Cisco VPN :: 3745 - Can't Reach Inside Host After Connected To ASA

May 31, 2011

I am having problems accessing our internal network via VPN. We have an ASA at the perimeter that connects to a 3745 router and all of our networks come of that router. I can establish a VPN connection to the ASA but I can’t ping any of our internal host.
 
The internal network I need to access is 172.18.0.0. When I connect to the ASA I get a dhcp address from a pool created in the ASA, the pool is 172.200.1.x. I can’t ping from the ASA to the connected vpn host and I can’t ping from the host to the ASA ip address or to 3745 connected to it.
 
ASA config: 
group-policy NAMEOFPOLICY internal
group-policy NAMEOFPOLICY attributes
dns-server value 172.18.2.2 172.18.2.23

[Code]....

route inside 172.18.0.0 255.255.0.0 172.18.255.1 1 Route on the 3745 back to the ASA ip route 0.0.0.0 0.0.0.0 172.18.255.2 I can’t see anything on the internal network, I can’t even ping the dns servers and so on.

View 3 Replies


ADVERTISEMENT

Cisco Routers :: RV220W Cannot Reach Gateway Or Any Host Behind It

Oct 31, 2012

I have created a connection gateway-to-gateway between RV220W and RVL200, is doing without any problems.For example, I can ping the gateway on the other side. But when I connect trough RV220W QuickVPN (or PPTP) I can not reach the gateway (RVL200) or any host behind it.

View 4 Replies View Related

Cisco :: ASA 5505 SSL VPN Can't Reach Inside From VPN Subnet

Jul 7, 2012

I've setup a SSL VPN to a ASA 5505 and can connect.

VPN network 192.168.2.0 /24
Inside Network 192.168.1.0 /24
Outside is connected to Router.

I am trying to RDP to a win server on the inside network but I cant get to it. Can not even ping 192.168.1.1 or (not sure if I could anyways) 192.168.2.1...

I added a ACL on the outside interface and then inside interface permit ip any any but still no ping or RDP...

New at VPN and have survived so far on cisco docs but this problem is evading me.

: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa

[Code]....

View 1 Replies View Related

Cisco VPN :: ASA 5505 SSL VPN Can't Reach Inside From Subnet?

Jul 6, 2012

I've setup a SSL VPN to a ASA 5505 and can connect.
 
VPN network 192.168.2.0 /24
Inside Network 192.168.1.0 /24
Outside is connected to Router.
 
I am trying to RDP to a win server on the inside network but I cant get to it. Can not even ping 192.168.1.1 or (not sure if I could anyways) 192.168.2.1...I can ping from the 192.168.1.0 net to 10.0.0.0 and 192.168.2.0 without issue but not the other way around....I added a ACL on the outside interface and then inside interface permit ip any any but still no ping or RDP...
 
: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted

[code]....

View 1 Replies View Related

Cisco VPN :: ASA 8.4 Cannot Reach VPN Clients From Inside Hosts

Jun 18, 2012

I am able to reach VPN clients (Anyconnect) only from hosts directly connected to the ASA's inside interface subnet. However, hosts on other internal subnets (177.1.10.0 & 177.1.11.0) are unable to connect to clients on VPN. The ASA is running ver 8.4. [code]

View 8 Replies View Related

Cisco Wireless :: WLC4112 Based WLAN Cannot Reach Any Host But Gateway

Oct 29, 2012

We use a WLC4112 controller with a number of AP1010s.  My controller is uplinked to a 4500, which is then connected to a number of 2950s and 4000s, which are where the APs are connected.    All switches, as well as the WLC, are connected together using gig fiber, configured as trunk, with no trunk allowed VLAN restrictions. We operate a guest network on VLAN 4 (192.168.14.0/24), which aside from the internet gateway (192.168.14.3), provides a couple other services:

     dhcp (192.168.14.50)
     print (192.168.14.49)
 
The gateway is connected to a copper port set to access vlan 4.  The DHCP is provided via an Intel nic configured for vlan 4 (among others).  The print is a Hyper-V virtual NIC set to vlan 4.  There are also hard-wire ports that access this network in various parts of the building, all as "switchport access vlan 4." I have a "guest" network set up on the WLC, operating on dynamic port "Visitor", vlan 4 (192.168.14.48).  My wireless clients get an IP from my DHCP server, but cannot ping (or otherwise communicate with) any hosts EXCEPT the gateway (192.168.14.3), so they can get on the Internet without issue.  The WLC itself can ping any of the aforementioned wired hosts, and all of the wired hosts can ping each other and the WLC.  It is only the wireless clients that refuse to communicate with anything except the gateway.  There are no routers in this network apart from the default gateway, this is a basic /24.  All hosts are masked at 255.255.255.0.  The wireless clients get an IP from 192.168.14.50, though they cannot ping it (but again, everything wired can).My other wireless network, the "corporate" network, does not display this behavior, everything can ping everything. 

View 17 Replies View Related

Cisco Firewall :: ASA 5510 - Anyconnect Client Can't Reach Inside Network

Jan 2, 2012

So, I've set up Anyconnect client access to an ASA-5510.
 
I've got a handful of interfaces, which contain hosts that should be accesible to anyconnect clients.  I'm unable to reach addresses on a specific network, due to what packet-tracer claims is an implicit deny, though I'm unsure where to apply an access-list in this case.
 
fw1# show nameif
Interface                Name                     Security
Ethernet0/0.205          SECURE                  90

[Code].....

View 7 Replies View Related

Cisco :: Can't Ping From Inside To Outside Host?

Jul 6, 2011

configure my Cisco ASA5510 (asa version 8.3.1) so that one of the host (e.g.192.168.8.20) behind management interface can ping to the other host (e.g. 192.168.2.246) behind OUTSIDEinterface. I tried modifying the ACLs, NATs and ICMP statement, but still failed[CODE]

View 19 Replies View Related

Cisco Firewall :: ASA 5505 - Allow (outside) Host To (inside)

May 20, 2011

I have a ASA 5505 Sec Plus. I would like to allow outside hosts to our mail server and also our FTP server. So i would like to allow only SMTP, HTTP (for Outlook Web Access) and FTP.

View 10 Replies View Related

Cisco Firewall :: ASA5505 - Can't Ping Inside Host

Sep 29, 2012

I just try to ping a internal Host but it want to go.
 
Laptop<===>ASA5505
 
Connected is the Laptop at Ethernet 0/2 Inside
 
My running-config is a clear config, only VLAN 1 has a IP and Ethernet 0/2 is up.
 
But If I try to ping to the Laptop I get the followed:
 
asa5505# ping 192.168.1.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
asa5505#
 
From the Laptop to the ASA5505 I can Ping successfully.

View 6 Replies View Related

Cisco Firewall :: ASA (8.4) / Redirect Outside IP Request To Inside Host

Mar 27, 2012

Wondering if on the ASA (8.4) its possible to do something like what DNS rewrite does, but with IP requests.  Scenario.  Mobile phone accesses a web app inside our network fine over cellular.  Once it comes inside on to wifi it still has the public IP address cached so the ASA doesn't allow its request to loop around and the app appears broken.  We're considering lowering the TTL on the DNS host entry but I think we are battling phones/mobile OS's that don't have a strict adherence to name resolution standards.  A lot just seem  to refresh their caches every 10-15 minutes.

View 4 Replies View Related

Cisco Firewall :: ASA5505 Cannot Ping Inside Host

Aug 2, 2011

I have Cisco ASA 5505  installed  and use as default gateway. I go to Internet through the ASA5505 Here is my Problem.I can not ping from ASA prompt(ASA#) to my Laptop connected to the ASA, but i can ping the ASA inside interface from laptop i can not use ASDM  and the VPN Tunnel is not working between the sie
  
ASA# ping 10.10.10.12
???????????
100% lost 
Laptop c
C:/ping 10.10.10.1
!!!!!!!!!!!!!!!!
 
Here is the Topology
 
INTERNET .<=========================>ASA<===============================> LAPTOP
  
I disabled window firewall on the Laptop , but no goof result.

View 3 Replies View Related

Cisco Firewall :: ASA 5520 - PING From Outside Into Inside Host

May 13, 2013

I have ASA 5520. I cannot ping the host(192.168.1.20) which is inside firewall from outside hosts. Inside host (192.168.1.20) is translated into (198.24.210.226) using static NAT.From outside host, I used "PING 198.24.210.226".  Is it because I used dynamic PAT for inside hosts?

interface GigabitEthernet0/0nameif outsidesecurity-level 0ip address 198.24.210.230 255.255.255.248!interface GigabitEthernet0/1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0

[Code].....

View 3 Replies View Related

Cisco VPN :: ASA 8.2 / VPN Connected But Unable To Reach Other Interfaces

Feb 8, 2011

I have  remote access vpn setup and I can get connected with no issues. I assigned the vpn a pool of addresses from the end of my inside interface subnet. When connected I can ping any device on that subnet, I can also connect to my switch on the same subnet via my browser. I can not however access any device located in my dmz while connected. This is a new setup I'm testing but I need vpn user to be able to use rdp to connect to machines in the dmz.
 
Result of the command: "show running-config"
 
: Saved
:
ASA Version 8.2(1)
!
hostname ASA1
domain-name
enable password  encrypted

[code].....

View 4 Replies View Related

Cisco Firewall :: ASA 8.4 - Connection Fails When Host On Inside Tries To Connect To Server On Outside

Mar 9, 2011

We are using an ASA with 8.4 in transparent mode. Connection fails when a host on inside tries to connect to a server on outside. This server uses mac-address 0100.5E00.0000 to load balance but replies with real mac-address.Firewall logs "Deny TCP".ARP inspection is disabled.

View 2 Replies View Related

Cisco Firewall :: Unable To Ping Host From Inside Interface From PIX525

Feb 3, 2012

When I tried to upgrading PIX525  6.3 to  7.0 , Not able to Ping the host from the PIX 525 Inside interface  which is on the same subnet,  Also from the host to Inside Interface ,  Tried with Directly connected  laptop with Cross cable and using Straight cable via switch, But the  results end with fail.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 - Can't Reach FTP Site While Inside Firewall?

Feb 26, 2011

I am trying to configure our ASA 5505 so that our users can access our ftp site using [URL] while inside the firewall. Our ftp site is setup so that you can reach it by either browsing to the above url or by browsing to ftp://99.23.119.78 but we are unable to access our ftp site from either route while inside the firewall. We can access our ftp site using the internal ip address of 192.168.1.3.
 
Here is our current confguration:
 
Result of the command: "show running-config"
: Saved:ASA Version 8.2(1) !hostname ciscoasaenable password qVQaNBP31RadYDLM encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0 !interface Vlan2nameif ATTsecurity-level 0pppoe client vpdn group ATTip address pppoe setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!ftp mode passiveobject-group service DM_INLINE_TCP_1 tcpport-object eq ftpport-object eq ftp-dataport-object eq wwwaccess-list ATT_access_in extended permit tcp any host 99.23.119.78 object-group DM_INLINE_TCP_1 access-list ATT_access_in extended permit tcp any interface ATT eq ftp access-list ATT_access_in extended permit tcp any interface ATT eq ftp-data access-list ATT_access_in extended permit tcp any interface ATT eq www access-list 100 extended permit tcp any interface ATT eq ftp

[code]....

View 6 Replies View Related

Cisco Firewall :: 5520 - Inside Server To See Actual Outside Host Source IP In Udp Packet

Mar 3, 2013

I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server.   The server can get to outside hosts OK, and the traffic is being NATed  properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send  'announcement' UDP packets to the inside server.  I thought this might be an  outside-NAT-required issue to get the traffic routed, but I need the inside server to see the  actual outside host source IP in the UDP packet, so I basically set the  outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the  destination (inside server) subnet, and its gateway is the outside  interface of the ASA, the same way the inside server is able to get to  hosts outside.  The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
 
I have the appropriate ACL's set up, and when I do 'show access-list' I  see policy hits for the 'permit' statements where the outside host is  generating the announcement and it's hitting the ACL.  I even duplicated  the ACL into list 101 and 102, and applied 101 for inbound traffic on  the outside int, and applied 102 for outbound traffic on the inside int,  and I'm seeing policy hits on both permit statements outside and  inside, so it looks like the traffic is being passed on to the inside  interface and permitted, but the server isn't seeing the packets.
 
I can ping the outside interface from the outside, but cannot ping the  inside interface or any inside hosts from the outside, even though I  have 'permit icmp any any' enabled on the ACL on both ints. When I  remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
 
I set up the same scenario in my lab with an ASA 5505, with the same results.  Below is the running config from the 5505 in the lab.  The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
 
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
description Inside LAN Interface
nameif inside(code)

View 6 Replies View Related

Cisco WAN :: C2950 - Monitor Port Where Modem Is Connected From Host?

Jul 22, 2011

I have build topology like this:
 
host------c2950(f0/3)------(f0/4)c3550(f0/41)----modem-----Internet
 
I wanted to monitor c3560 port where modem is connected from host. So for that I configured rspan. configurate show below. But problem is that after configuration f0/4 of c3550 remains up and f0/3 of c2950 goes down. WHen I look at status of f0/4 it show "FastEthernet0/4 is up, line protocol is down (monitoring)". I tried to search websites It seems configuration is fine.

[code]...

View 1 Replies View Related

Cisco Switching/Routing :: 3750 - Port VLAN Setting Reverts Whenever Host Connected

Apr 17, 2013

One of the ports on the 3750 stack was configured for VLAN121. It was changed to VLAN40 and the configuration saved. Both VLANs exist in the switch configuration. As soon as a host was connected (in this case, a label printer) the port VLAN reverted back to VLAN121.

View 3 Replies View Related

Cisco VPN :: Pix 515e - Remote Host Cannot Ping Any LAN Host

Jun 27, 2011

I have a host that can successfully connect to a PIX 515E (7.x OS) via VPN Client; however, I have no IP routing to the LAN from the remote host.The VPN IP pool works finem,The LAN default gateway is the inside interface on the PIX; the network is flat L2 behind it.The default route on the PIX points out; no other routes are defined,The VPN remote host can be pinged from LAN hosts, but the VPN remote host cannot ping any LAN host, not even the PIX inside interface.

View 2 Replies View Related

Cisco VPN :: ASA 5510 Ping / Communication Host To Host

May 7, 2012

ASA 5510
Ver 8.2(5)
 
I have been looking all over the place for the answer of how to allow clients on an IPSEC VPN to ping from host to host.

View 4 Replies View Related

Can Pure IPv6 Host Ping A IPv4 Host?

Feb 10, 2011

I'm just wondering if its possible to ping an IPv4 host using the IPv6 host assuming that the NAT64 has already been implemented?
[code]...

View 2 Replies View Related

Cisco WAN :: 2811 - Cannot Ping Inside Global IP From Inside Network

Dec 18, 2010

I have 2 questions.Om my cisco 2811 (IOS 12.4(15) T9 IPBASE W/O Crypto) i am using 3 interfaces.And i have a pool of Global addresses: 200.x.z.97-200.x.z.126 255.255.255.0
 
FastEthernet 0/1 description WAN interfaceip nat outsideip address 200.x.y.253 255.255.255.0
 
GigabitInterface 0/2/0description DMZ interfaceip nat insideip address 10.0.0.1 255.255.255.0
 
GigabitInterface 0/3/0description LAN interfaceip nat insideip address 192.168.0.251 255.255.255.0
[Code]....

View 8 Replies View Related

Cisco WAN :: NAT Inside-to-inside (hairpinning) With NVI On 887VA?

Nov 25, 2011

I'm trying to configure hairpinning on my Cisco 887VA VDSL router, so all LAN users can connect to the server using SMTP port 25 which is also in the same LAN subnet, using external router address, which is assigned to dialer1 interface.Traffic comming in from outside works fine.
 
External IP: 1.1.1.1/29
PC address connecting to the server: 192.168.101.28
Server address: 192.168.101.200
IOS: 15.1.4M1

[code]....

I'm running tcpdump on the server on port 25 and... nothing happens. The traffic is not going through.One thing that I've notices in debug ip packet is this line:

s=1.1.1.1 (Vlan1), d=192.168.101.200 (Vlan1), len 52, rcvd local pkt

shouldn't source be internal vlan1 IP - 192.168.101.1?

View 3 Replies View Related

Cisco WAN :: How To Run GetVPN On 3745

Jun 6, 2011

I need to connect site to MPLS provider and run Cisco GETVPN.Problem:I have been browsing Cisco Feature Navigator Tool and to my surprise when I enter "platform:3745" I can't find an image compatible with GET VPN. there is no workaround (image) I can run GET VPN on 3745? I need IP routing (BGP, OSPF) as well.

View 1 Replies View Related

Cisco WAN :: 3745 IOS 15.2 Changed Commands

Jan 22, 2012

we've got a pair of old 3745's that are getting upgraded to new  2911's, and I'm trying to run IOS 15.2 on the new routers to get them most current before going into test and production use.The routers are doing BGP, IPv4, and HSRP, and I'm trying to put one in  at a time as to not have to big bang everything at once.  I'm putting  the one that matters least in first, and basically using the same config  as the old one, which was running IOS 11.
 
I was using "no ip mroute-cache" on ethernet interfaces, and it says  that command is deprecated and I should use the MFIB commands instead.  Darn if I know what that means, I believe it was set up so the ethernet  interfaces had IP multicast fast switching disabled, which was set up by  our vendor 10 years ago so I'm not sure if it matters. It would seem  logical to me this would have an impact on HSRP and speed of failover.   Does this matter, and if so how in the world do I do this with IOS 15.2?The second one is the use of "no fair-queue" on our serial connection  for a T1.  This command isn't there either, and I'm not sure if I even  need to bother on this. It was set up on the old router on a T1 Frame  Relay circuit.

View 2 Replies View Related

Cisco WAN :: What Is Best Router To Be Replaced 3745 EOL

Jan 15, 2012

There is no special requirements, just need new hardware with some reserve availability. As for now it's 3745 EOL and I assume to use 3945.

View 4 Replies View Related

Cisco WAN :: Routing With 3640 And 3745 Via WIC-2T

Feb 8, 2012

I have two routers I am trying to connect via the WIC-2T port. I can ping from router to router, but not from my PC (192.168.2.122) to the 3745 (10.0.1.3)..

3640:
Current configuration : 1846 bytes
!
version 12.2

[Code].....

View 15 Replies View Related

Cisco WAN :: GRE Over IPSEC On 3745 With VPN Module CPU

Jun 19, 2012

i just configured GRE over IPSEC on my Cisco 3745 router with VPN module installed. As soon i hit 25Mbps traffic, my CPU is touching 80%.
 
What maximum Traffic 3745 with GRE over IPSEC it can support?
 
Also show process CPU sorted dont show any evidence of which process eating it up.
  
sh processes cpu sorted
CPU utilization for five seconds: 75%/75%; one minute: 77%; five minutes: 78%
PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process

[Code].....

View 3 Replies View Related

Cisco :: Upgrading 3745 To A 3945 Device?

Mar 29, 2012

I have to replace the 3745 which is our edge router (running (C3745-ADVIPSERVICESK9-M), Version 12.4(23), RELEASE SOFTWARE (fc1)) with (I think) a 3900 (drawing from memory, I haven't actually seen the device yet).In an ideal world, I SHOULD be able to just set term length to "0", do a show run, copy that off to a text file, and then paste it into the new one...

View 19 Replies View Related

Cisco WAN :: How Many NM-32A Or NM-16A Module Can Be Installed On 3745 And 3640

Jul 19, 2011

how many NM-32A or NM-16A module can be installed on 3745 and 3640 routers?

View 1 Replies View Related

Cisco WAN :: 3745 / Migrating Configuration To New Router With Different IOS?

Sep 28, 2011

One of my clients has an older 3745 running IOS 12.3 and we are looking at replacing it with a new 3945 that runs IOS 15.0. This router is also configured with CME. Is it possible to migrate the current 12.3 config to load on the new 15.0 IOS? This will be my first encounter with 15.0 so I don't know what I am up against at this time. I am just hoping I don't have to retype all the ephone config, dial-peers, etc

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved