Cisco VPN :: 5505 - IPSec RA Connects - No Traffic To Internal Network

May 17, 2013

I have a ASA 5505, which has two IPSec RA tunnels build, for each one the user is able to authenticate  and get an IP address is the designated IP pool, but they are not able to ping the Firewall, or RDP to any internal servers. Here is a copy of the running config:
 
: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa(code)

View 1 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5505 Allowing Traffic Between Two Internal Networks

Aug 30, 2011

I'm usually not working with this product, but this is what I'm trying to do.I have 2 internal networks setup on our Cisco ASA 5505 firewall. (not done by me, I'm a new to this product)I'm trying to access a server on one network from a PC located on the other internal network. (preferable through the web gui)When I try "Packet Tracer" from interface "Trust4" it fails on the NAT phase.(Source ip: 10.0.4.99, Destination ip: 10.0.6.99)
When I check the NAT rule, it says:
Type            Source     Interface    AddressDynamic         any          outside      outside.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 / Allow External Traffic To Access Internal Computers

Mar 22, 2012

We have an ASA 5505 running version 8.4. We are having problems allowing external traffic to access computers behind the firewall. Our current config is:
 
ASA Version 8.4(3)!hostname ciscoasadomain-name default.domain.invalidnames!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!interface Vlan1nameif insidesecurity-level 100ip address 10.2.1.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address 152.18.75.132 255.255.255.240!boot system disk0:/asa843-k8.binftp mode passivedns server-group DefaultDNSdomain-name default.domain.invalidobject network a-152.18.75.133host 152.18.75.133object network a-10.2.1.2host 10.2.1.2object-group network ext-serversnetwork-object host 142.21.53.249network-object host 142.21.53.251network-object host 142.21.53.195object-group network ecomm_serversnetwork-object

[code]....

View 10 Replies View Related

Cisco WAN :: ASA 5505 - Forwarding All Incoming Traffic To Two Internal HTTP Server

Oct 2, 2011

We have Cisco ASA 5505, 90.x.y.2/29 IP is assigned to outside interface. We have one internal HTTP server so that I use static (inside,outside) tcp interface [URL] to forward all incoming HTTP traffic to internal HTTP server 1. Now we need to add new physical HTTP server 2 so that I would like to forward

HTTP traffic to e.g. 90.x.y.3/29 to 172.16.0.11.
 
How can I do that? See scenario image (scenario.png) if needed.

View 6 Replies View Related

Cisco VPN :: ASA 5505 - IPSec VPN L2L Tunnel Up But No Traffic

Mar 19, 2011

I have a Site to Site IPSEC VPN Tunnel created with ASDM wizard.
 
Cisco ASA-5505
Peer A: x.x.x.x
Lan A:     192.168.0.0    255.255.255.0
 Fortinet FortiGate-50b
Peer B: y.y.y.y
Lan B:     192.168.23.0  255.255.255.0
 
I start traffic from LAN B with a ping (or telnet it doesn't matter) that receive no reply but tunnel goes up fine.
 
"show isakmp sa" seems ok (says "State   : MM_ACTIVE")
"show ipsec sa" seems ok but all #pkts are zero
 
try ftp, telnet from LAN B to LAN A systems but no one work. "show ipsec sa" all #pkts are zero As soon as I generate traffic from LAN A to LAN B these works (with tunnel already up) also traffic from LAN B to LAN A works.Obviously if I end VPN and start tunnel making traffic from LAN A all work fine bidirectionally, LAN A reach LAN B and LAN B reach LAN A.No msg logged in either two appliance.
 
Seems a very strange problem because seems not related to Phase1 or Phase2 already established.Traffic (routing ?) start works only after at least one packet goes from LAN A to LAN B.No msg logged in either two appliance.Problems begun in ASA version 8.0(4) ASDM version 6.1(3) and remain/continue after upgrade to ASA Version 8.4(1) ASDM version 6.4(1).

View 1 Replies View Related

Cisco Firewall :: ASA 5505 - HTTPS Traffic Through DMZ Interface To Internal Exchange Server?

Apr 23, 2012

I have an ASA 5505 with the base license,When I setup the DMZ interface I had to add the deny access to the inside VLAN.  The DMZ works fine with WiFi on it, but user's iPhones can't get email unless they turn WiFi off.Is there a simple way to allow HTTPS traffic through the DMZ interface to our internal Exchange server which is NAT'd on the 5505's external IP?

View 3 Replies View Related

Cisco Firewall :: ASA 5505 / Block Internal LAN And Internet Traffic Except LogMeIn Site?

Sep 12, 2011

I have configure Cisco 5505 as layer 2 firewall mode. I have vendor machine connected  to Cisco ASA 5505 on port 2 as VLAN2 inside then VLAN1 outside connected to my internal network on layer 2 cisco 2960 switch. This machine needs access only to LOGMEIN then block all internal/internet traffic. 
 
vendor machine on vlan 2 inside >> Cisco ASA 5505 vlan1 outside  >> layer2 switch >> internal LAN >> Cisco 5520 main FW >>> INTERNET

View 1 Replies View Related

Cisco VPN :: ASA 5505 - Forward All Traffic Over Ipsec Tunnel?

Jul 18, 2011

I currently have two Cisco ASA 5505.  They are at different  physical sites (SITE A, SITE B) and are configured with a site-to-site VPN which is  active and working.
 
I can communicate with the subnets on either site from the other and both are connected to the internet, however I need to ensure that all the traffic at my site B goes through this VPN to my site A.
 
I changed this access-list : access-list outside_2_cryptomap extended permit ip network_siteB network_siteA to access-list outside_2_cryptomap extended permit ip network_siteB any
 
But this does not work. If I do [URL], site B IP address  is not same that site A.

View 7 Replies View Related

Cisco VPN :: 5505 LAN-to-LAN IPsec VPN Tunnel Traffic Not Being Routed

Feb 24, 2011

I am trying to set up a LAN-to-LAN VPN tunnel between two sites.  One site has a 5505, and the other site has a 5510.  It looks like the tunnel is being established fine (both ISAKMP and IPSEC SAs look OK), but traffic doesn't appear to be routing across the internet between the devices. [code]

View 15 Replies View Related

Cisco VPN :: ASA 5505 - Client Connects But No Remote Network Access

Feb 13, 2013

I have one user who is unable to Access Remote Network resources when connected to the VPN on his home network.  VPN shows connected and he is given a remote IP from the VPN Pool, but he cannot ping any IP on our network.  When connected using Sprint Wi-Fi card he is able to connect and access remote network from the same laptop.  Maybe there is some network overlap that I am missing. 
 
see attached firewall config (zzz... being firewall public IP) and remote user route table.  ASA 5505 VPN Client 5.0.07.0290 

View 5 Replies View Related

Cisco :: ASA 5520 - Don't Allow Guest Traffic Access Internal Network

Feb 28, 2013

I have created a new sub-interface on our ASA 5520 for guest internet access.

My goal is to allow access to a few specific services hanging off some dmz interfaces on the same firewall and full unrestricted access to the internet only. Everything else should be out of bounds.

The order of the rules I plan to setup on the guest interface inbound are:

#1. <rules to allow access to specific services in the dmz>

#2. <block any ip access to the entire private network ip address space>

#3. <permit ip any any>

#1. These rules will give access to the guest user to services located in the dmz

#2. This rule will block all access to any services in the private ip address space (thus blocking access to all internal services)

#3. This rule is to allow access to any other services i.e. the internet.

Is this the best way to achieve my goal in the most secure way or is there a better way? i.e. is there a way to force the traffic by default to only go out the outside interface unless there is a specific rule allowing it go elsewhere?

(Of course Dynamic PAT will also be configured for traffic coming from the guest interface to the outside interface.)

View 2 Replies View Related

Cisco VPN :: ASA 5505 - VPN Cannot Ping Internal Network

Nov 11, 2012

I have the connection working with my ASA 5505 but cannot ping the internal network. (Note external interface is getting the IP via DHCP)

View 4 Replies View Related

Cisco Firewall :: ASA5505 Appears To Be Dropping Traffic For Internal Network?

Jan 10, 2013

we have a Cisco 2901 as a router on a stick for several vlans. Everything on the segment routes fine and accesses the internet just as they should. The 2901 connects to an ASA5505 on port 0/1. Any host connected to the ASA5505 can access the internet, but can not ping into any of the vlans off of the 2901. The strange thing is on either segement of the network I can ping all of the gateways. What is even more strange is when I run wireshark from behind the firewall going into the 2901 I can not see the packet on another wireshark instance behind the 2901. However if I start a ping for a host host behind the asa I can see the packet in wireshark on the host, which I am trying to ping, hit the gateway.

View 15 Replies View Related

Cisco Firewall :: ASA 5505 How To Map SSH From Outside Network Range To Internal

Feb 21, 2013

I have a Cisco ASA 5505 (version above) and I have someone that needs to SSH into a box behind the ASA. I'm having a few issues trying to configure this access-list and NAT. I've tried many combinations and clearly my IOS is not as good as I thought. What commands should I enter to accomplish mapping SSH from an outside network range to an internal host ?

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Configuration Cannot Get To Internal Network

Jan 25, 2012

I now need to configure an ASA 5505 for a small server farm.  It's fairly straightforward:isp -> asa5505 -> internal servers,'m using static addresses -- no DHCP involved.VPN works;  I can get into the internal network.pinging from the ASA to an external address works,However, I cannot get from a laptop connected to an internal port out to the internet, either using ping or typing an address in the browser.

View 7 Replies View Related

Cisco VPN :: ASA 5505 Can't Ping Any Device Internal Network

Feb 6, 2011

I'm new to this cisco 5505 and I want to carry out a task as simple as a remote access VPN, in my case I did the wizard, with time on my test, I could connect to the VPN, but I can not ping any device internal network. [code]

View 6 Replies View Related

Cisco VPN :: 5505 - Logged In VPN Can't Access DMZ From Internal Network

Apr 9, 2012

What I got is a 5505 ASA firewall and I'm connected to it via VPN.  I'm pulling an 192.168.169.x address because that's what we set their company's internet LAN to.  Which is what we want.  What I can't do while I'm VPN'd in is ping from the internet network to the DMZ, and the same when I try and ping from the DMZ to the internal network.
 
The DMZ is on a 196.0.0.x network.The internet network is 192.168.169.x network.
 
I don't need them to have internet access on the DMZ I just want to be able to access it from the internal network.  What is going on is we need them to be able to VPN into the DMZ and access their equipment.  At this point it would just make me happy to be able to ping from the internal network to the DMZ and I can figure it out from there I've setup rules and applied them and when I wasn't having success I referred back to defaults.  Right now the rules are set at default, any thing in and anything out, on both internal and DMZ.  I'm using a VPN client and going through Cisco ASDM Launcher to setup the rules and static routes, I haven't done anything with the command line.  All the research I've done everyone does it command line, I find it easier to do it GUI.  This is my first time working with an ASA firewall.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Cannot Ping Secondary Internal Network?

Jan 15, 2012

Cisco ASA 5505 Cannot Ping Secondary Internal Network.

View 9 Replies View Related

Cisco Firewall :: ASA 5505 - Nat Internal Network Before Sending Over Tunnel

Oct 27, 2011

For a customer I have configured a new ASA 5505 firewall with 8.42 software. I had to build 3 ipsec tunnels to different locations and firewalls. All tunnels are working except one. I have to translate the inside network 1 to 1 to a different private range before it is sent over the tunnel. Each host from network 192.168.133.0 /24 has to be translated to a  192.168.112.0 /24 host and then sent over the tunnel. (e.g. 192.168.133.22 translated to 192.168.112.22)

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Connect Single Internal Network To Internet?

Aug 23, 2012

I have configured an ASA 5505 to connect a single internal network to internet, it is not working. I have attached the config

View 9 Replies View Related

Cisco Firewall :: ASA 5505 / Vendor Is Not Able To Access Devices On Internal Network

Sep 10, 2012

I have a 5505 between a vendor router & my company network, vendor is not able to access devices on internal network. I am also not able to access the firewall via asdm

View 10 Replies View Related

Cisco Switching/Routing :: 5505 Can't Connect To Public NAT Address From Internal Network

Dec 19, 2011

I have an ASA 5505 configured with internal network, a DMZ, and a VPN on seperate subnets.  The implicit rules allow my internal client computers to connect to the web servers on the DMZ IP, but I can not connect to the public NAT address from the internal network.  I have a DNS server on my internal network and it does resolve to the public IP correctly.  NAT seems to be working correctly because if I go outside the network and connect to the public IP or qualified name then I can get to everything correctly.  I do not see any messages in the Cisco logs and the packet trace tool shows the route of http from an internal IP adddress  to the external (NATed) address is allowed.
 
Specifically, I can go to http://192.168.1.121 from the internal (192.168.0/24) network, but I can not go to http://72.22.214.121 (the NAT address) from the internal network.  If I am outside my cisco then I can go to http://72.22.214.121 easily. [code]

View 1 Replies View Related

Cisco VPN :: ASA 5505 / Remote Access VPN - Unable To Access Internal Network

May 7, 2012

I have created remote access vpn in my ASA 5505. The tunnel is established but i am not able to access the internal network.

View 3 Replies View Related

Cisco :: VPN Connects But Can't Pass Traffic?

Apr 29, 2011

A former coworker of mine setup VPN capabilities to our office network shortly before he left. It is no longer working. We can connect to VPN but I'm not able to ping any devices on the remote network or Remote Desktop to any of the server. After 30 minutes, the VPN connection drops. I have attached our ASA 5505 config to assist in troubleshooting.

View 3 Replies View Related

Cisco Firewall :: ASA5510 - Use Internal DHCP Throughout VPN IPSEC

Oct 19, 2011

I've a question about VPN IPSEC on ASA5510
 
In the LAN network , we use a DHCP on a Windows2003Server. Is it Possible to Configure the remote VPN Clients to use this DCHPserver throughout the VPN IPSEC and Assigned Automatically IP when the connection is done?

View 1 Replies View Related

Cisco :: Ikev1 ASA 8.4 VPN Connects But Doesn't Pass Traffic

May 2, 2011

I setup the ikev1 client and can connect but I can't pass traffic either way. I have tried icmp, port 80, smb etc... here is my config: ........

View 9 Replies View Related

Cisco VPN :: ASA 5510 - Anyconnect Connects But Won't Pass Traffic?

Aug 11, 2011

I am trying to use a ASA 5510 with AnyConnect as an in-line SSL VPN device.  I have a separate firewall that NAT's 443 to the inside IP of the ASA, which is the only configured interface on the ASA.  I can connect to the ASA from the WAN just fine and the AnyConnect client connects just fine, I get an IP lease across the VPN on my LAN, all looks well.  The problem is that I cannot pass any traffic.  The only device on my LAN that I can ping is the ASA, nothing else including the default gateway is accessibe.  I have setup a static route on the ASA pointing 0.0.0.0 0.0.0.0 to the LAN gateway, but no dice.

View 1 Replies View Related

Cisco Firewall :: ASA5505 Connects Through Lan But Cannot Pass Traffic

Sep 13, 2011

We have an issue where by we connect to various customers and the Cisco IPSEC remote access works fine from our LAN through an ASA5505 to a customer site.We have 1 customer that we have some issues with. We can connect  from the LAN through to the customers VPN, authenticate and establish a tunnel but in we cannot pass traffic. When we try from outside of the office on a public internet connection the VPN works fine. What could cause this issue?

View 3 Replies View Related

Cisco Firewall :: Configure ASA To Send All Traffic From (3) VLans To Interfaces That Connects To 2960?

Apr 18, 2013

I have a an ASA 5520 connected to a Layer 3 (3750) switch (Inside) and a connection to a 2960 switch (Outside) to get to the internet. . I have created vlan interfaces on the 3750 switch and enabled ip routing on the switch to enable the vlans to communicate with each other.
 
Vlan Interfaces on the switch:
Vlan 100 172.17.1
Vlan 200 172.18.1
Vlan 300 192.168.3.1 
 
I want the devices connected to the 3 vlans to be able to pass through the firewall and get out to the internet.I have connected the ASA to the 3750 by routed interfaces (10.10.10.1) --------- (10.10.10.2) and they are able to ping each other.I have also put a default route on the 3750 sending all traffic from the switch to the ASA inside interface (10.10.10.1)The issue that i am having is that the ASA also connects to a 2960 which has a connection to the Internet, and they are handing off an ethernet connection from the 2960 that sits in VLAN 55 (Vlan 55 is the Internet accessible vlan).How do I configure my ASA to send all traffic from my (3) vlans to the interfaces that connects to the 2960 switch?

View 21 Replies View Related

Cisco :: 1841 Move All Traffic From Internet IP To One Of Internal

Aug 2, 2012

I am in trouble with my cisco 1841 configuration.The "what I want to" schema: very external IP ( AAA.AAA.AAA.AAA ) in the internet cloud => | cisco 1841 external IP BBB.BBB.BBB.BBB | => internal computer IP CCC.CCC.CCC.CCC

View 1 Replies View Related

Cisco Firewall :: ASA Version 8.3(2) - Internal Traffic Not Allowed

Jul 29, 2011

i have reviewed this configuration a couple of times and I am not seeing my error. I have two internal subnets, in different VLANs with the ASA being the default router. The internal zone works fine, but the zone called wireless on VLAN 13 doesn't.   The firewall blocks all communications and the rules look correct to me. I want all traffic on this wireless subnet to be allowed to cross over the firewall and NAT to the outside interface, just as the inside zone does.

View 1 Replies View Related

Cisco WAN :: 1841 / Move All Traffic From Internet IP To One Of Internal Ips?

Aug 1, 2012

I am in trouble with my cisco 1841 configuration. The "what I want to schema":very external IP ( AAA.AAA.AAA.AAA ) in the internet cloud => | cisco 1841 external IP BBB.BBB.BBB.BBB | => internal computer IP  CCC.CCC.CCC.CCC
 
Steps (this what I think should be done):

1. Find all packets from A by acl

2. Route finded packets throught cisco1841 directly to internal ip address
 
It should be easy but it doesn't.

View 2 Replies View Related

Cisco Routers :: Looking For Internal Traffic Monitor For RV042

Jul 31, 2012

I have an RV042 router and I'm looking to monitor the total upstream and downstream traffic from within the router.

I know there is tons of software that I can put on a network computer to monitor traffic, but is there any software that I can put on the router itself that will monitor the traffic from within the router?                  

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved