Cisco Firewall :: Cannot View Permit Entries In The Log On ASA 5520

Apr 6, 2011

I can not seem to view my "permit" entries in the log on my ASA 5520. I set up logging-lists, changed the level to 3 on  the logging statement, and simply can't find it anywhere.
Partial config:
logging enabled
logging timestamp
logging JC-L3 level errors
logging monitor JC-L3
logging buffered JC-L3
logging trap notifications


View 6 Replies


Cisco Firewall :: ASA 5520 - Permit Traffic To Inside Via MAC - Address?

Apr 6, 2011

I have a handheld device that will be used for inventory outside of our office. It has 3g capabilities. Is there anyway I can permit traffic from this device from the outside world coming into my network?  I need to open a couple of ports so it can hit the server. But I have no intention to open these ports up to the entire world.  I use an ASA 5520 with a managed router from our provider. I looked around on the Cisco site and the only information I found was for permitting and denying traffic from devices that are within the network.

View 2 Replies View Related

View Web History From ASA 5520 Firewall?

Dec 21, 2010

I was wondering if the ASA 5520 Firewall had the ability to view web traffic or site surfing or does this only work if I have a logging server configured for the ASA to log to? I don't use the ASA much since I'm the database administrator for my company but from time to time I'm asked when nobody else is available. I just checked the ASDM & see that the buffer clears after so many lines & I don't believe we've got a logging server.

View 2 Replies View Related

Cisco Firewall :: How To Permit Traffic From Outside To DMZ On ASA 8.4

Jan 22, 2013

I Have this Topology: R1 is as server and i want to public that server in INTERNET using public IP, but i can not do that. I tried to do a NAT but it just translate from DMZ to Outside, however i can not to ping to from Outside (R2).
I have a route in R2 [1/0] via 
On R2 i can´t ping to
On R2 i can´t ping to
On R1 i can ping to
On Inside i can ping to
when i try to ping from DMZ to Outside ( the debug, and show nat details, show me:
ciscoasa(config)# nat: translation - dmz: to outside:
nat: untranslation - outside: to dmz:
nat: untranslation - outside: to dmz:
nat: untranslation - outside: to dmz:
ciscoasa(config)# sh nat detail


View 6 Replies View Related

Cisco Firewall :: ASA 5510 - Setting Up ACL To Permit Access Only To The Nat Subnet?

Apr 9, 2012

setting up an ACL on my ASA 5510 to permit access only to the Nat subnet from inside to the outside interface. This firewall is setup for the DR solution in the production network. I am applying following acl in the inbound direction on the inside interface.
permit ip any "Nat_subnet"
After appliying this acl to inside interface I observed that I can ping to the destinations in NAT'ed subnet but unable to ssh to the servers. Following is the summary of my configuration.

interface Ethernet0/0
nameif outside
security-level 0
ip address standby


View 3 Replies View Related

Cisco Firewall :: ASA5510 Permit Incoming Connection From Remote LAN

Sep 4, 2011

Actually all service from site to site is permitted, without restriction.I want to insert an ASA to block some internet traffic on main site.I try to configure my ASA5510.No problem for outgoing connection or to permit a single service on main site.But impossible to give access to all service/connection from all remote site to main site. [code]

View 7 Replies View Related

Cisco Firewall :: ASA 5510 Ways To Allow Outside Adapter To Permit Smtp

Oct 25, 2012

We have a 5510 (8.2) with the following 4 interfaces (security-levels) inside (95), outside(0), dmz(25), and test (95).  The dmz network is and the outside interface is have run into a situation where a dmz hosted iRedMail server running postfix ( is relaying mail which in some cases points back to us at and into our Exchange server.  In these cases in the dmz server's mail logs we see postfix timeout trying to connect to smtp at  When I try to telnet from to the outside interface on port 25 it times out.We've tried different ways to allow the outside adapter to permit smtp (or any service!) from but we're left scratching out heads.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - See Logged Traffic On Permit Rules

Feb 9, 2012

I have a rule which permits traffic to a web server and logging is enabled.  But when I go to syslog I am only seeing traffic which has been denied.  What needs to change to be able to see the logged traffic on permit rules?

View 1 Replies View Related

Cisco Firewall :: ASA 5585- TCP Syslog / Logging Permit-Host Down

Jul 5, 2012

We have a firewall service environment where logging is handled with UDP at the moment. Recently we have noticed that some messages get lost on the way to the server (Since the server doesn't seem to be under huge stress from syslog traffic). We decided to try sending the syslog via TCP. You can imagine my surprise when I enabled the "logging host <interface name> <server ip> tcp/1470" on an ASA Security context and find out that all the connections through that firewall are now being blocked. Granted, I could have checked the command reference for this specific command but I never even thought of the possibility of a logging command being able to stop all traffic on a firewall.
The TCP syslog connection failing was caused by a mismatched TCP port on the server which got corrected quickly. Even though I could now view log messages from the firewall in question in real time, the only message logged was the blocking of new connections with the following syslog message: "%ASA-3-201008: Disallowing new connections."
Here start my questions:
- New connections are supposed to be blocked when the the TCP Syslog server are not reachable. How is it possible that I am seeing the TCP syslog sent to the server and the ASA Security Context is still blocking the traffic? 
- I configured the "logging permit-host down" after I found the command and it supposedly should prevent the above problem/situation from happening. Yet after issuing this command on the Security Context in question, connections were still being blocked with the same syslog message. Why is this? 
- Eventually I changed the logging back to UDP. This yet again caused no change to the situation. All the customer connections were still being blocked. Why is this? 
- After all the above I removed all possible logging configurations from the Security Context. This had absolutely no effect on the situation either. 
- As a last measure I changed to the system context of the ASA and totally removed the syslog interface from the Security Context. This also had absolutely no effect on the situation. 
At the end I was forced to save the configuration on the ASAs Flash -memory, remove the Security Context, create the SC again, attach the interfaces again and load the configuration from the flash into the Security Context. This in the end corrected the problem. Seems to me this is some sort of bug since the syslog server was receiving the syslog messages from the SC but the ASA was still blocking all new connections. Even the command "logging permit-host down" command didn't wor or changing back to UDP.
It seems the Security Context in question just simply got stuck and continued blocking all connections even though in the end it didn't have ANY logging configurations on. Seems to me that this is quite a risky configuration if you are possibly facing cutting all traffic for hundreds of customers when the syslog connection is lost or the above situation happens and isn't corrected by any of the above measures we took (like the command "logging permit-host down" which is supposed to avoid this situation altogether).

View 4 Replies View Related

Cisco Firewall :: 5510 - Outlook Port Only Permit (POP3 995 / SMTP 587) With TLS Encryption

Jun 3, 2012

In Cisco ASA 5510 , outlook port only permit ( pop3 995/smtp :587) with TLS encryption. How we can do it thru ASDM .

View 1 Replies View Related

Cisco Firewall :: 15.2 / How To Interpret IOS Log Entries

Oct 12, 2011

how to read some of these log entries I see on the IOS 15.2 router I'm working with.  I'm fairly new to this stuff.  My understanding is that the first socket ( is the originating one, and the 2nd socket is the receiving or destination.  This makes sense when I see an entry like:
01043: *Nov 21 2012 10:28:34.323 PCTime: %FW-6-DROP_PKT: Dropping tcp session xx.xx.241.163:39557 192.168.xx.xx:80  due to  RST inside current window with ip ident 0
The internal IP is our email server inside the LAN, the first IP is some IP in a foreign country, so someobody visited our web interface for the email server, obviously trying to breach or recon the interface but whatever.  Then I see an (unrelated) entry like this elsewhere in the logs:
001095: *Nov 21 2012 25:56:03.531 PCTime: %FW-6-DROP_PKT: Dropping tcp session xx.xx.178.210:25 192.168.xx.xx:47343 on zone-pair inside-outside class INSIDE-OUTSIDE due to  Stray Segment with ip ident 0
What this latter entry tells me is that the Internet host sent data FROM port 25 to what I am guessing is the open port our internal email server must have originated some other communication from.  However we do not accept incoming port 25 mail from anywhere but a designated IP so this "send" is not supposed ot occur.  So first off, am I reading that correctly?  Is the first IP the sending system, and the second IP the receiver?   there are no other entries in the logs between these two hosts, so either the logs have truncated with oldest entries removed (log buffer is set to 51200), or that outside host is sending, hoping to get our mail server to respond?  BTW, the outside host WHOIS's to Microsoft's IP range, Block 1. 

View 8 Replies View Related

Cisco Firewall :: How Many Route Entries Can ASA5520 (8.2.1-k8) Support

Sep 24, 2011

how many route entries can ASA5520 (8.2.1-k8) support?

View 2 Replies View Related

Cisco Firewall :: 6552 Static Entries With Same Ip Address But Different Ports

Sep 15, 2011

Our proxy/anti-smap/IPS box called PROXY is behind our Cisco ASA firewall. The PROXY is set in transparent mode.The PROXY internal ip is (internal ip)We have the MX record for with public ip (public ip as we entered with ISP public DNS)What happens now is that the emails that come through get "caught" by the PROXY and then we setup a thing whereby the emails are then forwarded from PROXY to our server. Also, we made a static entry in PROXY whereby we can https to our email server for the outlook web access from outside of work therefore allowing for users to see the outlook web access web page.On the Cisco firewall, we put the static entry that is mapped to thus the mail server public ip is mapped to the PROXY.
Now, the box has this thing whereby it sends an email to all staff once a day telling them how many mails are legit, how many rejected and how many are spam - the spam emails are listed within the email and staff can at a click of a release button next to each spam email release a particular email from the PROXY box and make it to into their inbox.  This works fine from the inside network, but I have issues from the outside due to the DNS and other things.I also put in the PROXY that any network can release spam and that our staff vlan can release emails. Also, on the inside of the firewall we did an access list that computers from staff vlan can access on port 6552 (Which is the release spam port).Hence, we can release emails from internal network through the Microsoft Outlook.
On the outside network, we cannot release emails when using outlook web access.The host name for the PROXY release spam is so what we did also today is ask "ISP" to make an A record entry for another public ip which is for meanwhile made an entry on the access list that comptuers from outside can access on port 6552 (which is the release port).Now the only question is in regards to the static entries:
1. do we (and can we?) static map to through a port 3840 on the Cisco ASA (although we have already mapped to - I have a doubt here as this might mean we might not get emails? Or would we have to do the static again for this one specifcying the as an smtp entry and the as a release button?

2. have I made a mistake in general and should I have just told the ISP to make a CNAME entry for with the public ip (which is the public ip for MX record?)?

View 9 Replies View Related

Cisco Firewall :: 5580 To Create Syslog Entries When Someone Connects Via HTTPS / SSH

Mar 13, 2011

Is it possible for a Cisco ASA 5580 to create Syslog entries when someone connects via HTTPS or SSH to it. I need to obtain information from Syslog when someone does this.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 / 8.0 - Capture Type ASP Drop Entries With No Reason?

Dec 4, 2011

I have a capture set up of type "asp-drop all", and I am capturing certain packets with no indicated ASP drop reason.  See output below (ASA 5510 with 8.0(5)23 code):asa5510-8.0#  show capture, capture ASP type asp-drop all buffer 15000 circular-buffer [Capturing - 14912 bytes]

View 2 Replies View Related

Cisco Firewall :: Maximum Number Of 1-1 Static Nat Entries On ASA 5515X Or 5525X?

Aug 7, 2012

I have a FWSM cluster that I exceeded the maximum number of static nat entries on.  i migrated the connectivity off to a pair of PIX 535's that seem to be handling the adderess translation needs.  however the number of NAT entries being required is increasing and being the PIX series wal EOL'd several years back..I need to replace them..  The static 1-1 nat entries cannot be summarized into network as the hosts that are being nat'd are scattered all over various micro subnets in the all 3 rfc1918 ipv4 address ranges and they are being manged directly by snmp and SNMP-trap and other services that prohibit the use of many-to-one nat.   Is there a mknown maximum number of static 1-1 nat entries that can be defined on the ASA 5515-x, 5525=x and higher ASA firewalls?  Say I wanted to be able to grow to 2500 or more static 1-1 nat entries.  I am currently running 2010 1-1 static host nats currently.

View 1 Replies View Related

Cisco Firewall :: 5585x - Threat Detection Log Entries In Multi Context Mode

Dec 29, 2012

We have a 5585X running in multi context mode, and we are getting log entries for scanning threat detection, such as:
%ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 2 per second, max configured rate is 10; Current average rate is 5 per second, max configured rate is 5; Cumulative total count is 3116
Threat detection is not supported in multi context mode so I cannot tune the thresholds, is there any way that I can get rid of this outside of messing about with logging levels/message IDs?

View 2 Replies View Related

D-Link D-ViewCam :: 3.3 / Setup 4 Cameras To View With Remote Live View?

Apr 12, 2013

I am trying to setup 4 cameras to view with remote live view. I set up my server with IP addresses of   ....   85. The screen has only the option for 1  video channel. I have seen on-line screen shots that have options for channel 1 through 8. I want to assign each camera to a different channel so I will be able to use remote live view to show all 4 cameras  at the same time. I can only show one at a time. Do I need a different version than 3.3 or some obscure windows 7 setting?

View 5 Replies View Related

Cisco Firewall :: Unable To View PIX515e Via ADSM

May 20, 2012

I am trying to veiw my PIX515e via the ASDM, but I am unable to...Can you review my config and make sure I have everything setup the way it is supposed to?
PIX Version 8.0(4)32
hostname pixfirewall
enable password DQucN59Njn0OjpJL encrypted
passwd DQucN59Njn0OjpJL encrypted(code)

View 1 Replies View Related

Cisco Firewall :: Unable To View PIX515e Via ASDM?

May 20, 2012

I am trying to veiw my PIX515e via the ASDM, but I am unable to...Can you review my config and make sure I have everything setup the way it is supposed to?
PIX Version 8.0(4)32
hostname pixfirewall


View 3 Replies View Related

D-Link DCS Network Camera :: 920 Can't View From Outside Firewall

Apr 19, 2012

I have a camera set up in my kitchen and it works and I can view it in our house, on other computers or my iphone.  But I can't view it from my work or anywhere outside our wireless range.It is a DCS-920.  I have opened port 80, and checked it with a port checker and it says its open.  I have bell as a provider with a 2 wire 2701hg-g modem.I read on here about someone else not having a gateway address or primary DNS.  I don't know what to put in there.  My camera address is

View 4 Replies View Related

Cisco Firewall :: ASA5520 - Can't View ACL Count Details Using ASDM

Feb 9, 2012

We are running a ASA5520 with system image of "disk0:/asa843-k8.bin".  I'm also running ASDM ver: 6.4(7)So my question is while I'm in the ASDM on the configuration of the firewall, I'm looking at the Access Rules.  When I do a show log on any of the rules that have hit counts on them, it opens up a Real-Time Log Viewer but I don't see any information.  It's not showing anything, nothing appears, it just sit's there like it's waiting but no data is coming.  Even though if I go back out to all the rules, I can see the hit count incrementing.  The same thing happens no matter which rule I pick with hit counts on them.

View 1 Replies View Related

Cisco Firewall :: Different Between ASA-5520-K9 And ASA-5520-K8

Nov 2, 2012

We were using ASA-5520-K9 with  ASA-SSM-AIP-20-K9 but recently found some hardware problem in our running ASA. Now cisco want to replace with ASA-5520-K8.

View 1 Replies View Related

Cisco Firewall :: ASA 5500 / ASDM - View Historical Metrics In Graph Form For Traffic Overview

Sep 25, 2011

Running an ASA 5500, and using ASDM to connect. I need to view the historical metrics in graph form for traffic overview, that is shown on the firewall dashboard. I have enabled historical data, but all I see the 5 minute intervals.

View 4 Replies View Related

Cisco :: Permit Snmp Queries On Just One Interface?

Feb 27, 2013

I'm familiar with snmp-server views and excluding certain mib's, but is it possible to permit an snmp host to poll just one interface and nothing else on the router?

View 2 Replies View Related

Cisco :: Config 2600 And Permit Samsung DVR Publishing?

Feb 12, 2013

I need config mi own Cisco Router 2600 and permit to External Internet my Samsung DVR SDE-4001

View 3 Replies View Related

Cisco :: Access List To Permit IP's Instead Denies All Traffic?

Feb 16, 2011

I'm new to this forum and Cisco in general but I feel it may be very resourceful to me as I am a new network administrator fresh out of school for a local credit unionHere's my situation:We need to limit access to one of our servers to only 3 workstations used by our IT department. The server is on a Cisco 3560G on port 17, which is the interface I'm trying to apply a standard, basic ACL to, which looks like this:

View 10 Replies View Related

Cisco WAN :: How To Configure ASA 5505 To Permit MySQL Traffic

Aug 9, 2011

I have an application behind an ASA 5505 that needs to access a mysql database over the Internet.  How do IO configure the ASA to allow this remote mysql connection?

View 1 Replies View Related

Cisco WAN :: Permit Connection From Outside To Inside In 2911 Router?

Jan 24, 2012

I need to permit the connection from outside to inside in a 2911 Cisco router, only from an Public IP Address (suppose to some local private IPs.

I have one question:
Using the command:
ip nat inside source static tcp <local ip> <port> <global ip> <port>
The "global IP" can be the Public IP from where the connection starts (in this case or it must be the Public IP assigned the the Router interface connected to the Public Network.

View 8 Replies View Related

Cisco :: Configure ASA5505 To Permit Access To Internal LAN?

May 12, 2013

I have configured a Cisco ASA 5505 to allow VPN access from outside to my LAN using Cisco VPN Client software. The connection is establishing properly with the ip address from my VPNPool. From outside (on VPN connection) I can ping the interface e0/0 (outside)  and the interface e0/1 (inside) of the firewall, but I cannot ping the layer 3 switch interface to which the ASA is connected ( int gi1/0/22 ip address ) and I cannot ping any vlan interfaces inside my switch. Therefore, I cannot connect to any server on my internal LAN. I am available at any time if further information is needed. find attached my ASA config.

View 7 Replies View Related

Cisco WAN :: 800 Router - Permit Some IP To Connect Over Port 3389?

Apr 22, 2011

Below is my show run of a Cisco 800 router (Two VLAN's, single WAN) that works fine. Problem is that in this senario port 3389 is open for everyone. Only two remote users are allowed to connect trough port 3389. Let's say WAN IP's : and How would a good access-rule look like to fix it?

no service padservice tcp-keepalives-inservice tcp-keepalives-outservice timestamps debug datetime msecservice timestamps log datetime msecservice password-encryptionservice sequence-numbers!hostname cisco-867!boot-start-markerboot-end-marker!logging buffered 51200logging console criticalenable secret 5 ***!no aaa new-modelmemory-size iomem 10clock timezone GMT 1clock summer-time GMT date Mar 30 2002 1:00 Oct 26 2035 1:59!!no ip source-route!!ip dhcp excluded-address!ip dhcp pool Vlan2 network domain-name dsl.local default-router dns-server lease 0 8!!ip cefno ip bootp serverno ip domain lookup!!!archive log config


View 2 Replies View Related

Cisco Firewall :: Upgrade From 5505 To 5520 On Network - ASA Firewall Throughput

Feb 27, 2013

I'd like to see some REAL LIFE comparisons of ASA firewall throughput (a bit like this one for ISR G2 Routers - [URL].
The reason I ask is that I recently upgraded a firewall from an ASA5505 to an ASA5520 on a small network where the only outside connectivity was a single 10meg Internet circuit with an IPSEC VPN (not landed on the firewall but on a router) to another site.
When I swapped out the firewall the users noticed a big improvement. The firewall is not doing anything out of the ordinary - no IPS or VPN, just standard state full inspection.

View 5 Replies View Related

Cisco Firewall :: ASA 5520 - Routed Management Interface On Transparent Firewall?

May 5, 2013

I have an asa 5520.  How would I configure my dedicated management interface to be able to route off subnet while the firewall is in transparent mode?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved