Cisco VPN :: 5505 SSL VPN Works From Inside But Not Outside

Sep 20, 2012

I'm setting up a VPN in order to share files between two locations. I'm not sure it's the best solution, but he insists on using his Cisco ASA 5505 Firewall via a clientless VPN. His set-up is a simple residential cable modem (Motorola SurfBoard/TimeWarner) set in DMZ mode, the Cisco ASA, and an Ubuntu server.
 
The Clientless VPN is set up, as are the user groups, and bookmarks. I'm able to browse to the firewall's internal interface IP (https://192.168.1.1) and log in to the Clientless VPN portal, and from there, I can access all of the plug-ins I've configured (CIFS, VNC, etc). The problem is that I cannot connect from outside the local area network.
 
I think it's something very basic that I'm missing, like a NAT rule. I've tried adding some, but they always seem to interfer with the NAT rule allowing users to connect, via the internet, to the Apache web server (port 80) running on the Ubuntu machine behind the ASA Firewall.
 
Like I said, I'm not sure this is the best solution for him. Using an ASA seems like overkill for something that can be accomplished with some software, but he and I are both fans of Cisco, and, as I said, he is adament about using this set-up. If it comes down to it, I'd like to be able to honestly tell him that I exhausted every resource in trying to find a way to make this work for him before giving up and going to "Plan B".

View 2 Replies


ADVERTISEMENT

Cisco VPN :: PIX-525 - VPN Works On Inside Interface But Not Outside

Sep 25, 2011

I have a PIX-525 with an UR license.  I was trying to get my VPN to work from my iphone over the weekend but to no avail.  I then changed the interface to the inside to see if my iMac could connect and bingo!  It worked.  I then tried to connect via inside interface with my iphone and it worked.
 
I connected a PIX-515e and, using the same settings, can connect to the outside interface via my iPhone.

Now, to answer the pressing questions, yes I changed the server IP address in my IPSEC client settings to reflect the outside and inside interfaces as I was testing each one.  I was using a preshared secret.  Yes, the secret was entered correctly and they all matched...yes, the tunnel name was entered correctly.  I was using local user database for authentication with username/password (i.e. no certificate authorization to make things simpler for debugging).  I changed the syslog to debugging and I see absolutely no errors when trying to connect my iphone to the outside interface (i.e. turning wifi off so I'm on my 3G data network).  The only thing I see is where my iphone hits the outside interface and it does a teardown (or whatever its called) but that's it.
 
Why would this work like a charm with my PIX-515e and not my PIX-525?  Could the VPN accelerator card in the 525 be at fault?  The 515e does not have the aecellerator card.  why I can esablish a VPN connection on the inside interface but not the outside?

View 6 Replies View Related

Cisco VPN :: ASA 5505 8.3 (1) To 8.2 (2) Works Only One Way

Jun 26, 2011

I’ve set VPN up between two sites using Cisco ASA 5505 and Wizard. Unfortunately VPN works only one way From 8.2 (2) to 8.3 (1) and after spending one day trying to resolve the issue. Logs shows that ping leave ASA 8.3 but never hits ASA 8.2 – opposite way everything works perfectly. [code]

View 2 Replies View Related

Cisco :: ASA 5505 SSL VPN Can't Reach Inside From VPN Subnet

Jul 7, 2012

I've setup a SSL VPN to a ASA 5505 and can connect.

VPN network 192.168.2.0 /24
Inside Network 192.168.1.0 /24
Outside is connected to Router.

I am trying to RDP to a win server on the inside network but I cant get to it. Can not even ping 192.168.1.1 or (not sure if I could anyways) 192.168.2.1...

I added a ACL on the outside interface and then inside interface permit ip any any but still no ping or RDP...

New at VPN and have survived so far on cisco docs but this problem is evading me.

: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa

[Code]....

View 1 Replies View Related

Cisco :: ASA 5505 DMZ Do Not Talk To Inside Network

Jul 29, 2011

I have a 5505 with the security plus license. I have a web server in the DMZ that needs to talk with a server on the inside network but it doesn't seem to be able to. Im guessing there is something I need to do to enable the DMZ to talk to the inside network.

Here is the config.

[code]...

View 1 Replies View Related

Cisco Firewall :: 5505 DNS Does Not Resolve Inside DMZ

May 14, 2012

I have a 5505 that currently has inside/outside interfaces and everything is working just fine. I am trying to create a DMZ that will essentially be just for vendors/guests. the DMZ will have full access to the outside (Internet) but no access to the inside. I am using the FW for DHCP, and 8.8.8.8 and 4.2.2.2 for DNS. I currently have 1 laptop in the DMZ vlan, and it is getting a correct IP, and it is showing 8.8.8.8 and 4.2.2.2 in ipconfig. I can ping/tracert 8.8.8.8/ 4.2. 2.2/74.125.137.147(what url... resolved to on a laptop connected to the inside vlan), but I cannot ping nor browse to url.... [code]

View 1 Replies View Related

Cisco Firewall :: Enable SIP From Outside To Inside (ASA 5505)

May 14, 2012

We recently purchases the Cisco ASA 5505 to get familiar with it, possibly buying more appliances for our branch offices. However, since the appliance is installed, our SIP telephones no longer register with our SIP service provider.
 
The SIP phones are all on 10.0.1.0/24 while the SIP provider is external via the outside network. I copied our configuration below. how to enable SIP for all 10.0.1.0/24 hosts and ports 5060, 5160, 5260, 5360?
 
gcxfw# show running-config
: Saved
:
ASA Version 8.4(3)

[Code].....

View 2 Replies View Related

Cisco Firewall :: 5505 DMZ To Inside ASA 8.4 / ASDM 6.4

May 21, 2012

I have a standard ASA 5505 with inside, dmz and outside with the default security levels, 100/50/0. we have an email server inside which has been NATed and is working fine. However users accessing the wireless on the dmz are unable to access their emails on https (443). How do I allow SSL access ONLY to users on the dmz using ASA 8.4 commands or ADSM 6.4?

View 10 Replies View Related

Cisco VPN :: 5505 - AnyConnect Access To Inside IPs

Sep 13, 2011

I'm having problems getting AnyConnect clients to reach a server (192.168.139.3) on the Inside interface of my ASA 5505.  Ideally, this would be accessible from the DfltAccessPolicy or another dedicated policy, but right now I'm happy with any access.  Everything else seems to be working as expected.  I've rebuilt this config a number of times without success.  I can ping the IP from the ASA itself.

View 2 Replies View Related

Cisco VPN :: ASA 5505 SSL VPN Can't Reach Inside From Subnet?

Jul 6, 2012

I've setup a SSL VPN to a ASA 5505 and can connect.
 
VPN network 192.168.2.0 /24
Inside Network 192.168.1.0 /24
Outside is connected to Router.
 
I am trying to RDP to a win server on the inside network but I cant get to it. Can not even ping 192.168.1.1 or (not sure if I could anyways) 192.168.2.1...I can ping from the 192.168.1.0 net to 10.0.0.0 and 192.168.2.0 without issue but not the other way around....I added a ACL on the outside interface and then inside interface permit ip any any but still no ping or RDP...
 
: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted

[code]....

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Ping Inside To Outside Don't Go

Sep 29, 2012

I have 2 ASA and would like to build a Side-to-Side VPN between these ASA. So I can learn something about configure a ASA for different thinks. But now I don`t can Ping from a Client to the Internet-Router.My Configuration is:
 
Client IP 192.168.1.100 <===> ASA Inside 192.168.1.1 /Outside 192.168.178.254 <===> Router 192.168.178.1
 
Is there something wrong at my config? or do I need inside private Adresses and at the Outside Global IP`s.
 
At the Router I have a Static Route that the 192.168.1.0 / 24 ist to find over Gateway 192.168.178.254

View 2 Replies View Related

Cisco Firewall :: ASA 5505 - Allow (outside) Host To (inside)

May 20, 2011

I have a ASA 5505 Sec Plus. I would like to allow outside hosts to our mail server and also our FTP server. So i would like to allow only SMTP, HTTP (for Outlook Web Access) and FTP.

View 10 Replies View Related

Cisco Firewall :: NAT With Inside / DMZ VLANs On ASA 5505 V8.4(2)?

Sep 16, 2012

I have a 5505 with Base license running ASA software v8.4(2) that has been working happily for a while with an inside and an outside VLAN.
 
The outside has a single statically configured public IP, and I have a number of static NAT rules to expose a few internal servers as well as Dynamic-NAT for all devices on inside to gain access to the Internet... the main bits of the config are below:
 
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2

[code]....

I now have a requirement to add a "dmz" VLAN for guests to have access to the Internet using a dedicated wireless AP, but not to any of the inside resources. As the ASA has a base license I have configured "no forward interface" to the inside vlan, which suits the purpose fine
 
interface Vlan12
description Used only for guests access to the Internet - no access to the corporate resources
no forward interface Vlan1
nameif guests
security-level 20
ip address 192.168.2.1 255.255.255.0
 
My problem is that when I try to add NATing from the dmz to the outside I get a:
 
     ERROR: Address a.b.c.d overlaps with outside interface address.
     ERROR: NAT Policy is not downloaded
 
with either:
 
object network guests_subnet
subnet 192.168.2.0 255.255.255.0
nat (guests,outside) dynamic interface

[code]....
 
Having had a look at the ASA Configuration guides, all the examples I can see with several "internal" VLAN's being NAT'ed use one external IP per VLAN - is this a feature/restriction of the ASA software? Are there any workarounds? Or is the overlap in the error message really about the current NATing to the inside VLAN which is done on the "any" 0.0.0.0 subnet - would the following then work:
 
object network obj_any
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) dynamic a.b.c.d
object network guests_subnet
subnet 192.168.2.0 255.255.255.0
nat (guests,outside) dynamic a.b.c.d

View 5 Replies View Related

Cisco Firewall :: Connect Inside To Outside In ASA 5505?

Apr 2, 2013

I have a test ASA 5505 with the setting below:

How can I connect to the internet (Vlan 1 to VLan 11)
 
[code]....

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Router In Second Inside

Jul 19, 2011

I have an ASA 5505 with the typical inside/outside interfaces.  I also have a DMZ that I've named remote for all of my ISP VLAN'd remote offices to connect.  I've set the security levels on both the inside and remote interfaces to 100.  From remote 192.168.71.0 network I can ping to the remote interface on my ASA, 12.230.129.66/8, but can't ping anything on the inside network, 192.168.1.0, or the web. From my ASA I can ping the router directly attached to the remote interface, 12.233.136.162/8.  From my inside 192.168.1.0 network I can hit the web fine, but cant ping the remote router 12.233.136.162 or the remote network..
 
I dont' know if I missing something with routing, or with the two interfaces w/ same security...or what?
 
Here's my config. I've also attached an awesomely bad network map.
 
Result of the command: "wr t"
: Saved:ASA Version 8.2(5) !hostname ciscoasadomain-name wec.wnetenable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2switchport access vlan 3!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!interface Vlan1nameif insidesecurity-level 100ip [Code]...

View 6 Replies View Related

Cisco Firewall :: New ASA 5505 / Can't Ping Inside Interface

May 10, 2011

I have a new ASA 5505 and all is working fine, I can CLI and ASDM into it, but just can't ping the inside interface, do I need to enable a feature to make this work somehow?

View 1 Replies View Related

Cisco Firewall :: 5505 Inside Interface To Another Switch?

Apr 23, 2012

I am connecting the inside interface to an upstream switch and therefore will need to assign a static IP address to the inside address as I did below:
 
#sho int ip brief 
Vlan1                      123.123.123.123  YES manual up                    up
 
I will also use this to manage the ASA. I am having a problem with the network configuration of the inside interface as I can't ping the gateway and/or the in IP of the inside interface.Do I need to add any routes?

View 3 Replies View Related

Cisco Firewall :: Unable To Telnet / SSH / RDP From Inside DMZ / ASA 5505

Oct 31, 2011

I am unable to Telnet/SSH/RDP from my inside network to my DMZ. I am not sure where the problem lies, I am able to use VNC from the inside to the DMZ (ports 5800, 5900), and also establish connection on Ports (26700-26899). I have a computer connected directly to the DMZ and those services work to all networks on the DMZ.I have attached Logs of successful VNC connections, unsuccessful RDP and Telnet sessions, and the running config.

View 23 Replies View Related

Cisco VPN :: 5505 IPSEC VPN To An Inside Global Address?

May 6, 2013

I have an ASA5505 with 8.4 software used on a business DSL account.This means I am running PPPoE session to the provider and am then given an Inside Global subnet /29.I have various servers NATed to specific IP's then have the DHCP users NAT with overload to another of my inside global addresses. When I try to establish an IPSEC tunnel to any of my inside globals and monitor I get an access denied message but there is nothing that is blocking.If I determine my PPPoE IP address I am able to extablish a IPSEC session to that but cannot exchange traffic. Not that I want to use that IP anyway because that PPPoE Session IP changes and only my inside globals are static.I spent several hours on this and cannot put my finger on it. Do I need to allow VPN to the INSIDE interface?

View 2 Replies View Related

Cisco Firewall :: 5505 / Can't Connect To All Sites Outside From Inside

Dec 20, 2012

For some reason there are some sites that I cannot access websites from inside interface.One such example is lxer.com where I am receiving this message in the browser:The connection has timed out   The server at www.lxer.com is taking too long to respond.This has "suddenly" happened, and so I am wondering what others have done when such things has happened. My outside has a dhcp-IP, and I have noticed that this address had changed, so I corrected this in my router settings.ASA version is 5505
 
These are my settings:

: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
domain-name example.no
enable password 123412321 encrypted
passwd 1231231 encrypted
names

[code]....

View 4 Replies View Related

Cisco Firewall :: ASA 5505 - Allow Traffic Between Inside Interfaces

Nov 9, 2011

I trying to allow traffic between 2 inside interfaces with the same security level.  VLAN1 and VLAN15.  The are on different physical ports on the ASA.  I tried to configure this through the GUI Web interface and checked ' enable traffic between two or more interfaces with the same security levels'.  With this ASA version, I do not need NAT to allow this, correct?
  
ASA Version 8.2(1)
!
hostname ciscoasa

[Code].....

View 1 Replies View Related

Cisco Firewall :: HTTPs Access From DMZ To Inside On ASA 5505

Jan 5, 2012

We have an ASA5505 UL bundel, updated with this license "L-ASA5505-SEC-PL=" to enable traffic from DMZ to Inside. No NAT or rules deployed for that yet.

On the Inside we have Exchange 2007 in a single server installation. The public url for smtp, ActiveSync, OWA and Outlook Anywhere is mail.company.se. There is a static NAT for outside traffic to access above mentioned services on inside. Now, on DMZ there is the WLAN for guests to access the Internet. How ever, our Smart Phones with WLAN turned on, cannot sync to the Exchange Server on the Inside! The DMZ gets IP-addressen from ASA on DMZ Interface with external DNS configured. How can I configure the ASA to achieve the function of ActiveSync from DMZ to Inside with the public URL from the phones?

View 15 Replies View Related

Cisco WAN :: ASA 5505 Inside Network Route To Internet

Nov 8, 2011

i have asa 5505 , so i wanna my inside network to access to the internet. my internet gateway is 155.155.155.1
  
: Saved
:
ASA Version 8.2(1)
!
interface Vlan1

[Code]....

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Forward Address Outside / Inside?

Feb 27, 2011

I have a cisco asa 5505 and i need a public ip address on the inside of my network without NAT. for example: I can create a static nat translation rule, but this is not what i need.
 
isp -> x.x.x.1 /29 (outside asa)  (inside network) x.x.x.2 /29
 
Is this possible?

View 1 Replies View Related

Cisco WAN :: 5505 Accessing Web Servers On Inside Network

Jul 5, 2011

Got a problem accessing our webservers on the inside interface from other clients on the inside interface on our ASA 5505.As in, they type in url... in their browser, and it wont work.
 
However, if we use a PC on another outside network, it works just fine! [code]

View 2 Replies View Related

Cisco Firewall :: 5505 - Can't Ping ASA Inside Interface

Dec 12, 2011

I have an ASA 5505 that I'm trying to set up a guest network on.  I've configured an interface as a trunk and allowed the 2 vlans but I'm not getting any layer 3 to it.  The switch connected to it is a 3560 and port is configured as a trunk with the same vlans.
 
I can't ping the ASA inside interface but I see its MAC address in the swtich's table.
 
[code]....

View 4 Replies View Related

Cisco Firewall :: ASA 5505 Multiple Inside Interfaces And NAT?

Sep 23, 2011

I have an ASA 5505 running 8.2(1), that is configured with three interfaces as follows:

Inside (security 100) 10.0.0.0 /24
Inside 2 (security 100) 192.168.0.0 /24
Outside (security 0) internet
 
Inside is connected to my internal network, inside 2 is connected to the network of a sister organization, outside is outside.
 
I'd like to be able to route between from inside to inside 2, and have NAT translate me to inside2's address.
 
I have inter-interface traffic configured, and when I use a NAT exemption, I can route fine. But the resources on network 2 must see my request as coming from the inside2 interface IP.

View 2 Replies View Related

Cisco Firewall :: Redundant Inside Interfaces On ASA 5505

Mar 6, 2011

My customer is running an ASA5505 with 8.3 code.
 
The have a somewhat flaky proxy between their inside LAN and the firewall.  I'd like to have a configuration as follows:
 
 LAN   > Proxy > VLAN 1 (eth0/2) on ASA
 
and
 
LAN > VLAN 1 (eth0/3) on ASA
 
So that in the event of Proxy failure (let's just say it loses power) the eth0/3 interface will kick in.
 
This appears to be easily configured according to the documentation:
 
"The following example creates two redundant interfaces:
 
hostname(config)# interface redundant 1
hostname(config-if)# member-interface gigabitethernet 0/0
hostname(config-if)# member-interface gigabitethernet 0/1
hostname(config-if)# interface redundant 2
hostname(config-if)# member-interface gigabitethernet 0/2
hostname(config-if)# member-interface gigabitethernet 0/3"
 
But these commands don't seem to be available on a 5505.

View 7 Replies View Related

Cisco Firewall :: Restricted Inside Users Of ASA 5505

Jul 6, 2011

i have an asa 5505 firewall with asa version 8.2(1). my asa connected on wan port over isp router on internet.inside users connected over dlink switch and the allied telesis 24 ports switch on this asa. the inside users are blocked and they can't communicate. all inside ports of asa 5505 are in one vlan and all ports are switch ports. the configuration of my firewall is 
 
: Saved : Written by xxxxxx at 11:26:22.109 CEDT Thu Jul 7 2011 ! ASA Version 8.2(1) ! hostname asa5505 domain-name dri.local enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface Vlan1 no

[Code].....

View 5 Replies View Related

ASA 5505 Content Filtering For Inside Network

Feb 26, 2012

I'm looking for a content filtering/antivirus/antispyware appliance for my company. Right now we have an ASA 5505 at the edge. We have several outside employees connecting via Cisco VPN clients to the ASA. I need an appliance that can do content filtering for my inside network, guest network, and VPN users. That's two local VLANs and a VPN pool which are all terminated at the ASA.

I've had good luck with Cymphonix in the past, but their boxes are a bit steep for the amount of throughput I need. We'll probably be moving from a 15/15 fiber connection to 80/10 cable soon since our provider can't seem to keep us online; even with an alleged "100%" SLA. They just don't have a network capable of anything close to 100% uptime, plain and simple.

I'd like to keep the ASA running as our firewall and VPN server, so the device needs to be able to do content filtering/av/as in a transparent mode.

View 9 Replies View Related

Cisco Firewall :: ASA 5505 Dropping UDP / 53 Traffic On Inside Interface?

Jul 21, 2012

We have a Cisco ASA 5505 (v7.2(3)) with a "fairly" normal configuration yet we have a problem where it appears UDP/53 traffic is denied on our inside network.
 
here is output from our sys log:

SyslogID   Source IP      Dest IP    Description
305006      172.18.22.3                   portmap translation creation failed for udp src inside:172.18.22.156/42013 dst inside:172.18.22.3/53
 
To give some clarification:

172.18.22.3      is one of our DNS servers
172.18.22.156  is a device we're experimenting with.
 
We've bypassed the Cisco by using a 4G wireless router with this same device - and it works flawlessly.Here is a [scrubbed] copy of our config. It is what I inherited from the previous admin - I'm not sure of all its finer points (I'm not Cisco certified -- perhaps I'm just certifiable.)
 
: Saved 
:
 ASA Version 7.2(3)
 !
 hostname [redacted]

[code].....

View 5 Replies View Related

Cisco Firewall :: ASA 5505 - Dropping TCP Connections On Inside Interface

Feb 12, 2013

Trying to add inside routes on an ASA 5505 to point traffic to another gateway for other connected networks is resulting in the following error 6Sep 16200 819:13:5810601510.184.236.1265003810.170.54.1823389Deny TCP (no connection) from 10.184.236.126/50038 to 10.170.54.182/3389 flags RST on interface insideI believe the problem is due to the Asymetric tcp connection and the ASA is dropping the connection because it only see one half of the traffic.Is there a way we can stop the firewall dropping the TCP connections on the inside interface? i've tried removing the threat managment which didnt work.Annoying thing is were putting the ASA 5505's in to replace old Watchguard soho firewalls only the watchguards forwarded the traffic no problem at all.

View 1 Replies View Related

Cisco Switching/Routing :: Inside Static Route For ASA 5505

Jul 30, 2012

We have two sites: 192.168.100.x and 192.168.101.x currently connected  via IPsec VPN. On each end we have a Cisco ASA 5505. However, each site  also has an MPLS VPN with intentions to move all traffic to this link.  Will  this work on the ASA? We need to make sure traffic can hit the ASA @ site A on the  inside interface and trafiic will forward to the MPLS VPN router which  then handles the traffic. Too, will it cause any problems in  bi-directional flow between the two sites?

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved