Cisco Firewall :: Understanding ASA 5505 Service Contracts?
Feb 18, 2013
I currently have 2 5505 SEC BUN as Primary/FO Firewalls and I am considering purchasing the ASA5510-AIP10-K9 for use as a dedicated IPS device. Looking at [URL] I see that for service updates, CON-SU1-AS1A10K9 is available for this product, providing "IPS Signature and Engine Updates" and "OS Updates."It is my understanding that in the ASA5510-AIP10-K9 there are 2 OS:
1. ASA OS
2. AIP SSM-10 OS
My question is: Are both the ASA and AIP SSM-10 able to receive "OS updates" with this service contract?
View 3 Replies
ADVERTISEMENT
Mar 1, 2013
ASA 5505 Version 8.2 or older nat (inside) 1 10.0.0.0 255.255.255.0nat (INTF4) 1 10.0.4.0 255.255.255.0nat (INTF5) 1 10.0.5.0 255.255.255.0nat (INTF6) 1 10.0.6.0 255.255.255.0nat (INTF7) 1 10.0.7.0 255.255.255.0global (outside) 1 209.165.200.235-209.165.200.254 netmask 255.255.255.224global (outside) 1 interface
I believe this setup does the following. The inside interface and interfaces 4,5,6,and 7 will translate using this line....
global (outside) 1 209.165.200.235-209.165.200.254 netmask 255.255.255.224
and if the addresses run out is will start using the ouside interface IP address to translate, so traffic is not disrupted and is based on the line of configuration.....
global (outside) 1 interface
My question, does it do this because of the order of the configuration..
global (outside) 1 209.165.200.235-209.165.200.254 netmask 255.255.255.224global (outside) 1 interface
or would it do it that way even if it was like this?
global (outside) 1 interfaceglobal (outside) 1 209.165.200.235-209.165.200.254 netmask 255.255.255.224
and if so why?Now let's convert the above configuration to ASA 5505 Version 8.3 or newer.
object network OUTSIDE-NAT-POOLrange 209.165.200.235 209.165.200.254object network INTERNAL-SEGMENTSsubnet 10.0.0.0 255.255.248.0nat (any,outside) dynamic OUTSIDE-NAT-POOL interface
My question is how does it know to use the outside interface as a backup when the OUTSIDE-NAT-POOL is depleted?Also why do I need to define the INTERNAL-SEGMENTS ? Doesn't the "any" in the (any,outside) take care of that?Also wouldn't the "any" in (any,outside) cover interface 3 or DMZ which could be an issue?
View 7 Replies
View Related
Oct 23, 2012
I have found cisco's config for dynamic DNS on an ASA. However, I have seen many articles that the ASA doesnt support the HTTP update method that most dynamic dns services use.
View 2 Replies
View Related
Mar 15, 2011
Have a customer who has two ISPs right now and only using one through a basic SOHO router. Looking to upgrade to something that supports dual WAN and allows connections from outside in on both WAN ports. There are 25-30 inside hosts.Requirements: Allow incoming connections on BOTH WAN ports to a single inside host
-This is a web app that needs as close to 100% uptime as possible
-Round robin DNS is set up
-Failover for internal people should one of the ISPs go down
Looking at either an ASA 5505 with Security Plus or an 891 Integrated Service Router.
View 1 Replies
View Related
Feb 13, 2013
connecting ASA 5505 with the Action Tech Router?
View 1 Replies
View Related
Apr 30, 2013
I'm trying to support a friend. They just switched to TWC Business Class from Megapath. They have a Cisco 5505 ASA and are trying to configure it to work with the new TimeWarner cable modem. But we can't get PCs behind the firewall out to the Internet.
We think it should be a pretty simple config. They have the ASA connected directly to the modem. The modem is running DHCP, and we''ve configured the ASA to get its address via DHCP. We have a Windows server behind the firewall; it can't get out the Internet either. It's set up to be a DHCP server and is giving IP addresses to the PCs on the network.
Laptops connected via wifi to a wireless router attached to the modem are able to connect to the internet, thus we know the modem is up and running fine.
Here's our running config:
ASA Version 8.4(1)!hostname ciscoasadomain-name opanslab.comenable password yYME2neTGgA0S1./ encryptedpasswd yYME2neTGgA0S1./ encryptednames!interface Vlan1nameif insidesecurity-level 100ip address
[Code].....
View 5 Replies
View Related
Apr 26, 2012
I want to be able to gather some time metrics based on source IP, and destination port. Is it possiable to track how much time a user spends using a service based on it's port number. I have figured out how to capture all the data, and I can then look at timestamps, but I would like a better way if possible. Can this be done at the firewall, or do I need a different appliance?
View 1 Replies
View Related
Oct 10, 2011
Any document which expalins what you need to know when looking at purchasing an ASA5505. Which clearly describes the verious permitations and combinations of these lovely little boxes?
I recently purchased a basic: ASA5505-BUN-K9
I realise now this comes with 10 internal users, 2 ssl and no anyconnect mobility. All these can be purchased as additional licenses.
Its my understanding that to support unlimmited Internal/Inside hosts - I need to purchase the L-ASA5505-SEC-PL (Security Plus License)
1) What is the model I should go for if I want to support unlimmited interneal. Can a 5505 be purchased with with security plus?
View 10 Replies
View Related
May 16, 2011
When I create a service object or group and add the object to a new rule it never works.I mean the traffic match not the rule. I see not hits.I placed the rule on top of my access list to check if I do somethink wrong but it is not working. When I place only a service for example tcp/23 it is working.
my ip service object
object-group service g-as400 description access client 2 as400 machine service-object tcp-udp destination eq 397 service-object tcp destination eq 137 service-object tcp destination eq 2001 service-object tcp destination eq 3000 service-object tcp destination eq 445 service-object tcp destination range 446 447 service-object tcp destination eq 449 service-object tcp destination eq 5010 service-object tcp destination eq 5544 service-object tcp destination eq 5555 service-object tcp destination range 8470 8476 service-object tcp destination eq 8480 service-object tcp destination eq
[code]...
View 8 Replies
View Related
May 25, 2013
does the cisco wlc 2504 (software release 7.4) support QoS per-user bandwidth contracts ? I only can see the default QoS profiles (gold, platinum...) i can't see the per-user bandwidth contract to modify it. shoud it be activated ?
View 3 Replies
View Related
Aug 16, 2011
One of our customers have one Cisco WLC 2100 (firmware 5.2) with 4 AP Mesh 1522, in a city deployment. In order to achieve local regulatory, has to implement bandwidth limitations per user.
I got screen captures of WLC QoS Profiles options, with Average Data Rate in Per-User Bandwidth Contracts. So my question is, do I need any other equipment to achieve per user bandwidth limitation? Can it be done with WLC QoS options?
View 3 Replies
View Related
Jun 3, 2012
I am trying to confgure a L2L VPN tunnel to a service provider using an ASA 5505.My problem is that the service provider will not accept traffic from a LAN subnet, they will only accept traffice from a public IP.We have a small public subnet of x.x.x.50/255.255.255.248, our public IP (outside interface IP on the ASA 5505) is x.x.x.50 and the service provider wants to see traffic coming from us on x.x.x.51How can I NAT our LAN subnet (10.0.0.0/24) to one public IP (x.x.x.51)?
View 14 Replies
View Related
Dec 8, 2012
I am currently trying to understand Subnetting via CCNA. My progress is going well,I understand the class below:
Class A 0-127 Max IP 2^24 = 16777216
Class B 128-191 Max IP 2^16 = 65536
Class C 192-223 Max IP 2^8 = 256
However I have seen an example from an ip calculator website, and noticed this :
Address: 192.168.1.0 11000000.10101000 .00000001.00000000
Netmask: 255.255.0.0 = 16 11111111.11111111 .00000000.00000000
Wildcard: 0.0.255.255 00000000.00000000 .11111111.11111111
=>
Network: 192.168.0.0/16 11000000.10101000 .00000000.00000000 (Class C) - I would have thought this would have been Class B?
Broadcast: 192.168.255.255 11000000.10101000 .11111111.11111111
HostMin: 192.168.0.1 11000000.10101000 .00000000.00000001
HostMax: 192.168.255.254 11000000.10101000 .11111111.11111110
Hosts/Net: 65534 (Private Internet)
Is this an invalid IP/masks as the max hosts is 65534 (which should be class B?). If so shouldnt the IP address range from 128-191- eg 172.16 (I know that CIDR is the amount of 1's. ).What calculates the class is it the netmask or the range of the first octet?
View 1 Replies
View Related
Jul 19, 2012
I have four networks:
172.19.0.0/16
172.20.0.0/16
172.21.0.0/16
172.22.0.0/16
I understand that the summarize route is 172.16.0.0 (255.248.0.0)However I'm trying to understand which other networks fall under this route and how
View 2 Replies
View Related
Jun 27, 2011
I need to understand why change audit report reports an unused username Name of the user who performed the change. This is the name entered when the user logged in. It can be the name under which the LMS application is running, or the name using which the change was performed on the device. #The User Name field may not always reflect the user name. The User Name is reflected only when: A config change was performed using LMS. #A config change was performed outside of LMS, but the network has username-based AAA security model, wherein authentication is performed by an AAA server, which could be TACACS/RADIUS or local.
View 2 Replies
View Related
Dec 22, 2010
I need to understand security bundles. I purchased a Cisco Security Bundle, Advanced Security, 64F/256D. part number CISCO3825-SEC/K9. My expectation from this device was that I will get an IOS based firewall with no need for an additional firewall module. however, the supplier is telling me that I have to buy a firewall module to use the feature. Isn't the bundle supposed to come with all I needed since is a bundle?
Is there any command I can use to verify if this device is really what I paid for? what can can I check for in the sh inv and sh ver commands? I don't see any information from these commands.
View 1 Replies
View Related
Mar 20, 2011
Understanding and configuring windows gateway
View 1 Replies
View Related
Feb 23, 2011
When I connect to a public wi-fi connection (e.g. library, hotel, Starbucks), am I sharing the same IP address?
View 19 Replies
View Related
Aug 19, 2011
Looking at the logs RV220W I can read the following lines:
[rv220w]Fri Aug 19 18:28:54 2011(UTC) [rv220w][Kernel][KERNEL] Clearing the ISR a800000003378400
[rv220w]Fri Aug 19 18:30:39 2011(UTC) [rv220w][Kernel][KERNEL] Clearing the ISR a800000003378200
[rv220w]Fri Aug 19 19:23:04 2011(UTC) [rv220w][Kernel][KERNEL] Clearing the ISR a800000003378e00
[ code] ....
What are they?? and what should be done ????.
View 2 Replies
View Related
Oct 28, 2012
I am a D-I-Y type of guy and have managed to setup Apache on my LAN and make it accessible via WAN over port 80 and Tomcat on port 8080.I aim to possibly get a home web server up (will calculate the costs), but I need some questions answered about networking.
My understanding on ports are that they can be a risk if left open (which I have done) if there is no service or application listening on my side on those ports.So I take it that leaving those ports open and removing the services or applications that run on my side for these ports is a major security risk?
I noticed though that Xampp (1.8.1) does not allow requests over WAN unless I set my password for Apache. Does setting this password imply that Xampp is safe to use in a production environment?
View 1 Replies
View Related
Feb 28, 2012
We have a situation where services are stopped on the real servers. The probes fail and we confirm the services are not running on the server. We cannot access the ports from the ACE directly. We can still however acces the VIP on the TCP port (L4 VIP class-map). So we can still telnet to the VIP on the port from thr Client side of the network.This is on ACE 20 Modules deployed in Routed mode. The version of software is A2(3.3).
Tried removing multi-match and loadbalance policies as well as class-map and re-applying then re-appyling the service policy to interface. Same behavior,This is a problem at another level as some services are being monitored by GSS via TCP keep-Alive and this obviuosly causes a problem as the service then never goes off-line.
View 10 Replies
View Related
Aug 12, 2012
how to change the order of the groups that are displayed at the SSL VPN sign in page? I am using an ASA-5520. Right now the anyconnect client group displays above the clientless SSL intranet group and I want it reversed.
View 6 Replies
View Related
Jan 10, 2013
We've recently inherited a platform with little handover and also minimal networking experience.We're going 100 miles an hour in learning, but I'm a bit confused with the idea of a L2 switch with no IP assignments to ports, so using VLANs, and a L3 switch with IP assignments. And the combination of both.We have 2 Cisco 3750 switches, along with a whole host of other hardware, so we're starting at this "gateway" to start breaking things down.
View 7 Replies
View Related
Apr 16, 2012
I've been working on breaking down and understanding the default auto qos configuration on a Cisco 3750 in the hopes of putting together a QoS strategy that will fit our environment. I'm having some difficulty understanding how the "mls qos queue-set output" syntax works.
From another post, at [URL], the author offers the following example and explanation;
mls qos queue-set output <1/2> threshold 2 400 400 100 400thresshold 1: 400%
thresshold 2: 400%
thresshold 3: 100% (implicit, not configurable)
reserved: 100%
max: 400%
However, I'm having trouble understanding what is meant. Here, it looks like it's saying, for example;
mls qos queue-set output 1 threshold 2 400 400 100 400
How come there is syntax stating "threshold 2" when in the succeeding part the 400 refers to thresshold 1 and threshold 2 again? The syntax 400 400 is, apparently, already referring to thresshold 1 and 2, no?
View 1 Replies
View Related
Jan 16, 2012
I have been trying to understand from a long time about the throughput capacities of variety of Cisco Routers and Switches. Have searched over a million pages on cisco.com for data sheets/documents/etc. but havent succesfully got a single document highlighting all of what i need.
I have got queries on the below issues:Which model of Router can support upto 2Gig's of WAN Internet connection running BGP? Any list of routers and switches supporting variety of throughput's from 1 MB to 1 GB.I have heard some experts stating "Switches don't have throughput concerns as they switch the traffic and don't need to route traffic" How true is the statement?? and if it is, Why do we require 6500's instead of 3560 Distribution Switches.
View 3 Replies
View Related
Jan 13, 2013
I need to understand the USB interface.
View 4 Replies
View Related
May 14, 2013
How to create a mixed service ports on ASA 8.4(2)?I need to create a service group which has ICMP, TCP ports and also different UDP ports.Normally you would create different service group based on TCP/UDP/TCP-UDP/ICMP/Protocol and add then to new nested service group.But I want to create a new service group where you can define everything without the need to different service groups and nesting them into a new one.
View 1 Replies
View Related
Mar 20, 2013
I just got 2 Cat6504 Chassis and 2 ASASM pluged in them. show version from submodule ASA as follow:
SVC-APP-HW-3#show ver
Cisco IOS Software, trifecta Software (trifecta-SP-M), Version 15.1(1)SY, RELEASE SOFTWARE (fc2)
[Code].....
I want to upgrade new OS for ASA to 8.5 (asa851-smp-k8.bin) but after copy this soft to the module, I can not "write" command or when I reload this box, everything was no changed. SVC-APP-HW-3#write startup-config file open failed (No such device)
View 2 Replies
View Related
Mar 25, 2013
I have a fresh installation of LMS 4.0 on windows server 2003, when i click to open topology i get error message : ANIServer service may be down or Host name isn't DNS resolvable
i tried pdshow -brief ANIServer ===> service UP
DNS is working using host file in driversetc i restarted the server
restared the crmdmgtd
unistall / install java plugin
pdterm ANIServer
pdexec ANIServer
NO change ..
View 6 Replies
View Related
Jun 13, 2012
I have an inside network using PAT to one outside address. Our DNS server is on another local, but outside address. I can't get the inside network to successfully get addresses.I have another inside address that just uses the wirewall and gets addresses just fine from the same server.I have the box checked in ASDN that enables DHCP on the inside interface and points to the correct DHCP server,PAT service is working properly if I use a hard coded address for a machine on the inside network.This is an ASA5540 with 8.3(2)
View 2 Replies
View Related
Mar 8, 2013
I currently have 2 5505 SEC BUN as Primary/FO Firewalls and I am considering purchasing the ASA5510-AIP10-K9 for use as a dedicated IPS device. Looking at url... I see that for service updates, CON-SU1-AS1A10K9 is available for this product, providing "IPS Signature and Engine Updates" and "OS Updates."
It is my understanding that in the ASA5510-AIP10-K9 there are 2 OS:
1. ASA OS
2. AIP SSM-10 OS
My question is: Are both the ASA and AIP SSM-10 able to receive "OS updates" with this service contract? Essentially, I want to make sure that when I submit by budget, there isn't another contract that I also need.
View 8 Replies
View Related
Jul 3, 2012
we have two ASA (ASA2) with 8.3 version and ASA 7.2 (ASA1) , we have SNMP service active on ASA2 with 8.3 ASA version.Usually we do SNMP request from devices behind NAT on the ASA1 to the ASA2 SNMP service , two weeks ago suddenly we could not do request from devices behind NAT.
We check process (Sh process) from ASA2 and SNMP is running, we run "no snmp server" , and we reconfigure it on ASA2, ACLs to access SNMP seems well, and shun table seems ok too, to finish we check with packet tracer from ASA1 to ASA2 in ASA2 wizard and it seems well.We check SNMP UDP request from ASA1 to ASA2 in ASA1 wizard with packet tracer and it seems OK.Are there any automatic traffic rule ACL on ASA to protect to from multiple request ?
View 5 Replies
View Related
Jan 7, 2013
We have a problem with some websites being blocked every now and then. Everyone inside can access this external website for weeks, and then suddenly it's not available for a few hours, and then it comes back. All without me making any changes to the firewall, ASA5510. The external website that has nothing to do with us can be accessed from anywhere outside our network, example on my iphone through Verizon.
We have not set up any rules about blocking websites, all I found was the Default Service Policy. After backing up and then deleting the rule we are able to access all sites.
View 2 Replies
View Related
