Cisco VPN :: ASA 5505 - Remote Firewall Does Not Receive Single Packet From Source IP

Jun 3, 2012

I have setup an asa 5505 with multiple sub nets (plus license) and a vpn tunnel (ipsec) between this and an other asa on a second branch office (multiple vlans) . Now I need to route only two vlans from the first site to reach some of the second branch networks
 
let's call them: 1 branch
A-172.16.4.0/24
B-172.16.2.0/24
 
2 branch 
C- 10.10.10.0/24
D- 10.20.10.0/24
E- 10.66.10.0/24
 
the tunnelis ok From A to CDE . but from B to CDE won't come up. pinging is unsuccessful as well as all other traffic. the connection profile is setup to have both A and B as local networks and A and B by the moment share the same access rules configuration.
 
logs show firewall 1 let pass and build connections, without denies, but remote firewall does not receive a single packet from the source ip from network B.

View 2 Replies


ADVERTISEMENT

Cisco Firewall :: 5520 - Inside Server To See Actual Outside Host Source IP In Udp Packet

Mar 3, 2013

I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server.   The server can get to outside hosts OK, and the traffic is being NATed  properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send  'announcement' UDP packets to the inside server.  I thought this might be an  outside-NAT-required issue to get the traffic routed, but I need the inside server to see the  actual outside host source IP in the UDP packet, so I basically set the  outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the  destination (inside server) subnet, and its gateway is the outside  interface of the ASA, the same way the inside server is able to get to  hosts outside.  The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
 
I have the appropriate ACL's set up, and when I do 'show access-list' I  see policy hits for the 'permit' statements where the outside host is  generating the announcement and it's hitting the ACL.  I even duplicated  the ACL into list 101 and 102, and applied 101 for inbound traffic on  the outside int, and applied 102 for outbound traffic on the inside int,  and I'm seeing policy hits on both permit statements outside and  inside, so it looks like the traffic is being passed on to the inside  interface and permitted, but the server isn't seeing the packets.
 
I can ping the outside interface from the outside, but cannot ping the  inside interface or any inside hosts from the outside, even though I  have 'permit icmp any any' enabled on the ACL on both ints. When I  remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
 
I set up the same scenario in my lab with an ASA 5505, with the same results.  Below is the running config from the 5505 in the lab.  The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
 
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
description Inside LAN Interface
nameif inside(code)

View 6 Replies View Related

Cisco Firewall :: ASA 5505 - Can't Receive Mails From Some Customers

Jul 20, 2011

I can't receive mails from some customers, asa 5505 log get the message: "ASA_Outside|Deny TCP (no connection) from X.X.X.X/35702 to ASA_Outside/25 flags ACK  on interface outside".

View 5 Replies View Related

Cisco Firewall :: 5505 PAT With Single Public IP And Several Servers Behind Firewall

Nov 21, 2012

New to the ASA 5505 8.4 software version, but here is what I'm trying to do:
 
-Single static public IP:  16.2.3.4
-Need to PAT several ports to three separate servers behind firewall
-One server houses email, pptp server, ftp server and web services: 10.1.20.91
-One server houses drac management (port 445): 10.1.20.92
-One server is the IP phone server using a range of ports: 10.1.20.156
 
Basically, need to PAT the ports associated with each server to the respective servers behind the ASA 5505.  Is anything missing from this config? Do I need to include a global policy for PPTP and SMTP? [code]

View 11 Replies View Related

Cisco Firewall :: ASA5510 - Single Timeouts Drops Remote-Desktop Session

Oct 17, 2012

Just recently we replaced our HQ Cisco-Pix with Cisco-ASA 5510.  where we have many branches connecting to our HQ through site-to-site vpn.

Since putting this new ASA5510 at HQ , while we are getting a  Remote-Desktop session  into our branches clients, and at the time when even a single TIMEOUT occurs on the vpn-link  so the remote-desktop session   gets completly lost.  then we have to re-connect the session.
 
This issue happens as i said above  when a single  timeout  occurs on the vpn link.  What is the issue with the ASA5510. because with pix we didnt have this issue,  remote-desktops were never geting lost / reset  with single  timeout

View 1 Replies View Related

Cisco Firewall :: Single Session HTTPS Offload On ASA 5505?

Jan 14, 2013

I have an ancient Alteon load balancer which only supports HTTP and telnet access. Our management people only allow HTTPS through the management firewall farm, and don't want to change this policy.  So I need a low cost HTTPS to HTTP conversion, ideally on Cisco hardware like an ASA5505. It only needs one concurrent user. Is there a way to configure an ASA 5505 to terminate the inbound HTTPS seession and re-originate a HTTP management session to the Alteon? It looks to me as if the Clientless SSL VPN might do the job.Is there a way to do a SSH to telnet conversion on the ASA, or on a router?

View 1 Replies View Related

Cisco Switching/Routing :: 2600 - Source IP Set To Public When Packet Received

Mar 27, 2012

We have Cisco IP phones behind a 2600 series router:Most of the time when the PBX receives a packet from the phone, the source IP of the packet is set to the public IP of the router (1.2.3.4) as expected. However, once in a while, we get packets (at the PBX) with the source IP set to the private IP of the phone (10.0.0.12).The router is configured by our provider, and they can't give us any explanation for this behaviour. Is it safe to assume that PAT is not configured properly at the router?

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Not Giving Out DHCP To Clients / Only Discovery Packet?

May 3, 2012

My ASA 5505 has stopped giving out DHCP address to my machines.Everything was working fine and nothing has changed in the network. I've reloaded the firewall and clear all DHCP on the firewall I've even re-entered the cmd on the ASA.
 
I'm able to staticlly assigned address to the clients and all is way. When I do a DHCP debug on the ASA I don't see any events relating to the DHCP service apart from checking for lease expiry.
 
I've also tried to plug a machine straight into the ASA and no result. I finally did a packet capture and I am seeing the client machine sending out a DHCP discover packet and nothing else is responding.
 
My ASA config is:
 
dhcpd address 192.168.3.10-192.168.3.33 inside
dhcpd dns 8.8.4.4 interface inside
dhcpd option 3 ip 192.168.3.1 interface inside
dhcpd enable inside

View 7 Replies View Related

Cisco Firewall :: ASA 5505 - Connect Single Internal Network To Internet?

Aug 23, 2012

I have configured an ASA 5505 to connect a single internal network to internet, it is not working. I have attached the config

View 9 Replies View Related

Cisco Firewall :: ASA 5505 - Setup Single Port Exclusion For Static NAT?

Sep 20, 2012

I have been using static NAT to map between a single server behind an ASA 5505 and a single public IP address. In other words, I've been doing this:
 
object network NAT_ME
nat (inside,outside) static interface
 
Now I would like to start using the clientless VPN feature of the ASA, so I of course don't want that particular port forwarded to the server. Is there a way to define such an exclusion? I've tried several things, including setting up a separate NAT rule to direct that port back to the ASA's interface, without luck.
 
If that is not possible, what configuration would I need to move to in order to get the behavior that I want? It is important that all (non-VPN) traffic is passed exactly as it arrives at the firewall (whether it is coming from internal or external), with the exception of changing the IP address (i.e., I need static port mappings for some of my services).

View 5 Replies View Related

Cisco Switching/Routing :: 4500 / Packet Received With Invalid Source MAC Address

Sep 3, 2012

Most of the 4500 Switches in our network are giving the similar error for so many ports
 
%C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on p  t Gi2/6 in vlan 100
 
Its impossible to do a wireshark packet tracing for all the ports. 

View 2 Replies View Related

Cisco Switching/Routing :: 4507 - Packet Received With Invalid Source MAC Address

Feb 14, 2012

Issue I am having with a Cisco 4507? Below is the error i am receiving.
  
Feb 14 10:06:09 EST: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 508 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Po10 in vlan 112
Feb 14 18:44:06 EST: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 119 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Po10 in vlan 112
Feb 15 00:51:06 EST: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 366 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Po10 in vlan 112

[Code]...

View 9 Replies View Related

Cisco Firewall :: ASA 5505 Using Logging & Packet-capture To Locate Virus Infected PC

Aug 2, 2011

ATT notified my company we have a virus infected pc on one our networks which sits behind a Cisco ASA 5505 running 7.2(4). The set up is a basic inside/outside NAT configuration. They gave us the destination ip address and port which the our pc is contacting.  I have been tasked to track down the infected pc.  I created the following access-list and applied to the inside interface:
 
access-list VIRUS extended permit TCP ANY host x.x.x.x EQ YYYYY log debugging interval 600 access-group VIRUS in interface inside
 
I enable logging to the console whose output did not list the IP address of the infected pc, only the ip address of the DNS servers we were using. I then used the following capture commands to try locate the internal ip address of the infected pc:
 
capture in-cap interface inside access-list VIRUS-CAP buffer 1000000 packet 1522 capture in-cap access-list VIRUS-CAP interface inside
 
Neither step worked and the resulting console output overwhelmed the firewall in a very short period of time. Before attempting this task again, I would like to know if I am going about this the right way or if there is a better methodology?

View 24 Replies View Related

Cisco Firewall :: 5505 Firewall Between HQ And Remote Site

Jun 12, 2012

we are planning on connecting a new aquired company to ours soon?We will connect the remote site to the HQ via a D3. I've been told we will need to have a firewall between them and us for a time. I was thinking of terminating the D3 connection at the remote site of 80 users. Can I use the asr as a firewall as well, to protect the HQ from the Remote site - or should I use a seperate appliance?I was thinking of a asa5505 but, am concerned with bandwidth limitations of the box?

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Remote VPN Connectivity

Nov 7, 2012

I had a previous issue in which I couldn't make a connection to an ASA 5505 behind an edge firewall found here: url...My continuing issue is that I can indeed connect to the ASA 5505 remotely but I cannot access anything internally. I believe it is a NAT issue but as of yet, nothing has worked.

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Unresponsive Remote Management?

Aug 22, 2012

unresponsive / lockups with Cisco ASA 5505 remote management ?
 
I think it happens like this:
 
1) With ASDM (Java Web Start), add new crypto map (it could be anything, just happens to be what i added the last time this happened)

2) Click apply

3) ASDM hangs (at this point the Java client becomes entirely unresponsive)

4) ASDM.jnlp refuses to connect and eventually timeout dialog appears. However, VPN connections are still accepted.

5) After a few hours (over night), the ASA refuses all incoming traffic including VPN connections.

View 5 Replies View Related

Cisco Firewall :: Remote Management Access Through VPN On ASA 5505

May 21, 2012

I have a remote ASA5505 running 8.4(3) with a working site 2 site VPN tunnel to my main office. (The main office is running an ASA 5510 with OS 8.4.3 as well). The encryption domain is all private IP on main site vs. 172.16.10.0/23 on remote site.
 
Relevant config of the remote ASA:
 
interface Vlan1
nameif inside
security-level 100

[Code].....
 
I can manage the ASA on the outside interface (outside of the site 2 site VPN) using the TACACS credentials I can also ping my management station from the ASA using the inside interface, but as stated, the other way around does not work. I have not yet tested if management from the local 172.16.10.0/23 subnet works, but I will try this next.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Remote Access To ASDM?

Jan 5, 2012

How do I enable remote access to ASDM from outside of the network on the ASA 5505?  This would be used for remote access to the firewall at a site that is not utilizing VPN.

View 5 Replies View Related

Cisco Firewall :: 5505 Remote VPN And Backup ISP License

Oct 29, 2012

I have 5505 license with default 10 user license, want to increment the remote vpn user to 50 user license;will it be on yearly basis.Another question, can we purchase security plus license for configuring the failover config ,as well support the 50 user license on the same..

View 3 Replies View Related

Cisco Firewall :: Port Forwarding For Remote Desktop With ASA 5505?

Dec 16, 2012

Doing a port forward for remote desktop with asa 5505 9.1.1 and asdm 7.1.1 I could have done this with the previous versions of asdm but now it even more confusing?

View 21 Replies View Related

Cisco Firewall :: ASA 5505 Intermittently Disconnects Remote Vpn Users

Mar 7, 2011

I am using my ASA 5505 to remote VPN.  I use both windows and Macs.  I use the Cisco VPN client software on the windows machine, on the Mac I have used both the Cisco VPN software and the built in OS X VPN client. 
 
I am able to VPN with all machines, but randomly the VPN will disconnect all users.  I know there is a setting that may fix this which I think I tested in the past and it did not work, but I have now forgotten it. 

View 4 Replies View Related

Cisco VPN :: Allow Remote Access To Windows Server Through ASA (5505) Firewall

Jul 13, 2011

I would like to allow remote access to a windows server through a ASA  (5505) firewall. Users will use the vpn connection in order to connect to a private network. Is there any link  that describes the steps for ASDM?

View 3 Replies View Related

Cisco Firewall :: ASA 8.3(2) 5505 / Remote Access Vpn Default Gateway?

Jun 28, 2011

ASA 8.3(2) 5505
 
I've configured a number of remote access vpns on ASAs, but I don't recall having a default gateway setting assigned after logging in.
 
Is there a way to disable the assignment of a default gateway upon login?
 
The value assigned is meaningless. It's just the next available address in the local pool. 

View 2 Replies View Related

Cisco Firewall :: 5505 / How To Give Access To Remote Subnet

Mar 23, 2011

I want to give access to remote subnet on firewall 5505.

Remote subnet is 16x.15X.56.0

Here is my access list

access-list outside_5_cryptomap extended permit ip 192.168.12.0 255.255.254.0 16x.15X.56.0 255.255.254.0

View 7 Replies View Related

Cisco Firewall :: 5505 Remote VPN Clients Cannot Access Inside LAN

Apr 15, 2012

I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable. [code]

View 1 Replies View Related

Cisco Firewall :: Design Remote Access VPN With IPS Module On ASA 5505

Aug 13, 2011

I am proposing Remote access VPN solution to my client as per the attached diagram. However they are required IPS solution as well.
 
So in this case i dont think i can implement the IPS with outside interface in inline mode because of the encrypted traffic. Is it feasible if i enable IPS with inside interfce ?

View 1 Replies View Related

Network Diagnostics Pinged Remote Host But Did Not Receive Response

Feb 23, 2011

I can connect to the free wireless with no problem on my company laptop. Last night, I was using my personal laptop (as I have been for 2 weeks) on the wireless internet when I suddenly lost connection. In the Network and Sharing center of Windows Vista it shows a connection to the router but an 'X' between the router and the internet. When I run the diagnostic I get "Cannot communicate with primary DNS server (4.2.2.1)" The it says "Network diagnostics pinged the remote host but did not receive a response".

View 14 Replies View Related

Cisco Security :: To Restrict Remote Access VPN To ASA 5500 Based On Source

Oct 20, 2012

Is it possible to  restrict the Remote  Access VPN to  ASA based on the Source  Public IP , if so  how ? here I am not talking about the  VPN-Filter under group-policy . I Want to restrict the access from specified source  IP  (Public IP)

View 1 Replies View Related

Cisco Firewall :: ASA 5505 - VPN NAT Overlap Subnets Remote Interface Does Not Reply

Jul 10, 2012

Not really a big problem, but not knowing the answer is killing me.  This is what I have:
 
Host 1 <-> ASA 5505 <-> VPN connection<-> ASA5510 <-> Host 2
 
The problem is when one of the hosts trys to reach the inside interface of the remote ASA.  E.g. Host 1 trying to ping ASA5510 inside interface.  Again Host 1 and 2 have the same subnet address of 10.1.1.0/24.  I have configured the ASA 5505 to do the the NAT translations. 
 
[code]...

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Limit Access To Remote Desktop To Range Of Outside IPs

Jan 7, 2013

After getting hacked I want to limit terminal server/ remote desktop to only my computer. (although I may need to let other net in later)
 
In other words I want only computers from my home ip range (lets say my ISP gives me at  home something in  28.28.XX.0)  to be let in to the router at work and then to port 3389. 
 
In the work ASA 5505 softwareVersion  7.2(4)    I now have:
  
access-list outside_in extended permit tcp any interface outside eq 3389
 
static (inside, outside) tcp interface 3389 192.168.1.2 3389 netmask 255.255.255.255
 
acces-group outside_in in interface outside

View 3 Replies View Related

Cisco Firewall :: Unable To Access Remote Network After Connecting ASA 5510 And 5505

Sep 24, 2011

I am using two firewalls to connect two different offices. Firewall 5510 is running ASDM 6.3 and 5505 is running ASDM 6.2, Problem is that even after connecting two sites, i am unable to ping remote network from either side. I am mentioned static route as tunneled.

View 1 Replies View Related

Cisco Security :: ASA5510 - Single Timeout Drops Remote-Desktop Session

Oct 19, 2012

Just recently we replaced our HQ Cisco-Pix with Cisco-ASA 5510.  where we have many branches connecting to our HQ through site-to-site vpn. Since putting this new ASA5510 at HQ , while we are getting a  Remote-Desktop session  into our branches clients, and at the time when even a single TIMEOUT occurs on the vpn-link  so the remote-desktop session   gets completely lost.  then we have to re-connect the session.This issue happens as i said above  when a single  timeout  occurs on the vpn link.  What is the issue with the ASA5510. because with pix we didn't have this issue,  remote-desktops were never getting lost / reset  with single  timeout

View 1 Replies View Related

Cisco VPN :: 800 Series Extending A DMVPN With Very Small Remote Locations On Single ISP Link

Sep 11, 2012

I've been looking into posibilities for extending a DMVPN (already implemented) with very small (1-2 user) remote locations over a single ISP link.I would like to use what is basically the smallest Cisco router that supports DMVPN and EIGRP (stub) - here's a sample configuration:I know that the 881 can accomplish the above without issues (if it has Adv IP Services as licensing).I would like to know if I can use the smaller routers (physically smaller, that is) for a similar configuration. Can the Cisco 819 router.URL provide the same functionality? What about the Cisco 866VAE router URl.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved