Cisco WAN :: Allow ICMP Traffic On ASA 5510 From LAN Interface To DMZ?

Jul 17, 2012

I want to allow ICMP traffic on ASA 5510 from LAN interface to DMZ. I've permit any traffic and added ICMP to the inspestion list also but still there is problem. Belos is the configuration. The image is asa822-k8.bin

ASA Version 8.2(2)
hostname fw-01
interface Ethernet0/0


View 1 Replies


Cisco Firewall :: ASA 5510 Allowing ICMP Unreachable On Outside Interface

Oct 25, 2011

I am having some issues with my ASA 5510 (running ASA 8.2) dropping ICMP unreachable-fragmentation-required-but-df-bit-set type messages coming in on the outside interface. I have the following entry in the ACL for the outside interface:access-list outside_acl extended permit icmp any interface outside and there are no other entries in that list that should take precedence and drop the packet. Pings from outside to the ASA work when this ACE is present and do no when it is absent so it is clearly taking effect. I see the following entries in the debug log when sending a large non-fragmentable packet (that would cause an intermediate router to send back this ICMP response) out to the internet through the ASa,As far as I can tell I am not running ICMP inspection; I don't want it to do any stateful magic here since the outgoing traffic would have been ordinary data from another protocol and would not have caused an outgoing ICMP connection to be built to match against.

View 12 Replies View Related

Cisco Firewall :: ASA 5510 Ftp Traffic Passing On 1 Interface But Not Another?

Dec 20, 2011

FTP traffic routed from outside to the inside interface works fine.  I have another interface with multiple sub-interfaces and vlans configured.  FTP traffic routed from the outside to vlan2_servers is not making it through the firewall.  I must be missing something.  I have attached my config.

View 4 Replies View Related

Cisco Firewall :: ASA 5510 High Traffic On Outside Interface

Jul 31, 2012

I have little experience with firewalls, what I've learned has been by dealing with issues like this that arise from time to time.I know, I need to upgrade the version. It's in the works now. Anyways, my question/problem is: Today I've received reports of slow internet access/activity and have noticed myself that it seems a bit slow today.  On the dashboard of our asa 5510 the "outside interface" traffic usage is running contstantly high. It's at the top of the graph. How can I tell what is causing the spike in utilization. It usually runs at about 1500-2000 Kbps, and now it's up over 10,000.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 - Can't Move Traffic From DMZ To Outside Interface

Jan 16, 2012

I can't move traffic (isakmp udp_port: 500 & ipsec nat traverse udp_port: 4500) from my dmz to the  outside interface

View 1 Replies View Related

Cisco WAN :: ASA 5510 - Outside Interface Stops Sending And Receiving Traffic

Aug 8, 2012

Cisco ASA 5510.  Between 5 to 10 minutes of reseting the asa traffic stop accessing outside ip addresses.  Ping from console fails to ISP router IP. Ping to google name server failes.  I have reset to factory default only setting up nic and natting and it still happens. 

View 2 Replies View Related

Cisco Firewall :: ASA 5510 7.2.1 High Traffic On Outside Interface Very High Input?

Oct 13, 2011

Today I've received reports of slow internet access/activity and have noticed myself that it seems a bit slow today.  On the dashboard of our asa 5510 the "outside interface" traffic usage is running constantly high. It's at the top of the graph. How can I tell what is causing the spike in utilization. It usually runs at about 1500-2000 Kbps, and now it's up over 10,000.

View 6 Replies View Related

Cisco WAN :: 1811 ICMP On External Interface

Mar 10, 2012

 I've got a Cisco 1811 router with FastEthernet0 plugged into a cable modem with 5 static IP's. I want to disable the ability for those IP's to be pinged externally except for certain addresses that I specify (I have some offsite servers that I use to monitor the ISP link for example). I also want the ability to be able to ping external addresses from the router as well as any of my inside subnets. [code]

I've tried varying ACL's and applied to Fa0, none of which work [code]

View 3 Replies View Related

Cisco Firewall :: 2811 Not Allowing ICMP To PBX Through Same Interface

May 31, 2013

Attached is our network diagram showing the details of our remote office and the corporate side which are connected via private fiber. The workstation ( can ping the IP address of the PBX but not the .30 address and I know if we can’t ping it we can’t remotely manage it. The 2811 router, ASA 5510 and the 6509-E can ping both IP addresses on the PBX. The ASA logs the error "Denied ICMP type=0, from laddr on interface inside to no matching session" when the workstation pings the .30 address.
We changed the default gateway of the PBX from to (2811 router) and we were able to ping both IP addresses from the workstation but the SIP trunks from the Internet stopped working (they NAT to the .30 address). Because calls may be forwarded from the PBX to the corporate network (via IP phones) we will eventually need to change the default gateway to10.20.0.1 and still need the Internet SIP trunks.
My two questions are, how do we resolve the issue of pinging the .30 address from the workstation and then when the time comes how do we resolve the issue with the SIP traffic reaching the .30 address when we change the default GW of the PBX to the address of the 2811 router.

View 9 Replies View Related

Cisco Firewall :: 5510 8.4 And ICMP

Sep 19, 2011

So I have my shiny new (used, but new to me) 5510 finally working and installed in my Dev network. I need to have icmp (ping and trace route) available from the inside network. I Google and found a few articles on how to do it. I tried modifying the class maps, but it looks like there are changes in the commands in 8.4 and the articles I found evidently were for 8.2 and lower. I tried doing it with access lists, again from examples and traffic stopped in all directions (not good) so I am back to being functional and how to do it in 8.4. Documentation seems sparse on the net with 8.4

View 4 Replies View Related

Cisco Switching/Routing :: Monitor ICMP Traffic On C6509?

Dec 22, 2011

Both regular IP traffic and ICMP traffic are passing through the source port. C6509 provides the option of filtering vlan traffic during monitoring. But I don't have vlan traffic.
qa-c6509-c(config)#monitor session 1 filter ?  vlan  SPAN filter VLAN
So I applied an access-list which only allows icmp traffic to be sent out of the monitoring port. But it does not work.

View 4 Replies View Related

Cisco Switches :: Cannot Get The SG200-8 To Mirror Any Traffic Other Than Ping (icmp)

Mar 11, 2012

Cannot get the SG200-8 to mirror any traffic other than ping (icmp).

Factory default settings, with port 7 src to port 1 dst on session 1.

Pings mirror just fine. But other traffic. such as web and ssh, is not being mirrored.

FW version

View 3 Replies View Related

Cisco Firewall :: ASA5505 Icmp Denied For Inside Interface?

May 6, 2012

I have ASA5505 configured with internal network as  and default gateway From the inside network, i'm able to access internet and able to ping all website (enabled ping).   and all internel  network devices can ping each other.  Except  i cannot ping my gateway (ASA5505)  I'm continously seeing this message on the log, when i tried to ping.. How to fix this?
Denied ICMP type=8, code=0 from on interface inside
replace xxx with my network devices that try to ping the gateway..I dont want outsiders ping my gateway, i need ping for inside internal network only.

View 5 Replies View Related

Cisco Firewall :: ASA5540 - No ICMP Reply From Inside Sub-interface

Apr 28, 2013

I need to monitor with ping the inside sub-interface of my ASA5540, is that possible? I get the ICMP requests but no replys going out from the box.
 I need to ping the from the
ASA Version 8.0(5) 
interface GigabitEthernet0/1
nameif inside


View 2 Replies View Related

Cisco Firewall :: ASA 5510 / PAT / ICMP Echo Outgoing IP

Apr 16, 2013

I have ASA 5510 with soft version 8.4(5) installed. There are two interfaces:
IP - inside
IP - outside
I have configured PAT, so network gets NATted to address. Everything works fine, except I can't reach via ICMP from the internet.
X.X.X.X Deny inbound icmp src OUTSIDE:X.X.X.X dst OUTSIDE: (type 8, code 0)
But I have configured an access list allowing ICMP from any to any: access-list outside_access_in extended permit icmp any any
Thus address, which is binded to outside interface itself, is perfectly reachable via ICMP.
I've got two questions:

1) Is there a way to fix it? It will be handy for diagnostic purposes.

2) is it possible to configure the secondary IP address on the interface on ASA? I've read, that there are some complications.

View 6 Replies View Related

Cisco Firewall :: ASA 5510 - Allow ICMP From Three Blocks Of IP Addresses?

Jul 12, 2011

I have an ASA5510 running version 8.4. ICMP is blocked from the internet to the outside interface of our firewall but now our ISP is requesting us to allow ICMP from their network to the outside of our ASA. I need to allow ICMP from three blocks of IP Addresses?

View 9 Replies View Related

Cisco Switching/Routing :: ICMP High Response Time To SVI Interface 3750X

Mar 13, 2011

I am in the process of installing a 3750x (IOS 12.2 (53r) SE2 IP Base) Cisco Catalyst switch in a new network of just 2 PC's (2 hosts, OS windows7 64Bits). I have enabled SVI interfaces with the both hosts installed in 2 different network segments.  We then start connectivity test.  The response time for the PING command between both hosts remain below 1 millisecond, whereas the response time between the hosts and their correspondent SVI interface is variable, and at all time is higher than 1 millisecond, sometimes it reaches 17 milliseconds. (Note that the switch CPU usage is only 8% at the time of testing)  We have performed this same connectivity test changing the 3750x switches  and in two different locations obtaining the same results. 

View 2 Replies View Related

Cisco Firewall :: ASA 5510 How To Limit Icmp To Just Single Host

Nov 1, 2012

I am working on an ASA 5510 on 8.4 IOS and need to know how to limit icmp to just a single host? What I would like to do is be able to PING from the Inside interface 10.X.X.X to host on the Outside, but thats it no other host would be PINGable.I tried MANY different access-list statements but the only way I can get icmp out and working is using the "fixup protocol icmp" but then everything is PINGable and the ASA does not block anything.

View 3 Replies View Related

Cisco Firewall :: PIX 501 / Can Traffic Goes From Inside Interface To Outside Interface

Oct 9, 2011

I have Pix 501 firewall and I'm just configuring the device for "Email Server" to allowing POP/SMTP.
Inside Interface Address:
Outside Interface Address: ISP provided IP address
My question is can my traffic goes from inside interface to outside interface? (because the inside interface address not from 10.0/172./192.168 private address)Also I'm allowing internet from this email server ( so what my access list to be configured? and what my subnet mask shoud be there?
Pix(config)#access-list outbound permit tcp any eq 80
Pix(config)#access-list outbound permit udp any eq 53
Pix(config)#access-group outbound in interface inside

View 7 Replies View Related

Cisco Firewall :: 6509 ICMP Echo From Firewall Interface

May 1, 2011

two 6509 chassis with VSS configuration.One of those chassis have one FWSM installed and the configuration is like this:
Switch: firewall multiple-vlan-interfacesfirewall switch 1 module 3 vlan-group 1firewall vlan-group 1  3-5,7,8,10,200 interface Vlan200 ip address
I am not receiving icmp replays from the fswm interfaces if i try to ping from do not see any debuging info in the logsI successfully ping from the inside networks int the cat6500, but int the network, can not ping

View 1 Replies View Related

Cisco Infrastructure :: 185 / Traffic-shaping On The LAN Interface?

May 5, 2011

There is a remote server that downloads info from a server here at HQ. When the dowloads start the rxload on the S0/0/0 interface jumps to 98 percent or so; rxload 250/255. I needed to limit the bandwidth utilization between the servers, so I added the below line to the LAN interface on the remote router.By adding the command, it reduced the download utilization -which is what I wanted.
access-list 185 permit ip host any
int f0/0
traffic-shape group 185 10000 8000 8000 1000
Question:How would applying this to the LAN interface cause the download utilization (Coming from s0/0/0) to decrease?

View 4 Replies View Related

Cisco :: 2821 / EEM - Monitor Interface Traffic In / Out?

Nov 2, 2011

i want to monitor interface traffic in/out by eem and the if the values is overer than some value i will change the policy. for example my router is 2821 is have 2 fastEthernet port , i want to monitor the traffic on fasE1/0 if traffic over than 80Mbps i will change some configuration ( example: change next-hop on static route) for via traffic to interface fasE1/1 for reduce the traffic on interface fasE1/0?

View 6 Replies View Related

Cisco WAN :: 2900 - Traffic Not Passing From One Interface To Another

Jan 15, 2013

I am facing a very big problem with site to site vpn on cisco 2900 ios.
I configured the vpn and when i ping  from router itself to destination ip with source as lan interface , VPN works, no problem.
but when i connect any computer directly to router's lan interface to initiate traffic , it doesnot work at all. and on computer's lan i see yeloow sign.
mtu is 1500, speed is auto (I tried changing also) , duplex is auto ( i tried changing also) , through firewall on pc should not affect but still i disabled it.
since their is no problem with vpn config as vpn comes up when i initiate ping from router itself but i dont know why it is not working from lan.
do we need any inspect icmp on this router also ? or any policy modification to pass traffic across the interfac on router is required ?
I was useinf c2900k9-15.0(M4).bin and i upgraded it to 15.3 which is lated to get reed of any bug .
I connected two laptops directly to router's gi0/0, g0/1 interface to ping from one laptop to another but this also did not work.

View 3 Replies View Related

Routing Of Specific Traffic To Certain Interface?

Jul 7, 2011

I have two ethernet adaptors on my windows machine. OS is Win-XP.I am running ADSL broadband on LAN1 and on LAN2 I am accessing applications on our company's WAN. LAN1 is on subnet and LAN2 is on subnet.Accessing application through LAN2 involves DNS that is located distantly, therefore routers are also in picture.Problem is that while accessing the application that run on the network of LAN2, I have to disable LAN1. Otherwise the traffic goes on LAN1.

View 2 Replies View Related

Cisco Firewall :: Cross Interface Traffic ASA5505

Mar 12, 2012

I have an ASA-5505. [code] I have an Exchange server on the network.  I need to be able to allow Active-Sync and OWA from the Guest WiFi through to the Exchange server on the network.  The Guest Wi-Fi uses external DNS so traffic is going out to the Internet and getting an IP address which is of course assigned to the Outside interface abd trying to come back in on that interface.How do I make this do what I need?  How do I setup the rules to allow this traffic?

View 2 Replies View Related

Cisco Routers :: RV042 No Traffic Moves In Or Out Via WAN Interface

Sep 3, 2012

I'm having some problems blocking IP blocks.  I have several blocks of IP's that I want blocked.I want to block from communicating with a server on my lan.So I make a rule in the RV042 to deny all traffic from to, source wan1, destination lan, my server's ip,As soon as I move that rule above the traffic forwarding rules I have created, no traffic moves in or out via the wan interface.  It seems to just cut off all traffic. 

View 2 Replies View Related

Cisco VPN :: To Ensure That Traffic Is Not Just Being Routed Out Of Interface 3825

May 31, 2011

I have my main branch router (3825) and two remote routers (2821's).  They are connected through leased lines that do not touch the internet.  For various security reasons I have to ensure that the traffic from the remote's are encrypted in a VPN tunnel even though it is still part of a private network.I have went ahead and created the tunnels and I can verify that they are up.  I have applied the cryptomap to the correct interfaces, etc.So the question is - How do I ensure that traffic is not just being router out of the interface from the remote sites back to the branch router with or without using the VPN tunnel?  I've taken down the tunnels and of course, the traffic is still being passed back and fourth.

View 1 Replies View Related

Cisco :: 2028 WLC Management Interface / Unexpected Traffic

Apr 16, 2012

I have a number of WLCs/WiSM2 running (still using WCS for management). The management interfaces for the controllers are on a purely private subnet. While going through the intenet edge ASA logs I noticed some traffic drops for the controllers on the Inside interface. I took a packet capture from the controllers and found that they were sending TCP traffic to a number of IP addresses (Microsoft, Hotmail and Google) - always with a src port 2028 (submitserver) with the ACK/FIN flags set. Why this traffic is coming from the management interfaces? The management interface is not used by any wireless clients and is not the default interface for any of the SSIDs.

View 4 Replies View Related

Cisco :: WLC Management Interface Unexpected Traffic 2028

May 22, 2013

I have a number of WLCs/WiSM2 running (still using WCS for management). The management interfaces for the controllers are on a purely private subnet. While going through the intenet edge ASA logs I noticed some traffic drops for the controllers on the Inside interface. I took a packet capture from the controllers and found that they were sending TCP traffic to a number of IP addresses (Microsoft, Hotmail and Google) - always with a src port 2028 (submitserver) with the ACK/FIN flags set.

View 2 Replies View Related

Cisco WAN :: 2911 Not Passing LAN Traffic To Public Interface

Sep 23, 2011

We have a 2911 Router running 15.0(1)M4. G 0/0 is our LAN interface, and it has three subinterfacesG0/0.1 is our data LAN, and the gateway for our Windows machines.  This is the interface this question concerns.G0/0.23 is a separate LAN for various equipmentG0/0.192 is another LAN for equipmentG 0/1 is connected to the internet, and has a public address.S 0/0/0 is a T1 PPP, connected to our core data centerS 0/1/0 is a backup T1 PPP, again, connected to our core data center.There are three static routes entered:ip route 100 This is the first PPPip route 200 This is the secondary PPPip route 255 It currently has a cost of 255 while i figure this one out. represents the cable company gateway, which I can ping properly.  I've also used "gigabitethernet 0/1" in place of the next hop ip with the same results. The public interface is properly connected, and can ping it's next hop (the cable company gateway).  When I change the static route for gigabitethernet 0/1 to a cost of "0", the router can properly ping DNS names, such as through the public interface. 
However, devices on the data LAN cannot reach any public addresses except for the router's public interface, let alone DNS names (I am using as my test IP).  If I revert the cost back to 255, making the PPP the gateway of last resort, these devices can again connect. (they travel through the PPP to our Data center's internet) 
This confuses me.  If our server, on the same LAN as the router can ping the public interface (it's definitley not leaving the 2911, as latency is less than 1ms), and the router itself can ping outside addresses, what is preventing the router's public interface from passing traffic to the internet from any source other than itself?  I have attached our running config in the hopes that there is something obvious I'm missing (the public ip addresses have been changed so they are not exposed).  I simply want clients on our LAN to get to the internet via the public interface of the local router, and still connect to corporate resources using the PPP links. MAS_2911#sho run

Building configuration... 
Current configuration : 5666 bytes
! Last configuration change at 01:47:50 eastern Sat Sep 24 2011 by redacted


View 6 Replies View Related

Cisco WAN :: 3825 Router Interface Does Not Pass Traffic

Mar 7, 2012

we have a Cisco 3825 router which does not work well with a DSL  modem(ISP provided). I have configured the Gi0/0 port of the router to  plug into this DSL modem but it does not ping to the ISP gateway. If we  do a shut/no shut on the interface then it work fine for about 30 secs.  Sometimes even for 1 hr. Then the packets drop and we cannot pass any  traffic through this interface.
Now, if the ISP connection is terminated on a computer it works fine. It works fine without dropping any packet.I  have tried various options like using a straight/cross cable. I have  tried to configure the interface negotiation for 100/full, 100/half,  auto/auto and almost all the options.I have also tried to interconnect the devices using a L2 device like a HUB. Nothing works.

View 5 Replies View Related

Cisco WAN :: Too Much Traffic On Interface - Link L2 Between SW4500 And SW6500

May 22, 2013

LINK L2, Between SW4500 and SW6500.
I have experience too much traffic between the link L2 (Fastethernet - GigabitEthernet),, 90%.  What can I do to fix that, any command? rate-limit or something?
Here is some outputs of the interfaces:
FastEthernet2/30 is up, line protocol is up (connected)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 247/255, rxload 27/255
Encapsulation ARPA, loopback not set


View 1 Replies View Related

Cisco VPN :: 5520 - Traffic Enters One Interface And Forwards To Another

Apr 19, 2013

I am building a new VPN Anyconnect solution. I want the traffic to enter a interface and that traffic should be forwarded to my "VPN-Machine".
The system is a ASA5520 with old software, I am not at work now so i cannot tell exactly.
So my question is, how do i make the traffic enter one interface and being forwarded to another? I have splitted the physical interface to several sub-interfaces.

View 5 Replies View Related

Copyrights 2005-15, All rights reserved