Cisco Security :: ASA 5550 / Communication Between Servers On DMZ And Inside?
Feb 15, 2012
We have ASA 5550, I have a citirx server in the dmz which is natted statically to a public ip address for port 443. The dmz server communicate with our internal server (i.e. AD) for LDAP authentication. I have a static transparent nat from inside to dmz for the internal server's communcation with dmz.
When accessing the application from inside the network on the internal web server it works perfectly fine and authenticates with the AD.But when accessing from outside, the reach the citrix server and then the AD authentication fails, basically it works intermitantly. I have tried to check the communcation from the DMZ server to the internal server and the icmp works perfectly fine, even I am able to telnet on the ports specified on the internal servers from the DMZ servers. I tried to look into the logs on the ASA and this is something that looks suspicious to me.
Feb 16 Teardown TCP connection 47646475 for dmz1:CITRIX-DMZ1/47179 to inside:inside-server/80 duration 0:00:00 bytes 1230 TCP FINs
Feb 16Built inbound TCP connection 47646476 for dmz1:CITRIX-DMZ1/47180 (CITRIX-DMZ1/47180) to inside:inside-server/80 (inside-server/80)
Feb 16Teardown TCP connection 47646476 for dmz1:CITRIX-DMZ1/47180 to inside:inside-server/80 duration 0:00:00 bytes 3824 TCP FINs
Feb 16Built inbound TCP connection 47646477 for dmz1:CITRIX-DMZ1/47181 (CITRIX-DMZ1/47181) to inside:inside-server/80 (inside-server/80)
Feb 16 Teardown TCP connection 47646477 for dmz1:CITRIX-DMZ1/47181 to inside:inside-server/80 duration 0:00:00 bytes 1224 TCP FINs
[code]....
View 2 Replies
ADVERTISEMENT
Mar 5, 2011
configure ASA 5510 as below
inside users should communicate with Hosts on the DMZ Zone and at the same time they should go for internet towards outside interface
ASA with 8.3(1)
default security levels
attached is the digram for your reference need communicate form inside to DMZ
View 1 Replies
View Related
Oct 23, 2011
I have a Cisco ASA 5510 configured to access the internet, with an:
inside interface (ethernet 0/1) 130.130.0.254 and outside interface (ethernet 0/0) x.x.x.x
I have now configured another inside interface (ethernet0/2) on ASA with the IP 172.16.0.254 and I have connected it directly to another switch with a management IP 172.16.0.5.
The problem is that the two inside interfaces (130.130.0.254 &172.16.0.254) cannot communicate with each other thus the e0/2 172.16.0.254 interface cannot access the internet.
View 5 Replies
View Related
May 13, 2011
I have ASA5550 ruuning Version 8.3(1) with inside and outside interfaces as below [code] On the inside : I have a server (10.20.10.36) that need to be accessed from an outside host (Y.Y.131.34) , so I have the below NAT/ACL rules. [code] is it right that I have to add two ACL entry for outside host to the NATed IP of the inside server , then again add another ACL entry from the same outside host to the private IP of my inside server o get this communication done?
View 7 Replies
View Related
Nov 30, 2011
ASA 5505 and DMZ, I have a Base License.
What do I need to do for access inside network to DMZ?
I successfully configure, internet Access for DZM and inside network, web server can be accessed from internet, but I have problem to configure communication from inside network to DMZ.
View 14 Replies
View Related
Apr 24, 2012
the inside interface on our primary ASA seemed to "hang". It dropped all the packets it received. Because the interface didnt go down, failover didn't happen. Device's info;
-Cisco Adaptive Security Appliance Software Version 8.2(3)
-Device Manager Version 6.3(3)
-Hardware: ASA5550, 4096 MB RAM, CPU Pentium 4 3000 MHz
-Internal ATA Compact Flash, 256MB
-BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
I attached a capture picture shows that traffic didnt go to the roof when the issue happened. Why the interface would "freeze" randomly?
View 1 Replies
View Related
Mar 16, 2012
I cannot get this to work properly and I've even had a Cisco engineer from TAC set-this up... and it literally broke my inside network. I have a VPN range of addresses..x.x.x.x on the Outside that needs access to a server on the Inside at y.y.y.y. HTTPS/443 connectivity. I need to NAT my VPN subnet/pool in order to talk to the inside host, as that host will not accept traffic from my VPN subnet, but obviously, will accept traffic from Inside my private network.
The Cisco tech entered the following static NAT statement to "fix" the problem - nat (outside,inside) source static VPN Inside-Network destination static Host-y.y.y.y Host-y.y.y.y For whatever reason, whenever this is configured on my ASA 5550 v8.3(2)25 the Inside interface starts proxy arping and assigns all IP addresses on my private network with the MAC address of the Inside interface.
The y.y.y.y is on a remote, routed network within my private, corporate MPLS network. My Inside private network (Inside-network shown in the static NAT above) is x.x.x.x. Not sure why this happens, but it kills my entire network and I have to jump through hoops to quiesce the network and get everything back to normal.I've tried to Dynamic-PAT/hide the VPN range behind the Inside interface through ASDM and that seems to do nothing.The NAT statement above will break my network. How to NAT this connection without killing my Inside network? Or, on how to properly hide my VPN subnet/pool behind my Inside interface and back to the VPN subnet/pool.
View 1 Replies
View Related
Jun 20, 2012
I am setting up a network that will use the 1941 router with a cellular card (HWIC) to connect to the Internet for communication with remote stations in the field. The 1941 has a static IP address (166.142.xxx.yyy) on the Internet provided by the ISP (Verizon). The 1941 is connected via ethernet to the ASA5510. The end goal is to have the field cell routers (Digi Transport WR-44-R, also static IP) connect to the ASA5510 via VPN tunnels for communication back to the servers behind the firewall. I'm not sure exactly how to configure the 1941 so that the remote router can connect to the ASA using the public IP of the 1941 router. I have the 1941 working stand alone and can connect to the Internet and pass traffic, but I tried a static NAT to translate the public IP to the private IP of the ASA and cannot pass traffic. below is part of the 1941 configuration: [code]
Do I need to use VLAN bridging to accomplish the task or am I missing something with the NAT?
View 3 Replies
View Related
Jan 23, 2012
We have ASA 5550, I have a portal server in the dmz which is natted statically to a public ip address for port 443. The application works fine from outside world. The server is also nated with a dynamic nat from inside to dmz and when I hit on the dmz ip from my inside it works fine.
The requirement for us is that the users sitting behind the inside (i.e. LAN) should access the server on the public ip address and not thru the dmz.
View 5 Replies
View Related
Aug 9, 2010
In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it?
View 6 Replies
View Related
Sep 21, 2012
I have 2 dmz interfaces(dmz1 and dmz2) with security level 50. I am able to ping the hosts on dmz2 from dmz1. I am running a service on a dmz2 host on port 82 but i am not able to access that service from dmz1. Also, i have an inside interface at security lever 99 which is able to access that service.
Also, i have defined the following command to allow same security level communication.
same-security-traffic permit inter-interface
View 2 Replies
View Related
Jul 7, 2012
We are going to setup a L2L VPN with a vendor and they asked us to NAT a couple IP addresses for remote access to a couple of servers on our inside network. Our device is an ASA 5580 with version 8.1 and we have a handfull of public IP addresses for use if needed. The vendor's remote network is a public IP address but for this posting I will use 192.168.10.0. Our inside servers are 10.100.10.20 and 10.100.10.30. Because 10.100.10 is in use with another customer they asked us to NAT 10.77.97.20 and 10.77.97.30 to the two inside servers.
View 2 Replies
View Related
Jul 5, 2011
Got a problem accessing our webservers on the inside interface from other clients on the inside interface on our ASA 5505.As in, they type in url... in their browser, and it wont work.
However, if we use a PC on another outside network, it works just fine! [code]
View 2 Replies
View Related
Dec 9, 2012
I need your support for upgrading the Security context license on 5550, at present we have 5 Security context license installed in ASA but we want it to increased till 10 conctexts. I want to understand if we need to get addtional 5 Security context license or 10.
View 5 Replies
View Related
Aug 8, 2012
I have a customer with an 877ISR with zone base firewall. They want to access two servers on the inside from the internet using RDP but with different ports.
Partial configuration.
interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
no ip redirects
no ip unreachables(code)
View 4 Replies
View Related
Oct 30, 2012
Got an ASA5525-X with 8.6 release. We have an inside interface (10.11.1.0/24) and a DMZ interface (10.254.1.0/24). On that DMZ interface theres an SMTP server; by using the Public server feature in ASDM we created a rule so we have mapped the 10.254.1.29 internal ip to an external ip 217.x.x.x Everything is fine; working ok, but for several reasons we need to access the public ip 217.x.x.x from an inside ip (10.11.1.10). I tried to do it by creating an exemption for the dynamic nat; if i don't do that i have a 'deny ip spoof from...' message rolling on my syslogs.Seems to do the trick.....but only for pings! i ping the public ip from the inside ip, and got the reply from the internal ip on the DMZ. But if i want to telnet port 25 from inside to public; its not working.
View 7 Replies
View Related
Aug 19, 2012
I want to implement Active/Standby cluster with a pair of 5550 ASAs and I have a licensing question. Here is the "sh activation-key detail" output from both devices...
ASA1:
sh activation-key detail:
Serial Number: XXXXX
No active temporary key.
Running Activation Key: XXXXX XXXXX XXXXX XXXXX XXXXX
[code]....
This platform has an ASA 5550 VPN Premium license.The flash activation key is the SAME as the running key.So it looks obvious that I'll have to upgrade the first ASA to support 25 SSL VPN Peers in order to build HA cluster, right?Now I want to know do I need the "ASA5505-SSL25-K9" license or something else.
View 12 Replies
View Related
Jan 14, 2012
I am having big problems trying to get what should be a rather simple configuration to work.I have a Cisco 2901 Router and have setup Zone Based Firewall on this.Traffic from the 192.168.223.x network does not pass through to the 192.168.1.x network.my traffic appears to disappear down the big bucket...Interesting I can ping machine on 192.168.223.0/24 network from the 192.168.1.0/24,So the static routes setup on the router on the 192.168.1.0/24 appear to be routing ok.
View 4 Replies
View Related
Apr 4, 2013
I've been using the trial version of a product called Folder Lock on another computer than the one I'm using right now to type this message. I got a little too enthusiastic about locking away folders into Folder Lock on that other computer, and I think I locked away Folder Lock itself.In the past (before this problem developed), when I clicked a Folder Lock icon, it used to prompt me for the Folder Lock password, which I would then input, and then Folder Lock would open, and I could lock and unlock folders. But the problem is that now I don't get prompted for the Folder Lock password. I get a message (from Folder Lock) that says, roughly, "you may not have permissions to carry out that action." So even though I have the Folder Lock password, I can't open Folder Lock, because it won't prompt me for the password, and just says I don't have permissions.I also locked into Folder Lock my downloads folder on that computer, and apparently folders or icons that used to allow me to access the internet on that computer. I can no longer access internet from that computer.I'm wondering how I can get Folder Lock to prompt me for the password, so I can open Folder Lock. I would like to unlock all the folders I locked -- including if I locked Folder Lock itself! I locked away a lot of my important stuff. I wonder if I should do a system restore to a date before I installed Folder Lock, but I wonder if the system restore might fail to delete Folder Lock, because Folder Lock might prevent its own deletion. I have Folder Lock 7. I have Windows 7.
View 3 Replies
View Related
Aug 2, 2012
I'm using Pix 501 with firmware: Version 6.3(3)I have problem with Pix 501:
+ transfer rate data between interface outside and inside very slow, even between 2 interface inside.
+ I have test file transfer between 2 PC connect via interface inside.
+ Results transfer 1 file 1MB with total time 60s
I don't upgrade software current from 6.3(3) to 6.3(5) via TFTP. It's error Please see attach file.
View 2 Replies
View Related
Jun 24, 2011
My son is constantly on social networking sites whilst he ought to be revising for his exams. I have tried blocking his websites from the router but this blocks everyones access to the sites. How can I prevent just him from accessing these sites through the router without interfering with my elder kids acess to the sites? Also i would like to know how to block all proxy servers as he is always using these to bypass my restrictions.
View 5 Replies
View Related
Dec 16, 2011
I am having some challenges on my DMZ network.My servers and Cisco Switches in the DMZ are picking the mac address of the Firewall(Cisco ASA).I have put some static arp entries on the Firewall and switches but the servers and users on the DMZ are still receiving the mac address of the Firewall.How can i stop the Firewall from changing the mac addresses of the devices on the network.My ASA is a 5520 and i have 2960Switches.
View 4 Replies
View Related
Apr 10, 2011
Iam trying to add servers to Tor (torproject.org) to remove country restrictions on videos from different websites such as bbc.com and i don't know how to do it. I got the server but I don't know what do do next?
View 1 Replies
View Related
Dec 18, 2010
I have 2 questions.Om my cisco 2811 (IOS 12.4(15) T9 IPBASE W/O Crypto) i am using 3 interfaces.And i have a pool of Global addresses: 200.x.z.97-200.x.z.126 255.255.255.0
FastEthernet 0/1 description WAN interfaceip nat outsideip address 200.x.y.253 255.255.255.0
GigabitInterface 0/2/0description DMZ interfaceip nat insideip address 10.0.0.1 255.255.255.0
GigabitInterface 0/3/0description LAN interfaceip nat insideip address 192.168.0.251 255.255.255.0
[Code]....
View 8 Replies
View Related
Nov 25, 2011
I'm trying to configure hairpinning on my Cisco 887VA VDSL router, so all LAN users can connect to the server using SMTP port 25 which is also in the same LAN subnet, using external router address, which is assigned to dialer1 interface.Traffic comming in from outside works fine.
External IP: 1.1.1.1/29
PC address connecting to the server: 192.168.101.28
Server address: 192.168.101.200
IOS: 15.1.4M1
[code]....
I'm running tcpdump on the server on port 25 and... nothing happens. The traffic is not going through.One thing that I've notices in debug ip packet is this line:
s=1.1.1.1 (Vlan1), d=192.168.101.200 (Vlan1), len 52, rcvd local pkt
shouldn't source be internal vlan1 IP - 192.168.101.1?
View 3 Replies
View Related
Jun 11, 2013
We are planning to split the Private servers from the DMZ Servers and configure an additional Interface and segment for this purpose.
Private Servers Segment: 192.168.4.0/24 (there is no DHCP all servers' IPs are statically configured)
DMZ Segment: 192.168.3.0/24 (This is a future deployment)
LAN Segment: 172.17.0.0/16
Both, Private Servers and DMZ Servers are in a collocation as well as the ASA5520. There are multiple Branch offices that uses subnets within the 172.17.0.0/16 Network and they are connected to the ASA5520 via Metro-E.
I do not know if this is possible but what I want to do is this:
In order to avoid the change of internal DNS records I want to mask the DMZ servers with a Private Server IP when a Private server or LAN host wants to access it like this:
The FTP server in the DMZ has the IP address: 192.168.3.100. But when a PC from the LAN wants to reach the FTP server it should points to its old IP: 192.168.4.100. This way the PC sends a packet to the ftp.corporate.net (192.168.4.100) the ASA recieves the packet and translate it to the (192.168.3.100) and send it out through the DMZ Interface.
Also if the Private Servers wants to reach the same FTP the ASA will act like a proxy-ARP and send the paquet to the DMZ by means of the translation of the IP.
View 6 Replies
View Related
Mar 20, 2012
I Have exented vlan 120,121 from DC-1 to DC-2,the DC-1 and DC-2 are connected using L2 Trunk over fiber terminated on Cisco 6513 on both site ,the distance around 40 Km ,on the DC-2 i just assigned server-1 TO VLAN 120 while server-2 in vlan 121 ,but these servers unable to communicate neither with DC-1 Servers or betwen them locally on DC-2 ,pls note that the servers at dc-2 rely on DC-1 for routing.
View 7 Replies
View Related
Apr 16, 2011
i'm trying to connect 5 servers together to create a private network.Each server has a network of it's own and i'm trying to make all 5 servers communicate with each other to share and search data simultaneously..
View 16 Replies
View Related
Jan 3, 2013
I have a customer who has vlan's and SVIs residing on a core 6509. the 6509 is connected to an ASA 5515 then out to the internet/sp edge deviceIP routing is not turned on. there is a static route on the 6509 that routes all ip's to the inside interface of the asa 5515 that the 6509 core is connected to.there is a set of vlans that are apart of a 192.168.128.0/19 subnet and all those vlans can "speak" to each other.
View 8 Replies
View Related
Sep 13, 2011
I am working on a Cisco 5510 with multiple interfaces and requirements. I have experience with Cisco IOS, but not too much with the ASAs. I seem to be getting a bit confused on the NATing and ACLs on a firewall that was started by another employee, who is no longer here. With my current config I can get the firewall in place (we are currently using an older PIX) and most basic functions work except for two key things: 1) communication from the finance interface to the inside interface. The finance subnet has some restrictions that you will see in the ACL- we are trying to limit connections to the those systems, but they need to be able access an e-mail server on the inside. 2) communication from the DMZ interface to the inside interface. Maybe related to the first problem?
View 2 Replies
View Related
Nov 30, 2011
I have a stack of SGE2010P switches with 3 vlans (1, 10 and 255) on it. Connected to it via a trunk port, I have a SF300-24P.On the trunk ports, I have vlan 1 untagged, vlans 10 and 255 tagged (on both sides, obviously).On the SGE2010 stack, I can set a ports primary vlan id to vlan 10, and workstations work correctly.On the SF300, if I set a port to type general, and the ports default vlan to 10 (on the port to vlan page), I cannot get any communication to work.This is my first time with a non-CLI switch, and am having real problems figuring out how to troubleshoot this problem.
View 1 Replies
View Related
Oct 12, 2011
I have created a new DMZ and a LAN on my ASA5510.My Ethernet DMZ port is connected directly to a server (192.168.220.10) This server is able to get to the internet properly.Gateway ASA router: 192.168.220.222..My Ethernet LAN port is connected to a L3 switch, This L3 switch is connected to a server (192.168.210.11). This server is able to get to the internet properly.My issues is that I cannot communicate from my 192.168.210.11 server to my DMZ server 192.168.220.10. From my 192.168.210.11 server I can ping my gateway 192.168.210.1 and 192.168.210.222. But I cannot ping 192.168.220.222. [code]
View 7 Replies
View Related
Feb 5, 2011
I have a SA 520W with the following configuration:
-WAN port: Internet access for web browsing and QuickVPN access for remote users
-Optional port: Configured as WAN, for VPN access to another office (Office 2) in the same building throung a public network
-Ethernet ports: Computers on Main Office.
So far I have been able to configure communication between Main Office and Office 2 via VPN.Office 2 have no Internet access, so I need to share the Internet access from Main Office.QuickVPN clients have no access to Office 2, only to Main Office.
View 1 Replies
View Related
