Cisco Firewall :: Unable To NAT ASA5505 To Windows 2012 Server
Apr 17, 2013
I have an unusual issue, for which I can find nothing on the net similar.
Setup:
ASA5505 = > CISCO3524 => Windows 2012 server
ASA is internet edge with ACL / NAT implemented.
We are wanting to implement inbound NATs for this server - 3389. We have many other servers on the internal side of this ASA that we are NATing to. Creating NATs using the same outside IP to another server is fine, no issues. This other test server resides on the same VLAN as the windows 2012 server. All IPv6 is turned off on the W2012 server, and it can web-browse out via the ASA as well. No matter what I do, however I cannot get iinbound NAT, on ANY port to this server working. Internally from another server to this server on any port is fine, i.e. we can RDP to this server without issue, so we know this works - the firewall on this server is turned off too. This is our ONLY w2012 server on the internal side. When we run a wireshark on the server whilst testing the NAT there is no traffic, so its getting blocked somewhere.
The config of the ASA is fairly big to to santize it and remove all customer reference would take a while to make display of this secure difficult.
i've been using a VPN to connect to my home network from elsewhere for a few months. It's set up as follows:
PPTP Maximum Strength Encryption EAP-MSCHAP-v2 Authentication
Now I find out that MSCHAPv2 authentication has been broken and is no longer considered secure (even by Microsoft), so I want to change the protocol I'm using to make it secure.
However, I've spent 3 hours now researching this and I cannot for the life of me figure out how to use a better protocol on my Windows Server 2012 home server. I've tried setting up PEAP authentication (still PPTP) a la Microsoft's recommendation document, but it requires a certificate. I've created a self-signed certificate but it seems I can't issue certificates (via this method) without being a member of a domain, so I'm stuck. I can't even get started with L2TP since I can't find the option for it.
My question is this: Is there a way to setup a secure VPN server using Windows Server 2012 without a domain? If so, how do I do this?
Ths only hapeens at one location. All the other locations are working the difference is this location goes through the firewall. If I bypass the firewall at this location it works.
I have assigned a task to configure a vpn between windows 2008 server and cisco asa 5505, what kind of vpn should i go with as the windows 2008 server r2 is on cloud and is it possible to configure site-to-site vpn for this network senario or not.. i have try ikev1/ipsec remote access vpn with l2tp with (CHAP, MS-CHAP v2) and couldn't find any document which will allow me to configure windows 2008 server to behave a client and connect it to asa, well what i did is that i configured a dail-up connnect with l2tp and found the following debug message
Sep 09 20:04:02 [IKEv1 DEBUG]IP = 172.16.32.5, Oakley proposal is acceptable Sep 09 20:04:02 [IKEv1 DEBUG]IP = 172.16.32.5, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 1
I have a micro-server at home running Server 2012 which is going to have a few virtual machines on hyper v.I also would like to use the server to watch films on which will be connected to by tv using a hdmi cable..I wanted to know is it ok to play films off server 2012 and watch them on the tv?
I have some unused 10G NIC's and want to see if there's a way to install them into a computer and turn that PC into a switch. I need to run Windows based software for driver support of the NIC's, such as Server 2012. This is a picture of what I am hoping to accomplish:
As you can see in the simplified picture above, I have a real switch which has a single 10G link that is connected to PC2. I would like to add the 10G cards to PC2 so that I can create a "switch" of 10G ports on PC2 which I can then hook up other clients (such as PC1 in the above picture).
PC2 needs to provide network access and internet access to PC1 (and other PC's connected to PC2 - not pictured).
The rest of the clients on the network are connected to the regular gigabit ethernet ports of the hardware switch (including my router which is 192.168.1.1).
I looked into Windows Internet Sharing, but for that to work, I need to connect the router to PC2 above and for other considerations not described above, it is not physically possible for me to do that.
Is there software I can run on PC2 that will turn all the NIC ports of PC2 into a "switch"?
I have a normal setup of ASA5505 (without security license) connected behind an internet router. From the ASA5505 console I can ping the Internet. However, users behind the Firewall on the internal LAN, cannot ping the Internet even though NATing is configured. The users can ping the Inside interface of the Firewall so there is no internal reachability problem. In addition, I noticed that the NAT inside access list is not having any hit counts at all when users are trying to reach the internet.
When i replace the ASA5505 with a router with NAT overload configuration on it, the setup works normally and users are able to browse the internet.
The ASA5505 configuration is shown below.
hostname Firewall
interface Ethernet0/0 description Connected To Internet Router switchport access vlan 10
Recently, I set a ASA5505 with Ipsec VPN. And I try AAA authenticate with internal Windows 2008 server. As docuemnt I read, I configure from ASDM authentication with "NT Domain". And then point to internal DC, which is Windows 2008 server. While I test it, it shows error
"Authentication test to host 192.168.xxx.xxx failed. Following error occurred -- ERROR: Authentication server not responding. No Error"
I just installed Server 2012 Standard on a trial. I would like to play around with Remote Desktop Services formerly called Terminal Services. I have no clue on where to start but I have installed the RDS roles.
Internet ISP -> Juniper SRX 210 Ge-0/0/0 Juniper fe0/0/2 -> Cisco ASA 5505 Cisco ASA 5505 - >Inernal LAN switch.
1. Internet is connected to Juniper Ge0/0/0 via /30 IP.
2. Juniper fe0/0/2 port is configured as inet port and configured the Internal public LAN pool provided by the ISP. And this port is directly connected to Cisco ASA 5505 E0/0. Its a /28 pool IP address. This interface is configured as outside and security level set to 0.
From Juniper SRX, am able to ping public Internet IPs (8.8.8.8).
Issue:
1. From ASA am unable to ping public ip configured on Juniper G0/0/0 port.(/30) 2. From ASA no other Public internet IP is pinging.
Troubleshooting Done so far.
1, Configured icmp inspection on ASA. 2. Used the packet tracer in ASA, it shows the packet is flowing outside without a drop. 3. Allowed all services in untrust zone in bound traffic in Juniper SRX. 4. Viewed the logs when I was trying the ping 8.8.8.8 in ASA. It says "Tear down ICMP connection for faddrr **** gaddr **
Recently, I have bought an ASA 5505 firewall which I have tried to connect to my ADSL router (Modem).It is now more than a week that I am trying to get internet connection through the firewall but I still can't succeed. I have tried many advices I get from this community but I still don't know what is wrong with my ASA Firewall configuration. From inside I am able to ping the inside and outside interface with a great success. and from my laptop which is connected to the firewall, I am able to ping the both interfaces (inside and outside) but still I can't access the internet.
As I don't have a static IP address from my ISP, I have configured the outside interface to pick up the ip address dynamically. Most of the time, the outside interface get the 192.168.1.2 ip address. [code]
I've been struggling with gaining access to the inter through our Comcast business gateway. We have had Comcast configure the device fro true static IP subnetting. Turned of local DHCP on the device etc. Here is my config.
However, whenever I try and run the ASDM client, I get the following error:
"Your ASA image has a version number 8.4(4)1 which is not supported by ASDM 6.2(1)."
How do I get the latest version installed on my Mac desktop? I know that I can connect via the web interface and run the ASDM client, but the same error persists. I have the asdm-649-103.bin file, but cannot connect to the ASA to install (I don't recall ever setting up SSH).
I can't seem to figure out which one I should go for. I'm thinking Kaspersky would have greater security but I'm not familiar with AVG's server level security.I don't need all the bells and whistles such as file encryption or password storage. I'm simply after a really strong AV for the server. Another one is VIPRE although I've heard it can take a while to configure it unlike Kaspersky which is pretty straight forward.
When I create a virtual switch on hyper v, i lose network connectivity and the default gateway is missing I have to manually put the default gateway in and disable and re enable the network adaptor each time the server restarts in order to get network connectivity. I am running windows server 2012 Hyper V Virtual Ethernet Adapter loses default gateway server 2012
There is web server at the internet. The firewall ASA5505 is located at the inside edge of the edge router and the internet is at the outside edge router of the edge router. The router has already been configured can route the outside network of firewall to internet. [code]
1. I have a host at the DMZ zone of firewall and if it wants to access this web server by http, the following command lines to be added to ASA5505 good enough and anything wrong with them? [code]
2.I have a doubt here that do I need to add any command line related to the Static Mapped address of 192.168.20.10/24 like below?
access-list Outside_DMZ extend permit tcp any 192.168.20.10 255.255.255.0 eq 80.whereby the 192.168.20.10 is the static mapped address of the Host at the DMZ to Outside Nertwork. Or, any other command related with the Static Mapped address have to be added?
1) I had Windows XP 2012 Security virus that I removed. The antivirus software also removed afs.sys and afs.reg file, that I repalced from backup. I also copied and merged afs.reg Doing this got me an ipaddress for my PC.
2) I can not connect my wired desktop to the Internet. I can ping the ip address of google.com but not the url. I can also not ping ip address of netgear.com. My laptop has no problem connecting to the wireless network.
3) I ran Winsockxpfix and flushed dns and no luck. [code]
We have a Cisco 5505 ASA fireawll at a remote site. I can get the firewall to issue the IP addresses to the pc's, Is there a way for the pc's to get their IP addresses directly from our DHCP server?
Using an ASA5505, have 1 static outside address, want to access an inside SBS-Server on SMTP, RDP (3389), HTTPS and port 987
Have configured network object nat rules using the asdm, SMTP works (I can telnet to the server on port 25 from outside), however for some reason I can not telnet inside and out on port 25, so outgoing mail does not work. RDP does not seem to work from outside, 987 I havent tested from outside. When I try to create a network object nat rule for https I get this message from the ASA:
I have installed ASA5505 in the network. Port forwarding has been done for one of the server in our LAN. Public users are able to access the server successfully. I am trying to access from inside using the same Public server IP, but unable to access it. Can I have this feature in ASA5505(I think it is loopback configuration). If so, may I know the configuration detail?
I have an ASA5505 running ver 8.0(2). I have configured the ssh timeout, ssh host commands and did the crypt o key gen. I am unable to access the device from the host I am allowing. Is there like ca save all command required? I am trying to use the default pix and telnet password. Do those still work?
I thought I had the configuration to allow bi-directional traffic for my Blackberry server. I have a second fw with the same config and it worked on that one. But right now, my blackberry server is down, and all the users are upset.
I ve configures an asa 5505 for remote vpn with anyconnect. it works just fíne - from remote i can ping the Clients and Server inside, i can do RDP or Connect via SSH to any machine, map some volumes local and so on but: I can not connect microsoft sql server. It uses port 1433 for the first connect and establishes then a dynamic connection. So i am a Newbie - what rules or configs do i miss?
We are using MS System Center Operations Manager to monitor network devices. We are trying to monitor our Cisco ASA 5525-X firewall interfaces.
We have a generic management pack installed that seems to work for parts of the 5525. We can see performance info for IF-4 but none of the other interfaces.
Our Management Pack is a generic Cisco Adaptive Security Appliance Version 9.1(1) management pack.
Is there a management pack that is specifically for this Cisco firewall?
I'm currently implementing Microsoft System Center 2012 Operations Manager, the curent stage of the project is to add the network devices to SCOM via SNMP in order to monitor them, I am able to add them all and monitor; however, my ASA 5510, although SCOM discovers the ASA via SNMP and adds it to the network monitoring list, it loses SNMP connectivy every 30 minutes, and 15 later it reconnect with SCOM, then after another 15 minutes it loses the connection again, and so on and so for.
I have configured a my desktop as a domain controller with server 2008..with dns service running on it. When i tried adding another desktop to this domain, i get the following error message
"Troubleshooting network identification Error: This computer successfully resolved the Domain Name System (DNS) service (SRV) resource record required to locate a domain controller, but it failed to locate a domain controller for the Active Directory domain displayed in the error message.
Cause: The required A (address) resource records that map the name of the domain controller to its IP address do not exist in DNS.
Solution: Verify that the required A resource records do not exist in DNS by using the Nslookup command-line tool.
See also: To verify that A resource records exist in DNS. Cause: The domain controller advertised in DNS may not be connected to the network or is connected to the network but is not running.
Solution: Verify connectivity and then verify that the domain controller is running.
See also: To test a TCP/IP configuration by using the ping command; DNS requirements for joining an Active Directory domain."
i can't get it working to expose on internal server to an outside interface.I used the public server function in ASDM.Internet access works if i nat my private adress to one of the available ipadresses provided by our isp.
Internal Server : owncloud 172.10.0.4 External Server : ext181 46.245.171.181
we are not able to connect to a outside PPTP vpn server;The scenario is this :Connections are started from inside netwok to a VPN server on the outside zone.
I have add these configs and still not working.policy-map global_policy class inspection_defaultinspect pptp ?i also have a acess-list for it.access-list inside_access_in extended permit tcp object inside-network any eq pptp access-list inside_access_in extended permit gre object inside-network any access-group inside_access_in in interface inside? I am missing something or this is all configs i have to get done ?
