Cisco WAN :: Forcing Traffic Through Specific Interfaces ASA 5510

Mar 6, 2012

How to force traffic back out the same interface from whence it entered.  Review the following topology.
 
Internet ---> ASA 5510 ---> Static IP1 ---> F3.1 ---> 1811 F0
                             |-------> Static IP2 ---> F3.2 ---> 1811 F5 ---> VLAN Int
 
ASA F3.1        10.1.254.9/30
ASA F3.2        10.1.254.13/30
1811 F0          10.1.254.10/30
1811 F5          10.254.1.14/30
 
When pinging the public IP of ASA F3.2 from the internet a reply is never received because the default route on the 1811 points to ASA F3.1.
 
How do I get the replies from the 1811 to go back out the same interface from whence it entered ? I am sure the answer is policy-based routing, but not sure how to write the config.

View 1 Replies


ADVERTISEMENT

Cisco VPN :: Forcing ASA 5510 To Follow Specific Route?

Apr 23, 2012

My setup has two firewalls to the internet, one is for all internal users who want to access the internet and the other is an ASA5510 acting as VPN terminaton to remote workers accessing using Anyconnect.
 
Each of the firewalls has a public interface on the same network (ex. 196.160.100.192/26).
 
We have a server with a public interface, and all traffic (internal and external) has to access via the public ip (again in the same network as above) and there are different profiles and access levels on that server depending if you are accessing from an internal IP or a public IP.
 
Well, when users are connected thrugh the VPN, although they have an internal IP address, as they are accessing the server on the public IP, the ASA sends the packets through its external interface (direct connected route) instead of sending it to the default internal gateway that is a "trusted" entry point on the server.
 
Any way to force the ASA to send that traffic to the internal default gateway instead of sending it to the external (direct connected) interface?

I have no access to the server (appliance under warranty) so I can't make any changes to it...

View 1 Replies View Related

Cisco VPN :: Forcing ASA5510 To Follow Specific Route?

Jul 11, 2011

My setup has two firewalls to the internet, one is for all internal users who want to access the internet and the other is an ASA5510 acting as VPN terminaton to remote workers accessing using Anyconnect.Each of the firewalls has a public interface on the same network (ex. 196.160.100.192/26).We have a server with a public interface, and all traffic (internal and external) has to access via the public ip (again in the same network as above) and there are different profiles and access levels on that server depending if you are accessing from an internal IP or a public IP.Well, when users are connected thrugh the VPN, although they have an internal IP address, as they are accessing the server on the public IP, the ASA sends the packets through its external interface (direct connected route) instead of sending it to the default internal gateway that is a "trusted" entry point on the server.Any way to force the ASA to send that traffic to the internal default gateway instead of sending it to the external (direct connected) interface?
 
PS: I have no access to the server (appliance under warranty) so I can't make any changes to it...

View 1 Replies View Related

Protocols / Routing :: Forcing Use Of Specific Outbound Port?

Jan 24, 2013

force something such as a Telnet client to use a particular outbound port when opening the TCP connection?

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - 2 Internet Interfaces Without Traffic

Jan 15, 2013

I need to route to sub nets form 2 different ASA interfaces. The ASA also has an outside interface works like gateway for internet access. Here is my configuration:

ASA Version 8.2(1)
host name ICE3
names
interface Ethernet0/0
name if outside
security-level 0
ip address 201.199.xxx.xx 255.255.255.248
[Code]....

View 9 Replies View Related

Cisco Firewall :: ASA 5510 8.4 / VPN Traffic For Specific Client?

Mar 16, 2013

I have ASA 5510 8.4 Firewall where more than 20 Site to Site VPN Clients are configured on it. how to see the traffic for one Specific Site to Site VPN.Actually this site to site vpn is always keep dropping for every minute. I'm sure its a problem at the other end.The remaining 19 VPNS are UP and working without any problem. How to see the traffic for specific vlan.More over we dont have any syslog server in our network. Is their any chance we can check the traffic on the firewall?

View 6 Replies View Related

Cisco WAN :: ASA 5510 / Forcing Inside Interface To Go Out Backup ISP?

Nov 12, 2012

We have a 5510 and I have a second ISP setup for a backup link. We have 4 ports connected to 4 different internal subnets. I want to force one of the ports to use the backup ISP link at all times. I'm having a little problem with where I need to make the changes in my ASA.

Interface "outside" is my main ISP
Interface "building3" is my backup ISP.
 
I want to force the "Guest" network to use the "building3" link for all traffic. Here's a snippet of my config
 
global (outside) 10 interface
global (building3) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 0.0.0.0 0.0.0.0
nat (Guest) 10 0.0.0.0 0.0.0.0

[URL]
 
Do I need to change the global pool or create a new one? I have a couple free public IP addresess on the building3 subnet I can use for a pool.

View 2 Replies View Related

Cisco Switching/Routing :: ASA 5510 Routing Specific Traffic To Inside Router

Nov 7, 2012

I have an ASA 5510, with Ethernet0 connected to Internet via a T1 line, Ethernet1 connected to LAN1, and Ethernet2 connected to LAN2.  LAN1 & LAN2 are independant, but share the Internet connection, via the T1 line.  On LAN2, I have another router that connects to the Internet, via a Comcast line.  I wish to route some of the traffic on LAN2 (10.38.77.0) to the other Router, on LAN2 (10.38.77.12) (connected to the Comcast line).  I have entered the following lines:

route inside2 10.11.0.0 255.255.0.0 10.38.77.12 1
route inside2 10.252.0.0 255.255.0.0 10.38.77.12 1
route inside2 172.22.6.0 255.255.255.0 10.38.77.12 1
 
I can trace the routes from the ASA 5510 (1st hop is to 10.38.77.12), but not from anything else on LAN2.

View 7 Replies View Related

Cisco :: Routing Traffic Between Two Cell Interfaces

Jan 28, 2013

I would like to ask a question about the setup that I'm trying to implement.I've got two WICs, 3G and LTE, in the router, one has its static IP address using 3G network, and another one has negotiated IP address using LTE network.There is no physical circuit/connection coming in to this place.Let say 3G network is (A.A.A.A|Cellular 0/0/0), and LTE network is (Negotiated IP|Cellular 0/1/0).There are two different network coming to the router. Let say they are 10.1.1.0/24, and 10.1.2.0/24,I want to route 10.1.1.0/24 traffic using 3G Network A.A.A.A Cell0/0/0,and route 10.1.2.0/24 traffic using LTE network, Negotiated IP Cell0/1/0. We're talking about only the default routes here.

View 1 Replies View Related

Cisco VPN :: ASA5510 Can't Seem To Route Traffic To Both Interfaces

Sep 12, 2012

I currently have a site to site VPN running connecting a branch office and the Main office using a ASA5510 and ASA 5505. currently PC's at the branch can access the network in the main office using interface 0/1, but we have added another ip range using interface 0/2 and I can't seem to route the traffic to both interfaces. I currently have 0/1 as inside 192.168.10.1 which works, and have added 0/2 as Inside2 192.168.20.1. I know I am forgetting something, any commands to route incoming VPN traffic so PC's at the branch office can connect to both IP ranges?

View 14 Replies View Related

Cisco Firewall :: 5520 VPN Traffic Between Interfaces

Jun 12, 2011

Our ASA 5520 firewall is running 8.0(4) IOS.I have an internal L2L VPN terminating on my firewall (from an internal remote site) on ENG interface.With the default "sysopt connection permit-vpn" command enabled, VPN traffic is allowed to bypass the ENG interface acl.The security level on the ENG interface is set at 50.The security level on the destination interface PRODUCTION is set at 40.Inbound VPN traffic bypasses ENG interface acl and since higher-to-lower security level allows VPN traffic to flow freely from ENG to PRODUCTION, it seems the only place to check/filter VPN traffic is an ACL placed on the PRODCTTION interface and set at INBOUND (outbound VPN traffic).

View 4 Replies View Related

Routing Of Specific Traffic To Certain Interface?

Jul 7, 2011

I have two ethernet adaptors on my windows machine. OS is Win-XP.I am running ADSL broadband on LAN1 and on LAN2 I am accessing applications on our company's WAN. LAN1 is on 192.168.1.0/24 subnet and LAN2 is on 10.68.104.0/22 subnet.Accessing application through LAN2 involves DNS that is located distantly, therefore routers are also in picture.Problem is that while accessing the application that run on the network of LAN2, I have to disable LAN1. Otherwise the traffic goes on LAN1.

View 2 Replies View Related

Flow Browser Traffic Through A Specific NIC?

Oct 14, 2011

My question is pretty straight forward but here is some background information. I would like my browsing traffic to funnel through my phone's 3G or WiFi connection. Is there any information out there on how to direct the browser to use the second internet connection? I was thinking about setting up a VPN using the second nic and somehow instruct the browser to use the specific proxy. I have no idea if that is even possible though.

The need for this is pretty simple. I do not want my browsing habits being logged by my company's network. Also while maintaining the current corporate connection so Outlook and RDP programs continue to function correctly.

View 1 Replies View Related

ASA5505 - Tunnel A Specific Traffic Via VPN

May 20, 2012

I have a number of sites in China, they have decent inter-country connectivity but poor connectivity when going overseas.

We have a single site in China witha dedicated 1:1 leased line that has good conectivity both inside and outside of China.

All the sites in China have ASA5505 firewalls

One of our Citrix farms is hosted in the UK and although the main site with the leased line is fine accessing the farm the other sites are not. I would like to try and tunnel just the citrix connectivity via a VPN to the China head office then use their connection to get out to the farm.

how to tunnel all traffic but not just specific traffic over the VPN.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Traffic Flow Between Interfaces

Jun 13, 2012

I am fairly new to configuring ASA's. I have an ASA 5505 with one outside interface and three inside interfaces (inside1, inside2, and management). I need inside1 and inside2 to be able to talk to eachother but cannot work out how to make this happen. They are both configured to the same security level and the 'Enable traffic between interfaces with same security level' box is ticked. I have also tried adding appropriate NAT and Access rules. The packet tracer suggests the rules are correct for allowing traffic flow between interfaces but obviosly this may not be the case.

View 14 Replies View Related

Cisco Switching/Routing :: 2911 - Allow Traffic Between Two LAN Interfaces?

Nov 15, 2011

I have a 2911 router. One interface is configured external (WAN) and two interfaces are configured on separate internal private subnets. What is the configuration to allow all traffic in both directions between the two internal subnets?

View 21 Replies View Related

Cisco Firewall :: ASA 5505 - Allow Traffic Between Inside Interfaces

Nov 9, 2011

I trying to allow traffic between 2 inside interfaces with the same security level.  VLAN1 and VLAN15.  The are on different physical ports on the ASA.  I tried to configure this through the GUI Web interface and checked ' enable traffic between two or more interfaces with the same security levels'.  With this ASA version, I do not need NAT to allow this, correct?
  
ASA Version 8.2(1)
!
hostname ciscoasa

[Code].....

View 1 Replies View Related

Cisco WAN :: 3925 Router Not Routing IP Traffic Between Two GB Interfaces?

Jan 14, 2013

We currently installed a 100Mbps fiber line with Ethernet hand-off.  I  purchased a Cisco 3925 ISR to be the gateway for this connection.  I am  not going to use it for any security purposes.  I have an ASA5520 that  will do that work.  Right now I am currently just trying to get the  router online.
 
I know the following

Laptop <--->GB 0/1((()))GB0/0<---->Ethern
et handoff from ISP. 

I  can ping and SSH to the outside interface of the router from outside  the network.  I can also ping and SSH to the router from the laptop that  is directly attached to the routers GB0/1 port.  From the Router's CLI I  can ping IP addresses on the internet. From the laptop I can not. I can not access the internet through the router though. Here is my config.Building configuration... 

Current configuration : 3724 bytes!! Last configuration change at 02:17:03 UTC Tue Jan 15 2013 by ggsis! NVRAM config last updated at 02:09:33 UTC Tue Jan 15 2013 by ggsis! NVRAM config last updated at 02:09:33 UTC Tue Jan 15 2013 by ggsisversion 15.1service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname XXXNAMEXXX!boot-start-markerboot-end-marker!!logging buffered 51200 warningsenable secret 4 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX!no aaa new-modelmemory-size iomem 20!no ipv6 cefip source-routeip cef!!!!!no ip domain lookupip domain name XXXXXXXXXXXXXXDomainXXXXXXXXXXXmultilink bundle-name authenticated!!crypto pki token default removal timeout 0!crypto pki trustpoint TP-self-signed-XXXXXXXXXXXXXXXXenrollment selfsignedsubject-name cn=IOS-Self-Signed-Certificate-XXXXXXXXXXXXXrevocation-check nonersakeypair TP-self-signed-XXXXXXXXXXXXXX!!crypto pki certificate chain TP-self-signed-XXXXXXXXXXXXXXcertificate self-signed

[code]...

View 10 Replies View Related

D-Link DIR-825 :: Block Inbound Traffic From A Specific IP?

Oct 5, 2011

How to configure the 825 to block inbound traffic from a specific internet IP address ?i noticed an IP and MAC that i don't recognize that is listed as a connection to my NAS's media server ...i blocked it in the NAS configuration page, but i don't want any unsolicited traffic into my network.

View 3 Replies View Related

Cisco Firewall :: ASA5510 - Traffic Between Multiple Inside Interfaces

Oct 10, 2011

I've been trying to figure this one out for quite a while.  I currently have 2 inside interfaces (data, phone) and I am moving to 3 inside interfaces (servers, workstations, phones).  I have not been able to get any traffic between the interfaces.  With the current setup it was not a major problem.  With the new setup it will be a major problem.
 
Below is a sanitized version of the config.

ASA Version 8.2(1)
!
hostname BOB

[Code].....

View 11 Replies View Related

Cisco Firewall :: ASA5505 - With Two Trusted Interfaces / Traffic Not Going Out Of Inside2?

Nov 14, 2011

I'm going nuts with this ASA5505. This is a secondary firewall used only in emergencies when the primary Checkpoint failes.
 
The basics, it has two trusted interfaces, E0/1 and E0/2-6. E0/1, inside2 has 192.168.01/29 and inside is 192.168.200.1/24.  I'd like any traffic to be allowed from inside and inside2 to outside and any traffic from the inside interfaces should be routed. No restrictions should apply between the two interfaces.
 
inside works just fine but no traffic is going out of inside2, not to outside or to inside.

View 8 Replies View Related

Cisco Firewall :: ASA 5510 - IP Sec VPN On Sub-interfaces

Jun 20, 2012

Can  ASA sub-interfaces run separate IP Sec VPN tunnels eg
 
There are 02 sub-interfaces of 01 physical interface of Cisco ASA5510 [ASA Version 8.2(5)] and I need to run 01 IP Sec VPN tunnel on each of these

View 1 Replies View Related

Cisco Switching/Routing :: 3750 - Only Allow Specific Traffic To VLAN

Oct 10, 2012

Have a quick question regarding inter-vlan routing on a 3750.  Overview of network is ISP --> ASA --> 3750 (acting as my core and default gw).  I have 5 vlan interfaces on my 3750, all w/ 192.192.x.x subnets, a 6th w/ 192.168.100.x, and a 7th w/ 192.168.200.x.  I have enabled "ip routing" on the switch and can successfully ping from subnet A to subnet B as long as both devices are using the correct DG for their vlan, which is the switch.  I have a few ports that are trunked as well that go to ESX hosts which break out the vlans according to the subnet the vm should be attached to.  The ASA is set to nat internal traffic for all the vlans.
 
Now my question:  short of applying an ACL to each vlan interface to block traffic from other 192.192.x.x subnets is there a better way to accomplish this?  I want my 192.168.10.x subnet to be able to reach all the subnets, but don't want 192.192.10.x to be able to talk to 192.192.20.x for example.  I was thinking to create an acl like this:
 
access-list 120 permit ip 192.192.10.0 0.0.0.255 access-list 120 deny ip 192.192.0.0 0.0.255.255 192.192.10.0 0.0.0.255access-list 120 permit ip any 192.168.100.0 0.0.0.255 192.192.10.0 0.0.0.255
 
and then applying this to the interface for the appropriate vlan. 

View 4 Replies View Related

Cisco Routers :: RV042 - How To Direct Traffic Through Specific Wan Port

Aug 1, 2012

I have an RV042. I understand and have created the services I need. The documentation is just not clear on how to direct traffic for these services to a specific wan port.
 
Can this even be done with this router? If so, the how? Use rate control or priority? Does checking a wan port mean that it will only go through that port?

View 4 Replies View Related

Cisco Firewall :: Force ASA 5520 Traffic Out Specific Interface

Jun 1, 2011

I'm trying to route all default traffic from my production environment through my ASA 5520 on the "outside2" interface.The 5520 has a site to site VPN to our DR site on the "outside/inside" interfaces via one ISP. On another ISP, interfaces "outside2/inside2" go to the internet.
When I make my 3750 stack default route for the inside2 interface IP I cannot get to the internet. When it is pointed to the inside interface on my 5505, I can.
 
I get the following errors when I try to open google.com from a production server:Why is the 5520 trying to use the "outside" interface instead of the "outside2" interface to go out?

View 6 Replies View Related

Cisco AAA/Identity/Nac :: Specific Targets Not Receiving Syslog Traffic From ACS 5.3

May 9, 2013

We have a distributed ACS 5.3 set up - a PR and DR replicating successfully.I've set up 4 remote syslog targets. 2 of them are at the same site as the PR ACS and 2 are at the same site as the DR ACS.The logging collector is set on the PR ACS.
 
The problem is that it "appears" that  PR ACS  is only sending PR ACS syslog info to one of the remote syslog targets out of the four.
 
The syslog target which does receive from the PR ACS is at the same site as the PR ACS.
 
"appears" means that some one has looked on the syslog targets to see what's been received / or not received.
 
I've been told that the syslog traffic for  syslog targets is being received from the DR ACS. Which is strange as the PR ACS is the actual log collector (and is not at the same site as the DR ACS).
 
I've also got Alarm Syslog targets set up on the PR ACS , (2 are the same ip addresses used in the 4 remote syslog targets). IP addresses of the remote syslog targets have been double checked and can be pinged from each ACS (PR and DR).

View 5 Replies View Related

NSA 2400 - Tool To Monitor Web Traffic For One Specific User?

Feb 5, 2013

I am trying to find a tool that will monitor the web traffic for one specific user. If it is capable of bundling it into a report that would also be a benefit. I have searched, but not come up with much aside from broad network monitoring tools. All that is really needed is to capture all the activity from http traffic for this one specific user/PC (since she uses the same PC all the time). We have a Sonicwall NSA 2400 as our internet filter, but I was not able to locate anything on there for specific user reporting.

View 2 Replies View Related

Cisco VPN :: ASA 5510 - Set Up Domain Specific DNS?

Feb 17, 2013

Is it possible to set up a domain specific DNS on an ASA 5510?The problem I am having is that while the site to site VPN is up the DNS servers on the main site are serving ip addresses for the remote site. Main site is on CBeyond and remote is on Time Warner so when doing an nslookup at the remote site it returns one IP address and when the remote site uses google DNS servers it returns another. The main difference being download speed (weird that it relates) as using main site DNS it was 3 hours and google DNS it took 10 minutes. I am looking for a way to serve DNS for the main site domains and for all public domains use google DNS or Time Warner DNS.

View 3 Replies View Related

Cisco Switching/Routing :: ASA 5520 - Can't Ping / Pass Traffic Through Interfaces

Apr 17, 2012

I've just started a CCNA course and my lack of knowledge has me a bit stuck. My network is comprised of Cisco components and I'm semi familiar with them just from reading and looking through options. I currently am using a Cisco ASA 5520 on my network and I am trying to join another network via one of the interfaces. My network is 192.168.0.0 255.255.0.0 and my inside interface is 192.168.1.1 255.255.0.0. I enabled a second interface using a static ip of 10.0.0.1 with a subnet of 255.255.255.128. Connected to that interface, I have a Fortigate firewall at 10.0.0.2 255.255.255.128. I can ping just fine from the Fortigate network to the 10.0.0.1 interface on the Cisco ASA 5520 network, but I can not ping the 10.0.0.1 interface (or anything past it) on the ASA 5520 from any computer on the Cisco network. I've read that ACL's and NAT have to be done as well as enabling traffic between interfaces with the same security levels. (both interfaces have security levels of 100 and the option is checked to allow traffic).

Note: each network has it's own internet connection. The connection is to share information on servers on both networks with each other.

View 1 Replies View Related

Cisco :: ASA 5510 Ping Between Inside Interfaces

May 4, 2012

I have two inside interfaces (both security level 100) inside and inside110. Inside is 192.168.105.3/24 and inside110 is 192.168.110.3/24. I have a PC on the 192.168.105.0/24 network. I cannot ping the 192.168.110.3 IP of interface inside110.

View 2 Replies View Related

Cisco WAN :: ASA 5510 ASDM 6.1 - Getting Multiple WAN Interfaces?

Aug 20, 2012

I am trying to enable a second WAN interface on our ASA.the end goal is to move all internet traffic to the new connection, but first i want to test it working.I have setup my computer as an object in the ASDM and the interface is configured correctly (same settings on a different router and that was working)I setup a route with a lower metric ( 1 lower than the default route which routes everything through current main internet interface) to route traffic from my computer out through the new interface but i am still connected on the old interface.I duplicated some of th NAT rules  (but i would have thought if these werent working then i would have no internet connection anyway)

View 5 Replies View Related

Cisco Firewall :: Communication Between Interfaces Of ASA 5510?

Mar 12, 2011

I configured ASA 5510 ...
 
Totally it had 5 ports..
 
How to provide communication between two different interfaces which had configured as same security level?
 
How many trunks will support ASA 5510 with base-license?
 
How to configure trunk to an interface with different VLNs( Router on a stick).

View 6 Replies View Related

Cisco VPN :: Remote User VPN Across Interfaces 5510

May 5, 2013

I have a client that wants to segment their wireless network behind their ASA.  We currently have a normal setup, 5510, 2 interfaces, outside, inside.  On the inside network there are Cisco Wireless APs that allow for internal access to the network.  We want to move the APs to a new interface on the ASA and only allow traffic bettwen this new "Wireless" network and the internal network by using remote user VPN.  So my question is, can you use remote user VPN from the new Wireless network to the inside network?? 

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved