Cisco Firewall :: Get ASA 8.2(1) Working With FTPS On IIS 7.5?
May 16, 2012
I found the link that effectively said PIX/ASA 7.x does not support FTP with TLS/SSL (FTP/FTPS). I can't find anything which states whether it works on a later release? We have 8.2(1) and we are struggling to implement it. The FTP/FTPS server is in the DMZ and is hosted by Windows 2008 IIS 7.5. How to get this solution implemented, as the contractor from our local Cisco vendor spent 3 hours on it and couldn't get it working this morning.
View 1 Replies
ADVERTISEMENT
Mar 19, 2012
there was remote FTP - users behind ASA5540 can connect to it.
Now, with this ftp there is SSL/TLS encryption added and users behind this ASA can't connect to this FTPS.
It this possible for users behind ASA to connect to FTPSs?
View 2 Replies
View Related
Apr 13, 2012
We had an ASA 5510 as a firewall in our environment, and there is a requirement to access an ftps server from our location. Currently from the server location they configured everything by allowing our public ip to their server and gave the following details to access ftp.Please suggest which traffic needs to be allowed in our ASA to access the ftp server address as mentioned above. From my initial analysis, it's found that 989 port is also enabled for the access, but that was not mentioned by them.
View 1 Replies
View Related
Feb 11, 2013
I have a problem when trying to access from a workstation on the internal network to an external FTP server using Explicit FTPS. After the server requires the client TLS Authentication the client inits TLS but the connection is closed by timeout.
I have disabled the FTP inspection on the firewall and I have opened some high ports from the Internet to the test workstation (ACL and NAT rules), but without results.
If I try to connect from a workstation to the FTP server using a direct Internet connection I can access the FTP server without problems, so I think the problem is in the ASA.
View 6 Replies
View Related
Jul 15, 2012
my ASA config does not work? My config is attached in a txt file.
I tried to forward port 25 and 110 from the outside to the inside server, but I can't connect...
View 36 Replies
View Related
Nov 10, 2012
I have a windows 2003 server and an ASA 5512
I'm trying to use SSLVPN and it was all working, and I don't believe any configs on either box have been changed.
On Friday people were connecting, but now I get a message "Login Error" in the browser. In the ASDM home 'latest ADSM Syslog Messsages' I get "AAA authentication server not accessible", followed by two messsages AAA Marking LDAP server in group as FAILED AAA Marking LDAP server in group as ACTIVE
When I go to configuration --> Remote Access VPN --> AAA/Local Users AAA server groups and click on my RADIUS server and click Test, it takes a while and says ERROR: AD agent Server not responding: No error
If I stop my IAS server on my Windows box i get the same error but much more quickly.
I have a sonciwall set up doing the same thing, and RADIUS seems to work happily, so I don't think it's the server config...
View 5 Replies
View Related
Jun 2, 2012
I recently acquired a used ASA 5505 and have encountered issues with getting the PoE output on Ports 6 & 7 working. Theese two PoE ports are behaving like all the other ports (100mbit, Vlan 1). Per the best I could Google, I made sure the all relevant ports are set to "auto" for duplex and link speed. Again, the ports do work for data - just not PoE. The LEDs light up ok.
I've tested four different working devices that can be powered off PoE with it, and all failed to power up using a straight-thru Ethernet cable connected to ports 6 & 7.
Ubiquiti PicoStation M2
MikroTik OmniTik
MikroTik RB450G
MikroTik RB433
What should I do to get PoE working? Is it a defective unit?
: Saved
: Written by enable_15 at 18:56:43.926 CDT Sun Jun 3 2012
!
ASA Version 8.4(4)
[Code].....
View 1 Replies
View Related
May 20, 2013
i'm trying to setup my 5505 for SSH but it seem doesn't work. console and HTTPS/ASDM are working.
my teraterm is just stuck with the user/password screen. also tried using putty but still failed.
ciscoasa# exit
Logoff
Username: admin
[Code].....
View 2 Replies
View Related
Jan 14, 2013
I have recently upgraded ASA to 8.4 and found that ASDM is not working on it. I tried the latest ASDM version 7.1 still no luck. When I try to access ASA using IE...it just shows " Page can not be displayed "
Following is the config which I have
http server enable
http 0.0.0.0 0.0.0.0 inside
http 10.52.193.218 255.255.255.255 inside
asdm image disk0:/asdm-711-52.bin
asdm location 0.0.0.0 0.0.0.0 inside
asdm history enable
Is there anything else required in ASA 8.4 for ASDM to work? When I telnet to ASA interface with 443 port it works
View 8 Replies
View Related
Jul 22, 2012
I have a server (172.16.10.1) inside the LAN and IP of the server has been maped to public IP 41.219.130.10.
Topology
Server(172.16.10.1)
DNS Server (8.8.8.8) ----- Outside ASA Inside ----------- |
User (192.168.1.x)
Users are using Public DNS Server to resolve the domain. In this case, users will resolve the server domain to public IP address 41.219.130.10 instead of 172.16.10.1 that cause the server is unreachable for the users by default.So I enable DNS modification feature on ASA. DNS keyword has been add to static NAT clause. ASA suppose to modify the DNS record to change the public IP to private IP address. But it is not working.
access-list inside_acl extended permit udp any host 8.8.8.8 eq 53
access-list outside_acl extended permit tcp any host 41.219.130.10
access-group inside_acl in interface inside
access-group inside_acl in interface outside
[code].....
View 9 Replies
View Related
Jul 11, 2011
We recently upgraded our ASA to 8.3, most everything went ok, but I am having problems with outgoing nat. It seems that when one our systems that needs to be natted to an outside IP address when connecting out is not doing it. When that system goes out the ip address is our internet IP and not the natted address, however, inbound everything works.
We have one rule that does PAT
nat (INSIDE,OUTSIDE) source dynamic OG_IP_NAT_DMZ obj-1.1.1.1This is the natting statement that should be translating the addressesobject network obj-10.200.0.10
nat (INSIDE,OUTSIDE) static 2.2.2.2I think I need to double nat, is that right if so how?
View 9 Replies
View Related
Oct 7, 2012
I am not able to telnet or ssh to ASA running 8.2.5(33). [code] I am able to ping inside interface of the ASA. Telnet gets stuck at Trying
View 2 Replies
View Related
Jul 1, 2011
I configured ASA 5510 with IOS 8.4.2 version. I configured SSH to outside and backup interface with any any permission.
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 backup
configured password with command
passwd < Password>
While connecting from outside through Putty i am not able to authenticate the password.
Aftter entering user name as pix its asking password. After entering its not authenticating.
I taken output by telnetting to inside after connecting to the firewall from outside and entering username as pix
PM-ASA-5510# sh ssh sessions
SID Client IP Version Mode Encryption Hmac State Username1 122.169.252.112 2.0 IN aes256-cbc sha1 KeysExchanged pix OUT aes256-cbc sha1 KeysExchanged pixSPM-ASA-5510#
View 5 Replies
View Related
Aug 22, 2012
Our NOC is trying to configure a site to site tunnel to one of our customers. The tunnel is up and operational, however we can't get our NAT rules to match what we want.
We are running ASA version 8.4(3)
The traffic is sourced from 172.16.1.50 (inside1) and destined to192.168.2.9 (outside), the nat configuration is posted below:
NOC-ASA5510-01# show run nat
nat (inside1,inside2) source static ng-noc-networks ng-noc-networks destination static ng-inside2-networks ng-inside2-networks
nat (inside1,outside) source static test test-EXT destination static otherside otherside
object network obj_any
nat (inside1,outside) dynamic interface dns
object network servers-noc
nat (inside1,outside) static 192.168.1.68
Here is the output from the show nat detailed:
NOC-ASA5510-01# show nat detail
Manual NAT Policies (Section 1)
I left off entry 1 but it doesnt have any translated hits either
2 (inside1) to (outside) source static test test-EXT destination static otherside otherside
translate_hits = 0, untranslate_hits = 624
Source - Origin: 172.16.1.50/32, Translated: 192.168.1.67/32
Destination - Origin:192.168.2.9/32, Translated:192.168.2.9/32
Auto NAT Policies (Section 2)
1 (inside1) to (outside) source static servers-noc 192.168.1.68
translate_hits = 0, untranslate_hits = 187
Source - Origin: 172.16.1.101/32, Translated: 192.168.1.68/32
2 (inside1) to (outside) source dynamic obj_any interface dns
translate_hits = 58417, untranslate_hits = 1511
Source - Origin: 0.0.0.0/0, Translated: 192.168.1.66/29
Here are the network objects:
object network test
host 172.16.1.50
object network test-EXT
host 192.168.1.67
[Code]...
View 2 Replies
View Related
Jul 2, 2012
When i install my ASA5505 i get the following message? "This platform has a Base license.
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CNlite-MC-Boot-Cisco-1.2
SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05
i2c_write_byte_w_suspend() error, slot = 0x0, device = 0x40, address = 26 byte
count = 1. Reason: I2C_UNPOPULATED_ERROR"
View 5 Replies
View Related
Mar 8, 2012
I've got an ASA 5510 running 8.4.I have a host on an inside interface, with a static NAT configured on the ASA. The inbound/return half of the NAT doesn't appear to be working. [code] I run a ping from the host (192.168.100.98) to something on the outside (1.2.3.4)Running captures, I can see the outbound ping leaving, having been NATed OK. I can see the reply coming back in to the outside interface with the correct IP address, but I never get the final NATed packet appear on the inside interface. The packet just disappears inside the ASA.
View 2 Replies
View Related
Jan 16, 2012
I'm trying to configure an ASA 5520 with cut-through proxy feature. The user is required to be authenticated when trying to access an outside resource from the inside. This is a test lab before it is implemented in production. [code]
View 15 Replies
View Related
Sep 6, 2011
When we had 8.2.2, we bought a Mobile license to make the iPads running AnyConnect happy. I applied it, but since we'd only purchased one license, it broke failover. 8.4 lets you share tracking licenses, and since we were planning on the upgrade to 8.4.x anyway, I figured no big deal, I'll get that straightened out when I do the upgrade.
Did the upgrade this weekend, and I still can't get things happy, the boxes don't see one-another:
Here's a show failover on the primary:
Failover OnFailover unit PrimaryFailover LAN Interface: failover GigabitEthernet0/3 (up)Unit Poll frequency 1 seconds, holdtime 15 seconds Interface Poll frequency 5 seconds, holdtime 25 seconds Interface Policy 1Monitored Interfaces 6 of 160
[Code].....
View 3 Replies
View Related
May 21, 2012
I've been struggling to get ASDM (PDM) installed and running on my PIX 515e. The PIX IOS version is 7.2.4(30) The ASDM version I've copied to flash is 524.
I've followed the Cisco documentation verbatim, however I still cannot connect via the Java ASDM client or via http. When I try to connect via http, my PIX shows the following error: "tcp access denied by acl from..." I do not this this is a security (ACL) issue as I've tested after opening everything up and still no luck.
Here's my running config (w/ the relevant statements prepended with ">>>"):
show run
: Saved
:
[Code]....
View 14 Replies
View Related
Apr 26, 2011
Just upped our external ASA-5540 pair to 8.4(1), and now one of our nat's is busted.
Here's the lowdown:
Our public IP for our IronPorts ends in .167. That IP is natted to a VIP on our ACE, which load balances to the IronPorts.
The outside interface of the ASA uses .162, which has been the pat for all outbound traffic for a few years... except for the subnet that houses the IronPorts. Due to reverse lookup, that subnet uses the .167 IP address for all outbound traffic.
After the code upgrade, the nat won't work. No email sent or received. Nothing but Deny's on the ASA with flags reading either "SYN" or "RST". IE: Apr 27 12:56:11 10.22.151.41 local5.crit %ASA-2-106001: Inbound TCP connection denied from 69.25.174.17/36917 to 207.236.211.167/25 flags SYN on interface outside
If I return the subnet pat back to the outside interface, then inbound traffic works fine, though reverse lookup fails and anyone running a reasonable spam filter won't send to us.
View 6 Replies
View Related
Jan 28, 2013
i have 2 internal server sitting in inside interface
inside network vlan 1 ip address 192.168.0.20, and 192.168.0.22
i going to map 192.168.0.20 to public ip routable address 203.117.124.180 and 192.168.0.22 to public ip routable address 203.117.124.181
the purpose is to make those 2 server 192.168.0.20, and .22 to be able to access remotely using public routable ip address,
however, after done the configuration i still not able to ping or access the public IP Address mention above. my both server are turn on and can access internally.both server are also able to access internet. See below partial configuration retrieve from Show Run.
nat-control
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
nat (Antlab) 1 0.0.0.0 0.0.0.0
[Code].....
View 2 Replies
View Related
Aug 23, 2011
I am trying to get a Cisco ASA5505 to get onto the internet using PPPOE through a Netgear DG384 ADSL router. I have the Netgear in Modem only mode - if you put it in Router mode internet access works fine. When I change it to Modem mode, the error I get on the ASA is PADI timeout. Looking through the config I think I am missing a Global NAT??Also not 100% on the best way to set the IP - we have a static IP from the ISP. Do you set the interface to use DHCP and get this address or set it statically? Then do you put the setroute option or put in a static? [code]
View 5 Replies
View Related
Nov 14, 2011
I implemented a ASA5510 with latest software version. I configured outside interface, default route, PAT to the outside interface. I am able to ping and telnet to the inside interface of the ASA.But internet is not working.Did i miss any configuration?i enabled icmp to outside,. i did a ping to the next hop from ASA. but it is not working.
View 6 Replies
View Related
Dec 16, 2011
I'm trying to get a new 5505 installed in our network to replace the 1841 that died over the past few days (memory issues). One of the big pieces of functionality that the old router gave us was the ability to open certain ports to the outside world to let clients see web sites we were working on for them or let employees RDP in to their work machines. I'm having trouble getting that working properly with the new device.
After a lot of trial and error, I finally got some ports working, but only for some IP addresses. In theory, Comcast (our ISP) is routing 13 IP addresses to our device (a.b.c.177 through 189). For historical reasons, the external IP of the device is .178. Only those NAT entries for .177, .178 and .179 are currently working. I've attached the configuration of the ASA, as well as the configuration of the old 1841. As far as I know, Comcast's equipment is doing its job, so I don't have a lot of reason to question that end of it. And it was working with the 1841 in place before its untimely demise.
One note - I am also having trouble getting the VPNs working, so they are a work in progress. That will account for some of the differences in the configs.
View 7 Replies
View Related
Apr 6, 2011
I have configured a Cisco router. I am able to ping google from rotuer. I can ping my local IP from router and router local IP to my machine. But I can not access internet on machine. I can not ping google and any other IP out of network.
View 11 Replies
View Related
Apr 16, 2013
there is an issue with tracroute from ASA 5505 with 9.0(2) - here is the running configuration [code] with this running configuration - from the LAN tracerouet to public IP, it is working fine. but once I traceroute from the LAN 192.168.225.x to the corporate networks via the IPSec l2l tunnel - it does not show any hop at all - even the inside interface of the ASA does not show in the traceroute.
View 4 Replies
View Related
Aug 15, 2012
I have a cisco ASA5520 box running with IOS version8.2(5)13 where default policy map is applied globally. But I have not seen any traffic being inspected through included protocol defined under policy map.All configuration seems to be ok for me.
service-policy global_policy global
Global policy:
Service-policy: global_policy
Class-map: inspection_default
Inspect: ftp, packet 0, drop 0, reset-drop 0
[code]....
View 1 Replies
View Related
Mar 13, 2011
We are try to connect ssh via outside system (from Internet) its was not getting connected.
When we try to connect from outside pool of ip than its working.
View 1 Replies
View Related
Mar 27, 2012
I can no longer SSH to a primary active firewall. It had all of a sudden stopped working. However I am able to SSH to the secondary standby firewall without any problems. I did try to regenerate the RSA key on the primary fw, but still unable to connect. The only way I can connect to it is by using telnet.
I ran the "show asp table socket" command and I'm seeing port 22 listening on the primary IP address (not the standby), foreign address is 0.0.0.0:*. I did a packet capture on port 22 on the inside inside, seeing my request hit the fw and then right away a reset back from the fw.
version 8.2.(5)
model ASA5520
I'm hitting a bug in the software version I'm running? Or what else can I check before rebooting the primary fw?
View 6 Replies
View Related
May 23, 2012
I'm having issues with NAT dropping ICMP on default NAT. Do I need to create another NAT for ICMP?
Here's the packet-tracer result:
firewall01# packet-tracer input inside icmp 172.23.1.74 0 10 8.8.8.8 detailed
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
[code]....
View 4 Replies
View Related
Mar 2, 2011
I have an ASA5510 which was running version 8.31. SSH was working fine on version 8.31 but since i upgraded it to version 8.41 the SSH stopped working.
View 7 Replies
View Related
Jan 28, 2013
I am trying to set up a SLA statement on an ASA 5505 version 8.2(5). When I enter the command "sla monitor schedule 1 life forever start-time now" I get a message stating "%Entry not configured."
View 1 Replies
View Related
May 3, 2013
I am having a wierd case, where in i have a 5520 and i am not able to ssh into that firewall. When did a capture on that firewall it shows my connection is getting reset as soon as i try to ssh into the box. Given below is the config for ssh into the firewall.
!
ssh 10.252.253.0 255.255.255.0 inside
ssh 10.114.255.240 255.255.255.255 inside
ssh 169.2.162.75 255.255.255.255 inside
[Code].....
View 3 Replies
View Related
