Cisco Switching/Routing :: ASA5505 - Protect Client From Malicious Attacks And Has CLI
Sep 1, 2012
We are finding the price for ASA 5505 to high and our clients are having problem securing budgets for these devices. We don't want to move to different vendors and we have a team of people we already know Cisco well.I have seen Cisco router 877 which have the ipadvance ios, is this the same as the ASA5505.We would like to offer our clients an alternative to ASA5505, but something which can do the same as a edge device but also protect the client from malicious attacks and has CLI.
View 1 Replies
ADVERTISEMENT
Jun 26, 2011
malcious url blocked messages while using a enternet browsing.
View 2 Replies
View Related
Sep 25, 2012
I have an internal server that is running DNS. I have that server configured to foward out to OpenDNS. I am using OpenDNS to do web filtering for my internal network. It looks as if the relay is not working in the router and that it is not fowarding those dns requests from my internal DNS server and out to openDNS. I have went back and added the name-server option for 208.67.220.220 and 208.67.222.222 (OpenDNS), but that has not fixed my problem.
Here's my running config:
eep-asa(config)# sh run
: Saved
:
ASA Version 8.2(5)
!
hostname eep-asa
domain-name expertep.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
[code]....
View 7 Replies
View Related
Nov 17, 2011
Completly new to Cisco ASA and need to get this working ASAP.ASA 5505 8.4(1) is the secondary FW and I need for it to allow everything going out and block everything coming in but for the VPN clients. Since a Cisco moron, I used the ASDM and it's wizards to make this work, which might explain my situation.
[code]....
My Cisco VPN Client connects to the ASA and receives 10.10.101.1 IP address, but I get no connectivity to the ASA or any other 192.168.101.x server or service (tried telnet, RDP, ping, etc.)
View 2 Replies
View Related
Apr 23, 2013
I did some searching and the answers said it was supposedly possible but no info on how to do it. I am wondering if it is possible to configure a Cisco ASA 5505/10/20 to be a client to an existing (in this case) cisco client vpn. The reasons why are complicated (and imo irrelevant) but basically I need to be able to make a small network that can be on this vpn rather than individual machines.The client vpn is a basic IPSec over UDP Cisco VPN to an ASA5505.So how would I configure another ASA to connect to this like its a client?
View 3 Replies
View Related
Dec 12, 2012
, I have ipsec vpn setup on an asa5505 at one of my office locations but when I try to log in to the vpn with the vpn client it just dont work but I have a Linux laptop with vpnc loaded and that connects just fine no problems there ? by the way on my windows system i Have vpn client 5.0.07 asa5505 8.0.(4) asdm 6.1.(3)
View 5 Replies
View Related
Mar 17, 2012
i have the asa5505. the configuration of asa 5505 is:
: Saved
Code...
i analyzed this traffic i see problem with the nat- Asymmetric NAT rules matched for forward and reverse flows. where i made error?
View 0 Replies
View Related
Apr 12, 2011
I want to set up our ASA5505 firewall to allow access from the Cisco VPN Client software.I have nstalled the client software then tried using the VPN wizard to set up the connection without success, I am running Windows 7 32 bit and Cisco client 5.0.03.0530. [code]
View 22 Replies
View Related
Jul 20, 2011
I installed on 2 different PCs (Win7 64-bit) the Cisco VPN Client 5.0.07 with the same VPN profile for 2 different users. We use an ASA5505 (8.0(5) sec plus license) as the VPN end point for the clients. The VPN Clients can connect simultaneously to the ASA, they receive the split tunnel infos but only ONE client can ping the internal network ip range. The other one has no access to the internal resources! When they separately try to connect, there is no problem. Each of them can reach the internal net.On other 2 PCs (Win 7 32-bit) the clients have no problem reaching the internal net (simultaneously connect).
View 0 Replies
View Related
Sep 18, 2011
I have just purchased and setup a vpn on my ASA5505 and now I wish to setup a Windows VPN client to use it. Does CISCO have any free vpn clients for Windows?I tried to download a client from the CISCO downloads area, but it's for some kind of purchase agreement. I would have thought that the vpn client was free to download given my ASA comes with two free vpn licenses.
View 5 Replies
View Related
Oct 4, 2011
when it comes to IOS based SSL VPN setup, so have run into an issue which I can't seem to find an answer for.
What i'm after is a way to restrict access to an AnyConnect authenticated and connected client, on a specific profile, to a list of specific websites (all on the Intranet). Everything else must be blocked.
On the IOS device, I had it fudged to pretty much retstrict access to a certain IP and port, and used a mod rewrite in Apache to re-write a URL from that IP to the host the site actually resided on. It's cludged together and working, but it's not ideal (and it's not going to allow for scaling up to what I need).
I can find plenty of references here and on the net to using regex to create block lists based on a global policy to disallow specific URLS, but I need the inverse of that, and, only applied to a specific policy group.
Is this possible on an ASA5505? Is it possible on *any* ASA?
View 11 Replies
View Related
Feb 24, 2011
I use VPN Client 5.0.06.0110 to connect my home computer to my office, which has an ASA5505. If my immediate network connection to the PC client is lost while the VPN is active, I get a BSOD. There's no problem if my DSL drops or a cable beyond my router is unplugged. It only (and always) fails if the network cable to the PC running the VPN Client is diconnected (or if my router loses power) while the link is connected.
View 6 Replies
View Related
Feb 1, 2012
I have a PCF file that works fine on Windows XP. The tunnel to the ASA5505 comes up, and I can ping my server at 10.1.1.2.
I take the same PCF file and put it on a Windows 7 machine client version 5.0.07.0440 and the tunnel comes up. But I'm unable to ping my 10.1.1.2 server.
Does something in the pcf file need to change for this version of the client?
View 1 Replies
View Related
Jul 3, 2012
An ASA 5505. Device boots to rommon #0> and stays there. The complete boot record follows:
CISCO SYSTEMS
Embedded BIOS Version 1.0(12)13 08/28/08 15:50:37.45
Low Memory: 632 KB
High Memory: 507 MB
[Code]....
View 15 Replies
View Related
May 24, 2011
I am working with an ASA5505. I have configured a Remote Access IPsec Connection profile. This profile is configured to give clients a virtual ip address via DHCP as shown in this configuration example: url...When the DHCP request is sent from the ASA to the DHCP server, the hostname in the request is set to the name of the IPsec connection profile and a number. Is it possible to have the hostname set to the host name of the client that initiated the connection?Does the ASA support receiving a hostname as part of a IKE Mode Config Request?
View 9 Replies
View Related
Mar 24, 2013
I've deployed AnyConnect on Windows 7 clients, and they are throwing this message after few days of usage: "The VPN client driver has encountered an error."
-Version: anyconnect-win-2.4.0202-web-deploy-k9
-OS: Windows 7 Pro 64-bit
-FW: ASA 5505
What seems to fix it:
1. Uninstall Any Connect Client then,
2. Remove C:UsersUserAppDataLocalCisco folder
View 4 Replies
View Related
May 28, 2012
We have an internal DNS server that all internal hosts do lookups to .. these requests are forwarded onto open dns for anything the dns server isnt authoritative for.. My question is we have purchased the botnet filter and this requires the asa5505 dns client to be active on at least one interface .. Should i point the asa dns to an external IP such as 8.8.8.8 and apply DNS enabled on interface outside ( am using asdm) I don't want the ASA to control DNS for our internal clients we already have a internal server for this, i DO want the asa5505 to check dns packets against its botnet filter, whilst still using open dns for forwarding.
View 1 Replies
View Related
Jun 12, 2012
My first time programming a Cisco ASA - Anyways I''m trying to setup up Ethernet 0/6 to be a DMZ Connection When I add port 0/6 to DMZ it gives me an error saying "The IP Address X.X.X.X /Subnet Mask cannot overlap the subnet of interface outside"So my question is I have an outside connection already configured - How can I make a DMZ connection with the same subnet mask with a different IP?
View 1 Replies
View Related
Dec 26, 2011
How can i create an top 10 list of the most popular website that users connect to through the ASA Firewall.
i have enabled HTTP inspect, and setup an Syslog server (S plunk), that collects all HTTP entries in the log, but i don't know how, to create an top list in s plunk.(don't if it is possible)
is there a better way to do this ? e.g. URL filter with web scene or IPS
View 1 Replies
View Related
Mar 20, 2013
I have an internal DVR system that I am trying to share to the outside world. We recently put in an ASA5505 and I am having trouble getting the settings correct.I want to use an external IP to access the DVR system from anywhere and have my ASA5505 redirect the traffic to the internal IP address. I assume I need to use a NAT and a route policy however can not figure out how it would be.
View 11 Replies
View Related
Jul 28, 2011
I have the below configuration for a cisco asa 5505. There is a ADSL router in front of the ASA which has a static IP. I set up a remote-access VPN (using the wizard), but I cannot connect to the ASA firewall as the attached VPN client log shows. My only concern is that there might be something missing, ie a static route that goes to the inside interface. [code]
View 7 Replies
View Related
Sep 28, 2011
We have two sites connect with an IPSec L2L VPN.
-Site A: 192.168.13.0/24
-Site B: 192.168.2.0/24
On both sites we have a ASA5505(Base license) to terminate the tunnel.On Site B we also got a remote access vpn to which we can connect using the vpn client.The lan2lan tunnel works fine and so the remote access vpn.Now i want to connect to Site A using my vpn client connected to Site B. [code] There are no vpn-filters or other special policys in place..If tried to ping from my vpn client to Site A while i was debugging ipsec 255 on site B: the asa matched the l2l-tunnel for traffic sourced from 192.168.25.x to 192.168.13.x but when im doing a show crypto ipsec sa detail there are no packets getting encrypted..so of course no packets reaching my asa on site a.
View 9 Replies
View Related
Jun 20, 2011
I have a XP workstation behind my ASA that can not connect to a client's network via Cisco VPN Client using IPSec...
In the logs it shows the translation is working on 500 but the VPN Client has the error 412, that the client is not responding.
Config below
ASA Version 8.2(1)!hostname RWFW1enable password encryptedpasswd encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address x.x.x.x
[Code].....
View 16 Replies
View Related
Nov 2, 2011
EasyVPN PIX515 server and ASA5505 client?
View 4 Replies
View Related
Jul 5, 2011
I need to configure our ASA5505 firewall for remote access to our network using EasyVPN software installed on a laptop. That laptop will be connected in the different places, using DSL or 3G toggle or Public Wi-Fi. For some people it's very easy, but I don't have any experience with firewalls.
View 9 Replies
View Related
May 28, 2011
inside network----ASA5505========internet===========Remote VPN client.
The ASA has one public IP on its outside interface and using PAT to the internet. It only has two interfaces, inside and outside using vlan. I created a IPSec VPN through CLI. My goal is for the remote client to browse the Internet throught tunnel.
Q1: Is it possible?
Q2: The remote side gets connected and has IP from the pool, with is part of inside network. But it cannot ping anything, including the gateway, which is the inside interface. I debug it, it shows the ASA receives the ping packages, but it doesnt send anything back to the client.
View 5 Replies
View Related
Jun 22, 2010
I have just configured a ASA5505 running 8.2.2 as a webvpn server for clientless VPN connections.
I need to setup a particular bookmark for a RDP session which forces the use of the java client for those who can't seem to get the ActiveX control working for some reason or another (virus scanners/firewalls/scerutiy policies etc).
I created a bookmark as follows, but it always tries to connect with the ActiveX control first when logging on from an IE client.
rdp://192.168.1.1/?force_java=yes
View 14 Replies
View Related
Feb 2, 2012
I'm having an issue routing between vlans. I have vlan 1, and 2. I want to ping something on vlan 2, from vlan 1. I cannot ping from a computer on vlan 1 to a computer on vlan 2. I can ping each computer from the ASA 5505. I get an error on the ASA when I try to ping from the computers. The error is Failed to locate egress interface for UDP from voice:192.168.0.199/137 to 192.168.1.200/137. I can't understand why it even mentions IP 192.168. 1.200/ 137... I reset the unit configuring it from scratch and still no go. I have no given a static route to the out yet.. I need to get inter-vlan routing working first. [code]
View 13 Replies
View Related
May 23, 2012
I'm building the below network configuration:
WAN -------- ASA5505 ------<802.1q trunk>----- L3 switch -----<802.1q trunk>----- L2 switch w/ VLAN support
The following VLANs exist on the ASA and both switches: VLAN 10 (10.10.10.0/24), VLAN 11 (10.10.11.0/24), and VLAN 99 (10.10.99.0/24).
The ASA5505 performs the following functions: routing to/from the WAN, firewall, NAT, and DHCP for each VLAN. It has an interface on each VLAN (10.10.x.2) for a DHCP server.
The L3 switch provides inter-VLAN routing and layer 2 switching. The L2 switch provides layer 2 switching, with VLAN support.
What should the default gateway on the L3 switch be? Should I set the IP of the physical interface connected the L3 switch to the ASA5505.
View 8 Replies
View Related
May 20, 2012
I'm trying to configure an 1142N AP + 2960-S + ASA5505 with wireless, vlans and trunking with no success. DHCP is provided from my DHCP-server on the inside.
View 4 Replies
View Related
Apr 11, 2013
remote location on MPLS circuit terminated on a Cisco router that has Internet connectivity through Central Site router. We are installing a cable modem at the remote location that is to be used as the Primary Internet Connection but still be able to use Internet through MPLS if the cable Internet goes down. We want the failover/fallback to be handled automatically.
We have an ASA5505 for the cable Internet which then feeds into the ISPs modem.
At first I was thinking about getting a module for the remote router so the cable Internet could be terminated on the remote router as well but that introduces a single point of failure. I would also like to firewall both the MPLS and the cable Internet but if I do so on the ASA there is another single point of failure.
View 2 Replies
View Related
Feb 17, 2013
I have found log from IPS on router WRVS4400N and most of attacks i am getting from 0.0.0.0 IP adress. Is it normal?
View 1 Replies
View Related
Feb 26, 2012
If client gateway = 192.168.64.9 then next-hop = 192.168.64.8 else use default-route 0.0.0.0
I know it's possible to do a route-map match ip-address ACL list. But is it possible to match on gateway?
Some info about hardware and config:
6509-E in VSS (IOS 12.2(17r)SX5) withVS-S720-10G supervisor.
All routes are static, IP for 192.168.64.9 is on SVI vlan.
View 3 Replies
View Related
