I'm trying to build a project where I utilize a Cisco 877 as a dumb modem by briding the ATM interface together with an Ethernet interface (VLAN) in this case due L2 switchports.The online documentation for RFC 2684 bridging states that I should be using AAL5SNAP as the encapsulation mechanism however, my ISP requires that I use the AAL5MUX encapsulation as part of the DSL settings. [code]
View 5 RepliesI'm supposed to configure this 1721 for bridged mode, taking a Level 3 T1 into the serial 0 side and passing it out the f/e 0 side. So, basically that's a T1 to ethernet conversion. I guess this customer is buying a T1 from us but they have to use a different make/model router due to the large hospital requiring that of doctors offices.Encapsulation from Level 3 is ppp static ip address, no password or anything like that.
View 3 Replies View Relatedwe have a 1310 connecting two buildings networks.inside each building we have a wireless network (Intermec access points).we are implementing WEP on the Intermec AP's.will the cisco 1310 allow the wep traffic without interference? or would i need to modify the 1310 somehow?
View 2 Replies View RelatedI am new to cisco ASA. I need to configure ASA 5520 in transparent bridge mode. [code] I need to place the new asa firewall in transparent mode. How to configure the firewall in transparent bridgmode.
View 5 Replies View RelatedI want to set up FWSM 4.1 on Cat6509 with multiple bridge groups in one transparent context. (as the manual says it can support up to 8 bridge-groups and the intent is to save security contexts) For a host in VLAN21 (b1_inside) to talk to a host in VLAN41 (b2_inside), traffic needs to be go out to MSFC which routed back the traffic through the FWSM. My question is how can I define a default route per bridge-group, I would assume FWSM should take the following two default routes per bridge-group interface but it won't;
route b1_outside 0.0.0.0 0.0.0.0 10.11.75.1 1
route b2_outside 0.0.0.0 0.0.0.0 10.11.76.1 1
seems like it allows only one default route per the context and gives me an error - "ERROR: Cannot add route entry, possible conflict with existing route"
How can I achieve outside per individual bridge-group?
FWSM context config:
Interface VLAN11
nameif b1_outside
bridge-group 1
security-level 0
!
Interface VLAN21
nameif b1_inside
[code]...
I've got an 877 configured and working just fine as a NATing DSL router, but I'd now like to add an ASA beside it. I've got an extra IP from the ISP so what I'd like to do is bridge the DSL interface to one of the switch ports on the 877 and plug the ASA in there.
I've created a bridge group, put the ATM0.1 in it and then tried to put a switchport in it and get:
FastEthernet1 does not support bridging
So, I created an SVI and put that in the bridge-group and added Fa1 as an access member of that VLAN, but nothing seems to come out the interface to the ASA.
Can you use a Cisco 3600 to do a P2P bridge? Using the MAP's ethernet port to connect to a remote LAN? On that remote LAN can you have lightweight APs that connect to a controller on the RAP side?
View 13 Replies View RelatedI have a piece of hardware (audio device) with Ethernet network access only. I'd like to give it to my users and have them connect via Wifi. But configuring a Wifi bridge for each use is too onerous. I'm looking for a wireless bridge device with a display and keypad that allows the user to scan, select and associate with a wifi router, then bridge the wireless network to ethernet so I can attach my device. Does such an animal exist? Price is not a major factor.
View 5 Replies View RelatedI have on my ethernet linux box, that is responsible for IPv6. This box is configured as IPv6 gateway from my network and it also sends RA to the network. All devices on ethernet network can work on IPv6 without problem. Clients, that are connected to WiFi, they just receive the RA from this box -> this packet is sended over WRVS4400N to the wifi network. But all other traffic do not pass the WRVS4400N, so the wifi client is not able to ping the IPv6 gateway. There is no problem on IPv4, there the wifi client is able to communicate with any ethernet device.I have tested WRVS4400N setting "ipv4 only". If I switch on "ipv4 and ipv6", than all devices will get some additional IPv6 adresses and the communication from WiFi client to IPv6 router is not working again. How to configure the WRVS4400N to bridge all IPv6 traffic between WiFi and ethernet?
View 2 Replies View RelatedThese questions are only in relation to the above Wireless Router (v6, FW-v1.02 [2010]) :
1. What is an Ethernet Bridge (the basic authoritative definition), and besides gaming, what are they generally used for in a business setting?
2. What are VPN settings in a Router used for, and can a VPN be configured on a remote PC without them?
3. Utilizing bridging, etc., can I utilize my WRT54G as a makeshift Range Expander as long as the primary router doesnt have WEP key requirements? The current WIFI doesnt reach my PC, so I thought I could configure my router midway in hopes of extending the other routers' signal, via some kind of bridging if necessary. Naturally, there would only be a wireless connection between routers.
4. How can I setup a simple Captive Portal on this router?
I have a DAP-1522 in my den that I am connecting as a bridge to a Netgear WNDR3800 that in turn is connected to a cable modem in my living room. I have multiple PC's connected to the DAP-1522 via the Ethernet Ports. All the Ethernet connected PC's are getting IP addresses from my Netgear WNDR3800 via DHCP and can access the Internet fine. The weird thing is the PC's connected to the DAP-1522 through the Ethernet ports can't see each other - they are isolated from each other. I can see the DAP-1522 hard wired PC's from a laptop connected wirelessly through the Netgear WNDR3800 but the PC's wired to the DAP-1522 can't see each or communicate to each other via IP, though they can communicate to anything else on the Netgear WNDR3800 wireless network or Internet.Only the PC's connected to the DAP-1522 via the Ethernet ports are isolated from each other. Very strange. This is a problem because I have a NAS device I want to connect to the DAP-1522 that will be shared by the PCs in my den. I do software development and want access between the PC's and NAS device at Ethernet Gigabit speed. I am using default configurations for the DAP-1522. It appears that firmware for the bridging function if funky. I am on firmware version 1.41. The hardware release is A1.Not sure if it is an issue with the DAP-1522 or the Netgear WNDR3800.
View 5 Replies View RelatedI am trying to bridge internet connection received from my laptop to my desktop with an ethernet cable. Both machines are running win 7.When I try to connect to my local area connection on the desktop most of the time it fails and I'm left with 'Unidentified network' and no internet connection. Sometimes, rarely it does connect properly but I get a notification about there being an IP conflict in the network, but things work as they should.When I diagnose the problem it tells me that "Local Area Connection doesn't have a valid IP configuration"
View 5 Replies View RelatedI have the DIR-655, Rev. B running 2.07NA firmware, and have a strange problem with my wired clients. I have my primary computer/desktop PC connected via wired connection. I also have several wireless clients (laptop, iPad, iPhones, etc.). All have been performing normally. However, in December I connected a wired weather internet bridge to another ethernet port on the DIR-655.
It functions as it is supposed to, and all other connected devices do as well. But here's the problem - whenever I use the desktop PC (the only other wired connection) to do anything on the internet (mostly just web browsing ... I don't stream media from the internet on it, I don't do torrents....nothing out of the ordinary, and nothing really of high bandwidth), the wired weather bridge cannot communicate with its associated website. This continues as long as I'm using the desktop PC. When I stop using the desktop, the weather bridge resumes normally.
I have researched the weather bridge, and it is simply doing POST transactions (or so I'm told) to the website listening to it. It doesn't wait for acknowledgements or anything...just keeps POSTing updates. I tried reserving an IP for the weather bridge and the desktop, enabling QoS, and prioritizing the weather bridge (100 vs. desktop at 125), but it didn't work. I've tried moving the weather bridge into the DMZ. I'm totally baffled how just using the desktop to browse the internet could completely block the traffic from the weather bridge.
On the weather bridge support site, they suggested that I insure I'm not connected in gigabit speeds from my computer to the router, because in the past that has been known to cause issues on clients not running that speed, but I don't think my desktop is connected in that fashion. According to the settings, it can do 10 or 100, full or half. I have it set to AUTO.
I've a WLC 2106 and it is running IOS version 7.0.240. I am trying to setup a wireless mesh and used the Ethernet bridge port on the MAP to extend the network. The wireless mesh works fine but I can not get the switch to work that is connected to the ethernet port on the MAP.I'm using two different Access points. I'm using a Air Cap 3502i as the RAP and a Air Lap1142N as the MAP.The switch port that is connected to the RAP and MAP is configured as the following:
switchport mode trunk
switchport trunk native vlan 2
switchport trunk allowed vlan 10,20,30,40
[code]....
The wireless mesh between the RAP and MAP works fine. I can connect a device to the MAP wirelessly and access the network with no problem but I can not get anything to work that connects to the switch that is connected to the MAP ethernet port.
i am placing a formal request to Cisco and to the firmware development team to create a new-and-improved firmware release for the WET200 wireless Ethernet bridge, a product that is still being produced, shipped, and sold. I purchased the product about one-and-a-half years ago and have enjoyed its performance. There have been, however, some flaws with the device, namely the following:While configured to use WPA2-based security, DHCP-related traffic is not passed from a router/gateway's DHCP Server to connected devices on the WET200. Current firmware release notes indicate this was a known issue and was, supposedly, fixed; however, due to the level of problems customers are reporting, it appears this may have only been resolved, if at all, with security configurations of WPA, WEP, or OPEN. It has not been fixed for customers using WPA2-based security.When I originally purchased the WET200 and configured it to use WPA2-based security, while it, initially, did have a few problems connecting to my router/gateway, it, eventually, did connect and stayed connected for, approximately, one year. However, in September of 2009, it suddenly lost connectivity with my router/gateway and has not been able to establish a connection since, even after reinstalling the latest firmware revision and after several soft and hard resets of the device. I tested the WET200 with another router/gateway, only to experience the same issue. Other devices are connecting to my router/gateway, but, not the WET200. The last firmware update for the WET200 was dated back in July of 2008. Currently, it is January 2010 and since these issues have been known for quite some time, it is unacceptable that the firmware for this device has not been updated in such a long time, especially when there are known issues with the WET200's firmware. Such lack of support is forcing me and my clients to stop using these Cisco-based products and purchase competing hardware, something I would prefer not to do; however, without better support, I and my clients do not have a choice. Expecting me and my clients to use an inferior form of security on the WET200, such as WEP and/or WPA, until a firmware update is issued is unacceptable, especially when that update has not been released in over one-and-a-half years. Such lack of support is especially unforgettable when my clients and I are looking to purchase new networking equipment. In the past, I would not have hesitated to purchase a Cisco-based product; now, with this experience in mind, I am finding it very difficult to recommend to a client that he or she should invest their organization's finances into Cisco-branded equipment. Proper, professional, timely, support of your hardware is expected of your customers, especially if you wish them to remain loyal customers. I have noticed that other similar devices, albeit, higher-end devices, have had their firmware updated, more recently, compared to the WET200. I assumed this meant that the firmware development team was updating all firmware on such devices. So far, I have been disappointed in the lack of firmware updates for the WET200. While I understand the possible desire to update the higher-end products, first, as a professional whose job is to research, recommend, purchase, install,configure, secure, and maintain both the enterprise-level and small business-level devices, I highly encourage Cisco not to overlook their small business products when the firmware development team is updating firmware for any Cisco products. Deficiency in the support of one strata of Cisco-based products is reflective upon the support of any Cisco-based product and is not easily forgiven by Cisco customers, such as myself, when new and additional hardware needs to be purchased.
View 15 Replies View RelatedNeeding to bridge from my wic interface to an ethernet interface on a 2900 series router so that I can pass through the ip address given to the WIC, to my ASA so that I don't have to give my ASA a private range address. (Just like a service provider might do when bringing a T1 with managed router in to my prem)
View 1 Replies View RelatedASA 505 is connected to layer 3 switch.ASA is in transparent mode.Layer 3 switch has SVI Vlan 20 and also it has dhcp server for vlan 20.PC connected to transparent switch is not able to get the IP address from layer switch.I have config the ACL on outside interface of ASA to allow the DHCP reply coming from Switch.When i assign static IP to PC connected to port eth0/1 of ASA it works fine. [code]
View 4 Replies View RelatedI am trying to get an ASA5510 working in transparent mode, multi-context. I am on revision 8.2.5, so there are no bridge groups (those are enabled in 8.4). I first set it to transparent mode, then set it to multi-context mode. I am doing trunking through the Ethernet0/0 to Ethernet0/1, and have two vlans on subinterfaces of each interface. These interfaces are in the 2nd and 3rd contexts, and all trunking between vlans is working correctly in transparent mode.
But I can't telnet or ssh to the ASA itself.
I have an IP address on the inside vlan interface in each context, and can ping tthe IP in context 2 and context 3. There is an IP also in the admin context, but I am unable to ping this. I have tried putting it in the same vlan as the 2nd context, and putting it on the management interface, but since there is a global IP only in transparent mode, I don't think the management interface is used (even though it is in the admin contexts included interfaces).
Since I can't connect to the ASA, I can't easily get the running config to post it here, even though that would likely
To summarize:
- transparent mode
- multi-context
- trunking (dot1q) through Eth0/0 and Eth0/1, so each interface has four sub-interfaces, each in its own vlan
- these VLANs are in each of the contexts except the admin context
- the IP of each conext is able to be pinged, but can't telnet or ssh to it
- telnet and ssh are setup for allowing a /16 subnet range access, in each context
- access-list is setup for permit ip any any and permit icmp any any on the inside and outside interface of each context
- all thru-traffic is passing correctly, but can't manage the ASA other than sitting at the console of it
What I'm going to try now is putting the admin context into one of the vlans in the trunk and see if I can use it that way.
I would like to know if it is possible to make a solution with Anyconnect where remote user´s PC start an automatic VPN connection via Anyconnect as soon as the users enter their Windows Login and password on their notebook.
I was thinking of using computer certificate for this solution so it is completely transparent for the user which is the requirement for this solution.
I need to know if the 5512X IPS will work if the ASA is in transparent mode and/or any limitations.
View 5 Replies View RelatedIs it possible for an 5505 ASA to be in transparent mode such as ethernet0/0 outside, ethernet 0/1 inside, and use ethernet 0/2 for syslog only on a seperate network other than the one that 0/0 and 0/1 is using. The tranparent part being on a 192.168.168.X/24 and the syslog server being on say a 10.2.1.X/24 network?
View 1 Replies View RelatedI just have 1 question. I am going to be getting U Verse installed at my house and have been having a hard time finding this in the documentation. The modem I am going to be getting is the 3800HGV-B. Over on the ATT forum users are stating that the modem needs every MAC of every potential IP. I thought about using it's DMZ Plus mode but I am getting a block of 8 IP's and it doesn't seem to play nice unless it see's 5 different MAC's. Right now I have my 5505 in routed mode so I don't believe it passes the MAC of the client's through. Will the ASA pass the MAC of the client's through to the modem with the appropriate ACL's applied?
View 2 Replies View RelatedRecently i have configured ASA5550 with 2 Contexts in Transparent mode. Traffic can pass through a single Firewall context but through both contexts it couldn't.
View 0 Replies View Related have a Cisco ASA that I am trying to configure in a unique way, I want it to perform a variety of tasks;
VPN SSL
VPN Tunnels
Firewall Inside to Outside via versa
But the difficult task, is creating a DMZ with devices that are assigned fully routed IP addresses from our ISP directly, these are H323 and SIP devices that cannot use NAT, and must have a fully routed IP address assigned to them.
Obviously the problem I have with the Firewall in its default routed mode, is that it wont allow me to overlap IP addresses on the outside interface with the DMZ interface.
Could the Firewall be configured for Transparent mode between Outside and DMZ, but Routed mode between Outside and Inside?
Eth0/0: 10.0.0./24 (inside)
Eth0/1: 190.0.0.0/24 (dmz)
Eth0/2: 190.0.0.0/24 (outside)
[Code]....
But could the new Cisco ASA with the latest firmware and model be ale to do this with 1 physical firewall?
Recently, I unable to configure the failover on bridge group in transparent mode . I have five interfaces .out of this only 3 is showing in the show run config . Whether I can config failover on on of the data interfaces.
I have the ASA 5520 with the version ASA Version 7.2(4) <context>
i need to configure a ASA 5505 in transparent mode.learned from Internet, my configuration is :
int e0/0 --- vlan 1---->nameif outside
int e0/4 --- vlan 2------> nameif inside
gloable ip is 172.17.104.10 255.255.255.0
http server enable
http 172.17.104.0 255.255.255.0 inside
when i connect the outside interface to one PC with ip addr 172.17.104.194 my PC connect to inside interface with ip 172.17.104.249 cannot ping each other even when i set rules as permit any any on both direction
I've setup my Cisco ASA 5505 in transparent mode. I have a Cisco 1841 connecting to the ISP (DHCP client) and F0/0 for inside. The 1841 is the DHCP server. I have my ASA 5505 behind the 1841 in transparent mode (Vlan 1 for Outside and Vlan 1 for inside). The router config is good as when you connect a computer straight to the inside interface I get DHCP and can go to internet, no problems what so ever. But When you're trying to go through ASA isn't not working. if I add a ip any any statement to the access list it will work but having an "ip any any" in a access list is like having no firewall at all.
ciscoasa(config)# sh run
: Saved
:
ASA Version 8.2(4)
!
firewall transparent
hostname ciscoasa
enable password zmQ6OnxvsOOEDNAy encrypted
[code]....
recently i have install asa 5520 (8.2) in my networks.Earlier I was using my transparent proxy with 2821 by the following configuration access-list 120 deny ip host 192.168.112.12 anyaccess-list 120 permit tcp any any eq wwwaccess-list 120 deny ip any any route-map PROXY-REDIRECT permit 10match ip address 120set ip next-hop 192.168.112.12 ip policy route-map PROXY-REDIRECT and was working fine. How i can use my transparent proxy with ASA?
View 2 Replies View RelatedI have a problem whit the configuration of a Firewall ASA 5585 whit the BVI Interface and transparent Firewall, I have 2 VLAN that i want to interconnect.
The problem is whit the configuration of VLAN. The traffic does not cross the FW.
We have a few stacked 3750 switches with vtp transparent configured...some plugged in a fiber from another network into our stacked switches...that network/switch has vtp server configured...once that switch connected to our stack of switches, it turned that stack switch into vtp server...causing the previous vlans configured to erase thus causing management issues with the stacked switches..
View 4 Replies View RelatedI have a cisco ASA5505 configured in transparent mode. This evening we attempted to plug a couple of new servers in but they simply didnt work, despite our test server working absolutely fine. The server IP's are all in a network object group (the same as the test server) and they're all using the same ACLs etc. I'm relatively new to configuring cisco equipment.
the only thing I can think of is a static route I had to add to get the managemet IP to work might be causing problems.route outside 0.0.0.0 0.0.0.0 XX.XXX.132.1 1(IP addresses obfuscated- servers are all in the same range so assume XX.XXX is the same across all IP's).
I understand that in transparent mode an ASA5510 would only be able to have two interfaces, inside and outside. My question is could one of those logical interfaces be an LACP'd interface, made up of two physical interfaces. Topology below. I understand that the router and ASA5510 are SPOF here, so it is a bit of a moot point, but we're connecting already existing infrastructures together!
|-------–---| |---------|
| Switch 1 |------| |
|-----------| | ASA5510 | |----------|
| | | (transp |---------| Router |
|-------–---| | mode) | |----------|
| Switch 2 |------| |
|-----------| |---------|
I´m trying to config a wccp web-proxy in a ISR 2811 at branch network. I have an Iron Port at Head-Quarter.
The idea is that the users at branch network, transparently forward http traffic to Iron Port at Central-Office and from them go to Internet.
The communication between sites is over DMVPN. I have two GRE tunnels running OSPF.
The Iron Port is configured as wccp v2 transparent redirection with forwarding method L2 or GRE an retunr method as L2 or GRE.
I receive packets on the branch router "Here I Am" but it get a message on debug:
Nov 21 19:26:07.067 GMT-2: WCCP-EVNT:D10: Here_I_Am packet from 172.16.10.10 w/bad fwd method L2, received indirectly via Tunnel1Nov 21 19:26:07.067 GMT-2: WCCP-EVNT:D10: Here_I_Am packet from 172.16.10.10 with incompatible capabilites
Nov 21 19:46:07.035 GMT-2: WCCP-PKT:D10: Sending I_See_You packet to 172.16.10.10 w/ rcv_id 0000004F