Our ESP traffic is passing through multiple nodes and we can not establish the tunnel. and I want to know which node blocked ESP traffic. How to trace which node blocked ESP traffic ?
View 5 RepliesI have a two ASA 5520's and I want to be able to see or monitor the traffic between each tunnel. I am using external addresses but for the sake of this question I will use the following: 1.1.1.1 to 2.2.2.2 . How can I montior the traffic?
View 3 Replies View RelatedI have an ASA5510 with 8.3 and a Cisco PIX525 (retiring). The ASA was for VPN traffic only while the PIX was for all other Internet traffic. I'm trying to move all the traffic to the ASA5510 so I used the PIX to ASA migration tool. I migrated the PIX rules over to the ASA5510, however we can't receive email and there is no external access to our internal websites. But the VPN connections remain intact and internal users can get out to the internet.
When I run Packet Tracer on my outside (incoming rules) the packets are dropped at the inside interface. What am I missing?
I've just bought a ASA 5505 to project my LAN. I've already use Cisco router in the past but it's the first time with ASA line.Everythings work except one major point, the return traffic is blocked by the system… I don't really understand how the zone based firewall is supposed to work but it seems OK by default, my LAN side is allowed to talk with the Internet but Internet is not allowed to directly call my LAN. The NAT is setup to use the IP of my outside interface.When I try to ping a public server, the ASA debug log show me that the communication can go out the network, with the good translation, then go back to the ASA from the public server and here, the ASA block it because the communication is not allowed.I've only found two workaround:
-allow inside trafic with static rules, and I say NO ;
-disable the zone based feature by settings all zone to the 0 level…
How I'm supposed to make my state-full firewall work with zone based feature?
I got ASA 5510 with base license, can I block all Peer-2-Peer traffic from inside to outside.
ASA Giga 0/0 connected to ISP Router 2811
ASA Giga 0/1 connected to LAN switch 3560
I am facing the following problem. SmartPhone is connected WiFi hotspot. Suppose SmartPhone ip is 10.0.2.2 and hotspot ip is 10.140.13.12. I am able to send data from smartphone to a server(over internet) which has static ip and sender details in server are hotspot ip. Problem is sending data from server back to smartphone. Tried sending to 10.0.2.2(smartphone) from server but packets are not received.
View 3 Replies View RelatedI am able to ping the node but when i try to access the systm using backslash i am uable to access it and an error of host inaccessible.
View 1 Replies View RelatedI have 3 WRV200 that I want to install in 3 cities.I want each router to have its own Internet connection from the local ISP.I then want each router to connect to the other 2 routers and create a 3 node WAN using VPN connections.
View 1 Replies View Relatedto grant not to show the certificate error adevertise to all clients connecting to guest services (because obviously they don't have the CA root certificate of our company), we have purchased a wildcard certificate from Verisign in order to work with all of our PSN Common Names and friendly url for sponsor and mydevices. But when I try to import it to more than one PSN the following error message is shown " The certificate already exists in the data base".How can I import the same certificate (with the same private key) in every PSN in a node group?
We have ISE 1.1.2
I'm constantly seeing that the sync and replication status for my secondary admin/monitor node in the primary node as node not reachable. The secondary still thinks it is in standalone mode. When I run the ISE diag tool connectivity tests I am able successfully ping the devices from each other using both hostname and ip and the nslookup also works fine between both nodes. Ping and nslookups also work from different networks within the environment. The two nodes are in the same vlan on a 6500 vss pair but on different switches of the pair.
View 6 Replies View RelatedI have several locations with time clocks (a Kronos application) on a small home network with outgoing traffic wide open.I have a server in my office behind an ASA5505 router/firewall, also with outging traffic wide open. I have tried taking the device off of the remote network and giving the it a public, static ip address so it is actually on the internet, yet the server cannot see the device, but it can ping it. I was advised to put the device on the remote private network and set up a virtual server using port 8080 at the remote location. The server is still unable to see the device. I also set up a virtual server for VNC. When I am on my server on my work network behind the ASA5505, I can start my VNC viewer and attach to the device at the remote site using the IP of the router (apparently the device has a build in VNC server).
I have also tried to NAT my server to a public IP, I have set up incoming and outgoing rules on the firewalls at both ends.this should be a fairly straight forward connection.
I have a PIX 515e running version 7.2(4).I have 2 interfaces - DMZ3 (sec lvl 50) and LAB (sec lvl 100) behind the pix. There is also the OUTSIDE interface (sec lvl 0) which connects to the internet.In DMZ3 I have a webserver - x.x.124.217/24 (host is NATed via static command to public IP)In LAB I have a server - x.x.1.203/24 (entire range is NATed via NAT/Global statements to public IP)The server in LAB needs to access a webserver in DMZ3. From the internet both of these hosts have public addresses that are NATed into the inside addresses. I can reach the webserver from the internet, but not from the LAB interface.I think I have to add a static command so that the LAB host can access the DMZ3 host without accessing the internet.
View 3 Replies View RelatedI wish to purchase Cisco Prime LMS 4.1, particularly Cisco part # R-LMS-4.1-500-K9 which support 500 Cisco nodes.We have about 360 Cisco switches/routers/ASA/FWs/WLCs so the 500 nodes license would seem to suffice for now & for future growth.We also have about 200 lightweight APs that are managed & monitored by our WLC/WCS/Navigator environment.According to the device support documentation for LMS, it supports and I assume will auto-discover these APs.Does that mean these APs will use up node licenses on LMS even though management of the APs is done by WLC/WCS? If so is there an easy way to suppress discovery of APs by LMS so we don’t have to purchase extra node licenses for LMS? Or, does LMS offer additional support features for wireless APs not already offered by WLC/WCS/Navigator?Just trying to understand how many network node licenses for LMS I have to purchase.
View 3 Replies View Relatedi'm stuck at registering inline posture node to primary node. I doing fresh install both ISE appliance using version 1.1.1, patched all 3 available patach version after install. AD and DNS were perfectly configure, ping using hostname able to resolve Everything set, so both PSN and iPEP generate CSR and ready to let CA server to signed. But anyway this is the outcome i get Error message "Unable to authenticate. please check server and CA certificate."
01. - What certificate template to be use primary node and inline posture node? I having problem the CA certsrv won't show computer template for inline posture node. can i use web server template and on the extension include client autthenticaiton andserver authentication on this case?
- What certficate template use for primay node CSR?
02. According to Cisco ISE user guide 1.1.1, it mentioned "Creating certificate trust list in Primary ISE Node"
So first action is importing Root and CA certificate . my rootCA.cer import to certification operation certifcate store, while CSR generated then Bind CA certificate. question, should i check anything like "Tust for client authentication" checkbox or any other option to be check? How about Inline Posture node, should i export the CA certificate and import to primary node's certificate store?
we operate an active/passive cluster with 2 ASA5510 in Routed Mode. Is it possible to add another node, so that we have one active and two standby nodes in the cluster? Unfortunately, I have found no documentation on this .... The data sheet say only up to 10 nodes can be mentioned as a VPN load balancing cluster.
View 1 Replies View RelatedI would like to ask, given that i got 2 units of ISE-3315 appliance, one need to be primary node for admin-policy service-monitoring, another unit then become Inline posture node.For the preparation on line posture node, what shoud i do on it?
01. For the unit ready to become inline posture node, so I just boot it, install the OS from sractch (using version 1.1.1), then start the initialize setup etc, like Normal setup?
02. Before i regieter, what is the deployment nodes i should select for inline posture node unit? provided the admin-policy service-monitoring will become primary node, and registration for inline posture node will be next action.
I am trying to track down a device that's blocking a certain port I know there are programs out there than will do a trace-route that's on TCP but is there any programs that allow you to specify a port?
View 6 Replies View Relatedhow to trace ip adress during chat
View 2 Replies View Relatedhow to trace IP when proxy is used.someone I know is playing a prank that might cause my marriage to break.That person uses proxy with many different IP and also a loopback. does anyone know how to trace the IP even with the above is used.
View 2 Replies View RelatedIs there any way to trace a device using Ip address?
View 2 Replies View RelatedI want to know the return path between my IP and a server. I know that trace route gets some information about the hops from my IP to a server (for example www.google.com) but this info is about the forward path. But I want to know what is the path from the server to my PC, what is the reverse path (return path)? What are the middle hops? In other word, I want to know where is the forward and reverse path when I ping a server? I can find the forward path using trace route, but what about the return path?
View 7 Replies View Relatedtrack my laptop
View 2 Replies View RelatedI am receiving trace back logs in the 881G with 3G module. And after reload, the router is going to Initial Config. mode. What the latest IOS is?
Current IOS I am using is c880data-universalk9-mz.151-1.T3.bin. Any better IOS for complete efficient use of the PCEX-HSPA-G Module ?
If my computer was stolen could I locate it using the unique mac address? And is this why burgular didn't take two laptops when they burguled us last night
View 1 Replies View RelatedWe use microsoft exchange for outlook. I want to know which ports are being used by our exchange server to receive and send emails. Is it possible to check that?
View 1 Replies View Relatedi think someone took my laptop i can not know unless i can track it i have all the info on the laptop i still hae the box but i desperatly need to know where, basically someone has it and is telling me it is mine but will not let me see it.
View 1 Replies View Relatedour laptop missing at banaganapalli kurnool dist andhra pradesh
View 1 Replies View RelatedWe have a ASA 5505 and a 5510, that we are using site to site.I need to traceroute from the 5505-5510.. From the outside interfaces.. Don't want to do this through the site-to-site.I have temporarily added a few acl on the outside interfaces.when i traceroute it only goes one hop.. Maybe thats the way it suppose to be? I need to know all the hops between the outside interfaces on the 5505 to the outside interface on the 5510.
View 12 Replies View RelatedOur Firewall is just new. ASA5525X
Today, during a packet_trace to debug a routing problem, the active ASA
- thsasaprd02 - crashed suddenly.
I was able to copy-paste the console - including the command that triggered it - After the reboot I ran the command again, on the same ASA - after doing a manual failover - the command succeeded normally.
How to trace firewall and load balancers placed in data center.
View 6 Replies View RelatedWithin the past week,my facebook and yahoo mail accounts have been invaded and deleted. I know it is an iphone. I found several ip addresses.
View 1 Replies View RelatedHave win7 system, cisco WIRED 1720 router, ~1.5mb frame relay via C&WPanama, nortons antivirus installed. IP config dump is at the bottom, but in this event, I don't think my problem is local.An important work-related chat quit working today, and I have narrowed down the issue to not being able to connect to the provider website from my current location. (I can connect via US proxy, but cannot run the java applet via the proxy, it seems it is still trying to go from here to there).
The site I am trying to reach is host7.parachat.com, IP 64.13.158.24
I can load this page (just a landing page comment) as well as their main pages via us proxy, but time out trying to load directly. Fiddler returns a 502 error, socket connection failed.
have tested on 3 machines (all on same router), then on a laptop which hadn't been booted or updated in over a year (also on same router). Trying to find a free wireless network to test with the laptop, but that hasn't been found yet.
[code]....
i was looking to trace back a website from 2 months ago but not sure how to get into the history of the laptop,
View 1 Replies View Related