Cisco Security :: ASA5505 To Allow SMTP Relay And ACL Static Created Is Not Working
Dec 30, 2011I am trying to configure my ASA5505 to allow SMTP relay and the ACLStatic I created is not working. [code]
View 3 Replies
ADVERTISEMENT
Cisco Firewall :: ASA5505 8.4(4)1 Access-Lists Created In CLI Do Not Show In ASDM
Apr 30, 2013Yesterday, I configured ASA via CLI for Static PAT and created some entries in an access-list. I will be testing that setup this evening.
However on a quick double check of the settings on the device via ASDM I could not see the acess-list settings. I searched every tab and found nothing so I PuTTYed into the device and checked the running config. The rules I created were right there. Is this something I should expect? If so doesn't it defeat the point of having a GUI if it does not show a complete running config?
Cisco Firewall :: ASA5505 - ACL For SMTP Inbound
Dec 29, 2011I am trying to configure my ASA5505 to allow SMTP relay and the ACLStatic I created is not working.
View 1 Replies View RelatedCisco Firewall :: ASA5505 (8.4.2) How To Access Inside SBS-Server On SMTP / RDP
Oct 25, 2011Using an ASA5505, have 1 static outside address, want to access an inside SBS-Server on SMTP, RDP (3389), HTTPS and port 987
Have configured network object nat rules using the asdm, SMTP works (I can telnet to the server on port 25 from outside), however for some reason I can not telnet inside and out on port 25, so outgoing mail does not work. RDP does not seem to work from outside, 987 I havent tested from outside. When I try to create a network object nat rule for https I get this message from the ASA:
[OK] object network SBS-HTTPS
object network SBS-HTTPS
[ERROR] nat (inside,outside) static interface service tcp https https
NAT unable to reserve ports.
Cisco Firewall :: ASA 8.4 - Static NAT With Outbound SMTP
Mar 30, 2011Below is the interesting part of my config. I have static NAT configured and working inbound for the Exchange Server and the Barracuda, however outbound traffic from those hosts comes out as the interface IP. Thoughts? I've tried a number of things (outside, inside), etc.
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network DSN-EXCH01
host 10.250.231.51
object network MAIL-IN
host 10.250.231.50(code)
Cisco Firewall :: ASA5505 8.4.2 NAT To Forward SMTP And RDP Traffic To Internal Host
Nov 26, 2011I am new to the ASA series and I am at a complete loss as to why I cannot configure this router to forward SMTP and RDP traffic to an internal host.
The packet trace tool in ASDM shows complete end-to-end connectivity for RDP but it still fails to connect from outside. This is my config file, what I need to change in order to make it work?
Cisco Security :: 2821 / Unsupported SMTP Parameter
Apr 19, 2006We are running IOS12.4(5a) on a 2821 and have "ip inspect esmtp" enabled. We noticed that every day several emails end up in the postmaster account with the following message:
"A mail message was not sent due to a protocol error.
500 Firewall Error
The message that caused this notification was:"
On closer inspection the router logfiles show:
Apr 20 08:54:19 loghost 830747: 810587: Apr 20 08:54:19.441 BST: %FW-3-SMTP_UNSUPPORTED_PARAMETER: Unsupported SMTP parameter (Data Size (> 20000000)) from initiator (172.16.1.6:3537)
But the emails in questions are just a few kB. So what is going wrong. This is especially disturbing because the users don't get a notification that the email has not been delivered.
Cisco Security :: 7200 - No IP Bootp Server On A DHCP Relay Agent?
Mar 18, 2003I have a Cisco 7200 acting as the DHCP relay agent on my network. From a security standpoint, I want to disable the bootp server, with 'no ip bootp server'. What bearing, if any, does 'no ip bootp server' have on DHCP activity?
View 8 Replies View RelatedCisco WAN :: NM-1CE1U Working On Router 2600 / Configured With Frame-relay
Jan 22, 2013I have a NM-1CE1U working on my router 2600 , configured with frame-relay . But seems it does not work on my router 2811. I have check that the replacement is HWIC-1CE1T1-PRI , right ？
But the problem is these two modules have different interface type , I want to keep my cable interface type and find one module card working on 2800 or 2900 router , can configure frame-relay.
Cisco VPN :: ASA5505 Static L2L Tunnel - Won't Come Up
May 9, 2013We have a HUB ASA5505 SEC+ with a few other ASA's connected to it via L2L VPN. We have 1 active Static L2L, 1 Active Dynamic L2L, and I'm currently trying to add a Second Static L2L Tunnel.I verified that each WAN Interface can ping each other, and both devices have full internet connectivity. There is no double nat or content filtering going on either. I did notice that my Cisco Remote Access VPN Client won't connect properly through the ASA despite full internet connectivity, but when I connect directly to the modem I was able to connect properly. So apparently the ISP isn't blocking IPSEC traffic AFAIK.
Static2 is currently using a Temporary TAC License since our license is currently awaiting arrival, but a show version output shows that all VPN/3des features are enabled. [code]
Cisco VPN :: ASA5505 - Static Route To L2L Tunnel
Feb 14, 2011Got a problem routing trafic to my L2L tunnel...
Got an ASA5505 Sec+ with ip 10.45.10.1 on inside interface. Firmware 8.3(1). Got another Cisco router (From my ISP) with ip 10.45.10.254 - This one creates an L2L tunnel - To the 10.45.20.0/24 net.
On the 5505 ive got "route inside 10.45.20.0 255.255.255.0 10.45.10.254 1", and trafic is being directed to 10.45.10.254 as it should.
I know cause I can ping everything one the 10.45.20.0/24 net - But thats it... Cant RDP, connect to fileshare... Nothing.
When i test a PC and set it to gateway 10.45.10.254 I can access everything on the remote network. Do I need some NAT command or an access-list? I've setup AnyConnect VPN on the ASA and I can connect to both networks without any problems.
Cisco VPN :: IPSEC VPN From SRP521 Dynamic IP To ASA5505 Static IP
Jun 18, 2012I'm having problems configuring an IPSEC VPN between an SRP521 with a dynamic IP and a ASA5505 with a static IP. Static to Static is fine between these devices and I can configure that without problems. Dynamic to Static however.
View 1 Replies View RelatedCisco Firewall :: Multiple Static Port Translations On ASA5505
Aug 15, 2011I am at a loss on configuring a new ASA5505 for multiple static port translations.I would have expected to simply add several service command to a network object to complete the task, however, the service command overrides the previous and replaces rather than adds to the translations. [code] However, if entered in that order the 8443 overwrites the 8080 static translation.What is the correct procedure to establish multiple translations? If someone could also provide the "old" style for pre 8.2 release, I'd like to compare because I thought I used to do this with an access-list somewhere.
View 4 Replies View RelatedCisco VPN :: Anyconnect Clients Not Following Internal Static Routes On ASA5505
Feb 9, 2012I have just purchased an ASA 5505 for my remote users to access our internal network. I have followed all the setup instructions I can find. I am able to establish a VPN connection using the Anyconnect client and can see some of my internal network. (Basically, only the subnet of the internal interface) However, I have several subnets inside my LAN which are routed by another switch inside my LAN. I have built in the correct static routes so that the ASA will send traffic to that intenal routing switch for any subnets not part of it's inside interface subnet. I can see and ping those subnets from the ASA itself but the AnyConnect clients cannot.
View 9 Replies View RelatedCisco Security :: ASA5505 Upgrade From K8 To K9
Jan 31, 2013We have cisco asa 5505 series ulbunk8 and if it is possible to upgrade it to k9?
View 5 Replies View RelatedCisco Firewall :: Security Plus License For ASA5505
Jul 2, 2012I have Cisco ASA5505 8.2(5) connected with Cisco 5520 8.2(1) via IPSEC tunnel, I was able to SSH from the inside 5520 to inside IP of the asa5505. but I after I upgrade the license to security plus at 5505 I lost the SSH and ASDM to inside IP of 5505 from the inside network of the 5520. however I still can use SSH and ASDM on outside IP of 5505.
I did a lot of testing to make it work but I couldn't I added SSH 0.0.0.0/0 inside and outside also I added acl on both interfaces. when I did a trace on the outside interface from the private network of 5520 to 5505 inside IP I got IPSEC spoofed by the way that trace only works with security plus because I try to test on all my other firewalls 8.2(5) it shows nothing and all my firewalls can accessed from the private network 5520 except the one with the security plus!
Cisco Security :: ASA5505 Dual ISP Capability?
Jun 18, 2008I have two ISP's and I want to channel specific traffic out of an interface based on traffic type. Will the ASA 5505 security bundle allow me to route specific traffic out through a specific interface?
View 2 Replies View RelatedCisco Security :: Changing ASA5505 Configuration To Use Different ISP
Mar 22, 2012We have had an ASA5505 for close to two years. About a year ago, we added a second ISP ("BOB") which became our primary and our old one (SBC) became our backup. I successfully modified the config for this and it's been working well.
Now we're changing our primary ISP to Comcast and getting rid of BOB, so right now we actually have 3 ISPs coming into our building.
I removed the BOB interface and routes, then added an interface for Comcast using an IP address from the range they provided as well as a static route to the gateway they provided - everything is analagous to the previous interfaces and routes, but it doesn't work. If I physically disconnect the Ethernet cable going to the Comcast cable modem, then the ASA does fail back to the SBC interface as expected. If I put the BOB interface & route back in there, it works again through BOB.
If I connect a PC to the Comcast cable modem and use an IP/Gateway they provided, the Internet connection *does* work. Using this same exact IP info in the ASA doesn't work.
Is there some other configuration item besides interfaces and static routes that I should be modifying? Is there some way I can dig deeper into the ASA to see exactly what is failing?
Cisco WAN :: ASA5505 - SSL VPN Not Working
Jun 16, 2011I have ASA 5505 with outside interface IP 206.206.206.5 I configured the SSL vpn on this but still i am getting page can not be displaed when opening https://206.206.206.5 from broadband.
Below is the related configuration in ASA. What needs to be done in order to able to connect SSL vpn.
group-policy GroupPolicy1 internalgroup-policy GroupPolicy1 attributesvpn-tunnel-protocol IPSec l2tp-ipsecwebvpn functions url-entry file-access file-entry file-browsing
tunnel-group DefaultWEBVPNGroup general-attributesdefault-group-policy GroupPolicy1tunnel-group DefaultWEBVPNGroup webvpn-attributesnbns-server 10.10.10.11 timeout 2 retry 2
policy-map type inspect http Http_inspect_policyparameters protocol-violation action drop-connectionclass BlockDomainClass resetpolicy-map global-policyclass global-class inspect dns inspect esmtp inspect ftp inspect netbios inspect rsh inspect rtsp inspect snmp inspect sqlnet inspect tftp inspect xdmcp inspect icmppolicy-map inside-policyclass HTTPTrafic inspect http Http_inspect_policy!service-policy global-policy global
webvpnenable outsideurl-list nuk001 "abc002" cifs://10.10.10.1 1
Cisco VPN :: ASA5505 Configuration Not Working
Mar 8, 2011I would like to configure a cisco ASA5505 IPSEC VPN. I used the wizard and tried to connect to the outside .. does not work .. The network is configured in this manner: - ADSL router with public address and internal address 192.168.2.1 -> firewall interface inside and outside 192.168.2.2 192.168.3.1 (my network is 192.168.3.0). I used a VPN to the pools ranging from 192.168.4.1 to 192.168.4.100.
INTERNET ----- ROUTER ------ ASA5505 -------LAN
What should I change? there could be problems between the router and firewall?
Cisco VPN :: ASA5505 - Vpn Client Is Not Working
Dec 12, 2012, I have ipsec vpn setup on an asa5505 at one of my office locations but when I try to log in to the vpn with the vpn client it just dont work but I have a Linux laptop with vpnc loaded and that connects just fine no problems there ? by the way on my windows system i Have vpn client 5.0.07 asa5505 8.0.(4) asdm 6.1.(3)
View 5 Replies View RelatedCisco Security :: ASA 5510 Client Static IP
Sep 28, 2011I have a ASA 5510 that uses Radius for Authentication. What I am trying to do is assign each user that logs into VPN to have a specfic static IP based on userid. I have about 30 to 50 users. I don't want to complicate this by having them select a different profile when logging into the ASA. What is a clean and simply way to assign user static ip and not use local database for login?
View 1 Replies View RelatedSecurity / Firewalls :: Static IP Will Be Changing With The New ISP?
Apr 27, 2011I am looking for some resources on what steps would be involved in configuring a Cisco ASA 5500 when obtaining a new ISP. Since our static IP will be changing with the new ISP, just need to know what configurations changes will need to take place. We currently have a working config with DSL, but are switching to cable. We are using a DMZ configuration, and are going to try using ASDM first since that should be easier
View 3 Replies View RelatedCisco VPN :: ASA5505 Client 5.0.07 Not Working On Windows 7 64-bit
Jul 20, 2011I installed on 2 different PCs (Win7 64-bit) the Cisco VPN Client 5.0.07 with the same VPN profile for 2 different users. We use an ASA5505 (8.0(5) sec plus license) as the VPN end point for the clients. The VPN Clients can connect simultaneously to the ASA, they receive the split tunnel infos but only ONE client can ping the internal network ip range. The other one has no access to the internal resources! When they separately try to connect, there is no problem. Each of them can reach the internal net.On other 2 PCs (Win 7 32-bit) the clients have no problem reaching the internal net (simultaneously connect).
View 0 Replies View RelatedCisco VPN :: Split Tunneling On ASA5505 Not Working?
Mar 29, 2012I am currently trying to configure an Easy VPN connection from an ASA 5505 to and ASA 5520. I have enabled split tunnelling and in the group policy defined the network to be tunneled but when I activate the VPN it tunnels everything from the host computer connected to the ASA 5505. I get no internet access. Have been trying to troubleshoot this for days.Hee are soe specifics, running version 8.2(5) on the 5505 and the 5520 and below is the local config on the 5505 for the Easy VPN:
vpnclient server **.***.***.**
vpnclient mode network-extension-mode
vpnclient nem-st-autoconnect
vpnclient vpngroup dbernstein-5505 password *****
vpnclient username dbernstein password *****
vpnclient ipsec-over-tcp port 10000
vpnclient enable
and the downloaded dynamic policy:
Current Server : 12.***.163.**
Primary DNS : ***.160.***.39
Default Domain : cisco.com
PFS Enabled : No
Secure Unit Authentication Enabled : No
User Authentication Enabled : No
Split Tunnel Networks : ***.160.***.0/255.255.255.0
Backup Servers : None
Cisco Firewall :: ASA5505 PPPOE Is Not Working
Aug 23, 2011I am trying to get a Cisco ASA5505 to get onto the internet using PPPOE through a Netgear DG384 ADSL router. I have the Netgear in Modem only mode - if you put it in Router mode internet access works fine. When I change it to Modem mode, the error I get on the ASA is PADI timeout. Looking through the config I think I am missing a Global NAT??Also not 100% on the best way to set the IP - we have a static IP from the ISP. Do you set the interface to use DHCP and get this address or set it statically? Then do you put the setroute option or put in a static? [code]
View 5 Replies View RelatedCisco Security :: ASA 5505 8.41 Dynamic NAT / Static Configuration
Apr 17, 2011I'm having some issues configuring NAT statements on my ASA5505 which has recently been upgraded to 8.41.
I have a single dynamic IP on the outside interface of the ASA and would like all internal hosts to NAT/PAT to it. In addition, I would like to have several ports 'forwarded' to internal hosts, one of which is TCP/4343. With the current configuration all hosts are NATing to the external interface properly but the service running on TCP/4343 is not accessible from the outside. See command output below:
"sh run object" output:
object network DrJones host 10.81.220.90object network LAN-10.81.220.0 subnet 10.81.220.0 255.255.255.0
"sh run nat" output:
object network DrJones nat (inside,outside) static interface service tcp 4343 4343object network LAN-10.81.220.0 nat (inside,outside) dynamic interface
"sh run access-list" output:
access-list inside_access_in extended permit ip 10.81.220.0 255.255.255.0 anyaccess-list outside_access_in extended permit icmp any any echo-replyaccess-list outside_access_in extended permit tcp any interface outside eq 4343
Cisco WAN :: ASA5505 Inter Vlan NAT Exemption Not Working
Dec 4, 2012Short version is we cannot communicate between our subnets.We have a Cisco ASA 5505 we are using for our network router. We have a Netgear L3 switch behind that with 10 vlans. Each VLAN is on its own subnet. (10.0.10.x/24, 10.0.11.x/24, etc)We have PAT for each subnet to our outside interface. Each subnet NATs out properly currently.I have NAT exemption enabled for 2 of the subnets (eventually I will need all, but am just testing at the moment). I have tried multiple ways for the NAT exemption to allow all traffic from our inside VLANS. At this point in time I am trying to get "Engineering" to communicate with all hosts on "AuthUser". I can ping some hosts, but not as many as if I am directly on the interface. I can reach a port 80 service, but not 443. I cannot access anything via hostname or NetBIOS.What am I missing to allow higher security level interfaces to fully communicate with lower security level interfaces?
View 0 Replies View RelatedCisco Firewall :: ASA5505 Web Filter Stopped Working
Dec 29, 2011We care currently using an ASA5505 as our firewall and redirecting web traffic to a S160 Iron port. Recently the web filter stopped working and the only way to get filtering again is to reset the redirection.
1. Is there any available log information to find out about the WCCP process and maybe way it stops?
2. Are there keep alive packets or anything of that natural between the ASA and Ironport?
Cisco Firewall :: ASA5505 / Port Forwarding Not Working?
Apr 6, 2012I'm not able to access my Slingbox from the outside. I've set up port forwarding on port 5001 to allow outside connections in, but port forwarding isn't working. Am I missing something?
object network INSIDE-HOSTS
subnet 10.10.10.0 255.255.255.0
object network Slingbox
host 10.10.10.254
object-group protocol TCPUDP
[code].....
Cisco Firewall :: ASA5505 Transparent Mode Not Working
Feb 19, 2013I have a cisco ASA5505 configured in transparent mode. This evening we attempted to plug a couple of new servers in but they simply didnt work, despite our test server working absolutely fine. The server IP's are all in a network object group (the same as the test server) and they're all using the same ACLs etc. I'm relatively new to configuring cisco equipment.
the only thing I can think of is a static route I had to add to get the managemet IP to work might be causing problems.route outside 0.0.0.0 0.0.0.0 XX.XXX.132.1 1(IP addresses obfuscated- servers are all in the same range so assume XX.XXX is the same across all IP's).
Cisco VPN :: ASA5505 Remote Access - Randomly Stops Working
May 9, 2013I have noticed a problem recently that our Remote Access VPN will randomly stop working. I will be able to connect and enter my Username+Password and it says Connected, but I cannot ping Remote Resources. If I check VPN Client Statistics, it shows Many Packets Sent/Encrypted, but None Received. It seems this problem affects all devices at once, but leaves the L2L tunnels intact.
It seems to randomly start working for a while, and everything seems fine until it stops working again. I verified that it is not a firewall problem, and it occurs on multiple ISPs and computers.
We also have 2 Static L2L Tunnels, and 1 Dynamic L2L Tunnel all of which operate flawlessly. All sites/remote users use split tunneling.
Below is the config, I just added the keepalives on the RA Tunnel to see if it would work, I haven't noticed any difference yet.
ASA Version 8.0(2)
!
hostname HQ-ASA5505
domain-name xxxxx.local
[Code]....
Linksys Wireless Router :: E1000 Static IP Address For Security Cam App
May 2, 2012I have a problem viewing my security cam on my android IP cam app.I forwarded port on my router to my security cam then fixed security cam to have a static IP but my computer being on DHCP, after reboot changed IP, so I lost connection to android IP cam app.I read on a forum,that If your camera is using DHCP,setup your router so that it always gives the same static IP address for the camera based on it's MAC address but where do you set this up a Linksys E1000 router & on Samsung Y? so I can view my security cam on my android IP cam app.?
View 9 Replies View Related
