Cisco WAN :: Setting Up Routes On ASA 5505?
Dec 12, 2012
I'm trying to set up a Cisco ASA 5505. I'm mainly setting things up through ASDM but I also have console access. Right now while I'm setting it up I have the outside/Vlan2 port attached to my existing network and a laptop connected to the inside/Vlan1 port. More info about that:
interface Vlan1
nameif inside
security-level 100
[Code]....
Before I added that last "0.0.0.0" entry, the ASA would not see anything on the internet. Now I can ping any external IP address from the router's console. However, the laptop I have connected to the 'inside' port still cannot reach any IP address outside the 10.10.153.0 network. Every time I try to add a similar route for the 'inside' interface, I get the following error: "You have another route configured for this network any which has same gateway 10.10.152.1 and same metric 1. You cannot add a duplicate route." I know I'm misunderstanding something here. In order to make devices connected to the 'inside' port connect to the internet, I need to set up a new route that will direct these devices to 10.10.152.1, right?
View 9 Replies
ADVERTISEMENT
Apr 2, 2013
I'm a bit perplexed atm with trying to set up multiple failover routes on a 2821 router. Let me say that I have more experieince in a switched network as routing is seldom required where I work atm. Here's my problem. I have a routing table set up as follows but only the primary routes work. The failover routes will not kick in once the primary route is not there.
ip route 10.32.11.0 255.255.255.0 128.32.8.11
ip route 10.32.11.0 255.255.255.0 128.32.24.11 100
ip route 10.32.12.0 255.255.255.0 128.32.8.12
ip route 10.32.12.0 255.255.255.0 128.32.24.12 100
ip route 10.32.14.0 255.255.255.0 128.32.8.14
ip route 10.32.14.0 255.255.255.0 128.32.24.14 100
Ip addresses are not exact but it gets the point across.
Why the failover routes are not failing over? The failover routes work if I remove the primary route from the config.
View 9 Replies
View Related
Feb 23, 2013
I was checking out the config on my ASA and noticed a bunch of static routes configured when I did a show route. With the exception of two that I expect to be there, the remainder point traffic destined for specific internal hosts to the outside interface, i.e.
S private_ip 255.255.255.255 [1/0] via public_ip, outside
I verified that I cannot ping those hosts from the firewall. I logged in to the ASDM. When I check the Configuration>Device Setup>Routing>Static Routes it only shows two static routes, the ones I expect to see. If I look under Monitoring>Routing>Routes, I see the same output as I did on the CLI. I looked around to see if I was missing a key location for this information, and I was able to see the same static routes output in Monitoring>Routing>Routes. Since this is under monitoring though there's no way to delete these routes, and I still don't know where they were configured originally. Then I happened to check under Monitoring>VPN>VPN Statistics>Sessions, and I see several of the private IPs used in the static routes being used by VPN users, including my own! I know I didn't assign myself a static IP for VPN use or anything like that. So, what are these static IP routes? Why do I see them in the CLI and not under the Configuration tab? I mean, I know I can delete them from the CLI but I'm trying to figure out why the info is not synced. Am I seeing dynamically created content based on the VPN connections?
View 2 Replies
View Related
Apr 8, 2011
Is there a way in EIGRP to prefer external routes versus internal routes. EIGRP always picks up internal routes as long as they are available, no matter if external routes have better metric. Our Scenario is that we have DMVPN hub and spoke topology running EIGRP 101. The Core routers also on EIGRP 101 prefer EIGRP 101 routes. We have the new MPLS network running BGP and redistributing these BGP routes into EIGRP 101. The core routers prefer EIGRP 101 routes (internal) to redistributed BGP (external) routes.
View 9 Replies
View Related
Dec 17, 2012
I am using a Cisco ASA 5505 Here is a description of my topology.
Headquarters = 192.168.201.0
Client X = 172.16.0.0
Datacenter = 10.12.0.0
Site to Site Tunnels:
Headquarters ---> Datacenter
Datacenter ---> Client X
I want to ability for computers in the Headquarters subnet to access the Client X subnet.I have tried setting up a static route to push all traffic destin for 172.16.0.0 to the datacenter, but was unsuccessful. how I can route all 172.16.0.0 through the tunnel.I have tried ading a static route on my ASA but without success.
View 3 Replies
View Related
Nov 14, 2011
I am trying to set up a DMZ on my Cisco ASA 5505, so that the wireless clients are connected behind the DMZ, the LAN clients are connected behind the inside interface and both groups of clients can get to the Internet. I have been able to configure the ASA for both wireless and LAN, but the wireless clients still cannot get to the Internet. The LAN clients can get to the Internet. I do not want the wireless clients and the LAN clients to be able to be able to communicate with each other. What commands do I need to run in order to allow the wireless clients to access the Internet?
View 11 Replies
View Related
Apr 4, 2011
I am wondering if this Cisco ASA 5505 Box is overkill for what I need?I have just become network admin to a small office that host two domains.
[code]...
Some of the clients are requesting a connection to the office from remote locations for file access and what not. So would implementing a Cisco ASA 5505 be overkill? I am a bit nervous of going forward as I have never had to "setup" an ASA box and dont want to kill the network.If I should NOT use this box, what should I use for a VPN connection?
View 6 Replies
View Related
Aug 14, 2011
My company has leased some office space to an outside company that handed me a 5505 and said "We want to VPN to our HQ through your Internet". I have two issues: I need this to work and I need to be able to access the 5505 from the management network. I don't care about the VPN aspect as much as making sure that I have basic communication down. I have everything configured per the diagram, but I can't ping the 5505 outside (Vlan 2) interface. I want to be able to configure and test the VPN setup on the 5505 from Putty on my PC.
The default route on the 5520 sends traffic to 10.10.1.1 and the default route on the 5510 sends traffic to the WAN interface. I added this route on the 5510:
outside 10.94.4.0 255.255.255.0 10.10.8.1
I still can't ping the default gateway on the 5505. There is a switch between my PC and the 5520 but the default route passes the traffic to the 5520. However on my tracert I don't even get to the 5520. What's going on here? Do I have to add a route to the switch just to manage the ASA 5505?
View 30 Replies
View Related
Oct 18, 2011
I have a ASA 5500 with Sec+ ?Is it possible to have Dual WAN, one WAN is used for default traffic and WAN2 would be strictly for VPN tunnels?
View 4 Replies
View Related
Feb 16, 2013
I have a client that has a 5505 installed. They want to VPN in with their Win7 laptop, but they don't want to shell out $1000 for the 10-pack Cisco VPN client.I have successfully setup the clientless VPN, and they can, through a browser, get to their files, but they'd like to map network drives so it's just like they're in the office.I tried setting the IP Sec up on the 5505, and then using the built-in Win7 VPN network connection, but no go.I also do everything through the ASDM, but I realize some things cannot be done. I'd prefer to use the ASDM!Anyone else get this configured? 99% of what I see out here is how to connect the 5505 for site-to-site VPN.
View 4 Replies
View Related
Mar 15, 2012
We are trying to setup our ASA 5505 to do port forwarding to multiple internal servers and have run into some issues. A little background on what we are trying to do.
We have 1 static external IP. Internally we have one exsisting server (10.1.1.184) that has port 80 forwarded to it and another exsisting server (10.1.1.185) that has port 443 forwarded to it. Both of these servers are serving seperate web apps to our employees who of course use them offsite. We have now added an additional server (10.1.1.186) that needs to use both ports 80 and 443. Is there any way to set it up so that these ports can be forwarded to all the servers that need them? Also, how would this work as far knowing what traffic will need to go to which server even though it is using the same port?
The equipment is: ASA 5505ASA Version 7.2(4)ASDM Version 5.2(4) I appologize in advance if what I'm trying to do is difficult/impossible. I inherted the ASA 5505 at this location and I was not here when it was initially installed. In fact no one on staff was here when it was initially installed. I did manage to find the passwords to it though. I'm not at all familiar with the ASA 5505 or Cisco secuirty appliances in general.
View 19 Replies
View Related
May 16, 2013
I have an ASA 5505 with Security Bundle license.
I am able to create 2 LAN networks (192.168.9.0 and 172.16.9.0) Vlan1 and Vlan12 respectively. I also setup 2 outside interfaces (outside1 and outside2).
Network 1 (192.168.9.0 - VLAN1) has no issues going out via Outside1, however I can't get Network 2 (172.16.9.0 - VLAN 12) to go thru outside2.
I put in a static route (route outside 172.16.9.0 255.255.255.0 x.x.x.x), the x.x.x.x is the default gateway of my ISP.
View 7 Replies
View Related
Mar 21, 2013
I am having a problem trying to figure out how to add a new ASA 5505 to an existing network. My current network is:Cable Modem > Linksys > 48 port switch With multiple hosts residing on the 192.168.0.x network.Now i know that the ASA comes default with 192.168.1.1 on the inside interface and i want to change that to 192.168.0.1. I have tried to do this thru ASDM using the wizard and manually. Once i hit ok for it to write the config, it gives me an error that it didnt take. I then lose connection to the ASA and have to hard boot it to get it back.I am trying to do this without my external connection connected and i have a laptop connected to the ASA on port 0/2 with an IP address of 192.168.1.75.Do i need to connect my internet connection to it first and then run the wizard? I was hoping to get it configured for my existing network before i plugged in the internet connection to limit my downtime.This ASA came with 6.4.1 ASDM and 8.2 OS installed. i was able to upgrade the ASDM to 7.X but when i go to update the OS to 9.1, i get an error that i am not registered to use cryptographic software. Dont know where i need to register to get it?
View 4 Replies
View Related
May 1, 2011
I have an ASA 5505 that I was updating from frimware 8.04 to 8.41. Anyway, I went through the update procedure half-asleep and accidentally deleted the boot image right after I installed it (I used the CLI and put in the command del asa8*.bin then just hit enter a bunch of times, which of course means I deleted the old firmware too).
So now whenever I power up the ASA, I get the "Could not find boot file" error. Is there a guide somewhere that tells me how can upload another boot image to the ASA and set the ASA to boot it from teh ROMMON prompt?
View 1 Replies
View Related
Mar 16, 2013
My wireless network consists mainly of approximately 1400 AP's 900 x 3602's, 500 x 3502's,The majority of these AP's especially the new ones have been manually optimised for channel and power settings. We paid an external surveyor to survey and optimise the AP's.
We have a few 5505 WLC's and the channel assignment method is set to "Freeze" ,My question is, if someone invokes a channel update on a WLC, will the WLC override the original manual channel setting if the WLC thinks it should be changed? And will the original setting be lost forever unless a restore is performed from the WLC Database?
View 5 Replies
View Related
Aug 23, 2011
setting up an ASA 5505 to be used as a firewall between a BT internet router(BTNet service) and a Cisco 3560 Lan switch. BT have presented me with a cisco 3800 series router with the following details:
Network Address Network Mask BTnet NTE Router LAN Address
There are 2 Gigethernet ports on the back of the router port Ge0/0 is connected to the BT NTE and the status light is flashing green. Int ge0/1 is connected into port int e0/1 of the ASA but i am unable to get any connection.
View 21 Replies
View Related
Dec 22, 2011
Trying to set up a asa 5505 in transparent firewall mode. I cannot set the management ip address:
ciscoasa> enable
Password:
ciscoasa# config term
[Code].....
View 7 Replies
View Related
Mar 31, 2011
Just now my boss asked me to prepare to set up site-to-site VPN on Cisco 881 Integrated Services router to ASA 5505 router which is now running at the HQ side. I am now learning pdf file from Cisco which mention how to setup site-to-site VPN between Cisco 1812 IOS router and ASA 5505 router by using ASDM V6.1 and SDM V2.5. Can't find the paper for that Cisco 881 device.
View 4 Replies
View Related
Nov 6, 2011
I am setting up a site to site IPSec VPN between two ASAs.I want to NAT an internal host that my VPN peer's network will be connecting to. So I need to make sure the traffic coming from this internal host is NATted before it enters the VPN tunnel as "interesting traffic"
So let's say remote network 192.168.20.0 /24 is connecting through IPSec VPN tunnel with peers 65.200.1.1 and 198.14.7.10 to host 10.100.1.7 on my network.I want to NAT host 10.100.1.7 to 192.168.100.5 to the remote network connects to the 192 address, not the 10 (I am using a ASA 5505)
View 9 Replies
View Related
Mar 31, 2011
who's familiar with the asa 5505 could give me a basic walk through on setting up a site to site vpn between two of them. One of the previous guys set it up so that people can vpn in with the cisco client but that's a whole different problem. It disconnects after a while randomly.
View 3 Replies
View Related
Feb 4, 2013
We have a BGP / OSPF configuration as shown in the topology picture. When the connection towards Internet is taken down, we expect the traffic to be forwarded toward WAN 2 (preferred) or WAN 1. The problem is that the BGP learned routes disappears when the Internet connection is taken down. The IP routing table on R2 only shows internal networks and the networks between R2 and WAN 1 and 2. No routes to internet is shown. We run "show ip bgp neighbors <ip-to-wan-1-router> received-routes" it contain internet routes. And when we run "show ip bgp neighbors <ip-to-wan-1-router> routes" it contains no routes at all.
View 2 Replies
View Related
Jul 24, 2011
How many routes support 7206VXR with NPE-G2?
View 2 Replies
View Related
Jan 23, 2011
I want to know the number of routes supported by CISCO3825-HSEC/K9(512MB DRAM).
View 2 Replies
View Related
Feb 15, 2011
I have an ASA 5510 that is configured for a remote access VPN
When users login, they are given an address from a locally defined pool (172.16.101.1-254 /24). Users can log in fine.
I have enabled EIGRP on the ASA and I have configured the following to be advertised:
1. 0.0.0.0 (default)
2. 172.16.100.0 /24 (dmz network)
3. 172.16.101.0 /24 (vpn pool)
I have also enabled reverse-route injection.
The problem I am having is that the VPN pool network is not being advertised via EIGRP, but the other networks are.
The other issue I am having is that even though I have created access-lists that allow the inside network (10.0.0.0) to ping the DMZ interface (172.16.101.1) on the ASA, the ASA is not allowing it. I have also created an ACL that allows the DMZ interface to ping inside, but this fails as well.
View 1 Replies
View Related
May 20, 2012
I am running an ASA with 8.4(3) and am trying to setup a dynamic VPN tunnel. We are having a business reason to establish a VPN tunnel to customers who do not have nailed down IP addresses. Now I found a number of documents that outline the steps involved. It seems the basic steps were to Establish a regular tunnelAdd dynamic crypto mapAssign the dynamic crypto map to the tunnel created under step 1. While this sounds pretty straight forward and simple, while prepping for doing just this I hot a road block while thinking it through. In order for my ASA to put anything into the tunnel it has to have a route to the remote network pointing at my VPN peer at the end of the tunnel. How do I do this in a dynamic tunnel? How do I add a dynamic route so the ASA knows which tunnel to stuff the traffic into? How do I stop the traffic from just being send to the Internet?
View 1 Replies
View Related
Jul 5, 2011
For ASR1000 to support 4M routes, RP2 must be used.
1) RP2 need to have 16GB memory in order to support 4M routes?
2) Need to use ESP20/40 together with RP2?
3) If RP2 + ESP10, supporting route table size down to 1M?
4) 4M routes is shared for both IPv4 an IPv6?
5) SIP card will affect route table size?
View 1 Replies
View Related
Mar 10, 2013
I'm using a Catalyst 4500 switch (C4507R+E) with Sup 7E. Cisco Datasheet of this switch says that it can learn maximum 256K IPV4 routes. Currently it just learns 10330 ipv4 routes. However when I show platform hardware ip route summary, it seems that the FIB is just free 100K routes as below output:
Entity total used free util%
Entries 260096 10332 249764 3
UC Ipv4 110592 10331 100261 9
unused 147456 147456 0 100
My question is: Can I make use of all 147456 unused routes? Or these ones have to use for any special purpose?
View 1 Replies
View Related
Nov 15, 2011
In my live VPN concentrator at work, my 5520 is showing a static route for each VPN client that is connected to my SSL vpn right now. This kind of confused me because wouldn't only one route to the address pools subnet be needed for my vpn users?
View 12 Replies
View Related
Apr 2, 2013
viewtopic.php?f=33&t=24000
How can you remove these "L" routes in routing table?
View 6 Replies
View Related
May 10, 2013
I bought the SG300-10 Switch a few days ago and updated it to firmware 1.3.0.59, but i think there's a bug in this firmware. If I go to "IP Configuration" IPv4 Routes" in L3 Mode nothing is displayed. In the log file i see that:
21474773112013-Mar-16 09:51:34Error%HTTP_HTTPS-E-DIAGNOSTICS: ERROR - in <RL_vtLeadTableGet> tag, can not find the table rlInetRoutingDistanceTable in the MIB. 21474775182013-Mar-14 22:39:22Error%HTTP_HTTPS-E-DIAGNOSTICS: ERROR - in <RL_vtLeadTableGet> tag, can not find the table rlInetRoutingDistanceTable in the MIB., aggregated (1)
Reset of the Switch doesn't work.
View 4 Replies
View Related
Jan 27, 2012
We have a Cisco 7301 concentrator, well two of them in HSRP configuration. We have multiple VPN's setup on that router (crypto map based). Recently we noticed the following:
- There is one IP address that has hundreds of static routes for some reason
- VPN for this customer is working, but I'm trying to find out why this is happening.
Here is how it looks like: S 0.0.0.0 0xF5FFFF2C [1/0] via "ip-address".There are hundreds of entries for a single IP there.
View 2 Replies
View Related
Jul 24, 2011
I am working on a network that has four nodes/Currently I have RIP running in between R1 and R2, and between R3 and R2. These are shared and R1 can access R3 just fine.R3 is running BGP and communicating with R4.R3 can ping everything in R4's network with no difficulty.Currently R3 is not rebroadcasting the BGP routes into RIPv2 as needed.I have tried clearing my BGP session and am still not able to get the BGP routes from R4 to R1.
View 1 Replies
View Related
Mar 6, 2012
<RouterA1>-Network2-<RouterA2>-AS65100-<RouterB1>-Network1-<RouterB2>
| |
| AS65101 |
<Router1>--------------------Network3----------------------<Router2>
Routers A1,A2,B1,B2 are in AS 65100
Routers 1 and 2 are in AS 65101
Routes from the network2 to network3 should go through RouterA1-Router1
Routes from the network1 to network3 should go through RouterB2-Router2
As for now all routes within AS 65100 to AS 65101 goes through RouterB2/Router2
View 3 Replies
View Related
