from the PC, but not from the PIX515. I'm using ethernet 1, and I have its IP set at, but for what ever reason I am unable to contact the computer. I tried messing with the access list a little bit but nothing so far.

PIX515(config)# show run
: Saved
PIX Version 6.3(5)
interface ethernet0 auto shutdown
interface ethernet1 auto
nameif ethernet0 outside security0


View 7 Replies View Related

Cisco Firewall :: Do PIX515 Support For Version 8.3

Jun 12, 2012

I have PIX515 with version 7.0 installed, so can i install version 8.3 on it?and what will be the memory requirements?

View 2 Replies View Related

Cisco Firewall :: PIX515 To ASA5510 8.4(5) Migration?

Dec 18, 2012

We're migrating as mentioned in the subject and this new format is quite a departure from previous iOS versions so I thought I'd post the configs of the PIX and the ASA and ask if someone is willing to compare them and verify that it is correct and should be basically plug and play. The are outside IP addresses and the yyy.yyy.yyy are inside addresses. .
Existing PIX config
PIX Version 6.3(4)
interface ethernet0 100full


View 2 Replies View Related

Cisco Firewall :: PIX515 6.3.3 - Configure Dual ISP On Two Interfaces?

Jul 4, 2011

I have a pix515 v6.3.3. Is it possible to configure dual ISP on two interfaces and have redundancy between them?

View 1 Replies View Related

Cisco Firewall :: PIX515 URL Filtering Doesn't Work

Nov 14, 2011

I have one outside interface with global IP address and two inside.Both inside interfaces restrict and non_restrict have private IP addresses.I tried to filter some URLs on PIX515 IOS 7.2, only on restrict interface but my filter does not work.I can access prohibited URL from restrict interface. What's wrong in my URL filtering?
Here is my config:
PIX Version 7.2(2)
hostname pixfirewall
enable password 8Ry2YjIyt7RRXU24 encrypted


View 1 Replies View Related

Firewall Is Deep Inside Private Network PIX515

Jan 7, 2011

I am having a spot of bother with a Cisco PIX515, I have posted the current running config below, now I am no cisco expert by any means although I can do basic stuff with them, now I am having trouble with traffic sent from the outside to address: it just doesn't appear to be going anywhere.

Now this firewall is deep inside a private network, with an upstream firewall that we don't manage. I have spoken to the people that look after that firewall and they say they they have traffic routing to and and thats it (although there is a website that runs from the server which (if my understanding is correct) gets traffic via [code]

View 2 Replies View Related

Cisco Firewall :: PIX515 - Timeout ICMP / Access Lists?

Mar 29, 2011

I am using a Pix 515 with IOS 8.0(3).I have in my access list on the outside interface.......access-list outside_access_in extended permit icmp any echo access-list outside_access_in extended permit icmp any order to allow ping requests and ping replies into my inside network. This certainly works since I can ping the inside from outside and vice versa, but in the ASDM display of access rules, the hit count for these two lines is always zero. If I run 'show access-list', the hit count for these lines is non-zero.
Why doesn't the hit count show up in the ASDM gui display?Also, I have read that the PIX does not treat ICMP in the same way as TCP or UDP and there is no stateful behaviour towards ICMP.  However, if I set up a continuous ping from outside to inside and then disable the above access list rule allowing echo requests towards the inside, the ping continues whereas I would expect it to stop.
In the config there is 'timeout icmp 00:00:02' if there is no stateful connection for ICMP, why is there a timeout value for it?

View 4 Replies View Related

Cisco Firewall :: PIX515 / 2821 / 2921 / Getting GRE IPsec Tunnel Setup?

Apr 18, 2013

We are setting up an old office building as an offsite data center. The network cosists on a PIX 501 firewall and a 2811 router.  I am attempting to setup a GRE tunnel over IPsec back to the main office.  The main office consists of a PIX515, a 2821 router, and a 2921 router.  
There is also an ASA5510 in our main office that is used as our primary connection for all of our external services and as a GRE endpoint for our other offices.  The PIX515 is used to connect our main office clients to the internet and we would like traffic between it and our offsite data center to go across it as well.   The default route is to use the ASA.   We used policy based routing on the 2821 and 2921 routers to direct the appropriate traffic to the PIX515.  Right now I am not able to get the tunnel setup.  It appears that the offsite datacenter is sending packets but is not receiving any when I issue the “show crypto ipsec sa” commands on both firewalls.  I will show the output of that command below. 
Main Office The external address The loopback address The tunnel address
 Offsite Datacenter The external address The loopback address The tunnel address
The main office PIX515 Config :

PIX Version 7.2(2)
interface Ethernet0
mac-address 5475.d0ba.5012
nameif outside
security-level 0
ip address


View 2 Replies View Related

Cisco VPN :: ASA5505 Firewall - Route Internet Via External?

Feb 6, 2013

I would hereby like to inform if it is possible to configure the Cisco ASA5505 firewall to route internet via an external VPN, while a laptop and smartphone connect to the firewall via Cisco AnyConnect VPN.
The configuration would result into: Laptop on public internet -> Cisco ASA5505 VPN -> External VPN (Unix server) -> internet.

View 4 Replies View Related

Cisco Firewall :: Testing 5515x At Home - No Internet Route

Apr 15, 2013

im new to cisco asa and the model is 5515x with license plus.  below is my config at home,
ciscoasa# sh run
: Saved


View 1 Replies View Related

Cisco Firewall :: 5510 Trace-route / Antispoofing On Not Default Route

Jun 24, 2011

I've enabled antispoof on all interfaces on asa 5510.If you start a traceroute to a network on the default route, everything works, since replies comes to an interface with route defined.If you start a tracer route to a network that is NOT on the default route (let's assume coporate MPLS), you only get response from first carrier router, the other are discarded because of anti spoof violation.
I have ICMP inspection and icmp-error inspection enabled.

View 1 Replies View Related

Cisco Routers :: Configure SR520 To Route Internet VLAN To Firewall

Jan 20, 2012

My operations manager says "Could you go on-site and configure a new clients new internet connection?" I make the arrangements and go on-site. As I'm working with the providers tech he says "Do you have a sub-interface confgured for a dot1q VLAN id of 1057?", I say "What?". Anyway my firewall is not capable of dot1q VLAN, so he says "Do you have a Cisco router that can provide the trunking?", I say "Yes, I tink so but not with me". The question is can I use an SR520 between my firewall and the provider demarc to route the VLAN he is talking about? My initial discovery says yes but I am not quite sure of the details on how to achieve this on the SR520.

View 2 Replies View Related

Cisco Firewall :: Site To Site VPN Between PIX515 And ASA 5505 With Dual ISP?

Apr 13, 2011

We have got site to site VPN configured between local site with PIX515 6.3(5) and remote site with ASA 5505 7.2(4) . Because of very unreliable internet connection in remote site , we have added new ISP link  which we want to use as redundant link .i understand ASA 5505 can be configured with two ISP link with SLA monitor method for redundancy as per this document ,[URL]
my question is how do i set up this pix 515 to have redundant VPN tunnel with remote site (when primiary ISP link fails in remote site and  secondary ISP links takes over ) .  I was thinking of using   PIX 515 with 2 peers in same crypto map used for that sepcific site to site vpn tunnel,not sure that is the right way or not though.But how would i configure ASA 5505 to use backup interface(where secondar isp router conects ) to particitae in Site to site Tunnel .

View 4 Replies View Related

Cisco Firewall :: Removing Route-map From Pix 525

Nov 1, 2012

I have pix firewall 525, configured with ospf process. We are also performing route filetering in ospf process using route-map. Now we want to remove this route-map from ospf process. Any step-by-step process for removing route map as per below list. How to remove route-map without having any impact as per above configuration.

View 1 Replies View Related

Cisco Firewall :: Route Tagging On ASA 8.4?

Mar 16, 2012

how to tag static routes on ASA. I have static routes that I want to redistribute into EIGRP on ASA. I can't find any tag option when defining a static route or under set command in route map... am I overlooking something?

View 1 Replies View Related

Cisco Firewall :: Trying To Get ASA5505 To Route

Nov 14, 2012

customer's WAN solution, instead of buying routers, purchasing department bought ASA's (don't even get me started!). So I have 5 ASA 5505's for the branch offices and one 5510 for the Head Office. I am trying to get them to behave like routers and pass the traffic across. I set up a lab with a 5505 and the 5510 using an ethernet cable for both Outside interfaces since the WAN links are going to be MetroEthernet Layer 2 anyway.
I tried static routes, dynamic routing, I followed examples from other persons who did it and it doesn't work. I attached the configs here to show I have the default routes, specific static routes pointing the traffic out, any any rules configured as well. I cannot ping from the internal lan of the 5505 to the internal lan of the 5510.

View 1 Replies View Related

Cisco Firewall :: ASA5510 / Default Route With Different AD Value?

Nov 14, 2011

Will ASA5510 support default route failover mechanism by giving two different AD value in the route outside command?

View 1 Replies View Related

Cisco Firewall :: Route To Same Interface On ASA 5510?

Sep 14, 2011

I would like to route traffic that are coming in and going out to the same interface on ASA. I am using inside interface with security-level 100.  In this URL, [URL], ASA is able to do that.

View 5 Replies View Related

Cisco Firewall :: NAT Route For Remote VPN On ASA 5510

Nov 15, 2011

I have configured a remote access VPN on my Firewall ASA5510. Everything worked fine and I can successfully connect through the VPN. The problem is I cannot ping or connect to any of my internal network resources. I tried to add a new NAT route from outside to my internal servers using the defined pool but due to a new ASA version there are many changed I see in the NAT routes

View 37 Replies View Related

Cisco Firewall :: ASA 8.4.2 - Clear Route Not Working

Jul 8, 2011

After command clear route, all timers just continue, there is not actually clearing the routing table... This is happening on two different boxes: pair of ASA 5520 and one 5505 ASA... I presume it is happening on all others too, but I don't have this release installed anywhere else...
C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route(code)

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Route Monitoring Options?

Oct 22, 2012

We have one pair Cisco ASA 5505 located in different location and there are two point to point links between those two locations, one for primary link (static route w/ low metric) and the other for backup (static route w/ high metric). The tracked options is enabled for monitoring the state of the primary route. the detail parameters regarding options as below,
Frequency: 30 seconds               Data Size: 28 bytes
Threshold: 3000 milliseconds     Tos: 0
Time out: 3000 milliseconds          Number of Packets: 8

I'm not sure if the setting is so sensitive that the secondary static route begins to work right away, even when some small link flappings occur. What is the best practice to set those parameters up in the production environment. How can we specify the reasonanble monitoring options to fit our needs.

View 5 Replies View Related

Cisco Firewall :: Multiple Route Commands On ASA 5505?

Jan 7, 2013

I want to know with an ASA 5505 w/ Security Plus License I get up to 20 VLANS/Named Interfaces.I have a customer that is getting a new subnet of external IP addresses from their service provider and a different default gateway to accomodate re-hosting their datacenter at their main office instead of at a Colo. My question, when building out their new DMZ, can I have multiple route commands?
Current Default Gateway 1.1.1.X
Internal hosts use and are natted to 1.1.1.X
New Default Gateway for DMZ Servers 2.2.2.x
Internal hosts still use 1.1.1.X, but server hosts in should use 2.2.2.X -- there are also a bunch of pre-existing static NAT rules for these servers such as translates to
I think I would accomplish this by using the following:
route inside 1.1.1.X
route DMZ 2.2.2.x
Would this be correct?

View 2 Replies View Related

Cisco Firewall :: Trace Route Between Two ASA 5505 And 5510

Oct 15, 2012

We have a ASA 5505 and a 5510, that we are using site to site.I need to traceroute from the 5505-5510.. From the outside interfaces.. Don't want to do this through the site-to-site.I have temporarily added a few acl on the outside interfaces.when i traceroute it only goes one hop.. Maybe thats the way it suppose to be? I need to know all the hops between the outside interfaces on the 5505 to the outside interface on the 5510.

View 12 Replies View Related

Cisco Firewall :: ASA5520 - Static Route Shows A- Or A-

Jul 14, 2012

We use ASDM 6.2 to manage our Cisco ASA 5520 running ASA Software Version 8.2 (1). I just noticed that some static routes have "A-" when you view the static routes with ASDM e.g. A- or A- (pls see attached print screen). I haven't seen this before and dont know what it means.

View 4 Replies View Related

Cisco Firewall :: 5505 - Route Traffic Between Two VLANs Through ASA

May 30, 2011

I have ASA 5505 Firewall with security plus license, I configured two V LAN 1 and V LAN 5 as my inside V LAN for different sub net, i need to route the traffic between this two V LAN's through ASA. I configured
int vlan 1
nameif inside
Security level 100
Ip address
[Code] .........

The problem is i am not able to ping other sub net, for ex my PC is in V LAN 1 not able to ping ... For troubleshoot i type debug icmp trace while pinging other subnet
ICMP echo request from to ID=512 seq=4608 len=32ICMP echo request from to ID=512 seq=4864 len=32ICMP echo request from to ID=512 seq=5120 len=32ICMP echo request from to ID=512 seq=5376 len=32

I turn off the firewall on my local machine.

View 10 Replies View Related

Cisco Firewall :: ASA 5515-X Route With Branch Locations?

Apr 17, 2013

We installed a new ASA 5515 about a month ago for the corporate office we also have 40 branch locations that feedback VOIP, camera, and Citrix to the corp location.  Each of the branch locations have a separate DSL connection with a local provider and all of them are dynamic IP addresses. 
The problem I have is that I cannot figure out a access rule to make the voip traffic work 100% of the time what ends up happening is five or six random locations change IP address's every day and I could not figure out how to create a access rule for that so I create a static route with that dynamic IP and then it will change a week or so later.  That's a horrible security risk and a lot of manual work.

View 4 Replies View Related

Cisco Firewall :: How Many Route Entries Can ASA5520 (8.2.1-k8) Support

Sep 24, 2011

how many route entries can ASA5520 (8.2.1-k8) support?

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Static Route To Inside Interface

Mar 29, 2011

I have inherited an ASA 5520.  In doing some auditing of the setup, I have noticed a Static Route that has the inside interface of the ASA as the Gateway IP.  I am trying to understand the purpose of this route or why a route would be setup this way.

Example Static Route:
Inside 10.xx.31.0 10.xx.xx.10 (10.xx.xx.10 is the inside interface of ASA)

View 2 Replies View Related

Cisco Firewall :: Slow Intervlan Routing On Asa 5510 Route

Jul 21, 2011

In the restructuration of my company network we install due ASA 5510 in failover for the management of internal network and DMZ. We configure the ASA in routed mode, we create the sub interface for server, client and dmz subnet and we connect the firewall ti the network. Everything works very good except the intervlan routin. If i try to send or receive a file in every protocol, ftp, http, smb o if i try to conne with rdp or vns to an host in a different vlan the connection goes very very slow. I particular a ftp connection between two host goes ti 15kb/s. I check all cable and port for some error on duplex ro speed, end all the uplink are 1gb and the single client connection 100Mb. I know that the main purpose of the ASA is not doing routing stuff but this behavior is very strange.

View 1 Replies View Related

Cisco Firewall :: 8.2 (ASA5510) / 8.4(2) (ASA5505) - Why Doesn't Route Map / Set IP Next-hop Work

Jan 2, 2012

I need to be able to redirect some HTTP traffic to an Ironport WSA (for now) on a DMZ interface, the initial config I'm trying to test is along the lines of the following (don't have access to the ASA at the moment to cut-and-paste):
access-list 101 deny any any neq www
access-list 101 deny tcp host any
access-list 101 permit tcp any any
route-map proxy-redirect permit 101
     match ip address 101
     set ip next-hop
Unfortunately the ASA does not take the "set ip next-hop" command, I get an invalid input error message and if I at the route map config prompt type "?" only the "metric" and "metric-type" commands are listed as available.
This happens both on 8.2 (ASA5510) and 8.4(2) (ASA5505). Since others are able to make this work, I assume there's something else on the ASA that I have to set to enable this command?

View 2 Replies View Related

Cisco Firewall :: E4200 Trace Route Doesn't Return DNS Name

Jun 10, 2013

I changed from a Linksys E4200 to a 5505 and when I use trace route, it doesn't return a DNS name for each hop.   I can see the hops shown as asterisks.  Do I have to add something to inspect for this to work?                  

View 1 Replies View Related

Copyrights 2005-15, All rights reserved