I need to setup a L2L vpn between two ASA 5505 model. but due to poor planning and documentation both sites has same subnet (192.168.1.0/24) now i need to set up L2L wtih overlapping subnets. is it possible with asa 5505?
View 1 Replies
In one of our offices in Tokyo, we used to connect to the internet using a PPPoE connection from an ASA5505 and then ran multiple IP SEC tunnels to our remote sites. We have a /28 public range, but I couldn't work out how to utilize the other addresses, as the firewall was assigned a /32 on it's dialer.
To try to use more of the address space, we changed the topology and put a 1921 router at the internet perimeter terminating the PPPoE and then connected the inside of that to the outside of our ASA5505. We split the /28 into two /29 sub nets. the dialer interface of the router has a /32 from one of the /29s and the link between the inside of the router and the outside of the firewall used the other /29.
Since that change, we have had a number of performance problems to devices located behind the firewall (over VPN). If there's no traffic going over it, then response times to the public facing interfaces of the eqpt there are good. The more traffic we push over it the more packet loss we get. The response times are consistent, it's the packet loss that's the problem. There are no errors or drops on the PPPoE interface.The obvious answer to this is that we're pushing more traffic over it than we should, but it's a 100Mb circuit and I'm having severe packet loss if I try to push about 2 or 3 Mbps through it.
We're pretty certain that it's an ISP problem and can't say for sure that the problem started when we changed the topology out there, but anything to do with the way we've split the subnets out like that?
Site A:
ASA5520
VLAN data subnet 172.16.10.x/24
VLAN Voice subnet 10.0.0.x/24
Site B:
ASA5505 Base license
VLAN data subnet 192.168.10.x/24
VLAN Voice (restr) subnet 10.0.1.0/24
The callmanager is located on site A and needs to sent out DHCP-offers to site B through the VPN so the IP-phones can register to the callmanager. I got the VPN up and running for the data-subnet but i can't get traffic through the voice-subnet/VLAN.
Can the ASA's do the job or do I need to route traffic before the ASA's on both sides and sent it through the tunnel, configured both subnets as interesting traffic? Ofcourse the last situation I need to upgrade the license for the 5505 to gain more VLAN's.
just getting started with ASA's. I've got my 5505 almost 100% configured but my port 25 forward to my Exchange server. Currently I've got an access list forwarding all traffic that hits the outside interface on port 25 to my Exchange server (access-list outside-in extended permit tcp any object mail-port-25 eq smtp). What I'd like to do now is say that only port 25 traffic from specific IP subnets gets forwarded. I thought I read that there's a couple of way to do this (from the inside interface, from the outside interface).
Also, what happens to port 25 hits that don't fall within the range I specify? Do they get a disconnect reply or do they just get ignored (no reply whatsoever)?
Edit: ...just to clarify, the allowed IP's I will be entering are the WAN IP's of my AS/AV service.
Not really a big problem, but not knowing the answer is killing me. This is what I have:
Host 1 <-> ASA 5505 <-> VPN connection<-> ASA5510 <-> Host 2
The problem is when one of the hosts trys to reach the inside interface of the remote ASA. E.g. Host 1 trying to ping ASA5510 inside interface. Again Host 1 and 2 have the same subnet address of 10.1.1.0/24. I have configured the ASA 5505 to do the the NAT translations.
[code]...
I have just setup a new WLC 2504 controller to manage a WiFi service that will span 6 geographic locations. The local networks at each location are on different subnets (all 192.168.x.x) and are linked up via IPSEC VPN links, and there is Active Directory spanning the sites, with DNS and DHCP servers running at each location.
I tested the WLC at our main office with a single AP, and it worked fine. The AP set itself up, and wireless devices connect with no probs. Great! Yesterday I headed out to one of our remote sites, and connected an AP to their network - and that seemed to work fine too. Within a few minutes I was able to see the WiFi network I'd setup, and my smartphone connected to it straight away (as I'd rpeviously connected at the main office), so I was pretty happy that all was working well.
This morning however I've had notification that wifi performance at the remote site isn't great. I've got someone to check their ip address, and I've found that their IP address and default gateway match the LAN at the main office where the WLC is based - NOT the LAN where the wireless client is. Obvioulsy this is not ideal!
(I guess I HAVE done something wrong!?). And how can I get wireless clients at remote sites to pick up an IP from the DHCP server at THEIR site?
I need to NAT some subnets to one IP and other subnets to another IP. The range command want work because some of the subnets are out of order.For example subnets 192.168.1.0 - 192.168.7.0 and 192.168.25.0, 192.168.28.0 nat'd to 1.1.1.1. subnet 192.168.26.0-192.168.27.0 nat'd to 1.1.1.2
View 2 Replies View RelatedI have a Time Warner Cable business class service with no static IP, with a wireless modem which is plugged to a CAT5 distribution panel. On the jacks (2 other rooms on the house) I have a Linksys E3000 and a Linksys Valet router for signal boost and gadgets usage (TV, cameras, etc).The main router (TWC) has it's own external IP which TWC assigns to me and internally distributes via DHCP the range 192.168.0.x. With that said:
- The E3000 has a 192.168.0.6 IP -- this is fixed setup on the TWC router (ubee brand) by MAC address
- The Valet has a 192.168.0.7 IP -- this is fixed setup on the TWC router (ubee brand) by MAC address
- The main router has the 192.168.0.1 as the gateway and web-interface
Whenever I connect something to the E3000, it is distributing the 192.168.1.x range and the valet 192.168.2.x range.That works perfectly for my home based business until I decided to use more stuff on the network such as a IP printer, IP cameras, etc.
- The IP cameras are connected to the E3000 due to signal strength and I have manually assigned them the 192.168.1.15 and 192.168.1.16 IPs and ports 9001 and 9002.
- The printer is connected to the E3000 and I have manually assigned the IP 192.168.1.30.
Issue 1: Port forwarding On the main router (TWC - UBEE) I have tried to setup a port forwarding by informing the Local IP as 192.168.0.6 (E3000 IP), Internal Port 0, Public Interface IP (0.0.0.0), Ext Start Port 9001, Ext End Port 9001, Protocol - Both, Enabled Yes. On the E3000 I did the same config (screen shot attached e3000.png).This is not working properly. I can't get into the camera.
Issue 2: Printer/ The printer is only accessible if I connect to the E3000 (because it is on the 192.168.1.x network)
Issue 3: How to configure all the devices on the same subnet? If I want everyone to be on the 192.168.0.x network, how to configure properly the E3000 and the Valet? I have tried to force them into the same network but it would not work properly. It would not get an IP from the UBEE router (main).
To set up AnyConnect on my ASA5505? I have my VPN access working properly through the Cisco client however I want to be able to use the clientless program as well that is available.
View 1 Replies View RelatedASA 5505 Sec plus lic w/OS 9.1
I want to setup a quick and simple VPN server on my ASA. I want to do local authentication and, once authenticated, I want to allow all internal access. I only have 1 WAN IP. I'm finding a ton of conflicting info online. The ASA is already setup and is operational. I just need the correct commands to setup the VPN.
I ordered a IPS module to a small ASA to replace a Snort IDS Server.I want only to perform IDS and reporting (not inline) The design (simplified) is
The problem is that i read this morning that ASA cannot handle this type of scenario, it can only analyse the traffic that is passing through it. Is there a chance to make this work ?
There is so much mis-information on the Internet and Cisco's own support site has bits and pieces everywhere (I've found at least 5 support pages in Cisco that address this subject), none work or are directly targeted at what I would consider is a major use case for this product. I can see from the many posts everywhere that getting L2TP/IPSEC to work is a major problem, requiring many configuration steps that all have to be perfect and there seems to be some trick to get it to work that most people struggle with. Most of the advice out there is impertinent and highly technical but doesn't work.
I would like to know if there is any consolidated instructions that WORK to create a VPN server on the 5505 using the ASDM and also how to set your Windows 7 (or 2008) client to work with it.
Like I've said, I've spent hours and hours on this and have yet to get anything to work. I have a brand new 5505 connected directly to DSL (static IP) that I ran the wizard on and followed the best advice I could find (by the way there's TONS of information on getting XP to work but afaik, this does NOT work for windows 7). Now that I've tried various things without success, I believe I've gotten it so fouled up I need to reset to factory defaults and start over.
I also have another brand new 5505 connected to a different DSL line. Behind that firewall, I have both windows 7 clients and windows 2008 server. I've tried lots of different things to get these to work including the registry hacks (which, if indeed is required, I seriously can't believe that Cisco hasn't given us a tool for).
I have tried to use the ASDM to do all my programming as I find the CLI to be extremely error prone and virtually incomprehensible.So, what the world needs is one place that gives all the instructions on what to do, step-by-step that really work for this simple use case of windows connecting to the ASA.
I have an ASA 5505 configured using easy VPN connecting to our corporate ASA. The ASA5505 is configured for network extension mode with a routable subnet. The clients that hang off the ASA 5505 are DHCP and get their IP address and DNS settings from the ASA 5505. I have a split tunnel setup, so only certain networks go over the tunnel back to corporate. Local Internet browsing goes out the ASA 5505 to the ISP.
My questions is how to setup split-dns. i would like to have my clients query the ISP's DNS servers for Internet based websites and when they need to access the exchange server the query goes to our corporate DNS servers. I see a setting for DNS names under the group policy on the corporate ASA, but how does the client know which DNS server to use?
The clients receive a primary DNS server (ISP) and a secondary (Corporate DNS) from the ASA5505.
I have an ASA 5505 that I would like to use only as a VPN access device into my network. I am looking for the most secure setup.
Currently I have a router with 4 networks/subnets: DMZ, public, protected, perimeter. DMZ is public DNS and web, no access to any other subnets, only 80 and 53 from public. Perimeter is an edge email server, only port 25 allowed to the email server on the protected subnet. Protected is all internal servers and workstatoins, no access from any other subnet and limited access out to public.
Where would I place the VPN device?
I have been asked to setup a VPN on a stick setup so that people on the move can use the encryption of our SSL VPN for web browsing etc using Any Connect. This works fine, whats my ip shows the external IP of the office when connected to the VPN and all traffic is pushed down the pipe. The only issue is when connected I have no access to local resources such as IP printers etc. How to do this on 5505?
View 6 Replies View RelatedI have a new Cisco ASA 5505 which I am trying to just setup so that all computers on the LAN can get to the internet (browsing and ping). My current setup attached.
View 1 Replies View RelatedI have an ASA 5505 with a dynamic IP address from the ISP.What I need to accomplish is the following:
- Either setup that ASA (Dynamic IP)VPN with an IOS router (Static IP)
- Or setup that ASA (Dynamic IP) with another ASA (Static IP)
I have a problem with a branch office setup, and I can't for the life of me think of what the problem is.I have a remote office setup, using an ASA 5505 that is set up to establish an easy vpn connection to the central network. The connection at the branch office is a 20/5 cable modem, the central network has a 25/25 fiber connection.
The issue I have is this. Wired clients work fine at this branch office, at least 95% of the time. I have a lightweight AP there that can come up and join the controllers at the central network, no problem. I haven't done anything with H-REAP because there are really no resources locally they need that would allow them to do their work, so all traffic is tunneled back to the WLC.
Wireless clients can authenticate to the AP, and I can get 15-20ms ping responses from them all day. Latency never comes close to the 600ms proposed limit with CAPWAP. Yet, for some reason the performance of the clients is problematic. Webpages will frequently not load correctly, they experience some freezing, and with one application we use - it refuses to load completely.If we bring these same computers to an AP connected to our central network, on the same SSID, they work flawlessly.
Something about this particular location is causing a lot of grief for our users.For what it's worth, we are running WCS 7.0.230.0 and the WLCs are on 7.0.116.0. The ASA is running a pretty basic configuration, pretty much out of the box with the easy vpn configuration entered.
I currently use MS ISA Server 2006 to protect a windows internal network, where there is also an MS Exchange server. I have acquired a Cisco 5510 to enhance security at main office. Later I will have ASA 5505 for branches, including VPN-ning. to have firewall at main office. I have several public IPs and would like to setup DMZ for Web, Exchange server and FTP. How do I setup interface and sub-interface for the DMZ?Can I continue using ISA Server connecting to Cisco 5510 on the perimeter? If so, How do I set the interfaces (and sub-interfaces) as well as NAT-ting and access configuration between the inside and outside?
View 12 Replies View RelatedI have setup a vpn connection at my remote offices with a 5505. At my main office I have a 5510.From my remote offices I can PING my Main office server. However when I go to set up a vpn connection through windows network and sharing center I can't seem to have the connection connect.....
View 15 Replies View RelatedI'm having trouble setting up a second IPSec VPN tunnel on my Cisco ASA 5505 to another office. I was able to setup the first one with no problem through the ASDM, but have not been able to get the second one up.The IPSec tunnel is connecting to a WRVS4400N router at the other office. I tried debugging crypto isakmp, and crypto ipsec, but I'm getting nothing. Below is the config. Does something look wrong on my end? I also attached a screenshot of the parameters setup on the remote router.
View 7 Replies View RelatedI have two 5505's facing each other over 10meg dsl internet links with slow up links, I think that the uplink is around 768K and down is 10meg.Behind each ASA on each end sits a pbx they are using H.323 point to point trunk for connectivity to talk to each other one the g.729 codec. I've read a little on Qos and I'm wondering if GRE over IPSecis the way to configure this setup. I'm needing recomendations. There are is no qos at present configured and its not working well at times. There are only 5 phones at the remote site and 5 computers. The remote end only supports 3 vlans as well. I'm new to ASA.
View 1 Replies View Relatedi need to configure a ASA 5505 in transparent mode.learned from Internet, my configuration is :
int e0/0 --- vlan 1---->nameif outside
int e0/4 --- vlan 2------> nameif inside
gloable ip is 172.17.104.10 255.255.255.0
http server enable
http 172.17.104.0 255.255.255.0 inside
when i connect the outside interface to one PC with ip addr 172.17.104.194 my PC connect to inside interface with ip 172.17.104.249 cannot ping each other even when i set rules as permit any any on both direction
I followed a few Youtube videos and replicated another ASA's VPN configuration through ASDM to create the Anyconnect VPN on the ASA 5505.
The problem is, after everything checked and triple checked, I still cannot get to https://external_IP. I can post configs if needed, but I really did replicate another ASA almost exactly.An online port scan shows my external IP as "not listening on port 443".However, when I run on the ASA :
I get the following (external IP changed to 123.123.123.123 for the forums):
Protocol Socket Local Address Foreign Address State
TCP 0004426f 192.168.8.4:22 0.0.0.0:* LISTEN
SSL 0574f7af 123.123.123.123:443 0.0.0.0:* LISTEN
DTLS 0577b0ef 123.123.123.123:443 0.0.0.0:* LISTEN
TCP 06fa8d1f 123.123.123.123:80 0.0.0.0:* LISTEN
SSL 079385bf 192.168.8.4:444 0.0.0.0:* LISTEN
So it does appear to be listening on the external IP on the outside interface correctly.I went ahead and tried the whole "change the ASDM port" as you can see from the inside interface being changed to 444 but management isn't even enabled on the outside interface so I'm not sure why it is acting this way.
The outside interface is plugged into a DSL modem. I don't think this DSL modem has any real intelligence, but I was going to disconnect the ASA and plug my laptop into the outside interface (on the same subnet) and then see if I could reach it. That was the only thing I could think of...that possibly the DSL modem was blocking the inbound traffic.
i want to setup a vpn connection between Cisco asa 5505 and centos server.
Here is my senerio:
ASA 5505
Public IP address 155.155.155.2
Local NETWORK : 192.168.6.X
Centos Server
------------------
Public ip address : 155.155.155.6
I have two 5505 ASA. I would like to know can I make two 5505 failover redundant with active standby setup?
View 11 Replies View RelatedI have a newly aquired asa 5505 that I just set up to the bare minimum configurations. I followed a cisco paper on how to create a "remote access vpn" setup for ipsec. I can sucessfully connect and establish a VPN, but when I try to access an inside resource from the vpn address, the asa blocks it.
Specific error is: Code...
I'm trying to set up a 5505 (running 8.3) so that i can use the client vpn through RADIUS authentication.I have set up a new local RAIDUS windows box and used the ASDM asistant and a few other guides to setup the 5505.
View 3 Replies View Relatedhow can I setup that the backup connection will start but after 30s of icmp timeout the default gateway (tracket object - 192.168.1.1)
My configuration:
sla monitor 123
type echo protocol ipIcmpEcho 192.168.1.1 interface outside
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 track 1
route backup 0.0.0.0 0.0.0.0 192.168.2.1 254
track 1 rtr 123 reachability
I am planning to imlpement an ASA 5505 in my home network and I am wondering if this is a valid configuration. I am wondering if it is necessary to have 3 separate internal subnets or if these can be cabeled together in a more efficient fashion?
I plan to keep the 2 servers (game, e-mail) branched off the ASA directly in a DMZ configuration. The rest of the clients connect through the wireless/wired router.
Any unforseen problems with a setup like this (Modem -> Firewall -> Internal Router)? I have read sites that say I will have to accept an IP via DHCP for the ASA's external interface.
I'm having trouble setting up the correct rules on an ASA 5505 I'm using in my home office. I have a couple of IP Cams I need to access remotely.
I've tried setting up simple NAT(PAT) and/or Access Rules, but it hasn't worked. I have a single dynamic IP for the Outside interface. Call it 77.76.88.10 and I am using PAT. The CAM is setup to connect on port 80, but could be configured if necessary. I've tried setting up NAT Rules using ASDM as follows:
Match Criteria: Original Packet
Source Intf = outside
Dest Intf = inside
[Code]....
I'm afraid to use CLI only because I am not confident I'll know how to remove changes if I make a mistake.
I have two ASA 5505's. One is currently setup as my firewall connected to the Cox Cable modem and wireless AP. I have another ASA that I would like to use, I have an idea that I could set that one up as a VPN unit, but not sure how I could do that. If that is not an option, can you provide the command line instructions on how to setup the VPN via the console cable. [code]
View 1 Replies View RelatedI have been using static NAT to map between a single server behind an ASA 5505 and a single public IP address. In other words, I've been doing this:
object network NAT_ME
nat (inside,outside) static interface
Now I would like to start using the clientless VPN feature of the ASA, so I of course don't want that particular port forwarded to the server. Is there a way to define such an exclusion? I've tried several things, including setting up a separate NAT rule to direct that port back to the ASA's interface, without luck.
If that is not possible, what configuration would I need to move to in order to get the behavior that I want? It is important that all (non-VPN) traffic is passed exactly as it arrives at the firewall (whether it is coming from internal or external), with the exception of changing the IP address (i.e., I need static port mappings for some of my services).
