Cisco Firewall :: Block Pings On Outside Interface Of ASA 5505?

May 2, 2013

I was asked to block pings from the internet to the outside interface of our ASA-5505 firewall.  I found a post that said to enter "icmp deny any outside", however that does not do it.
 
I created an ACL to try and do the trick, also to no avail:
 
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in in interface outside 
access-group outside_in in interface outside

View 8 Replies


ADVERTISEMENT

Cisco :: Block Pings From Outside To ASA 5505

May 1, 2013

I was asked to block pings from the internet to the outside interface of our ASA-5505 firewall.  I found a post that said to enter "icmp deny any outside", however that does not do it.
 
I created an ACL to try and do the trick, also to no avail:
 
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in in interface outside 
access-group outside_in in interface outside

View 1 Replies View Related

D-Link DIR-825 :: Block Private Ip Pings?

Feb 27, 2011

In the new firmware version is there a way to turn off or not allow anyone to ping my router by blocking any private type of IP address? Which also include loopback addresses?

View 1 Replies View Related

Cisco WAN :: 3845-MB Dropping Pings To Its Own Serial Interface?

May 16, 2013

I'm having an issue that I can't quite understand. I set up a test lab to get familiar with EIGRP routing. I have a Cisco 3845-MB with 2 VWIC2-2MFT-T1/E1 cards.sh ip int brief shows UP UP status on all serial ports. I gave it an IP address but I'm having trouble pinging the serial interface IP. It's dropping pings to its own S 1/1/0 interface when pinging from console. I have known good T1 crossover cables 1&2 - 4&5.
 
Here is the "ip int brief" from 3845-MB
 
3845-MB#sh ip int brief
Interface                  IP-Address      OK? Method Status                Prot
ocol
GigabitEthernet0/0         unassigned      YES NVRAM  administratively down down
 GigabitEthernet0/1         172.30.2.1      YES NVRAM  up                    up 
Serial1/1/0:0              10.3.29.2       YES manual up                    up

Right now it's pinging itself at about 60 -90% success rate... and I can't figure out why it's dropping any packets at all. I have other issues with in the lab as well... but i think this might be my "core" issue.To make matters even more "weird" I've tried two different VWIC2-2MFT-T1/E1 cards and I drop pings with both of them.

Here is a sh run and a sh diag:
 
3845-MB#sh run
Building configuration... 
Current configuration : 1434 bytes
!
version 12.4
service timestamps debug datetime msec

[code].....

View 4 Replies View Related

Cisco Routers :: WRVS4400N Responds To Pings But Web Interface Fails?

Apr 8, 2012

 I have a WRVS4400N router in a remote office.  I have connectivity to the office and computers there.  But the web interface for the router is failing to come up.  This happens once every few days or so.  Is there any utility or something that I can use to remotely reset the router without making use of the webinterface or having physical access to the router?

View 4 Replies View Related

Cisco Firewall :: ASA5510 - Block IP Address From Outside Interface

Jun 23, 2011

Recently, I've been having significant problems with denial of service on our ASA-5510. Two IP addresses in particular attack my ASA regularly. What kind of rule do I need to create to deny these IP's access to my firewall?

View 4 Replies View Related

Cisco Firewall :: ASA 5505 - Block Certain URL On Certain Users

May 20, 2013

I am using ASA5505 and I would like to block certain websites such as facebook.com on some users only

View 3 Replies View Related

Cisco Firewall :: 5505 - Block Everything Except A Few Ports

Apr 15, 2013

We have a client that is running a PC on a internet over satellite. To avoid any unessecery traffic over the satellite link (data traffic is quite expensive), we've suggested to use a 5505, as we had one handy already.
 
So basically what we wanted was to block everything outgoing and everything ingoing, except for example port 22 (ssh).
 
But I'm struggling a bit, since this is my first cisco router to be configured.
 
My interfaces are as follows.
Outside - DHCP
Inside (port 1) - 192.168.1.1
 
I'm only running ipv4.
 
in ASDM I made a static NAT rule for port 22, being forwarded to 192.168.1.5 (the computer)
 
in Access rules I made under outside (incomming rules) source=any destination=outside service=ssh action=permit
 
But when I try to add further rules to block everything else, it takes the SSH on port 22 with it. How should I do this the easiest way?
 
the hardware setup is pretty straight forward.
 
sat-terminal(with IP 192.168.0.1 running DHCP)   ->  5505 (outside IP=DHCP - inside IP=192.168.1.1)   ->    computer (IP=192.168.1.5)

View 24 Replies View Related

Cisco Firewall :: Block Website Or Ip Address From ASA 5505?

Apr 27, 2011

if it is possible to block a website or ip address from an ASA 5505? if it is possible, can you give me an example of the commands to get it done?

View 2 Replies View Related

Cisco Firewall :: ASA 5505-ISP Providing DHCP And Separate IP Block

Mar 12, 2011

I have a ASA 5505 that I have been using for a while, but a new ISP is trying to configure my service so that the outside interface has to be configured as DHCP to receive a reserved IP address, and then they will route a separate, non-contiguous block of addresses to that address.
 
Essentially, they have a DHCP reservation for 1.2.3.4 for my ASA, and then they have 10.2.3.16/28 as a separate block routed to me.
 
Obviously, I can do my static NAT translations using outside as the address, but I cannot get the separate block of addresses to route through the ASA. Is there a way to do this and get them to work? My ASA is running 7.2(2)

View 3 Replies View Related

Cisco Firewall :: How To Block ARES With ASA 5505 Base License

Sep 1, 2011

Well, I tried using the cisco configuration for ASA 5505 for blocking P2P: url...but this configuration only is usefull with programs like Kazaa, so I try this configuration to block ARES but the problem is that ARES try to make downloads from different ports, ¿How do I block ARES if there are sereveral ports ?

View 1 Replies View Related

Cisco Firewall :: 5505 Block Port 80 On A Specific Host In LAN

Apr 22, 2012

I'm using an ASA5505 (8.4(1)) and would like to block port 80 on a specific host in the LAN so machines in other remote LANs connected via VPN can't access this port on the host. Devices in the local LAN should have access to this port on the host. Here are the commands I'm using:
 
-access-list block_port extended deny tcp any host 10.20.10.20 eq 80
-access-list block_port extended permit ip any any
-access-group block_port out interface inside
 
These commands are not working as I would expect them to. When I browse to http://10.20.10.20 from a remote machine over the VPN tunnel I am able to access the host web server.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 / Block Internal LAN And Internet Traffic Except LogMeIn Site?

Sep 12, 2011

I have configure Cisco 5505 as layer 2 firewall mode. I have vendor machine connected  to Cisco ASA 5505 on port 2 as VLAN2 inside then VLAN1 outside connected to my internal network on layer 2 cisco 2960 switch. This machine needs access only to LOGMEIN then block all internal/internet traffic. 
 
vendor machine on vlan 2 inside >> Cisco ASA 5505 vlan1 outside  >> layer2 switch >> internal LAN >> Cisco 5520 main FW >>> INTERNET

View 1 Replies View Related

Cisco Firewall :: ASA 5505 / Block Website With Regular Expressions Affecting All Internet?

Dec 27, 2011

We have an ASA 5505 and I want to block www.facebook.com for all users on the inside network.  I followed the instructions laid out in Cisco support document ID 100513 using regular expressions with MPF but am running into some problems.
 
[URL]
 
Once the configuration has been changed based on these instruction www.facebook.com is blocked.  However I can't access any other websites except my Google News home page comes up just fine for some reason. 

ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 4nJloDG8uYd8w4D3 encrypted
names
!
interface Vlan1

[code]....

View 18 Replies View Related

Cisco Firewall :: Failover ASA 5505 - Setup Second Inside Interface On Firewall?

Feb 19, 2012

I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Creating Interface Vlan In Firewall

May 3, 2011

I have been working with ASA 5510,20,40,80 but not with 5505 this vlan and its interfaces are quite confusing.Just want to know how it works and its connectivity to Cisco Switch.Do i have to put the interface of the switch in the same vlan as i am creating the interface vlan in firewall ?Now the switch port connecting to this Eth1 interface should also be in the same vlan ? i.e vlan3 ?? or it will be in trunk ? The default configuration shows the eth0 with no access vlan and interface eth1 with access vlan 2... does it mean the eth0 is in vlan1 ? (Nativ Vlan ) ???

View 4 Replies View Related

Cisco Firewall :: Sub Interface On ASA 5505?

Dec 10, 2012

I want to creat sub int on ASA 5505 but when I am trying below command it show error.

------------------------------------
config t
int f0/0.3400
------------------------------------

My ASA software version is 8.2(5).

View 5 Replies View Related

Cisco Firewall :: Sub Interface On ASA 5505

May 13, 2009

Can we make sub interface on Cisco ASA 5505 model and if its possible then do that interface need to be upgraded into Trunk Port.

View 8 Replies View Related

Cisco Firewall :: Subinterface Not Respond To Pings Asa 5520

Apr 5, 2012

I'm trying to set up an 802.1 q trunk between my layer 3 switch and ASA5520.  I understand I need to create a subinterface to accomplish this and have done so.  However, the subinterface does not respond to pings, and when I attempt to run the packet tracer on the firewall itself, I get a message saying Flow is denied by configured rule.  But the strange thing is it shows the output interface as "np identity ifc":
 
(The VLAN in question is VLAN2 192.168.2.3 is the VLAN2 address on the switch).  The ASA config is as follows:
ASA Version 8.2(5) <context>
hostname context2 
names
!
interface GigabitEthernet0/0.2
nameif Inside0/0.2
[Code] ....

View 3 Replies View Related

Cisco Firewall :: Asa 5505 Cannot Telnet Or Ssh To The Outside Interface

Sep 9, 2011

I setup a site-to-site VPN tunnel at the remote ASA5505. I am able to asdm to the outside interface but not ssh. I switch to telnet and still not allow me to access. I added an ACL to allow telnet any to the outside interface but still not working. In ASDM I see the log Here is the second issue. When I want to change the telnet back to ssh using ASDM I got the following error.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Losing Outside Interface?

Aug 13, 2011

I have a problem where my outside interface stops passing traffic and the only way to resolve the issue is to reload the ASA, the interface never is down it just stops passing traffic. The inside interface never stops allowing traffic to pass as I can get to all my internal servers and shared drives.
 
The firmware is:
asa821-k8.bin 
Running Config
: Saved:ASA Version 8.2(1) !hostname f1domain-name somedomain.co.ukenable password w1Y.GBKFyC5NqO3M encryptedpasswd 2KFQnbNIdI.2KYOU

[Code].....

View 4 Replies View Related

Cisco Firewall :: 5505 PAT Between 2 Networks On Same Interface

Nov 6, 2011

I'm using asa 5505 with 8.4(2) and have the following problem.I have 2 Networks. each Network has it's own externel Internet-Ip and also Mail-Server.
[code]

Now I want a communication between the two Mailservers with their external Ip-Address.I did a static NAT from ipnt any to int any or also from int routed to int routed, but nothing worked.Packet tracer showed at NAT-Lookup where the externel adress of the second Mailserver is passed: Info Static translate Network1 to Network1
 
But it should show a translation from network1 to network1-external.Due to Security reasons, I cannot paste the whole config.Under 8.0 I did the same configuration with Policy-Nat and it worked.

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Backup Interface?

Nov 21, 2011

I have setup ASA 5505 with 2 ISP, named outside (primary)  and backup, the scenario is if outside down, then backup will take over, it works now. But it is not working when the primary connection cannot reach the gateway with the interface still up.
 
Is it possible when the primary connection cannot reach the gateway then backup automatically take over?
 
My configuration is:
 
ASA Version 8.2(1)
!
hostname cisco

[Code].....

View 4 Replies View Related

Cisco Firewall :: ASA 5505 - Cannot Ping Outside NAT Interface

Nov 14, 2011

I have a Cisco ASA 5505, the problem is I am not able to ping to outside natted interface (ip: 172.88.188.123 and 124 and 125) from inside network I have looked for ASA documentation through the internet and still got nothing.

the config are:
  
: Saved
:
ASA Version 8.2(1)
!

[Code].....

View 2 Replies View Related

Cisco Firewall :: ASA V8.4 Will Stop Pings With IPsec-Spoofing Logic

May 28, 2013

After hours of trial and error, and searching user groups, I have found that on occasion, ASA v8.4 will stop pings with the IPsec-Spoofing logic.  Interestingly, the packet-trace will say everything is allowed.
 
The fix (at least in my case, and one other) is to narrow the crypto-map to specific hosts, not subnets.

View 2 Replies View Related

Cisco Firewall :: New ASA 5505 / Can't Ping Inside Interface

May 10, 2011

I have a new ASA 5505 and all is working fine, I can CLI and ASDM into it, but just can't ping the inside interface, do I need to enable a feature to make this work somehow?

View 1 Replies View Related

Cisco Firewall :: 5505 Inside Interface To Another Switch?

Apr 23, 2012

I am connecting the inside interface to an upstream switch and therefore will need to assign a static IP address to the inside address as I did below:
 
#sho int ip brief 
Vlan1                      123.123.123.123  YES manual up                    up
 
I will also use this to manage the ASA. I am having a problem with the network configuration of the inside interface as I can't ping the gateway and/or the in IP of the inside interface.Do I need to add any routes?

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Failover - Can't Choose Interface

Dec 14, 2011

I am trying to configure two ASA-5505 as a failover pair. Software 8.2.5 and ASDM 6.4.5.206 Using the wizard i get to step3 .. then nothing happens. Trying direct in asdm but the only interface i can choose is "--None Unnamed-"

View 1 Replies View Related

Cisco Firewall :: 5505 - Can't Ping ASA Inside Interface

Dec 12, 2011

I have an ASA 5505 that I'm trying to set up a guest network on.  I've configured an interface as a trunk and allowed the 2 vlans but I'm not getting any layer 3 to it.  The switch connected to it is a 3560 and port is configured as a trunk with the same vlans.
 
I can't ping the ASA inside interface but I see its MAC address in the swtich's table.
 
[code]....

View 4 Replies View Related

Cisco Firewall :: ASA 5505 Can't See Any Elements About Physical Interface

May 30, 2011

I enabled snmp config  ASA 5505 with Version 7.2(4), the NMS/reporting system can give graphs for CPU & Memory usages. But I can't see any elements about physical interfaces.

View 1 Replies View Related

Cisco Firewall :: SQL Server Access From DMZ Interface ASA 5505

May 25, 2011

I would like to allow users from network 10.132.23.0/24, 10.132.33.0/24, 10.132.24.0/24 access to our SQL server(192.168.1.7) located on the inside interface(192.168.1.0/24 network) Those networks (10.132.0.0/16) come from the DMZ interface.

View 12 Replies View Related

Cisco Firewall :: ASA 5505 Dropping UDP / 53 Traffic On Inside Interface?

Jul 21, 2012

We have a Cisco ASA 5505 (v7.2(3)) with a "fairly" normal configuration yet we have a problem where it appears UDP/53 traffic is denied on our inside network.
 
here is output from our sys log:

SyslogID   Source IP      Dest IP    Description
305006      172.18.22.3                   portmap translation creation failed for udp src inside:172.18.22.156/42013 dst inside:172.18.22.3/53
 
To give some clarification:

172.18.22.3      is one of our DNS servers
172.18.22.156  is a device we're experimenting with.
 
We've bypassed the Cisco by using a 4G wireless router with this same device - and it works flawlessly.Here is a [scrubbed] copy of our config. It is what I inherited from the previous admin - I'm not sure of all its finer points (I'm not Cisco certified -- perhaps I'm just certifiable.)
 
: Saved 
:
 ASA Version 7.2(3)
 !
 hostname [redacted]

[code].....

View 5 Replies View Related

Cisco Firewall :: ASA 5505 - Dropping TCP Connections On Inside Interface

Feb 12, 2013

Trying to add inside routes on an ASA 5505 to point traffic to another gateway for other connected networks is resulting in the following error 6Sep 16200 819:13:5810601510.184.236.1265003810.170.54.1823389Deny TCP (no connection) from 10.184.236.126/50038 to 10.170.54.182/3389 flags RST on interface insideI believe the problem is due to the Asymetric tcp connection and the ASA is dropping the connection because it only see one half of the traffic.Is there a way we can stop the firewall dropping the TCP connections on the inside interface? i've tried removing the threat managment which didnt work.Annoying thing is were putting the ASA 5505's in to replace old Watchguard soho firewalls only the watchguards forwarded the traffic no problem at all.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved