Cisco WAN :: 5510 Block Of IP Addresses Assigned From ISP
Jan 6, 2011
I have a Cisco ASA 5510 with a 5 block of IP addresses assigned from our ISP. I am having issues with connectivity and routing traffic from the outside interface to the outside interface. I have my outside interface set up with IP address of 24.182.x.146, it allows internet access and also hosts a web server. Any time I have a client using this device for internet access, I am unable to have traffic accepted for my web server. I.E 100.100.x.52 is using this device, it browses to https://24.182.x.146 and it gets an unable to connect. I am able to connect to the web server from any other ISP/Device. [code]
View 4 Replies
ADVERTISEMENT
Jun 24, 2007
Here at HQ we have a 4402 WLC. At our remote sites we have 1231G APs running in autonomous mode. I upgraded one of the APs -- IOS 12.4(3g)JA -- to run LWAPP. Per release notes I've read upgraded 1231's do not support REAP/HREAP mode, consequently, it's running in LOCAL mode.
The AP is managed by the WLC. I created a WLAN for the remote site and assigned it to the MGMT interface; the remote site subnet doesn't exist in HQ. The DHCP server for the remote site is presently at that site; AP and DHCP server reside at the same place.
Clients authenticate successfully to the remote site AP, however, they are not getting DHCP addresses assigned. Does the DHCP server for the remote site have to reside in HQ since the AP is running in local mode? If so, where is that specified, on the MGMT interface config?
View 4 Replies
View Related
Mar 27, 2011
Here is the question,"If an ISP purchased the following block of IP addresses: 200.23.16.0/20, describe and/or diagram how they would be able to divide this block of IP adresses into 8 subnets for resale. What are the number of hosts for each subnet?"
View 12 Replies
View Related
Nov 20, 2012
We have both a Comcast and Verizon connection at our school. They are going into a Sonicwall NSA5500. The configuration is such that if the primary - Comcast - fails then the secondary - Verizon - will pickup the internet traffic. The issue we are having is with local Verizon customers. When we got our IP address from verizon it was a /24 subnet with a gateway starting at .1
I thought this was strange as every other time I have gotten a block of static IP addresses from an ISP it has been a /29 or /28 at the most. But the ISP confirmed that this is what we were supposed to get and it should not cause problems.
A local business we deal with happens to be on our subnet with the same next hop Gateway. When I perform a traceroute to them, the traffic goes directly out the Verizon WAN interface to our common gateway, then to the local business. This, all while the Comcast Interface is our dedicated primary for all traffic.
I spoke with Sonicwall and they explained that the firewall is simply taking the most efficient path which makes sense to me in some regard but is still confusing why it would use the interface when policy says it is a failover.
Now, this local business tries to send us email with their on premise Exchange - we also have Exchange. The emails will sit in their queue indefinitely and ultimately fail to reach us. If I disable the Verizon interface the emails come in perfectly fine - even some in their queue will immediately come through once I disable it. I thought this was a DNS issue but it is not or at least our DNS is all configured correctly where we have no other problems with email. Our MX records utilize the static IPs from Comcast - nothing is using our static Verizon addresses.
View 9 Replies
View Related
Jun 30, 2011
ASA 5510 ASA 8.0 ASDM 6.1 I want some remote users to have split-tunnel connection, others not. I used Cisco Document ID 100936 "Allow Split Tunneling for AnyConnect VPN Client on the ASA Configuration...". I created a new Group Policy with split-tunnel enabled. I created a new Connection Profile and assigned to it the new Group Policy. When I authenticate at the AnyConnect client I get a dropdown of the 2 connecton profiles, to choose the one I want. Each of them works, enabling or disabling split-tunnel. But I want to assign a connection profile to the particular user, not give the user a choice. The problem is I'm using LDAP authentication. The Local Users I set up before LDAP are obsolete, assigning them a Group Policy does nothing. I really don't want to give up LDAP and force people back to another local password. But the LDAP authentication to Active Directory just says yes or no, it won't assign a connection profile. At the AnyConnect Connection Profiles page I have set a switch "Allow user to select connection profile, identified by its alias, on the login page. Otherwise, DefaultWebVPNGroup will be the connection profile". If I clear that switch every user will be assigned the same default profile, which does not work.
View 2 Replies
View Related
Feb 8, 2013
I am wondering how I log into the router and block particular IP addresses to include especially Facebook. I have a N Wireless Router F5D8233-4. Is there a way to figure out a site IP address if you open up there website.
View 3 Replies
View Related
Mar 12, 2013
I have an E2500 wireless router and I am trying to block some incoming IP addresses. I'm trying to prevent a certain ISP from throttling my access on certain websites. I can do it on individual computers but we have a bunch of devices on this network
View 1 Replies
View Related
Feb 24, 2012
Is there a way to block a range of IP addresses in the E2500? Like parental controls but with IP addresses instead of URL..
View 2 Replies
View Related
Dec 20, 2012
how do I block IP/Internet Adresses for ALL users without adding the sites manually per user in the Parental Control panel? I want to block a certain IP/internet adress for all users but can't find this feature within my EA6500 anywhere?Is this a firmware bug? Has linskys forgotten that some sites want to blocked for all users and how do I do it all in one?
View 1 Replies
View Related
Apr 6, 2011
We have an issue in which some of our public IPs will not work from outside. We have a couple of subnets/29. We allow traffic via access rules and they point to internal servers (nat to nat). So I requested an ARP table from our ISP router. The table shows that the non working IPs have a differect MAC address than the working IPs. Our ISP blames our equipment (CIsco ASA 5510) for this. I spoke to Cisco support. They looked at our configuration, and tested it. They say our configuration is correct and the ISP's equipment is doing it.
IPSMAC address*.*.*.5*.*.4cd8*.*.*.4*.*.4cd8*.*.*.3*.*.4cd8*.*.*.2.*.*.4cd8*.*.*.204*.*.4cd8*.*.*.205*.*.4cd9
As you can see above, the IP ending in 205 has a different MAC address ending in 4cd9. It should end in 4cd8. This seems to happened randomly with all IPs. Like if I restart the ASA. Some of the IPs will not work, and will show a different MAC address.We then have to wait a couple of hrs for them to start work again.
View 1 Replies
View Related
Sep 9, 2012
I would like to create two site-to-site VPNs, one for data and one for VoIP, between the same sites. One end is an ASA 5510 and the other is a third party firewall. Is this possible if I use different sets of IP addresses for each tunnel?
View 3 Replies
View Related
Jul 12, 2011
I have an ASA5510 running version 8.4. ICMP is blocked from the internet to the outside interface of our firewall but now our ISP is requesting us to allow ICMP from their network to the outside of our ASA. I need to allow ICMP from three blocks of IP Addresses?
View 9 Replies
View Related
Dec 2, 2010
I'm currently replacing my ASA 5505 with a 5510. I have a range of public IP addresses, one has been assigned to the outside interface by the setup wizard (e.g. 123.123.123.124 ) and another I would like to NAT to an internal server (e.g 192.168.0.3 > 123.123.123.125). On my asa 5505 this seemed fairly straigh forward, i.e. create an incoming access rule that allowed SMTP to 123.123.123.125 and then create a static nat to translate 192.168.0.3 to 123.123.123.125. Since I've tried to do the same on the 5510 traffic is not passing through so I'm assuming that the use of additional public IP addresses is not handled in the same way as the 5505? I also see that by default on the 5505, 2 VLANs are created, one for the inside and one for the outside, where as this is not the case on the 5510. Is the problem that VLANs or sub-interfaces need to be created first? I'm doing the config via ASDM.
Everything else seems to OK i.e. access to ASDM via 123.123.123.124, outbound PAT and the site-to-site VPN.
View 15 Replies
View Related
Oct 13, 2011
How do i tell my firewall to start listen also on another outside ipadress assigned by my ISP? I have it used on other firewall right now. So my steps would be shutting down ip address assignment off old firewall interface. Assign that ip address to ASA5510 outside interface and configure NAT.
View 13 Replies
View Related
Dec 2, 2012
how to allow few url and block other in cisco asa 5510
View 6 Replies
View Related
Apr 12, 2011
ASA 5510, version 8.4.1 with ASDM 6.4.1
How can I prevent the user to share files with p2 programs (torrent, eMule, etc) and to chat via Instant Messaging, Facebook, Twitter, etc. ? I find a lot of suggestion, but allways related to 8.3 or older
View 6 Replies
View Related
Apr 22, 2013
where is the best place to block unwanted traffic? By that I mean, should I block it at the router, firewall, IPS? As an example, I'm dealing with DNS flood attacks - probably DDoS and reflection. I have a pair of Cisco 2821 routers with two different ISPs doing BGP. Behind that I have an ASA 5510 with IPS module. Behind that I have 2 public DNS servers. Over the last few days I've seen an increase in bogus DNS queries - high volume, distributed. My question is where is the best place to put the ACL to block them? I've been putting them on the ASA, but when the attack is running, it jacks the CPU to 60%. If I don't put the ACL, the IPS seems to pick them up after a while and the CPU is almost as high as with the ACL. I haven't tried to put the ACL on the routers.
View 2 Replies
View Related
Oct 9, 2011
I have 1 firewall module of ASA 5510. I am trying to block some URL's in it via ASDM but not working.
So far tried by following standard cisco doc which shows hwo to enable URL blocking via ASDM n via regex. Not working in my case.
View 1 Replies
View Related
Oct 3, 2012
block skype 5.1 in my network. This version of skype doesn't need Administrator rights to be installed. In my network there are 2 ways to Internet, one filtered by a PIX 525 ver 6.3(3) and the other by a ASA 5510 ver 8.3(2). No IPS system present on my network.
View 6 Replies
View Related
Nov 23, 2012
i want to Block torrents service in my Firewall , and give access to one of my pc , is it possible to do in the IOS 8.2
View 1 Replies
View Related
Feb 25, 2013
Now, i want to block some websites in cisco asa 5510 and in want to block key word like "sex", "game",..how can i config it?
View 3 Replies
View Related
Jan 4, 2012
I have a ASA 5510 device. I have been asked to block Ip range for India from accessing set of servers. Total Subnets: 34,675,968.I really don't want to create a two mile long access list with all these subnets.
View 2 Replies
View Related
Apr 16, 2013
I have cisco ASA 5510 with basic configuration (default policies). The problem is that windows XP users are unable to send emails form MS outlook and unable to log on to Hotmail , Gmail or any mailing site. While windows 7 and 8 users are not facing any problem.
View 2 Replies
View Related
Mar 5, 2012
how to go about setting up the ASA to block any SMTP traffic outbound except for our Exchange Server. This is in relationship to a SpamBot issue that blacklisted us. I have an ASA 5510 running version 6.2(5) / 8.2(2) with three ports. DMZ, Inside and the Outside interface. Up till today, I only needed to block outside traffic to our internal network which I used the ASDM to configure a rule on the outside interface for an incoming rule. I am assuming I need to create an outgoing rule on the outside interface; however, just to make sure I understand the terminology/traffic flow, I created the rule with my computer as the source (192.168.0.131) with ALL destination and the service as HTTP. My logic, which seems to fail here, is that any traffic from my computer going outbound would be blocked; however I am still able to browse... That said, if I were to change the source as the Exchange server and the Service Type to SMTP, it would not actually block traffic and therefore not solve our problem. I even gone as far as permitting traffic from my computer, expanding the hit counter and I see no hits. So I am no doubt doing this wrong. What I do know, is when I first created the rule, a second rule was automatically created (Implicit rule) that deny all sources and blocked all HTTP traffic until I changed it to Permit?
View 2 Replies
View Related
Jul 25, 2012
I have created Different extended access-list which allow/block some specific services like IP,TCP,UDP ,ICMP etc for certain source and destination . But now I have to allow/Block all/any type of services to a certain host from a extended access-list . How can I do it ?
View 4 Replies
View Related
May 17, 2013
I have purchased a Cisco ASA 5510 & want to block all social networking websites (https) either using CLI or ASDM.
View 1 Replies
View Related
Nov 29, 2012
I've configured an ASA 5510 FW with asa901-k8 ios. on it's "inside" port there is 10.90.0.0 network. there is another network (10.190.0.0) in my system that can be reached via another router which has 10.90.0.253 ip address. when a client in the 10.90 network wants to reach the 10.190 network the fw redirects the request to the router (10.90.0.253) because the fw is my gateway. there is no problem so far... but... while i can ping and traceroute a 10.190... user from 10.90... network, i can't use any non-icmp appliactions. for example i can't use rdp programs, http web interfaces of some devices on remote network (10.190.0.0). what can cause that? is there any rule in asa that blocks these protocols?
View 4 Replies
View Related
Jun 5, 2012
some recommendations for product selection and overall infrastructure setup for our datacenter: We have an old, legacy setup, and are looking to replace equipment, improve performance, enhance security, and implement hardware redundancy (if cost effective).
1) We now have (2) IP blocks from our provider, and need to support both (because we have mailers on older IPs with a good reputation rating).
2) We have (2) aged Sonicwalls, one for each IP block, each connects to multiple internal subnets (some internal subnets need connectivity to eachother, some don't).
3) We have (mostly) public facing web servers (Linux/Apache), as well as database servers (with no external access).
Questions-
1) Should we implement a Cisco ASA 5520 w/ or w/o SSM modules for the new IP block (for webservers)?
1a) Should we implement a Cisco ASA 5510 or 5505 for the existing IP block (for mailers)?
1b) Or, can we have multiple public IP blocks connected to a single ASA 5520 (or 2 ASA's w/ failover)?
2) Can we connect both firewalls (5520 and 5510/5505) to a single Catalyst 3550 (or similar) using VLANs, and have 6 - 10 VLANs for webserver subnets, with ACLs controlling which subnets/servers can connect to eachother?
2a) Should we implement a second Catalyst 3550 (or similar) for redundancy (webservers have multiple network cards).
3) From our provider, we only have (1) dmark which both IP blocks connect through. Currently we have a switch connected to the dmark in order to 'splice' the connection, and have both existing firewalls connected. Is there a better approach to this?
4) We would like to implement SSL-VPN, and possibly site to site IPSec VPN, but only if there will not be significant performance degredation.
5) Other thoughts/recommendations for new features, enhanced security, or redundancy?
View 1 Replies
View Related
Jan 31, 2011
i have cisco asa 5510 as firewall, i was trying to block some site using the link provided below
[URL]
and its working fine, but the problem i am having, when i go to download attachment from hotmail its not downloading, from gmail and other mails its
View 13 Replies
View Related
Oct 20, 2012
i use ASA 5510 and i want to block some urls :
-192.168.2.70 to 79 allow every thing
-192.168.2.80 to 89 : block facebook , myspace, twiter,
-192.168.2.90 to 99 : block facebook , myspace, twiter, youtube , dailymotion
-192.168.2.100 to 199 deny everting
View 1 Replies
View Related
Oct 8, 2012
In setup for old RV042 (V1), when updating / adding Mac addresses, the table is always sorted by IP addresses. But in the new oneRV042 (V3) I have, even with latest firmware 4.2.1.02 the list is random, thereby increasing the chance of user entering DUPLICATE IP addr with diff Mac addr. That will result in conflict.If the firmware sorts the DHCP entries by ip addresses, user would be able to catch duplicate ip errors even if the system does not flag the errors. All Cisco smart engineers can you all get the dhcp entries SORT by ip addresses.
View 2 Replies
View Related
Jun 4, 2013
I have just set up my asa5505 and while in the sh run I have the following lines
-dhcpd address 192.168.2.200-192.168.2.231 inside
-dhcpd enable inside
-dhcpd dns 68.94.156.1 interface outside
When a client connects to the device like: 192.168.2.215 there is no dns assigned. My devices are unable to access the internet unless I manually assign the dns in the local settings for that host.
View 6 Replies
View Related
Feb 1, 2011
I�ve assigned the static IP to Server, but when i go back to network properties it show Obtain IP address automatically, however, network working fine with previously assigned IP.
View 2 Replies
View Related
