Cisco VPN :: 5510 IPSEC No Traffic Flow

Jan 18, 2012

I am trying to pass Traffic thru the IPSEC tunnel but it does not work  ([Cisco Router 892] <---> [Cisco ASA 5510] <---> [Cisco Router 892]) The Cisco ASA 5510 doesn't pass traffic  UDP=500 & UDP=4500 ports...

View 1 Replies


ADVERTISEMENT

Firewall Access Traffic Flow

Aug 30, 2012

I've been thinking about this for a while and I can't seem to find a comforting answer: Assume you have three datacenters connected over a WAN. Each datacenter has its own Internet and firewall, and each firewall has a trusted network, untrusted network (Internet), and DMZ: [code]

-DMZhostA has inbound access from the Internet over port X.
-DMZhostB has outbound access to DMZhostC over port Y.
-DMZhostC has outbound access to the trusted network over port Z.

If DMZhostA gets compromised from the Internet, the attacker can indirectly access the trusted network through DMZhostC, assuming the services running on the given ports are vulnerable/poorly secured.How do you track this web of access? This is a simple scenario with just three firewalls and datacenters, but it gets proportionally more complex and harder to track as the network gets larger. Manually tracking the traffic flow seems tedious, slow, and inefficient.

View 5 Replies View Related

Flow Browser Traffic Through A Specific NIC?

Oct 14, 2011

My question is pretty straight forward but here is some background information. I would like my browsing traffic to funnel through my phone's 3G or WiFi connection. Is there any information out there on how to direct the browser to use the second internet connection? I was thinking about setting up a VPN using the second nic and somehow instruct the browser to use the specific proxy. I have no idea if that is even possible though.

The need for this is pretty simple. I do not want my browsing habits being logged by my company's network. Also while maintaining the current corporate connection so Outlook and RDP programs continue to function correctly.

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Traffic Flow Between Interfaces

Jun 13, 2012

I am fairly new to configuring ASA's. I have an ASA 5505 with one outside interface and three inside interfaces (inside1, inside2, and management). I need inside1 and inside2 to be able to talk to eachother but cannot work out how to make this happen. They are both configured to the same security level and the 'Enable traffic between interfaces with same security level' box is ticked. I have also tried adding appropriate NAT and Access rules. The packet tracer suggests the rules are correct for allowing traffic flow between interfaces but obviosly this may not be the case.

View 14 Replies View Related

Cisco :: 7204 VXR - IP Flow Not Showing Egress Traffic

Dec 6, 2011

I have a 7204VXR Router, with Neflow. The collection for all interfaces is ok, but one interface (Gigabitethernet 1/0), is not showing the egress traffic in the pictures. The configuration has "ip route-cache flow", ip flow egress, and ip flow ingress set. But, is not showing the egress traffic.

View 4 Replies View Related

Cisco Firewall :: ASA 5505 Ports Available For Traffic Flow In Router

Oct 21, 2011

I am in search of a new routers. I don't have any special task to do. Just the flow of maximum 2mb/sec data and some times video conference. However I need the Voip solution as well. I just got excited on the cisco ASA 5505 product. Can this fulfill my requirements. Can this work as the router 1841. Does this support DMVPN, SSL VPN and dynamic routing. Can I upgrade the IOS for dynamic routing purpose. Do you recommend to purchase this produe act or not instead of router ? What are the limitations of this product. If I purchase this I can use this as an router as well as strong security solution. How many ports are available for traffic flow in ASA 5505. Are all routed mode or some of them switch port.

View 1 Replies View Related

Cisco WAN :: Traffic Flow Not Reflected Properly Into Fluke With 7600

Aug 8, 2012

We are facing one issue at the Customer site as Cisco 7600 series Router's having issue for reflection of traffic flow through netfluke as using by Customer to get bandwidth utilization report for our WAN links.Recently we have brought this 7606S router into production and moved some of our WAN links to this router and We are not getting proper bandwidth utilization report in netfluke after configuring netflow in this device.
 
HTAINCHN21XXXCR001#sh ver
Cisco IOS Software, c7600s72033_rp Software (c7600s72033_rp-IPSERVICES-M), Version 12.2(33)SRB5, RELEASE SOFTWARE (fc2)
 HTAINCHN21XXXCR001#sh run int gi1/12

[code]....

View 1 Replies View Related

Cisco Switching/Routing :: Traffic Flow Catalyst 6509 With WS-X6548-GE-TX

Nov 21, 2011

I'm receiving multicast traffic (400Mbps) on port 9/38 and sending it out on port gi9/48. I'm trying to achieve that traffic will stay within the card without using the switchfabric, 

View 2 Replies View Related

Cisco Firewall :: ASA5580 - How To Configure Traffic Flow Idle Time-out With CSM

Feb 16, 2012

I am looking for the way to define an idle timeout for specific flows on an ASA5580 by using Cisco security manager. For ex I needed to define a specific idle timeout for connections beetween specific devices (Devices in vlan1, Device2 in vlan2).To test it I did following changes by CLI and it works fine.     access-list L1 extended permit ip <@IP1> <mask1> host <@IP2>    class-map CM1        match access-list L1    policy-map PM1        class CM1        set connection timeout idle 02:00:00
 
I try do do the same configuration with CSM in order to be able to manage each changes only by using CSM.So I defined  Access control list, Traffic flow and then I define timeout in CSM --> PIX/ASA/FWSM Platform --> Service Policy Rules  --> IPS, QoS and Connections Rules -> connections settings -> Traffic flow idle time-out. The problem is that each time I deploy the configuration with CSM I loose the timeout config line which is the most important for my application..

View 2 Replies View Related

Cisco Switches :: SF200 Witches Will Simply Freeze / Blocking All Traffic Flow

Mar 18, 2013

We have been deploying Cisco SF200-24P switches for our systems for over a year now. They connect to a Cisco 881 router. In many cases we are also deploying Cisco AP541s.Over the last few months, on an intermittent basis, the switches will simply freeze, blocking all traffic flow. The power LED also goes dark. It appears the switch has frozen. The only thing that seems to revive the switch is a hard reboot by pulling the power cord. In the last couple of weeks, one site in particular has gone down a handful of times. That client of our is fed up. Our patience is running thin too.
 
I cannot see any indications in the logs to any event that might give a clue as to the problem. We definitely see this problem with the 1.2.7.76 firmware and the 1.2.9.44 (latest as of typing this). Not sure if with earlier 1.1.2 firmware.Without a fix, we likely will have to change switches and possibly vendors as we need a reliable switch.I see some vague references to a similar problem. And one reference to a SG300 series having what sounds like the same issue.

View 8 Replies View Related

Cisco Switching/Routing :: Net-flow Not Reporting Egress Traffic On 6509 Vlan

Nov 27, 2011

We have a pair of 6509 working in a VSS configuration (IOS 12.2(33)SX5). The 6509s connect to a pair of ASAs (7.2 code) running in an Active/Standby setup. These ASAs in turn connect to routers going to remote sites. I have configured Netflow on the following VLANS,
 
VLAN 10 - Servers Vlan
VLAN 9 - Transit/ASA VLAN (connects ASAs to 6509s). All traffic originating from any VLAN on the 6509 crosses this VLAN in order to reach remote sites and vice versa
 
I configured the netflow source VLAN 11 although I am not collecing any netflow from it.Although I have been getting lots of Netflow info, I noticed that netflow for traffic originating from any user VLAN on the 6509s going to any remote site via TRANSIT/ASA VLAN(9) does not get reported, I even tested with 4 GB traffic but no result. Only reverse traffic (i.e. from remote site to user VLAN) is reported as it traverses the Transit VLAN (9).
 
I read somewhere that egress netflow is not supported in 6500, but isnt traffic originating from a user vlan to a remote site via the transit VLAN (9) considered ingress with respect to the transit VLAN (9)? I would like to know whether bidirectional Netflow is supported on 6500 VLANS. I have mimimum control on routers beyond the ASAs, and since these ASAs run 7.2 code netflow is not supported, and Monitoring this Transit Vlan gives me extremely useful info.
 
I do get netflow biderectional traffic from the Server Vlan 10, but I think it is correlated by the netflow collector from vlans 9 and 10. [code]

View 9 Replies View Related

Cisco 2960S - Enabling Flow Control On All Ports Interrupt Network Traffic?

Jan 20, 2013

I've been digging into some performance issues on a LAN that has a couple of 2960s. The monitoring software I'm using has indicated a high amount of discarded outbound packets (up to 5%). The suggested resolutions were to enable flow control.

My question is does enabling flow control on all ports interrupt network traffic at all? this is a production network so I had already planned on doing it during off hours but also wanted to know if I should be prepared for any significant drop in traffic.

View 14 Replies View Related

Cisco Security :: ASA 5510 / Routing Http Flow On Two Different Interfaces?

Jun 21, 2012

I use 3 interfaces on an ASA 5510. First interface is Lan, Second interface is Outside, Third interface is ADSL The Outside interface is used for VPN L2L and smtp traffic. (Leased line on router managed by ISP)The Adsl interface is used for Http traffic. (Adsl Cisco router) I use this configuration found on another forum subjet for routing.route outside 0.0.0.0 0.0.0.0 x.x.x.x 1route adsl 0.0.0.0 0.0.0.0  y.y.y.y 2 nat (inside) 1 0 0global (outside) 1 interfaceglobal (Adsl) 1 interface static (Adsl,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0 The problem is now I have an www intranet server on the VPN remote site. How i can exempt the http traffic to the intranet server routed through Adsl interface?

View 7 Replies View Related

Cisco Firewall :: 5510 - Http Connection With Video Flow

May 4, 2011

I am using ASA 5510 and I have a specific problem with Http Connection to receive a video Flow ( RSTP protocol ) in the LAN. Some Pc users (192.168.1.133,in the log)  with ASA Lan Interface as gateway can ping the Camera but don't receveive the video flow.Some Pc users (192.168.1.116,in the log) using another gateway can ping and receive the video flow. I used Whireshark  to capture traffic between camera and Pc using the 2 gateway. I joined Logs with this message.It seems to be a problem of TCP segments on the ASA, I try to changed some TCP options but it's still the same:- Disable Force Maximum Segment Size- Enable Force TCP Connection to Linger in TIME_WAIT State for at Least 15 Second.

View 7 Replies View Related

Cisco Switching/Routing :: 5520 Configure Traffic Flow Between Computers Inside VLANs And Routed Port

Jul 7, 2012

How to configure traffic flow between  computers inside VLANs and a routed port? Here is the setup details:
 
1. Switch 3750-X
2. VLAN 100 - ( SVI IP address 192.168.100.1 /24)
3. VLAN 200 - ( SVI IP address 192.168.200.1 /24)
4. routed port gi1/0/48 (IP address 192.168.150.1 /24). Note: this port is directly connected to a firewall ASA 5520 port IP 192.168.150.100 /24
 
Ip routing is enabled on the switch and inter vlan traffic is flowing ok. I can ping the routed port gi1/0/48 from  any computer connected in the VLAN 100 or 200. For example computer with IP 192.168.100.25 can ping the routed port 192.168.150.1. Switch can ping firewall port 192.168.150.100 and the 'sh ip route' command shows the network 192.168.150.0 /24 as directly connected network.
 
any computer in the two VLANs CANNOT ping firewall ASA port 192.168.150.100   Is it because inter VLAN routing does not work with a routed port on L3 switch? I looked up fallback bridging, but it is meant for non IP traffic.The goal is I am trying to set the ASA port as an internet gateway for VLANs. 

View 4 Replies View Related

Cisco :: IPSec VPN Not Forwarding Traffic?

May 25, 2011

why my VPN setup is not working correctly. The device is an ASA 5505 running IOS version 8.2. It has a license for 2 SSL VPNS, and 25 IPSec VPNs. The previous Admin had set up both but only the SSL VPN apparently works. I attempted to set up my own IPSec VPN using the ASDM wizard, with an IP range of 192.168.40.10-50. I am connecting from a Mac, 10.6. My local network (home) is a standard 192.168.1.0/24; the remote networks are 192.168.2.0 and 192.168.3.0. I tried connecting using the built-in Snow Leopard client, and although it said I was connected I couldn't actually contact anything on the corporate LAN.\

View 3 Replies View Related

Cisco VPN :: Configure IPsec L2L To Allow Only One Way Traffic

May 9, 2011

We have a business need that we have to set up a IPsec L2L tunnel (from multiple locations) to a business partner, we require that the connection can only be initiated from our side, not business partner side. I searched the web, one option is configure our side ASA to initate IKE only, this does not seem to meet our requirement, because once IPsec SA is up, IP layer traffic will flow freely in either direction; the other option people suggested is to use VPN filter in tunnel group policy, but the documention of how to use this vpn-filter to enforce one way traffic policy is not crystal clear to me;  I actually configured reflexive ACL on core L3 switch before the traffic hits ASA to reflect/evalulate specific traffic to businness partner's LAN network, that worked well. However one of our branch office's core L3 switch is Cat4K which does not support reflexive ACL with the image it is currently running, so I am stuck again .

View 1 Replies View Related

Cisco VPN :: 877 - IPSec Traffic Is Only Initiated From One End

Apr 27, 2013

I have configured the IPsec vpn between Cisco 877 and ISA server which is working fine and ok. But the issue is I have multiple subnet on the TMG "Treat Managmenet Gateway" side and only one subnet on the Cisco 877 side. I can only sending some subnet's traffics from Cisco 877 through the vpn tunnel to the other side which is TMG server and I have recieved teh timeout request for the rest of teh subnets.
 
However, if I initiated the ping from inside the ISA with different sources , I can reached the Cisco 877 and from then I can be able to send traffic.
 
So, the tunnel is up and active but it should be initated from ISA server to have a full connectivity. 
 
Here is the IP sec configuration on Cisco side:
 
crypto isakmp policy 1
encr 3des
authentication pre-share

[Code].....

View 1 Replies View Related

Cisco VPN :: C1841 -Traffic Won't Go Via IPSec

Jul 26, 2011

I have C1841 as EZVPN server and remote C1841 as EZVPN client. Connection between them is providers L3 VPN, so it is not over the internet. IPSec tunnels go up with no problem. Client is NEM. Problem is that traffic won't go via IPSec. No packets are encapsulated. I want all trafiic to go via tunnel, no split tunneling here. On client side Dialer0 is outside interface, since L3 VPN is over ADSL. On server's side I have only one interface connected to corporate network. Peer address is server's loopback address.

After IPSec is up, server gets remote subnets as static routes and redistribute them to OSPF. That part works fine, but remote site's traffic doesn't flow over IPSec to the coorporate LAN.
Could be TCP MSS or something like that?
 
Configuration:
EZVPN SERVER:
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2

View 2 Replies View Related

Cisco VPN :: ASA Or 871 IPSec L2L To SSG-140 - Tunnel Is Up But No Traffic

Aug 8, 2012

i am curently troubleshooting a ipsec l2l VPN between
 
1. ASA 7.2(4) to SSG-140
2. Cisco 871W to SSG-140
 
In both scenario's the tunnel is nicely established, and traffic goes into the tunnel, but nothing comes out. All encap's, but no decap's                    
 
It seems like a routing issue, but we can not find anything on both sites.
 
So maybe i m running into a (known) issue between cisco VPN equipment and the SSG-140?
 
Could it be a proxy-id issue? Cause they configure stuff like 10.1.1.0/24 and i configure 10.1.1.0 0.0.0.255

View 7 Replies View Related

Cisco VPN :: 881 / Route Traffic Thru IPSec Tunnel To DMZ

Jun 29, 2011

I need to route traffic to DMZ (and internal) from the branch office thru the IPSec tunnel. How do I manage that with my Cisco 881?

View 1 Replies View Related

Cisco VPN :: ASA 5505 - IPSec VPN L2L Tunnel Up But No Traffic

Mar 19, 2011

I have a Site to Site IPSEC VPN Tunnel created with ASDM wizard.
 
Cisco ASA-5505
Peer A: x.x.x.x
Lan A:     192.168.0.0    255.255.255.0
 Fortinet FortiGate-50b
Peer B: y.y.y.y
Lan B:     192.168.23.0  255.255.255.0
 
I start traffic from LAN B with a ping (or telnet it doesn't matter) that receive no reply but tunnel goes up fine.
 
"show isakmp sa" seems ok (says "State   : MM_ACTIVE")
"show ipsec sa" seems ok but all #pkts are zero
 
try ftp, telnet from LAN B to LAN A systems but no one work. "show ipsec sa" all #pkts are zero As soon as I generate traffic from LAN A to LAN B these works (with tunnel already up) also traffic from LAN B to LAN A works.Obviously if I end VPN and start tunnel making traffic from LAN A all work fine bidirectionally, LAN A reach LAN B and LAN B reach LAN A.No msg logged in either two appliance.
 
Seems a very strange problem because seems not related to Phase1 or Phase2 already established.Traffic (routing ?) start works only after at least one packet goes from LAN A to LAN B.No msg logged in either two appliance.Problems begun in ASA version 8.0(4) ASDM version 6.1(3) and remain/continue after upgrade to ASA Version 8.4(1) ASDM version 6.4(1).

View 1 Replies View Related

Cisco VPN :: 881 / Route All Traffic Over IPsec Tunnel?

Jan 30, 2012

We have 7 remote offices and 10 tower locations that utilize IPsec tunnels back to our HQ. We now want to force all traffic including web surfing through the tunnels. What would be the easiest way to acomplish this? I have tried utilizing the crypto map policy to do this, but was unable to acomplish this.
 
Each of our office locationss utilize a Cisco 2811 router and the tower locations utilize a Cisco 881.

View 21 Replies View Related

Cisco VPN :: 1841 - IPsec Tunnel Two Way Traffic

Oct 23, 2012

We are currently experiencing a problem on an IP SEC VPN tunnel that has all of us here completely stumped. We are hoping that one of you experts out there will be able to assist. Here are some basic details:
 
NETWORKS
An IPSEC site to site tunnel has been built between the two sites on different networks.
PIX 515E - MAIN SITE
Network 172.16.0.0/24
CISCO 1841 - REMOTE SITE
Network 172.16.99.0/24
 
ISSUE
All traffic flows over the VPN from the 172.16.99.0 network in the direction of the Pix, such as RDP, SIP etc. Pings will go in both directions across the tunnel. Other than the pings most traffic will NOT flow over the tunnel from the 172.16.0.0 network on the pix to the 172.16.99.0 network on the 1841. It would appear that something on the 1841 is blocking traffic coming in over the tunnel from the 172.16.0.0 network as we can not get a wire shark capture on a PC on the 172.16.99.0 network, other than the ICMP traces. Usually this is an access list problem but we have checked and double checked the configuration and can't see anything.
 
TROUBLESHOOTING SO FAR
 
1. Have tried inserting various access list changes to the tunnel on the 1841 to make specific reference to the 172.16.0.0 network. 
2. Have tried various NAT entries. 
3. Have removed and then recreated the VPN tunnel from a fresh start. 
4. Have made the MTU 1400 on the inside interfaces on the Pix and the 1841.
 
The tunnel is fully up at all times and as we say can ping in both directions.

View 7 Replies View Related

Cisco Wireless :: WRVS4400N Won't Route All Traffic Over IPsec

Dec 15, 2011

All of my remote sites use various routers to route all of their traffic via IPsec.  However, I have one WRVS4400N w/firmware 2.0.2.1 configured with a working tunnel.  My issue is I need to set the Remote Group to 0.0.0.0 0.0.0.0 so all traffic is forced via IPsec tunnel and not out the local gateway.  When I do the error, Remote Security Group and Local Security Group cannot be in the same network. However, it works with Cisco/Linksys RV042.

View 3 Replies View Related

Cisco VPN :: ASA 5520 IPSec Overlap - How To Route Traffic

Nov 13, 2011

We have multiple vpn tunnels coming to our cisco asa 5520 , the problem is that when we create another tunnel with the same network as another network on the firewall , it does not know how to route the traffic to which interface or sub interface.

View 2 Replies View Related

Cisco VPN :: 5520 - How Much Traffic Pass Through Into IPSec In ASA Firewall

Mar 20, 2013

How can I see the quantity of traffic that is passing through into an IPSec VPN in a ASA 5520.

View 3 Replies View Related

Cisco VPN :: ASA 5505 - Forward All Traffic Over Ipsec Tunnel?

Jul 18, 2011

I currently have two Cisco ASA 5505.  They are at different  physical sites (SITE A, SITE B) and are configured with a site-to-site VPN which is  active and working.
 
I can communicate with the subnets on either site from the other and both are connected to the internet, however I need to ensure that all the traffic at my site B goes through this VPN to my site A.
 
I changed this access-list : access-list outside_2_cryptomap extended permit ip network_siteB network_siteA to access-list outside_2_cryptomap extended permit ip network_siteB any
 
But this does not work. If I do [URL], site B IP address  is not same that site A.

View 7 Replies View Related

Cisco VPN :: 5505 LAN-to-LAN IPsec VPN Tunnel Traffic Not Being Routed

Feb 24, 2011

I am trying to set up a LAN-to-LAN VPN tunnel between two sites.  One site has a 5505, and the other site has a 5510.  It looks like the tunnel is being established fine (both ISAKMP and IPSEC SAs look OK), but traffic doesn't appear to be routing across the internet between the devices. [code]

View 15 Replies View Related

Cisco VPN :: ASA 8.4 - Limit IPSec User Traffic Volume

Nov 22, 2012

Is there anyway to limit a user's traffic volume on ASA8.4? if there is, how?

View 3 Replies View Related

Cisco VPN :: ASA5510 - Slow Traffic On IPSec Tunnels

May 2, 2013

We have many VPN tunnels back to our corporate office.  All of these tunnels are very slow (same with our client VPN's).  Our main firewall device at the corporate office is an ASA5510.  We have a 100 Mb/sec Metro Ethernet internet connection here.  We do not allow split-tunneling.

Our remote sites vary.  We have DSL connections, cable internet connections, and other types of broadband that vary in speeds from 5 to 100 Mb/sec (up and down).  The remote sites mostly have PIX 501's, but we have an ASA 5505 in one of the locations.

To take an example.  On one of our remote sites that has a 100 Mb/sec connection, if I ping device to device, I'm getting ping times of about 50ms.  And I'm pinging back through another 100 Mb/sec connection.  If I get on a computer down there and run a speed test, I'm showing down speeds of about 1.5 Mb/sec... nowhere near 100.  Some of that could be due to the lack of split tunneling, but I also suspect this could be an MTU issue. 

Right now, all my MTU's are just set to the default 1500.  Perhaps this is too high.  I used this site to check my max: [URL]
 
I did a few tests from behind several of my firewalls.  I pinged from a machine on one side of the tunnel to the firewall on the other end.  I'm assuming the max MTU I come up with is the max MTU for the firewall I'm behind while pinging, right?  The max amounts I came up with for some of my devices were as follows: Corporate ASA 5510 > 1272 (if you add the 28 byte packet header that would make it 1300) Remote PIX 501 > 1416 (if you add the 28 byte packet header that would make it 1444) Remote ASA 5505 > 1418 (if you add the 28 byte packet header that would make it 1446)

So, do I just need to set my MTU values to the appropriate amounts?  I have tried changing the value, but I don't see any change in speed/performance.  But I also don't know if I need to reboot the firewalls after changing the MTU.  I know with Catalyst switches, you have to reload.  But I didn't see any messages about needing to reboot on the ASA's/PIX's.

View 10 Replies View Related

Cisco VPN :: 5510 IPSec VPN Map

May 5, 2012

i have started managing a asa 5510 firewall which is already having 10 ipsec tunnels , the problem i am facing is they are configured as "ipsec vpn map"
 
i have attached sample config, i am finding it difficult to understand the parameters used in each tunnel as the configration seems bit complex to me, how it works .

View 9 Replies View Related

Cisco WAN :: 2851 - VPN Traffic Not Captured By IPSec Access List

Aug 29, 2012

we have two 2851's.  One in Australia, one in NZ, IPsec VPN between the two.
 
We have multiple subnets behind the tunnels. From all the sunbets in Aus we can reach all the subnets in NZ, except for one.  From NZ we can reach all the subnets in Aus.  The traceroute and pings from the subnet in question in Aus goes out the internet interface of the router instead of going into the tunnel.
 
The subnets in question are 10.110.220/24 (Aus), 10.110.250/24 (NZ)
 
The access lists at both ends cover the traffic required but for some reason when leaving Australia the traffic is not captured by:
 
Crypto Map "AUS-SYD" 20 ipsec-isakmp
Description: Auckland VPN
Peer = 203.167.249.46

[Code].....

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved