Cisco VPN :: Asa 5510 Multiple ISP For Different Purposes
Dec 2, 2012
I have a client that is using an ASA5510 and would like to make some changes ,current config ,int 0/0 - external connection (T1) with multiple VPN site to site tunnels and VPN client tunnels ,int 0/1 Internal (10 network),Proposed config , add cable internet to int 0/3 , route default internet traffic to cable internet , leave VPN tunnels on T1 ,failover internet in the event of cable internet outage(using tracking) ,Would one or both of these options work? if so what is the better way to do it?
I have an ASUS P5E3 Deluxe motherboard and am having minor connection issues. Occasionally it will have trouble connecting to the internet....IMO, the traffic gets stuck as it attempts to send requests through the non-internet connected line. Here's how I have it connected, running Windows XP: It has a Realtek ethernet jack which is LAN 1 on the Connections menu and that line is connected to the router for internet. Typical set-up that automatically assigns IP address and all other options. It also has a Marvell Yukon connection (LAN 2) that connects to the server so that I can use the networked printer. I've assigned an IP address within the range of the settings on that router. The printer works. Is there a way to direct all internet or web data through one card so that the connection doesn't get bogged down? The server has no internet connection so I don't want any internet requests to go through the Marvell Yukon ethernet jack.
Summary: Want to use a WRT54G cascaded behind existing DI-604 router to offer free wi-fi to guests. Need to keep guests on a separate subnet, and make sure their traffic is never routed to currently existing one (office PCs).
Tried above settings, with DHCP enabled for the new guest subnet. Using normal Gateway mode (i.e. re-NATting). Wireless guests can access the Internet, but also 192.168.0.x machines.Also tried, as suggested on several docs, disconnecting the WRT from the main network, resetting to factory defaults and setting up router from scratch, with the same result. It seems reasonable that, by default, things are set up in such a way that the new subnet can share resources with the existing one; however, I need the contrary and can't seem to get it right.BTW, as soon as I enter the static IP and default gateway for the WAN interface I see new default entries appearing on the static route table (Adv Routing / Show Table) for 10.x.x.x to 192.168.0.x routing. I suppose that this is necessary for the router itself, as a member of both, to be able to perform NAT and gateway through the upper tier -- since I can't seem to delete these entries manually, anyway.Considered using Router mode, but if I understand correctly, that would disable NAT, which seems (to me) inconsistent with the "separate subnet" requirement, since the main router would need to NAT guests as well as employee PCs (which would imply using one subnet for both, right?). Considered adding a firewall rule at the WRT, but the firmware does not seem to offer a suitable feature. There are "Filters", but those aim at restricting Internet access (which I want to allow), or to a certain range of ports, or even search keywords -- but not to a range of *hosts*.Tried filtering out guest-to-LAN traffic at the main router, but this proved nontrivial to get working (probably due to NAT-within-NAT which, other than that, works fine). It sounds a bit silly, anyway, I mean, why route this kind of traffic only to filter it out later on? I'd rather not route it at all in the first place. Can that be avoided? How?
I am trying to enable a second WAN interface on our ASA.the end goal is to move all internet traffic to the new connection, but first i want to test it working.I have setup my computer as an object in the ASDM and the interface is configured correctly (same settings on a different router and that was working)I setup a route with a lower metric ( 1 lower than the default route which routes everything through current main internet interface) to route traffic from my computer out through the new interface but i am still connected on the old interface.I duplicated some of th NAT rules (but i would have thought if these werent working then i would have no internet connection anyway)
I have an ASA5510 that is connected to outside for WAN, inside for LAN (10.22.254.0/24), and a iSCSI switch plugged into Ethernet 0/3 (10.22.244.0/24). I can ping the Eth0/3 interface (10.22.244.1) but I can't ping across that interface from WAN or LAN side.
START CONFIGURATION ASA Version 9.1(1) ! hostname ASA5510
I'm having a bit of trouble determining the best way to do this... I have 12 V LAN's set up (sub interfaces on a redundant group of two NICs) on my ASA 5510. On several of these, I want them to be able to access the internet but not access other V LAN's.
By default, they have a rule like "any to any less secure", and since the outside interface has a lower security level, this works great. But if I create an ACL on the interface, this rule disappears. I can restore internet access by adding an "any to any" or "(this interface's sub net) to any" rule, but this seems to imply that it allows access to any v LAN. Do I have to create a set of "deny" rules for each V LAN, on each V LAN, followed by an any-any rule to allow internet access, or is there a cleaner approach?
i've two cisco asa5510 with 4 FastEthernet interfaces each.They are connected as below:
[code]...
to three different ISP each of them! The 4rth interface of each of them, is connected to internal LAN network. Both Firewalls, offers VPN Services to ISP connections on Fa0/0
How can i achieve high availability for this scneario?is this possible to implement some HighAvailability and to offer the actual services to each of them, in case that the other firewall fail?What about using subintefaces? can i connect bothe ISP and Customers links on one or each of them, in case that firewall01 fails, all the services to be online on firewall02?
Currently I have an asa 5510 set up with one block of outside IP addresses. Everything is working fine in regards to my initial setup. However we needed to purchase additional IPs from our provider and ended up being a whole complete different block. Where I am getting stuck is getting the new IPs to NAT to inside addresses.
im lookin to establish a a multiple L2L ips tunnels ( one tunnel for each subnet) from my cisco asa 5510 to the same destination. should the cisco asa capable of this ?
I would like to create two site-to-site VPNs, one for data and one for VoIP, between the same sites. One end is an ASA 5510 and the other is a third party firewall. Is this possible if I use different sets of IP addresses for each tunnel?
I use a Cisco ASA 5510 with the AnyConnect VPN for remote workers. Now we want to give access to a select group of consultants who only need access to one sever and block everything else.
I was thinking this could be done by creating a separate AnyConnect Connection Profile on the ASA. From that new connection will come a new GroupPolicy with a ACL to only allow access to the one system. That GroupPolicy will point to the Radius Server looking for an account in a specific MemberOf group.
My question is - Could you explain how the ASA knows what Connection Profile to use when a user tries to authenticate? Does it automatically hunt down each Connection Profile until there is a username match via RADIUS in the Connect Profile?
I'm currently replacing my ASA 5505 with a 5510. I have a range of public IP addresses, one has been assigned to the outside interface by the setup wizard (e.g. 123.123.123.124 ) and another I would like to NAT to an internal server (e.g 192.168.0.3 > 123.123.123.125). On my asa 5505 this seemed fairly straigh forward, i.e. create an incoming access rule that allowed SMTP to 123.123.123.125 and then create a static nat to translate 192.168.0.3 to 123.123.123.125. Since I've tried to do the same on the 5510 traffic is not passing through so I'm assuming that the use of additional public IP addresses is not handled in the same way as the 5505? I also see that by default on the 5505, 2 VLANs are created, one for the inside and one for the outside, where as this is not the case on the 5510. Is the problem that VLANs or sub-interfaces need to be created first? I'm doing the config via ASDM.
Everything else seems to OK i.e. access to ASDM via 123.123.123.124, outbound PAT and the site-to-site VPN.
I have a few sites all running Cisco ASA 5510s. They all share the same asa (8.4(4)1) and asdm (6.4.9) version, but their configs differ significantly. I have a cold spare sitting in my office in the event we have a physical failure. Is there a quick and simple way I can load up multiple configs and then boot up the cold spare to then run the config from Site_A or Site_B? Just looking for a quick solution rather than doing a full restore should something fail spectacularly. Nice to say upon bootup, using confreg perhaps, to boot Site_A config rather than Site_C.
Due to special circumstances we have 2 ISP links on an ASA5510. I am trying to terminate some L2L VPN tunnels on one link and others on the second ISP Link, eg below:
LOCAL FIREWALL crypto map outside-map_isp1 20 match address VPN_ACL_Acrypto map outside-map_isp1 20 set peer 1.1.1.1crypto map outside-map_isp1 20 set transform-set TS-Generic crypto map outside-map_isp2 30 match address VPN_ACL_Bcrypto map outside-map_isp2 30 set peer 3.3.3.3crypto map outside-map_isp2 30 set transform-set TS-Generic crypto map outside-map-isp1 interface ISP_1crypto map outside-map-isp2 interface ISP_2 crypto isakmp enable ISP_1crypto isakmp enable ISP_2 route ISP_1 0.0.0.0 0.0.0.0 1.1.1.254route ISP_2 3.3.3.3 255.255.255.255 2.2.2.254
Establising the VPN tunnels in either direction when using ISP_1 works fine establishing in either direction from remote access users and multiple L2L tunnels (only showing one for example).
On ISP_2 1. Peer 3.3.3.3 device establishes a VPN tunnel, but the return traffic does NOT get back to devices on 3.3.3.3 tunnel. 2. The local firewall does NOT establish a VPN tunnel going to 3.3.3.3 It would seem to indicate that the problems lies with this multihomed firewall not directing the traffic correctly to either return down and establised VPN tunnel (point1) or to intiate a tunnel if none exists (point 2).
Reconfiguring the VPN tunnel peer for 3.3.3.3 to be on ISP_1 of the local firewall, all springs into life! There are sufficient license etc...
I am trying to set up my ASA5510 the fail over of ISP when it can't ping three different IP. I create three different tracking to three different IP using sla monitor & track rtr. But when I do
the last route will replace the previous two and only the last route command takes effect.Is there anyway I can set up the fail over to ISP2 only when it can't ping three different IP from ISP1?
We have plans for multiple ISPs and need to pick the correct device/architecture for that. single site: 3 ethernet hand offs (1 From ATT Fiber/10Mb pipe via their managed router, another one from ATT via Copper T1 via a separate circuit & managed router and the 3rd/last from Cable Modem/Comcast)
1.WAN hand off from another ISP from I will use ASA 5510 (already have) to use all the above 4 as inputs and then use the internal interface of the ASA 5510 as the default gateway for all the employees to browse the internet etc. so that1. If one one or more of the ISP lines die, we continue to operate (albeit lower bandwidth)
2. Also, we take advantage of the added bandwidth (even though it may not be the arithmetic sum of all the above).
I am working on replacing our Checkpoint Firewalls with ASA's, and am running into the following NAT problem. On some of our Checkpoints, there are external NAT's that are mapped to multiple internal hosts based on ports.Is there any way to translate that to the ASA? I'm not sure the ASA will let you have multiple internal hosts mapped to one external IP using static NATs. The main issue, is these are alarm panels that receive data from external hosts (the traffic is initiated externally on the Internet) so I can't use dynamic PAT with this.
I have a ASA 5510 at our corporate HQ that has one site to site VPN. I need to add 6 additional site to site VPN's to this ASA for our remote branches. How can I add them without affecting the existing site to site VPN? The 6 site to site VPN's will all have the same settings however these settings are different from the existing site to site that I already have set up. How can I set it up so the 6 additional VPN's use their own crypto map and all use the same settings?
I need to create a firewalled segment that not only separates hosts from general population, but also from each other. The solitary confinement of firewalled segments.I know that I could create a bunch of sub-interfaces, one for each host or group that needs to be isolated, but I'd really rather not have to do that if possible. 1) It could become a management nightmare between ACLs and sub-interfaces and 2) it's a waste of IP addresses.s there any way that I can create a bunch of separate VLANs behind the firewall and have them all terminate at the firewall, using a single firewall IP address for the gateway?
how i can configure a second ssid for guest access in our environment. this is our network setup prior to this request: Internet----Firewall (not ASA)---ce520---C1131AG and CME router is also connecting to the ce520 switch. we only have two vlans: one for voice and two for data.
Presently, there is no vlan configured on the AP because it on broadcasting ont ssid and wireless users gets IP from a windows DHCP server on the LAN. the configuration on the ce520 switch port for the AP and other switches say access vlan is the DATA vlan which automatically becomes the native vlan for all trunk port connecting the AP and other Stiches to the network.
Now with this new requirement, i have made my research and i have configured the AP to broadcast both the production and the guest Vlans. The two vlans are 20-DATA and 60-Guest. I made the DATA vlan on the AP the native vlan since the poe switch is using the DATA vlan as native on the trunk ports. I configured the firewall to serve as DHCP server for the guest ssid and i have added the ip helper-address on the guest vlan interface on all switches while the windows server remains the dhcp server for the production DATA Vlan. I have confirmed that the AP, switches can ping the default gateway of the guest dhcp server which is another interface on the firewall. I can now see and connect to all broadcasted ssids but the problem is I am not getting IP addresses from both the production dhcp server and guest dhcp server when i connected to the ssid one at a time. My AP config is attached below.
Do i need to redesign the whole network to have a native vlan other nthan the data vlan? Does the access point need to be aware of the voice vlan? Do the native Vlan on the AP need to be in Bridge-group 1 or can i leave it in bridge-group 20?
My question is if I can configure 3 ssid, for 3 different VLAN and add the DHCP address from a WAP4410N AP, when you upgrade to the latest version of IOS I can have this functionality?
I am trying to build a new network from scratch, I have the WLC 5508 w/ Aironet 3600e APs connected to my Netgear Smart Switches and a Linksys RV082 router that I'm using as my DHCP server with several VLANs for several stuff on my Switches.
I have 2 questions:
1. Can I have 5 Interfaces configured on 5 different VLANs, each SSID on each a different Port:
Port 1: Controller management only=> 192.168.x.x /24 Port 2: SSID 1: WiFi Internal=> 172.16.x.x/12 (Radius Auth with no sharing) Port 3: SSID 2: WiFi Internal w/ sharing=> 192.168.x.x/24 (Radius Auth with sharing) Port 4 :SSID 3: WiFi Guest=> 10.0.x.x/8 (Web Auth) Port 5: SSID 4: WiFi IT=> 192.168.x.x/24 ( Radius or certificate Auth with access to the controller management interface)
2. How can I use the Controller as the DHCP server for all the WiFi traffic, and how should that be configured to work with my other DHCP server?
i`m facing a problem configuring the mentioned access point to act as stand alone access point with multiple SSID assigned to differnet VLANs the problem is that
1) i`m not able to broadcast the both SSIDs in the same time from the Access point
2) i need to make the radius server to manage the SSID access for the wireless clients (trying to find a way in which the aceess point sends a log for the radius server containing the VLAN id /IP address of the the SSID) you may find the below info about the IOS ver. & the configuration?
Is it possible to assign a single ssid to multiple interface groups by assigning the ssid to multiple AP groups?
I have buildings geographically dispersed that are configured with multiple vlans in interface groups so that I can maintain an addressing scheme of dhcp assigned addresses per building. Each building is also further grouped as AP groups. I'd like to know if by assigning the same wlan ssid to each of the AP groups, will I maintain addressing integrity for each building? I'm thinking it will work.
Do the buildings have to be outside AP range of each other to avoid problems?
I'm trying to figure out how to get two 5510 ASA's to establish a Site-to-Site VPN.The version with two static IP's is working perfectly and stable but I haven't figured out how to get a VPN running between a static and a dynamic IP
We have a WLC 5500 apliance, but i have a problem, the APs have a administrative IP in a diferent segment, only conected to WLC the AP have same segment of the management interface, the 5500 don´t have APmanager interface.How configurate the WLC to conected and administrate all AP with different segment IP
I have an ASA connected to 2 ISPs.I am using object tracking for the default route so only 1 path is used at a time. I have a L2L VPN setup going out interface A. I would like to configure a 2nd VPN going out interface B with identical parameters.
(ASA software 8.2)
crypto map PATH_A 1 match address outside_1_cryptomap crypto map PATH_A 1 set peer 10.1.1.1 crypto map PATH_A 1 set transform-set ESP-AES-128-SHA crypto map PATH_A 1 set security-association lifetime seconds 28800 crypto map PATH_A 1 set security-association lifetime kilobytes 4608000 crypto map PATH_A 1 set reverse-route
I have a job with a budget-limited client who has three Cisco RV042 dual-WAN routers. They had hoped to establish rather seamless *inbound* service, which doesn't seem to be the real purpose for these units, they appear to be designed for bandwidth aggregation and/or rather seamless *outbound* service.Since they have three of these routers, and three broadband connections (two different 5 IP blocks at one ISP, one 5 IP block at a second ISP) I am toying with the idea of using one router per broadband, and configuring each router for One-to-One NAT, dispensing with the dual-WAN redundancy feature.Each router will come from a different public subnet, yet have a one-to-one NAT to the *same* internal server, for instance:
The routers will be configured on the same subnet internally. 192.168.1.1, 192.168.1.2, and 192.168.1.3 respectively. I'll use weighted multiple default gateways on the server's IP configuration, to establish their default and failover gateways.My question is, does configuring multiple routers for one-to-one NAT to the *same* server cause any conflict or failure? You know, of the "sorry bub that private interface is already sucked up by router 1 and I can't do this" nature?
