Cisco WAN :: ASA 5510 - Allow Local Network To Access Public Internet Address On DMZ
Mar 14, 2013
I have a Cisco ASA 5510 I am using ASDM 6.1
I have a LAN and a DMZ and an internet connection. I am using one of the internet connection IPs to host a HTTP service on a server in my DMZ. (its the same interface as my internet connenction but a different IP to the one used for internet connectivity)
so say my LAN is 192.168.1.x
and my DMZ is 172.168.1.x
I can access DMZ from Lan and vice versa. when i try to access the public IP (or URL) from a pc in my LAN i get nothing.
I have enabled DNS rewrite (doctoring) but it is still not working. the HTTP service is available from other sites.
View 1 Replies
ADVERTISEMENT
Jul 30, 2012
I am setting up a site to site IPsec connection with a company, something which I have done many times before without trouble. I use ASDM to configure this as it is quick and painless, usually.
We have a number of other site to site connections currently configured and working fine on this ASA, these are configured with the 'Protected network - Local network' configured with the private IP's of the hosts within our network we want to make available through the seperate tunnels. This includes the configuration setting on our ASA for each connection to 'Exempt ASA side hosts from NAT'.
With this new connection however, the company has asked us to use a public IP for the host we want them to reach through the tunnel. I am not sure why but they demand it. So I added a NAT rule for the inside host, and configured the connection with the public IP under 'Local Network'. When testing to try reach a host on their side, the tunnel does not even attempt to initiate.
I cant see where I am going wrong. I am guessing the 'Exempt ASA side host from NAT' does not require to be set for this, as how else would the ASA know which internal host the public IP relates to.
View 6 Replies
View Related
Jun 10, 2011
I configure for our office site to site VPN project. Now I configured already Site to site vpn between ASA 5510 and 1841 router.
HQ LAN
Branch LAN 10.2.1.0/24 >>> ASA 5510>>>>> 1841 >>> INTERNET <<<<<< 1841 <<<<<< 10.30.3.0/24 ^^^^ Call Manager 2851
Now can access from Branch LAN to HQ LAN each other. I face the problems that are
1) In branch LAN , they can access HQ LAN & resource , but cannot access internet. I didn't configure NAT on PH Router
2) Can I access internet from BRANCH LAN through HQ LAN to INTERNET. Or Can I access Internet from Branch LAN from PH Router directly while access to VPN to HQ LAN ?
3) In Branch Site , hard phone cannot work but soft phone on PC can call to HQ. Hard phone IP are same in Remote Network (172.16.1.0/24 ) . Is it problem ? how can I configure separately ?
View 2 Replies
View Related
Jul 11, 2012
i'm running a 5510 asa and the vpn has been working great for a while. We recently change our network provider so i had to change the public ip, and dns on the firewall... now i can still connect via the vpn and browse accross my mpls to other sites, but cant really access anything on the native lan that the firewall resides on?
View 9 Replies
View Related
Feb 28, 2011
Is it possible to assign public IP address as Router's local IP address (RVL200, RVS4000)?
View 1 Replies
View Related
Feb 5, 2012
We need to deploy a Cisco ASA 5510 behind the Internet facing router for Remote Access VPN (RAVPN). We bought the block of 16 IPs (in a different subnet) which is routed through the main router (69.x.x.x)and configured the outside interface of ASA with a public IP 64.x.x.x and subnet mask 255.255.255.240. Below is the network structure.
But, we can't access the ASA by it's public IP.
DSL Modem → RV082 router → Switch → LAN
(69.x.x.x) ↑ (192.168.0.0)
Cisco ASA 5510
(outside: 64.x.x.x, inside: 192.168.0.172)
View 16 Replies
View Related
Jan 23, 2012
We have ASA 5550, I have a portal server in the dmz which is natted statically to a public ip address for port 443. The application works fine from outside world. The server is also nated with a dynamic nat from inside to dmz and when I hit on the dmz ip from my inside it works fine.
The requirement for us is that the users sitting behind the inside (i.e. LAN) should access the server on the public ip address and not thru the dmz.
View 5 Replies
View Related
Mar 15, 2011
Will I break anything if I create a second IP address on the physical external interface of our ASA 5510? I want to point it nowhere internally but want an active interface that can be vulnerability scanned but won't lead anywhere internally.
View 9 Replies
View Related
Mar 5, 2012
We have a Cisco ASA 5520, and we're creating an IPSec VPN to another Cisco ASA. We have multiple VPNs on this firewall.
The issue with the latest one is they require a Public IP as the Local Encryption Network. I've seen this question a couple times while searching but never really a definitive answer.
Would using the "Outside-Network" as the local encryption network, then natting the appropriate IPs be sufficient? Or would this not work at all?
Our Public block is X1.X1.X1.64 - X1.X1.X1.79, our Peer IP X1.X1.X1.66. Would using X1.X1.X1.64/28 as the local encryption network make the connection? Then NAT the needed IPs from our DMZ X2.X2.X2.71 as X1.X1.X1.71 to the client?
Would this work or am I way off the mark (I'm by no means an ASA expert, and an ASDM explanation would work over command line).
Edit: Or would I have to create a new Global Pool made up of Public IPs on a different subnet mask than our actual Public IP address pool. And make that our Local Encrypted Network? I think this might be it, but could it cause IP overlapping? Our webserver is part of this and I'm worried about causing connection issues.
View 8 Replies
View Related
Mar 3, 2013
I have DMZ n/w 192.166.0.0/24 on which i have nated on public ip
-private ip : 192.16.0.201 (OWA)
-public ip : 61.x.x.x.
when i try to access owa(public ip ) from dmz it is not allowing , From what rules i need to set to get work ASA 5510 8.2
View 13 Replies
View Related
Jan 16, 2013
I configure anyconnect vpn on cisco asa version 8.2. vpn user need to access internet so i configured split-tunnel. the split-tunnel working but i do not want to use split-tunnel for security reason. i want vpn user use our local network internet. how i do it?i think that i must do vpn user subnet nat and then what i need do additionally?
View 1 Replies
View Related
Mar 13, 2011
What I'm trying to do is create a private network for local file sharing but also have internet access. There is a WRT54G router connected to a satellite modem in a separate building, just barely close enough to connect from my laptop, which is what sparked my original idea to use my WRT54GL as an access point.
View 1 Replies
View Related
May 22, 2012
I need to connect from an inside host to a host located in the DMZ zone for DNS queries. The host in the DMZ zone has a static NAT to the outside. The point now is that I would like to connect from inside to the NATed outside address, means to the public Internet address.
Inside host: 10.0.0.1 -> PAT for 10.0.0.0/8 to 20.0.0.254 (Outside Interface)
DMZ host: 192.168.1.1 -> NAT to outside to 20.0.0.1
The traffic should be 10.0.0.1 udp>1024 to 20.0.0.1 udp=53. The source IP address on the outside interface now is 20.0.0.254 (according to the PAT), the destination IP address 20.0.0.1. The DNS reply from 20.0.0.1 should go back now to 20.0.0.254 and then to the inside host 10.0.0.1.
I know that on the PIX it was not possible, to have outgoing traffic on the outside interface which immediately enters again the same interface. Can I realize this scenario with the ASA 8.4(3) release now?
View 1 Replies
View Related
Jun 4, 2013
Our ASA 5510 was configured with a public interface, a DMZ interface, and a private interface. I have a remote access VPN using AnyConnect client and LDAP authentication for Active Directory. We are changing ISP (groan!), which means all new public IP addresses. The new circuit is installed, so I have a second public interface (same security level as the first public interface, wholly different IP address range) enabled on the ASA. I hope to transition whatever I can, which means get the VPN access through either public interface. Can I just enable client access on the second public interface at the Anyconnect Connection Profiles tab in ASDM? That seems too simple. Can they share the one address pool?
View 1 Replies
View Related
Feb 6, 2013
I've been trying to set up my new Cisco 1921 Router to provide internet access to my local network but with no success. I've been reading guides and looking at videos and I have to be missing something becaouse I can't access internet (ping/tracert) from my local network.
The DHCP server works fine and the clients on my local network gets ip-adresses from the router but can't ping or tracert outside the local network.
[code]....
View 2 Replies
View Related
Oct 12, 2011
how to totaly disable Admin/ASDM access on our public interface of our 5510. I don't want to change IPSec or SSL access to the outside interface. Just totaly disable access to Admin/ASDM from the outside without halting all other access.
View 3 Replies
View Related
Jul 28, 2011
I have a request to establish a site to site VPN with a customer. While collecting the information I give them our local network subnet which is a private subnet (192.168.5.0). They asked me if I could give them a public address instead. They can not work with the 192.168.5 subnet. Is this possible?
My side of the VPN is an ASA 5505 running 8.2(2). The other side i believe is a Checkpoint.
View 5 Replies
View Related
May 1, 2013
I'm setting up a Cisco ASA 5510.I did the setup for my public and private interface.From the management software I can ping any outside domain using my public interface, but when I try to do that from my private interface I cannot.Also for some reason my ip phone connected to the private interface work (I'm able to make and receive call), but any computer that I connect to the private interface I cannot access the internet.
View 1 Replies
View Related
Dec 19, 2011
I have an ASA 5505 configured with internal network, a DMZ, and a VPN on seperate subnets. The implicit rules allow my internal client computers to connect to the web servers on the DMZ IP, but I can not connect to the public NAT address from the internal network. I have a DNS server on my internal network and it does resolve to the public IP correctly. NAT seems to be working correctly because if I go outside the network and connect to the public IP or qualified name then I can get to everything correctly. I do not see any messages in the Cisco logs and the packet trace tool shows the route of http from an internal IP adddress to the external (NATed) address is allowed.
Specifically, I can go to http://192.168.1.121 from the internal (192.168.0/24) network, but I can not go to http://72.22.214.121 (the NAT address) from the internal network. If I am outside my cisco then I can go to http://72.22.214.121 easily. [code]
View 1 Replies
View Related
Jul 12, 2012
Our HQ office has an ASA 5510 with full access to internal and external IP's. We have a small group of remote users that are working from a shared office suite and they only have Internet access by way of internal default gateway. Using a VPN client is not desirable due to many other devices requiring access to HQ. Is there a way to create a site-to-site VPN from this remote office space back to HQ (ASA 5510) if they have no access to the public IP address on their end?
View 2 Replies
View Related
May 23, 2012
when I ping another workstation on my local network I should get back it's local IP but instead I am getting an ip address that resolves to somewhere in Germany! In fact if I ping any bogus name, I mean anything, it returns this same address 62.116.181.25. If I shut down my cable modem then everything resolves correctly. And yes I have DNS relay enabled because it seems to be the only way to get the workstations to resolve external sites correctly.
View 2 Replies
View Related
Nov 13, 2011
I brought my desktop PC thinking their would be an ethernet port in the room but there isn't. I went out and bought a Belkin USB Wireless N150 network adapter and I download things at roughly 25kbps which just... sucks. I tried to ask the "tech guy" here what type of router they are using and he said "W-E-P" so I just said "okay" and walked away knowing that he barely speaks english. What can I do to get any more speed out of this? I don't know if it's a B, G, or N. If it's a G, would buying the N300 (i think it's "N+") or the N600 Dual Band work at all? What settings can I change? What can I buy?I've also got my Xbox 360 hooked into my PC via the ethernet port and shared the network connection with it to play Xbox Live, it's slow, but not unplayable.
MY PC SPECS:
3.2 intel core 2 duo (conroe)
asus p5q mobo
4gigs kingston
Windows Vista 64bit Ultimate
View 2 Replies
View Related
Jan 25, 2011
I use my desktop for streaming media throughout the house. I found it was causing lag for gaming most likely because it was taking up all the bandwidth for the router. We had a 2nd router laying around as well as a 2nd wireless adapter so we set up a 2nd network that was not connected to the internet for strictly media streaming.I attempted to change the network settings so the internet connection appeared as a public network so that streaming of media was hopefully diverted to the non internet wireless adapter.I want a faster way of transferring large video files from my laptop to my desktop. I recently bought a crossover cable to do this through direct connection.Both use the same user name and password as well as run the same win 7 pro however the desktop is the 64 bit version. I set up both ipv4 with the same addresses.When it has worked I am only getting a connection speed of just over 10mb and once I connect the crossover cable between the computers it knocks out my internet connection on the wireless card.
View 5 Replies
View Related
Mar 17, 2013
Is the following sysntax correct in removing a remote access vpn address pool and inserting a new one on an ASA5510?
(config)# NO ip local pool BWCVPN 192.168.200.1-192.168.200.128
(config)# ip local pool BWCVPN 192.168.300.1-192.168.300.128
(confif)# tunnel-group BWCVPN ciscovpn general-attributes
(config-general)# address-pool BWCVPN
View 5 Replies
View Related
Oct 7, 2011
Why I can't acces the internet in public places with my laptop.
View 1 Replies
View Related
May 18, 2011
Abruptly internet access disappeared. It's a router issue, none of the computers here can connect. Further, I can't access the router through a browser - 192.168.0.1 results in a "Firefox cannot connect" message. I've tried resetting the DNS to no avail. I'm typing via cell phone and it's annoying, but I'm willing to try about anything.
View 4 Replies
View Related
Nov 9, 2012
I want to use one (or two) AP1232AG-E-K9 access points for Internet connection through a public wireless network (BTFON), where wire broadband is not an option. I've downloaded what I think is the correct manual for the APs and I'm now scratching my head as to where and how to start setting them up. I want to use these Cisco APs in the hope they will give me better wireless performance than I'm currently getting, which is frequently flakey. I've tried to reset the APs to the factory default but there seem to be different ways of doing this depending on what you want and what you've got. I made up a console cable to access the console but there even appear to be different versions of this so I'm not sure if the cable I have is the correct one. I have setup and used lower end wireless devices in the past but these Cisco units seem real complicated.
View 39 Replies
View Related
Dec 15, 2011
We've a Cisco ASA 5505 connected directly to Verizon FiOS Circuit (ONT) box using Ethernet cable. As per the existing documention that I have, the previous configured this as a dedicated router to establish a seperate VPN connection our software provider. They assigned both Public Static and Local Static IP address. When I try to ping the public IP address, it says request time out; so the public IP address is no longer working.
When I ping the local IP address of 192.168.100.11, it responds. The SolarWind tool also shows Always UP signal. How can I login into this router either from remotely or locally to check the configuration, backup and do the fimrware upgrade?
I also tried to connect my laptop directly to the ASA 5505 router LAN port. After 3 minutes, I'm able to connect to Internet without any issues. However I don't know the IP address to use to login.
View 3 Replies
View Related
Oct 2, 2012
I am trying to provide internet access to public and private SSID's on Cisco AP541n using VLAN's connected directly to ASA5505. VLAN1 is inside interface (private) and VLAN12 is wlan interface (public SSID). The AP541n is plugged into switch port 0/7 on an ASA 5505.Port 0/7 is configured as trunk mode. I have internet access when connected to private SSID but no internet access when connected to public SSID. why I can't access internet on public SSID?
logging class ip history emergencies
mtu inside 1500
mtu outside 1500
[Code].....
View 5 Replies
View Related
Nov 21, 2012
the cisco 2921 Router has a default ip hhtp access class command found in it. Just i changed the default IP to the new ip i will use.The Router is accessable from the LAN only but not from the internet configured the Public ip . I think this is due to the standard access list 23 . how will i access the Router from the Internet using the Public IP.
View 6 Replies
View Related
Jan 15, 2012
I work at a Public Safety building in Pennsylvania and our employees here share a Wifi connection with a local hospital facility that is in a industrial park behind us. The room we work in is able to access the Public Wifi but only half of the room has a good connection. I went to the local computer store and purchased a Belkin Dual-band wireless Range Extender and got it all set up, now I have the Public Wifi Extention access and it will connect to it but it has no internet access. Now we have no access to the administor or the network from our facility. How do i get internet access thru this range extender? If i connect from the good half of the room to the Public wifi i have a good connection with internet access but as soon as you put it thru the extender no more internet access.
View 1 Replies
View Related
Jan 10, 2012
I have a local web development server that I'd like to open up so my clients can see the sites I build for them. The server is just my old laptop that I now use only as a web server.
I'm having trouble figuring out the port forwarding for this. I have a Netgear WGR614v9. I've configured the server to have a static IP, and have port forwarding sending port 80 over to the server. I've made an exception in Windows Firewall for port 80.
So, from my understanding, I should be able to go to my http://[my public ip], and I should in the least see my servers default site.
I think my problem is that I don't have just one website hosted by Apache. But instead am using Virtual Hosts to have a handful of sites hosted. So what I don't know is how to configure the server to know what site to serve.
I know I'm missing a step with having DNS setup. I haven't gone through that step yet because I thought it wasn't immediately necessary to configure the port forwarding.
View 13 Replies
View Related
Jul 21, 2011
I setup RA-VPN under local asa 5510 IP pool (192.168.127.0/24) and all was working fine. I got internet and local network access.
Then i have 5 site to site VPN working fine but when im traying to access to those L2L VPNs from the remote acces client im not able to do that. So after that i decided to obtain IP addresses from my DHCP server so i can obtain IPs from my local network (172.17.16.0/16) and then access normally to the VPN site to site. But the surprise was that the VPN cisco client is getting local IP address (172.17.16.222) perfectly but im not able to access even to my local network.
I have the same-security-traffic permit inter-interface same-security-traffic permit intra-interface enable.
View 6 Replies
View Related
