Cisco Firewall :: Routing Between PIX 506E And ASA5510?

Mar 17, 2013

There is a PIX 506E and ASA5510, with different connection to service provider. Problem is Apple remote users can't access resources protected by the PIX506E.  Apple users can access resources protected by ASA5510. Physically the PIX and ASA are in close proximity with no physical connections.  Is it possible for Apple users to authenticate with the ASA and the traffic get routed to and get authenticated by the PIX, inorder to access resources?Due to bandwidth restrictions, a DMZ on the ASA will not be created at this time inorder to consolodate firewalls.  Currently 2 x T1 is the connection between ASA and ISP; 1 T1 connects PIX to ISP.

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: Configure SSH Only Access On PIX 506e

Mar 4, 2011

How to configure SSH access on my PIX 506e.  I would like to use local authentication with no AAA server.  Also I would like to have telnet disabled completely.

View 3 Replies View Related

Cisco Firewall :: Need Pix 506E Version 4.3 Command

Nov 19, 2012

I have a PIX506E that was resently reset and it has version PIX Version 7.1(2) .  It either uses some different commands or I am not using them correctly. [code]

View 2 Replies View Related

Cisco Firewall :: Can't Setup PIX 506e Hardware

May 4, 2013

So i got a Cisco PIX 506e from a friend and want to set it up for a VPN. Though i cant download the PDM (PIX Device Manager) since i dont have a Contract or something like that. So i cant set it up.

View 1 Replies View Related

Cisco Firewall :: Replacing PIX 506e With ASA 5505?

Apr 29, 2012

I need to replace an ageing PIX 506e with an ASA 5505.The current setup looks like this:  The PIX is used for site-to-site VPN connection via the WAN 2 link.  The WAN 1 link is used for general Internet connectivity.I don't have access to the Draytek Router as it is supported by a 3rd party, but I believe it uses static routing to direct the relevant traffic to/from the PIX.
 
When I replace the PIX with the ASA, the inside i/f connection experiences dropouts - but no errors show in the logs.The only significant difference I can see in the config is that the ASA utilises VLans for the inside & outside interface configs - I used the PIX-to-ASA Migration tool to make the initial configuration on the ASA.In tests, if I only connect the inside i/f of the ASA, pings from the LAN are stable.  Once I connect the outside i/f, pings timeout approx 80% of the time.

View 2 Replies View Related

Cisco WAN :: PIX 506e - Firewall Traffic Monitoring?

Jan 10, 2011

I am new to the PIX firewall. And recently implemented the PIX 506e in my network. I wants to know how we can monitor the system that is generating the more traffic on Network through Firewall.

View 4 Replies View Related

Cisco Firewall :: PIX 506E Username Addition

Mar 5, 2011

I am trying to add a username to the local database for remote VPN connection but always i get this error when I add,Encrypted password is of incorrect lengthUsername addition failed.

View 1 Replies View Related

Cisco Firewall :: PIX 506e - Cannot Browse Startup

Mar 11, 2013

I just got a PIX 506e from a friend that was not longer using it. I'm trying to get started with the configuration page. I've reset it to factory defaults, rebooted and connected up ethernet. I can ping the device at 192.168.1.1 and access it via console. I browse the site https://192.168.1.1/startup.html, get the invalid ssl certification, get a login prompt (user/pass) and as the document says I leave it blank. As soon as I hit ok it goes to the 404 error Page Not found.

View 4 Replies View Related

Cisco Firewall :: How To Restore Configuration To PIX 506E

Mar 22, 2011

What is the easiest way to restore my config?  I backed it up yesterday with my tftp server.  Today I made some changes and messed some things up and need to restore the config from yesterday.

View 1 Replies View Related

Cisco Firewall :: Cannot Upgrade PIX 506E From Version 6 To 8 Software

Feb 26, 2013

I'm getting an error message on my 506E that is saying not enough flash space to install the new version 8 software. I did a clear flashfs command and then tried again but get the same error. Do the PIX 506E can be upgraded from version 6 to version 8? I am trying to install pix804-28.bin.

View 3 Replies View Related

Cisco Firewall :: Pix 506E - Clients Do Not Access Some Websites?

Feb 27, 2012

I have a problem with PIX 506E that meets the version 6.1, and in an simple computer network equipment seems to behave in strange ways because some web sites do not open or very open slow thereby its operation impracticable. On the other hand other web sites open normally.
 
Querying the web site of the Cisco, I found several documents discussing the same problem but in a later version ( 7.0 ), not in this version 6.1.
 
I've tried removing the pix from the network , not the error occurred, again insert pix however tested only with a machine, without the rest of the network and the problem persists

View 13 Replies View Related

Cisco Firewall :: PIX 506E With 2620 Which Type Of Cable Is Required

Sep 20, 2012

I like to set up a pix and router for this network for a small buss, but I need to know what type of cable do I need to set this connection to work straight through or a cross over cable?   also I need a subgestion if a nat would work better on the pix or leave it on the router?

View 4 Replies View Related

Cisco Firewall :: Pix 506e Passing Traffic Even With A Deny Ip Any Any Rule

Sep 20, 2012

So I was doing some testing with my BB Playbook where I wanted to see what outside connections it tried to make during startup and whatnot. I have a pix 506e running 6.3(5). I created an simple 'deny ip any any' access list on the inside interface so that the Playbook doesn't actually make any connections, but I set up a 'capture' on the inside interface accepting 'ip any any' to see what kind of traffic I could see heading outbound from the Playbook. Well, it started off showing attempts to query DNS (and failed, naturally), but then after a couple of minutes, it tried to connect to a couple of IPs over port 443 and actually got a response!!! For the life of me, I can't figure out how this can happen. NO traffic should be allowed outbound due to my explicit 'deny' rule, but for some reason some traffic on port 443 made it past the firewall and got a response back. There are no other rules in the access list except the 'deny' rule. My PIX configuration is quite simple and I cannot see anything that would allow the Playbook traffic to circumvent the access list.

I've come to think that either RIM has found away around Cisco access-lists, or there is a bug in the Pix OS. I know it's an old appliance/OS, but still. I wouldn't think it could be THAT easy to bypass the firewall.

View 4 Replies View Related

Cisco Switching/Routing :: Password Reset On PIX 506e

Apr 7, 2010

I trying to do password reset on a 506e that I got with the current password unknown.  I've gone to the Cisco URL for the reset: [code]

I am using the correct bin file as I checked with my pix version.  Also I CANNOT ping the firewall from a PCor system on the network, but CAN ping everthing from the PIX.I've tried using interface 1 but no go.  Also I've checked the TFTP software (Solarwinds) is running fine and I've unblocked it in XP's firewall.

View 2 Replies View Related

Cisco Firewall :: Hair Pin Routing On ASA5510

Jun 3, 2009

I wanted an ASA to do hairpin routing.  Here is the situation.  A client was running there internet through a partner's WAN.  They do not have a layer3 switch/router, and the defautl gateway on there network was actually the the partner's equip.  They recently purchased there own internet circuit and an ASA5510.  I initially tried putting in the nat exception and permit same security interface and static route on the ASA so that traffic bound for the extranet segment would be routed back out the inside interface toward the gateway to the partner's WAN.  Pings worked right away, however no applications would work: no web traffic, application traffic, anything.  My only guess is that the ASA does not like this in relation to stateful traffic flow, and the fact that since the partner's gateway is on the same subnet, you end up with asymentric routing. 

View 10 Replies View Related

Cisco Firewall :: ASA5510 Routing Failed To Locate Next Hop

Jun 14, 2012

I have two interfaces connected to two different subnet -  interface 0/1 = 10.100.1.0/24 , interface0/2 = 10.100.113.0/24 as they are direct connected to the ASA i assume i dont need to add an static route but when i try to ping from one interface to the other (ping inside 10.100.113.1) i get "Routing failed to locate next hop". [code]

View 1 Replies View Related

Cisco Firewall :: ASA5510 Not Routing Traffic To Internet

Sep 2, 2012

I have just set up a Cisco ASA 5510. It basically only contains the settings provided in the startup wizard. It however does not let through traffic from the internal interface to wan 2 (wan 1 is not connected yet but traffic should also be able to go there).

View 2 Replies View Related

Cisco Firewall :: ASA5510 Dynamic Routing And Static NAT

Dec 10, 2011

I have a ASA5510 with 2 internal interfaces (inside1 and inside2 same security level) configured with OSPF for dynamic routing with 2 routers to corporate subnets. I have a server in a private subnet that needs to be accessed from Internet. So static pat is used in ASA with the command
 
static (inside1, outside) tcp interface www 192.168.1.1 www netmask 255.255.255.255
 
As OSPF is in use, the subnet 192.168.1.0/24 may be reachable from interface inside2. When I tried to configure the static command for inside2,
 
static (inside2, outside) tcp interface www 192.168.1.1 www netmask 255.255.255.255.the error message came out "WARNING: mapped-address conflict with existing static...". Is this just a warning, or this is not possible in ASA.

View 2 Replies View Related

Cisco Firewall :: ASA5510 - Same Security Level VLan Routing?

Jun 25, 2011

I'm facing a problem with two vlans. Each vlan has internet access by NAT.
 
In each vlan there is at least one server, who should be accessible from the other vlan and vice versa.
 
The function "same-security-traffic permit inter-interface" doesn't work, because NAT control is in place - so an expert.
 
Some experts told me it's not possible to route back out the same interface, and also not route back out the seperate subinterfaces as well.

View 12 Replies View Related

Cisco Firewall :: ASA5510 - Routing From EzVPN Client To Non-LAN Zone

Feb 24, 2013

I got a Problem with Routing on a ASA5510.
 
I have ezVPN Clients connected to the ASA5510. Those Clients are assigned an IP from 192.168.236.0/24 Pool.
 
I have a Router of a contractor connected to a dedicated ASA Interface called IBIZA with IP Net 10.100.10.0/24 and the Router itself with the IP 10.100.10.1. Behind that Router is another private Network which I need to reach from the ezVPN Clients.
 
The Connection from the ezVPN Clients to the "LAN" Interface/Network on the ASA works fine, but I cannot reach either the Contractor Router (10.100.10.1) nor the Network behind that.
 
From the LAN Network (on the LAN Interface) I can reach both the Contractor Router and the Network behind.
 
When I use the Packet Tracer Tool from the ASDM it tells me that the Traffic goes through but ends on the LAN Interface. But it should end on the IBIZA Interface or am I wrong here ?
 
What do I need to tell the ASA to route the Traffic from the ezVPN Client to the Contractor Router and back ? I have set up the ezVPN Connection as full-tunnel so all Traffic goes through the VPN Tunnel. That shouldn´t be the Problem.

View 10 Replies View Related

Cisco Firewall :: ASA5510 / 1800 / 3825 - Routing Configuration

Aug 15, 2011

I try to setup a ASA5510, but without success. Actually, I have Cisco1800(192.168.96.1/21) from my ISP connected to a Cisco 3825 (via port with IP 192.168.96.2) all is working good. Now I want to insert a asa firewall between ISP router and 3825.
 
For that, I tried a more simple config :
ISProuter (192.168.96.1/21) ----  ASA outside port(192.168.96.2/255.255.255.248)  ASA INSIDE port (192.168.100.1/255.255.255.0) ---  a pc with IP 192.168.100.2, netsmask 255.255.255.0, gateway 192.168.100.1
From my ASA, I can ping 192.168.96.1.  but a "ping INSIDE 192.168.96.1" fail
from py pc, can ping 192.168.100.1, but not 192.168.96.1
Here, my ASA config :
 
ASA Version 7.0(8)host name cisco asa
enable password 8Ry2YjIyt7RRXU24 encrypted
password 2KFQnbNIdI.2KYOU encrypted
names dns-guard
!
interface Ethernet0/0
shutdown
no nameif
no security-level
no ip address
[code]....

View 1 Replies View Related

Cisco Firewall :: Difference ASA5510-BUN-K9 And ASA5510-Sec-Bun-K9

Jun 6, 2012

ASA 5510 have two model Bun-K9 and Sec-Bun-K9 from the datasheet find out difference Port related and Redundancy. My questions is : Have any major difference for Security service between two model ?

View 3 Replies View Related

Cisco Firewall :: ASA5510 - Routing / NATing From Internal Network To Outside Interface IP

Jun 3, 2012

I have an ASA5510 running version 8.2(5) I am having an issue with routing/natting from an internal network to the outside interface IP on port 443 which has a nat back in to another internal address. i works externally in from a public address. i also see log messages to do with IP Spoofing

View 1 Replies View Related

Cisco Firewall :: ASA5510 - Unable To Ping From User Desktop To Firewall Inside IP

Jun 11, 2012

I am able to ping from Switch to firewall inside ip and user desktop ip but unable to ping from user desktop to  FW Inside ip.. config is below for both switch and FW Cisco ASA5510....
 
TechCore-SW#ping 172.22.15.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.22.15.10, timeout is 2 seconds:

[Code].....

View 7 Replies View Related

Cisco Firewall :: ASA5510 Secondary Firewall Crashes After Upgrade To 8.4.1

Jun 29, 2011

I have two ASA5510's set up in failover, and the secondary keeps crashing after doing the interface checks when bringing failover up. This only happens if I try to upgrade the image on the secondary to anything newer than 8.4.1 (I've tried with 8.4.1-11 and 8.4.2). The primary one run just fine with new images.
 
I don't have the exact error right now, as I need to do a screen capture from console. It's just a huge crash dump.Are there anything I might have missed during the upgrade? Should I cold-boot both the firewalls in the correct order?

View 7 Replies View Related

Cisco Firewall :: ASA5510 Firewall Transparent Mode

Sep 10, 2012

i have a ASA5510 in the office, that already configured 3 context, namely, admin, user, server.in the server context, the last running config was not saved, and there was a power trip last friday night. 1 of the sub interface was affected, and i need to recreate that interface.I am getting the below error, it only allow me to do changes those pre-defined interface.how to I create extra sub interface?

View 3 Replies View Related

Cisco Firewall :: ASA5510 Firewall Interface Speed

Jul 21, 2011

I have a ASA5510 and I have a question about the speed the ports can handle, here is one port:
 
-interface Ethernet0/2
- speed 100
-shutdown
- no nameif
-no security-level
-no ip address
 
it's ethernet and not fastethernet so I figure it will only go to 10Mbps, but at the same time I can hard code the speed to 100.

View 2 Replies View Related

Cisco Firewall :: Memory Upgrade Of ASA5510 Firewall

Feb 22, 2012

i have cisco ASA 5510 Firewall using  in my network, i have  planning  to upgrade the Flash  memory  from  256 mb  to  512 mb  and   the RAM  from 256 mb to  1GB.

View 1 Replies View Related

Cisco Firewall :: Asa5510 - How To Add Secondary Firewall

May 4, 2012

I have a cisco asa 5510 with security plus license in Live enviroment . I need to add a secondary firewall . I was planning to do in active /standby mode for failover .But i have a doubt , when i do "show version " on live asa output says Active /active failover , does this means that i can only configure failover in active/active mode not in active/standby (which i want to do )?

Maximum Physical Interfaces  : 8
VLANs                        : 20, DMZ Unrestricted
Inside Hosts                 : Unlimited
Failover                   : Active/Active
VPN-DES                      : Enabled
VPN-3DES-AES                 : Enabled
VPN Peers                    : 25
WebVPN Peers                 : 2
Dual ISPs                    : Enabled
VLAN Trunk Ports             : 8
AnyConnect for Mobile        : Disabled
AnyConnect for Linksys phone : Disabled
Advanced Endpoint Assessment : Disabled
UC Proxy Sessions            : 2

This platform has an ASA 5505 Security Plus license...

View 4 Replies View Related

Cisco Firewall :: RDP Access Through ASA5510 Firewall?

Feb 12, 2012

i  am  using Cisco ASA5510 Firewall  in my  Network in the distrubition Layer .Private Range of Network Address  use  in the Network  and PAT  at the FW for  address translation.presently  encountering an issue  the users  behind  the FW  in my network  unable to  RDP  at port 2000  presented  at the Client Network.Able to Telnet  on port2000 but  not RDP .  any changes needed at the FW end  to  get the RDP Access.

View 12 Replies View Related

Cisco VPN :: How To Enable Xauth On Pix 506E

Feb 20, 2012

it is possible to enable Xauth on pix. I have read multiple threads about using the following cmds:
 
username test123password testing privilege 2
aaa-server LOCAL protocol local
crypto map mycrypto client authentication LOCAL
 
However the f/w wont let me add the crypto map cmd, just comes back with the following:
 
PIX(config)# c.rypto map mycryptomap client authenication LOCAL
Usage:  [ show ] crypto { ca | dynamic-map | ipsec | isakmp | map | sa } ...
show crypto engine [verify]
[ show | clear ] crypto interface [counters]
 
I also tried the following, but they dont work and I am not sure if they are meant for Xauth since I was under the impression that it had to be enabled globally.
 
PIX(config)# vpngroup test authentication-server LOCAL
Protocol "local" is not supported for authentication of remote users of a h/w client
PIX(config)# vpngroup test user-authentication       

[code]....

View 3 Replies View Related

Cisco VPN :: Can't Access Internal Network From VPN Using PIX 506E

Oct 28, 2012

I seem to be having an issue with my PIX configuration. I can ping the VPN client from the the internal network, but can cannot access any resources from the vpn client. [code]

View 4 Replies View Related

Cisco VPN :: ASA 5505 Access Network Behind PIX 506E

Jul 7, 2011

I have 2 firewalls in my network: ASA 5505 and PIX 506E. Both firewalls's internal network is in the 192.168.0.0/24 subnet but their external addresses are different of course. The inside IP for ASA 5505 is 192.168.0.254/24 whereas the PIX is 192.168.0.1/24. I've successfully configured VPN on the ASA 5505. I'm able to VPN to the ASA and can ping / access hosts that have the 192.168.0.254 as their gateways.However, I'm unable to ping/access hosts behind the PIX. What do I need to do in order to allow access to the network behind the PIX after I VPN to the ASA? Also, I'm unable to ping 192.168.0.254 after I VPN to the ASA.

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved