Cisco WAN :: ASA 5510 - Traffic From Location 1 To Another Via HQ?

Jun 15, 2011

Remote office 1 has an asa 5510 connected to a HQ office which has also an ASA 5510.The HQ office has also a IOS router 2921 with a DMVPN connection an other Remote offices.

Remote office 1 = Cisco asa 5510
Remote office 2 = Cisco IOS router 888

[code]...

View 1 Replies


ADVERTISEMENT

Cisco WAN :: 857 - How To Route Traffic Over Remote Location Internet

Nov 18, 2011

I have a customer which has a main location office and a remote one. Recently we interconnect their facilities using a local ISP service called Virtual Connectivity, which basically is a private network which can be accessed over aDSL or any other data circuit. They are using Cisco 888 routers to interconnect both sites.At the main site the customer also has an Internet circuit (with a Cisco 857 router)and he wants to remove the Internet circtuit from the remote site and provide them access over their main location Internet circuit.At the primary offices, we installed Cisco 2811 router as a gateway to route the Internet and remote network traffic over the required data circuit. Everything is working fine, but we can not access Internet from the remote location over the circuit installed a the main site. I understand this is a routing issue, since the traffic hits the main office network it does not knows how to reach the Internet. I am assuming this routing must be set into the main office Cisco 888 router (installed by the ISP to interconnect to their private cloud) in order to properly route it over the Internet circuit.Since I already have access over the Internet router and the gateway router at the main site, but not into the ISP router, is there any other way I can make this configurtion over the routers I already have access?

View 3 Replies View Related

Cisco VPN :: VPN Dropping To International Location ASA 5510

Jul 4, 2011

We have an ASA 5510 and are having issues supporting a client in Europe.  After about 5 minutes (sometimes it will last up to 30 minutes) we drop the connection with Reason 412:  The remote peer is no longer responding.  We are using the Cisco VPN client with the newest software version.  We have also tried this on both 32 bit and 64 bit OS's.  We have no issues VPNing to any other clients or with anyone VPNing into us.  It's only with the client in Europe.  We are able to VPN into their US site without any problems.  They also claim they have no issues with anyone else VPNing into them.

View 3 Replies View Related

Cisco Firewall :: 5510 / DMZ To Outside Only Traffic?

Nov 28, 2011

I have a classical "inside + DMZ + outside" configuration.I also have a mail server in DMZ which have to be allowed to reach any destination on the outside (internet) at least on the SMTP port, of course.If I make an access rule that allows traffic from that server to "any", everything works fine, but doing so the server is allowed to reach any destination, including what is behind the inside interface (internal network).I didn't find any other option to tell the ASA machine to allow any destination, but on the outside interface only.I do believe is possibile to have the ASA to allow any kind of traffic from a host on the DMZ to the outside interface only, but I didn't figure out how.
 
P.S.: I'm using a 5510 machine running version 8.2

View 4 Replies View Related

Cisco VPN :: No Traffic Goes Out When 5510 Installed

Jul 5, 2012

Main office has a ASA 5520, new office has a ASA 5510. Problem is no traffic goes out when the 5510 is installed, no internet no network connection to servers.I have both config files attached.

View 9 Replies View Related

Cisco WAN :: ASA 5510 Where To Block Traffic

Apr 22, 2013

where is the best place to block unwanted traffic?  By that I mean, should I block it at the router, firewall, IPS?  As an example, I'm dealing with DNS flood attacks - probably DDoS and reflection.  I have a pair of Cisco 2821 routers with two different ISPs doing BGP.  Behind that I have an ASA 5510 with IPS module.  Behind that I have 2 public DNS servers.  Over the last few days I've seen an increase in bogus DNS queries - high volume, distributed.  My question is where is the best place to put the ACL to block them? I've been putting them on the ASA, but when the attack is running, it jacks the CPU to 60%.  If I don't put the ACL, the IPS seems to pick them up after a while and the CPU is almost as high as with the ACL.  I haven't tried to put the ACL on the routers. 

View 2 Replies View Related

Cisco VPN :: ASA 5510 - Routing All Traffic Over Lan-to-Lan

Mar 6, 2013

Headquarters has an ASA 5510 (8.2.5) and each of the branch offices has an ASA 5505 (8.2.5).
 
Currently, internet traffic from the branch offices is routed straight out to the internet, while traffic destined for HQ is encrypted over the the VPN tunnel.
 
We use a Websense v10000 G2 to filter web traffic for our HQ site and the branch offices use Websense Hybrid filtering (a pac file in their browser - cloud based filtering).               
 
One change we are considering making is to route ALL traffic from the branch offices through our Headquarters to they can also be filtered by the v10000 G2, rather than using the Hybrid Filtering.  The Branch Offices typically have 6Mbps/768Kbps DSL connections.
 
What are there negative consequences of routing all traffic through our HQ?  HQ has enough bandwidth to accommodate the increased traffic from the branch offices but I was wondering how the branch offices would be affected?  Originally I was thinking that the Branch Office download speeds would essentially be limited to the speeds of their upload speeds because all traffic would be getting sent up to the Branch Office.  After thinking about his more though, I don't think this would actually be the case.  You would lose a little bit of speed due to the encryption, but it shouldn't be that drastic, correct?
 
Also, what configuration changes would be neccesary to achieve this?  Here is the NAT/Route configuration of one of my branch offices:
 
crypto map CDEOVPN 35 match address CDEO
crypto map CDEOVPN 35 set peer 24.XX.XX.251
crypto map CDEOVPN 35 set transform-set Main
crypto map CDEOVPN interface outside
 
access-list CDEO extended permit ip 10.124.0.0 255.255.0.0 10.0.0.0 255.0.0.0access-list NoNAT extended permit ip 10.124.0.0 255.255.0.0 10.0.0.0 255.0.0.0
 
global (outside) 1 interfacenat (inside) 0 access-list NoNATnat (inside) 1 0.0.0.0 0.0.0.0
 
route outside 0.0.0.0 0.0.0.0 71.X.X.51 1

I considered changing the the CDEO access-list to access-list CDEO extended permit ip 10.124.0.0 255.255.0.0 0.0.0.0 0.0.0.0 but I was afraid that maybe the VPN tunnel wouldn't be able to be established without first adding a deny statement so that traffic destined for the Public IP of our HQ ASA wouldn't try to go over the tunnel?  Would any changes be neccessary to my NAT rules?

View 3 Replies View Related

Cisco Firewall :: Determining All Traffic In And Out Of ASA 5510?

May 20, 2011

Just wondering if there are any methods or commands, natively, in the asa5510 for determining all traffic in to and from a certain server passing through the asa.  This would be without a syslog server or something similar.

View 3 Replies View Related

Cisco VPN :: No Traffic Over Tunnel Between ASA 5505 And 5510

Dec 5, 2010

I've a asa 5510 on the main site and different ASA 5505 on secundary sites for VPN tunneling between the sites. The problem is that the tunnels are acomplished but no traffic is going over them. What am i doing wrong? For the moment there is a ASA 5505 on the main site managing the tunnels but I want the 5510 to take over the job.

View 5 Replies View Related

Cisco Firewall :: Traffic Delay ASA 5510

Mar 11, 2013

Core Internal Network -> Cisco ASA 5510 -> DMZ Switch.If i send a ping reguest from internal network to servers in DMZ Switch over the ASA 5510, i can see a delay in response, some times this delay can be more than 80ms, this is a problem for the web applications in http traffic.How i can find what's happening on my ASA? I disable the inspect traffic over the IPS, disable the policy maps below, reload the two boxes, but doesn't works, the problem still persists. [code]

View 2 Replies View Related

Cisco VPN :: 5510 IPSEC No Traffic Flow

Jan 18, 2012

I am trying to pass Traffic thru the IPSEC tunnel but it does not work  ([Cisco Router 892] <---> [Cisco ASA 5510] <---> [Cisco Router 892]) The Cisco ASA 5510 doesn't pass traffic  UDP=500 & UDP=4500 ports...

View 1 Replies View Related

Cisco Firewall :: ASA 5510 With 8.4.1 - Traffic Is Not Flowing

Mar 27, 2011

I'm currently using ASA 5510 with software 8.4.1 and I have an issue with nat configuration. I used the following config line:nat (inside, dmz) source dynamic LAN Pat1 destination Server1 Server1
 
The traffic is not flowing and when I use Packet Tracer, packets are dropped at the NAT rule with the following error: Drop-reason: (acl-drop) Flow is denied by configured rule.The only ACE I have is permit ip any any.

View 2 Replies View Related

Cisco WAN :: Allow ICMP Traffic On ASA 5510 From LAN Interface To DMZ?

Jul 17, 2012

I want to allow ICMP traffic on ASA 5510 from LAN interface to DMZ. I've permit any traffic and added ICMP to the inspestion list also but still there is problem. Belos is the configuration. The image is asa822-k8.bin

:
ASA Version 8.2(2)
!
hostname fw-01
names
!
interface Ethernet0/0

[code]....

View 1 Replies View Related

Cisco Firewall :: ASA-5510 - SIP ACL Traffic Not Working

Jun 11, 2013

I have an ASA with an outside ACL that is configured to allow 208.84.248.95 SIP/5060 to 1x.x.x.46.  I show no hits.  I added an ACL to do a packet capture, it sees the packet coming into the ASA but not going to the Serv Prov interface.  I see hits on the vuong ACL but not the production acl_out ACL..  What is up?
 
NOTE:ACL_out is the ACL we use to allow outside traffic to enter our network. 
FW1(config)# sh access-list | i 1.x.x.46
access-list acl_out line 1 extended permit ip host 63.x.x.140 host 1x.x.x.46 (hitcnt=0) 0xc09a9387  (*NO HITS)
access-list acl_out line 658 extended permit udp host 208.84.248.95 host 1x.x.x.46 eq sip (hitcnt=0) 0x0f327179  (NO HITS)
[code]...

It was tested and verified from the inside network to make sure the server is listening on that port. Below we created an ACL to allow all IP from another test PC to the Server IP 1x.x.x.46.  We did a telnet to port 5060 and it showed hits but not on the acl_out ACL.
 
ccess-list vuong line 1 extended permit ip host 63.x.x.140 host 1x.x.x.46 (hitcnt=0) 0x2759fa92
FW1(config)# q
FW1# capture capture1 access-list vuong interface outside
[code]...
 
Below we applied the same ACL to the ServProv interface to see if traffic was going where it was supposed to .  By trying to telnet to the 1x.x.x46 IP from 63.x.x.140 IP.  Looking below, no traffic appeared on the capture2.
 
FW1# capture capture2 access-list vuong interface ServProv
FW1# sh capture capture2
0 packet captured
0 packet shown
[code]...
 
Capture 1 above shows the last 3 incoming messages initiated from 63.x.x.140 to the 1x.x.x.46! Vuong ACL belows shows 3 more hits.....nothing on the acl_out ACL???
 
FW1# sh access-list vuong
access-list vuong; 1 elements; name hash: 0x29df3e90
access-list vuong line 1 extended permit ip host 63.x.x.140 host 1x.x.x.46 (hitcnt=6) 0x2759fa92
[code]...

View 1 Replies View Related

Cisco VPN :: 5510 - Traffic Through Tunnel Is Very Slow

Jun 8, 2011

I got a stange vpn problem, just added a new vpn tunnel to our ASA5510 and then the users report that the traffic through the tunnel is very slow, when I try it myself I get a speed like 50kb/sec to the internal server.If I use our regular tunnel or any other tunnel the speed is just fine. I´ve added the new tunnel in the same way as the other tunnels,  that is thorugh ASDM vpn wizzard.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 No Traffic Flowing?

Jul 12, 2011

I have manually configured the Firewall ASA 5510 from existing PIX to match the configuration, however when I connect the firewall to the Network, no traffic is flowing in either direction. I have the Inside network on the 172.29.0.0 subnet and the outside network on 20.2.0.0 subnet. I am attaching the cofiguration file.

View 4 Replies View Related

Cisco Firewall :: 5510 Allow Traffic Inside To Outside

Nov 18, 2011

One Host on inside network needs to access customized application hosted on Internet. Its a customized application run on port 80, 443, 5000-to-50020

How do I allow this host access for this specific application. I got ASA 5510 and host is in the inside network, we also got an ACL on inside interface to have control.
 
-Host IP on inside network  - 172.16.30.15
-Application to access - 74.219.x.x
-Inside ACL name - inside-acl

View 5 Replies View Related

Cisco VPN :: ASA 5510 - Anyconnect Connects But Won't Pass Traffic?

Aug 11, 2011

I am trying to use a ASA 5510 with AnyConnect as an in-line SSL VPN device.  I have a separate firewall that NAT's 443 to the inside IP of the ASA, which is the only configured interface on the ASA.  I can connect to the ASA from the WAN just fine and the AnyConnect client connects just fine, I get an IP lease across the VPN on my LAN, all looks well.  The problem is that I cannot pass any traffic.  The only device on my LAN that I can ping is the ASA, nothing else including the default gateway is accessibe.  I have setup a static route on the ASA pointing 0.0.0.0 0.0.0.0 to the LAN gateway, but no dice.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Scan Traffic To Public IP?

Feb 19, 2013

Im having problems with google saying we generate to much traffic to [URL]
 
I need to know which machines on the inside are talking so much with google. Can this be done via ASA 5510? do i need a third party program for this?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Email Logging VPN Traffic

Feb 29, 2012

I use ASA 5510 and I would like to log VPN traffic ( for example, as soon as a remote user try to connect to the asa). I would like this log be send to a specific mail address. I already configure Email Logging for severity  ( level 3) and it works well.
 
How I can add the VPN traffic Log ?

View 4 Replies View Related

Cisco Firewall :: Traffic Shaping ASA 5510 Vs 5505?

Oct 19, 2011

Is there any difference with traffic shaping capability on the 5510 as opposed to the 5505? is there anything the 5510 can do that the 5505 cant? with regards to TShaping?

View 4 Replies View Related

Cisco Firewall :: Redirect HTTP / Ftp Traffic (ASA 5510)

Apr 25, 2011

i have the following scenario :
  
ISP1-------ASA 5510----------ISP2
                    |
                    |
                    |
                  LAN
 
i would like to use ISP2 for all http/https/ftp traffic.how could I force my ASA to set a different gateway for http/https/ftp traffic ?i have tried several solutions such as nat/pat rules, nothing seems to work.

View 7 Replies View Related

Cisco Firewall :: ASA 5510 Ftp Traffic Passing On 1 Interface But Not Another?

Dec 20, 2011

FTP traffic routed from outside to the inside interface works fine.  I have another interface with multiple sub-interfaces and vlans configured.  FTP traffic routed from the outside to vlan2_servers is not making it through the firewall.  I must be missing something.  I have attached my config.

View 4 Replies View Related

Cisco Firewall :: ASA 5510 8.4 / VPN Traffic For Specific Client?

Mar 16, 2013

I have ASA 5510 8.4 Firewall where more than 20 Site to Site VPN Clients are configured on it. how to see the traffic for one Specific Site to Site VPN.Actually this site to site vpn is always keep dropping for every minute. I'm sure its a problem at the other end.The remaining 19 VPNS are UP and working without any problem. How to see the traffic for specific vlan.More over we dont have any syslog server in our network. Is their any chance we can check the traffic on the firewall?

View 6 Replies View Related

Cisco Firewall :: ASA 5510 - Always Allow Traffic On A Single Port

Feb 1, 2012

I have a private network behind a configured Cisco ASA 5510. I need to send data back and forth between a server on the inside network and a device on the outside network on port 44818. No amount of configuration is allowing this to happen. The packet tracer always fails on of the implicity "deny" rules, even though my other rule should explicitly permit it. I also realize I need to set up routing from my outside network to the inside network, but I cannot see from the documentation how to do that on this particular port without simultaneously breaking my outside connection.
 
The inside IP for the ASA is 192.168.25.1
The outside IP for the ASA 192.168.11.54
 
Here is my current configuration:
 
: Saved
: Written by enable_15 at 08:49:25.956 UTC Thu Feb 2 2012
!
ASA Version 8.2(5)

[Code]....

View 6 Replies View Related

Cisco VPN :: 5510 Specify Remote Access Interesting Traffic?

Feb 9, 2013

I am having trouble making my remote access vpn decrypt traffic. I am using an ASA5510 and the cisco 5.0 vpn client. I have no problem getting the tunnel to come up. But the "decrypted traffic" stays zero and the "discarded traffic" increments continuously.Here is the ASA5510 crypto config:OK I guess this site doesn't allow pasting text so I attached the config.I am pretty sure that I can't pass traffic because I have not been able to figure out how to specify the interesting traffic for the vpn connection. What is the syntax for this? It looks like it should be some kind of tunnel- group commands.
 
Am I the only one who thinks that the Cisco documentation is worthless on this subject? The ASA config guide gives you everything you need to set up a tunnel, but has absolutely nothing on the config required to actually pass traffic.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 High Traffic On Outside Interface

Jul 31, 2012

I have little experience with firewalls, what I've learned has been by dealing with issues like this that arise from time to time.I know, I need to upgrade the version. It's in the works now. Anyways, my question/problem is: Today I've received reports of slow internet access/activity and have noticed myself that it seems a bit slow today.  On the dashboard of our asa 5510 the "outside interface" traffic usage is running contstantly high. It's at the top of the graph. How can I tell what is causing the spike in utilization. It usually runs at about 1500-2000 Kbps, and now it's up over 10,000.

View 2 Replies View Related

Cisco Firewall :: Cannot Get 5510 ASA To Reach Internet Traffic

Nov 30, 2012

I have been at this for the past few hours now. I just cannot get this device to pass through traffic to the internet. Here is the basic topology:
 
 Default Gateway (ISP): 208.118.125.129/29
IP of outside int (e0/0): 208.118.125.130/29
ip of inside int (e0/1): 10.1.1.1/24 
 
igniteCSGfw(config)# sho run
: Saved
:
ASA Version 8.0(4)

[Code].....

View 3 Replies View Related

Cisco Firewall :: ASA 5510 / QOS For VOIP Traffic To And From Internet

Apr 20, 2011

We are using an ASA 5510 as our gateway to our ISP.  All of our VOIP traffic is sent to an Internet SIP provider for our outbound calls.  Our pipe to the Internet is 100Mbps metro ethernet.  I am trying to find a way to provide QoS for this traffic so that I can reserve 20Mbps of the available 100Mbps pipe for VOIP traffic.From what I've been able to figure out so far I would use a combination of priority queues and traffic policing.  However, it seems that this is nearly impossible to accomplish because I cannot control the remote device that my ASA connects to because it is the ISP device.  I could police traffic on the inside interface of the ASA.  However, lets say that a client on our network starts downloading from an Internet host and the downloaded traffic saturates my Internet connection.  I could police this incoming (from the Internet) traffic on my outside interface of the firewall.  This would drop the packets but the bandwidth would have already been used by the time it reaches my firewall.Would the fact that I'm policing incoming traffic on my outside interface cause the sender to throttle down their transmit rate because packets are being dropped?  Would this achieve my goal of guaranteeing available bandwidth for my VOIP traffic by not allowing other traffic to saturate the link?Most documents I find regarding this topic describe providing QoS for VOIP traffic traversing a VPN connection in which case you could configure both end devices.

View 1 Replies View Related

Cisco Firewall :: 5510 - CSC SSM Slows Down Internet Traffic

May 17, 2011

We have Cisco ASA 5510 256RAM running 8.2.4 with CSC 6.3.1172.4, it slows down internet traffics drastically when we do speed test, we get something like this, It the computer is bypassing the CSC, it gets This was done when there's very low traffic on the LAN and CPU is low usage on the CSC. The CSC has been re-imaged also but still doesn't solve the problem.

View 6 Replies View Related

Cisco VPN :: 871 / 5510 - Any Way To Force Traffic Bound For 192.168.1.x To Go Over VPN Tunnel

Apr 3, 2011

I have 2 Cisco 871 set up to vpn in to an ASA 5510.  Everything has worked even when the 871 is behind a nat.
 
We use these routers to send to employees home for temporary use.
 
The WAN ports on the 871 are configured to pick up an IP via DHCP.
 
Office ASA 5510 - Public IP address
WAN - Public IP
Internal - 192.168.1.0/24
|
Internet
|
Home Router
WAN - Public IP
Internal - 192.168.1.0/24
|
Cisco 871 picks up 192.168.1.x on WAN port from user's home router
Internal vlan1  192.168.10.x/24
 
The problem is - this user's home router is using the same subnet as the internal network at the office.  Is there anyway to force traffic bound for 192.168.1.x to go over the VPN tunnel?  It does this correctly if the 871's WAN port is not also on the same subnet. The vpn tunnel does come up.  And I can ping to and from the router, it's just the clients behind the 871 that cannot ping or access the corp network.

View 2 Replies View Related

Cisco VPN :: 5510 / 5505 - Filter VPN Traffic Using Barracuda

Sep 20, 2012

I have a site to site VPN setup between a 5510 and 5505.  All traffic is sent ovet the VPN from the remote site to the home office.  Everything is working fine but the remote site "www" traffic is not going to the Barracuda. ISP -> CISCO ASA -> Barracuda -> Internal Switch.The Barracuda is setup "inline" with the internal network.

View 7 Replies View Related

Cisco Firewall :: ASA 5510 - Can't Move Traffic From DMZ To Outside Interface

Jan 16, 2012

I can't move traffic (isakmp udp_port: 500 & ipsec nat traverse udp_port: 4500) from my dmz to the  outside interface

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved