Cisco Firewall :: Cannot Ping To Inside Hosts From ASA-8.2

Jun 8, 2013

I am struggling to get successfull pings beween asa and inside hosts but couldn't succeed. Done packet tracer result is acl-drop
 
Here is the running config
 
Prem-ASA(config)# sh run
: Saved
:

[Code].....

View 7 Replies


ADVERTISEMENT

Cisco WAN :: ASA 8.4 Can't Ping External Hosts From Inside

Jun 9, 2011

DNS resolution works and I can surf the web without fail.  But if I try to ping any external hosts (I can ping inside interface of ASA fine) from the LAN I get timeouts.  I can ping anything from the ASA without fail.

ASA Version 8.4(1)
!
hostname fw1-nat-ann
domain-name inmd.infoblox.com
enable password anWLNen9CTFp7B/X encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names

View 1 Replies View Related

Cisco Firewall :: ASA 8.4 NAT On Outside And Inside For Certain External Hosts?

Nov 21, 2012

ASA is running 8.4.
 
Internal interface: 172.16.1.1
External interface: 172.16.2.1
 
Routing to 192.168.0.0 via internal host.I've got some static NATs, e.g:
 
object network obj-192.168.0.1
nat (inside,outside) static obj-172.16.2.1
 object network obj-192.168.0.3
nat (inside,outside) static obj-172.16.2.2
 
 I also want in internal NAT, but only for certain external hosts, so when they connect to any of the above, their source address is changed. I've attempted the following so an external host (172.16.2.254), has it's source changed to 172.16.1.100.
 
nat (outside,inside) source static obj-172.16.2.254 obj-172.16.1.100
 
But it's source remains unchanged.What am I missing?

View 3 Replies View Related

Cisco Firewall :: ASA5505 - Inside Hosts Limit

Feb 18, 2012

The ASA5505 I am working with has this from the show version:
 
Licensed features for this platform:Maximum Physical Interfaces : 8VLANs                       : 3, DMZ Restricted Inside Hosts                : 10Failover                    : Disabled VPN -DES                     : EnabledVPN-3DES-AES                : Enabled VPN Peers                   : 10WebVPN Peers                : 2Dual ISPs                   : Disabled VLAN Trunk Ports            : 0
This platform has a Base license.
 
Does the Insides Hosts  :10 line mean that only 10 devices can be connected to the firewall at one time? I would like to connect an AP to one of the PoE ports and have possibly more than 10 connected. Is this possible with this ASA5505? 

View 9 Replies View Related

Cisco Firewall :: Upgrade Inside Hosts From 10 To Unlimited On ASA5505 BUN K9

Aug 17, 2011

I want to  upgrade  "inside hosts" from 10 to unlimited on a ASA5505-BUN-K9, Do I have to buy  Security Plus license ( L-ASA5505-SEC-PL =)  ) before activating ASA5505-SW-10-UL ?

View 3 Replies View Related

Cisco Firewall :: ASA5505 - Outlook Access For Inside Hosts

Apr 25, 2011

I am using ASA 5505 firewall with base-license. I connected my firewall to one cisco 3750 switch where i created 5 vlans. I done NATing for all vlans and they able to get internet and working fine. They able to  browse all internet sites like gmail and yahoo mail.
 
All internal users are configured to use Outlook for their webmail. Here the problem is with outlook they are unable to send and receive the mails.
 
If they directly connected their system using public ip( Directly from ISP) they able to send and receive mails from outlook.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 - Should SSH Sessions From Inside To DMZ Hosts Survive

May 22, 2011

This is an issue I'm currently exploring with TAC, but I'd like a quick reality check. We have a pair of ASA 5510s in Active/Standby stateful failover mode. In some tests failing over from the active to the standby system breaks SSH connections from hosts on our Inside to hosts on our DMZs.
 
A specific example is our backup server on Inside which is connecting to our mail server in the DMZ2, and running ssh/rsync/scp for the backups. A running backup job fails with network timeout errors when I trigger the failover. Also, sometimes the mail server loses or hangs on its connection to our LDAP server in DMZ1, although sometimes this connection is fine (DMZ2 is more "inside" than DMZ1, and I assume the LDAP look ups are many short connections, vs the rsync backup being one long connection).
 
TAC has suggested that open SSH sesions will always fail when the ASAs failover. I believe this is true for management connections to the ASA, but I don't see why it should be the case for an SSH session through the ASA to a server in the DMZ. TAC has suggested that I open some connections to servers in the DMZ and test what happens, and I can do so this Wednesday morning during a maintenance window.But, in general, is this true? That is, given an SSH session from a workstation to a server, should a failover break it? If so, why?
 
The setup is:
 
MyWorkStation-INSIDE -> CoreSwitch (vlan 10) -> [ ASA-INSIDE - - (ASA-internal-connection) - - ASA-DMZ ] -> CoreSwitch (vlan 3) -> TargetServer
 
That is, all our inside VLANs are routed by our core L2/3 switch to a VLAN that connects to the Primary and Secondary ASA's INSIDE ports. There are also seperate VLANS on the core for the ASA's DMZ1 and DMZ2 connections, which go to both ASAs and to any servers in these zones.
 
The description of the ASA Stateful failover [URL]says: "The state information passed to the standby unit includes these:
 
· The NAT translation table
· The TCP connection states
· The UDP connection states
· The ARP table
· The Layer 2 bridge table (when it runs in the transparent firewall mode)
· The HTTP connection states (if HTTP replication is enabled)
· The ISAKMP and IPSec SA table
· The GTP PDP connection database

[code]....
 
I'm not quite sure what the ISAKMP and IPSec SA tables do, but shouldn't an SSH connection through the ASA be just a TCP connection? "For us, SSH from Inside to hosts in the DMZ survives failover," or, "Yah, failover breaks all SSH sessions."

View 2 Replies View Related

Cisco Firewall :: Inside Hosts Cannot Connect To Internet Through ASA 5510

Dec 4, 2011

I have an ASA 5510 which i've configured for internet access.I can connect to the internet from the ASA box,I can ping public networks from the console of the ASA box,but cannot access public hosts from internal hosts connecting via the ASA box.Find my config below to know what i ahave omitted or committed.
 
[code]...

View 5 Replies View Related

Cisco Firewall :: ASA 5505 8.4(1) - Map Multiple Inside Hosts Ports To One Public IP?

Jun 22, 2011

I'm stuck at asa 5505 nat, port forwarding configuration Here is what i need:

host1: 192.168.1.1 service tcp/100 >>>>> public ip 1.1.1.1 service tcp/100
host2: 192.168.1.2 service tcp/200 >>>>> public ip 1.1.1.1 service tcp/200
host3: 192.168.1.3 service tcp/300 >>>>> public ip 1.1.1.1 service tcp/300
 
So people from remote just need to use 1.1.1.1 public ip to access all the ports on three different inside server.I can do this on my old ASA 5505 with 8.0(4). Looks like there're lots of change from 8.0 to 8.4.

View 7 Replies View Related

Cisco Firewall :: ASA 5505 - Increase Inside Hosts License Count?

Feb 14, 2012

At the end of the day I simply need to upgrade the license on my ASA 5505 v7.2.4 (upgrade will come later as part of a larger project) to allow for >10 Inside Hosts. From what I've read there seems to be a 50 license upgrade out there. Can this be purchased directly? From whom? Will it only affect the Inside Hosts number and not affect any other licenses, configurations, etc. Just being overly cautious since this is way outside of my normal realm. Below is the current activation-key information....
 
Result of the command: "show activation-key"
  
Serial Number:  xxxxxxxxxxxxxx
Running Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
Licensed features for this platform:
Maximum Physical Interfaces : 8        
VLANs                       : 3, DMZ Restricted
Inside Hosts                : 10       
Failover                    : Disabled
VPN-DES                     : Enabled  
VPN-3DES-AES                : Enabled  
VPN Peers                   : 10       
WebVPN Peers                : 2        
Dual ISPs                   : Disabled 
VLAN Trunk Ports            : 0        
  
This platform has a Base license. 
 
The flash activation key is the SAME as the running key.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 - Cannot Ping Local Traffic And Hosts

Jul 24, 2012

I have, what I believe to be, a simple issue - I must be missing something. Site to Site VPN with Cisco ASA's. VPN is up, and remote hosts can ping the inside int of ASA (10.51.253.209). There is a PC (10.51.253.210) plugged into e0/1.

I know the PC is configured correctly with Windows firewall tuned off. The PC cannot get to the ouside world, and the ASA cannot ping 10.51.253.210.

I have seen this before, and I deleted VLAN 1, recreated it, and I could ping the local host without issue. Basically, the VPN is up and running but PC 10.51.253.210 cannot get out

ASA Version 7.2(4)
!
hostname *****
domain-name *****
enable password N7FecZuSHJlVZC2P encrypted
[Code]...

View 2 Replies View Related

Cisco Firewall :: ASA5510 - Unable To Ping From User Desktop To Firewall Inside IP

Jun 11, 2012

I am able to ping from Switch to firewall inside ip and user desktop ip but unable to ping from user desktop to  FW Inside ip.. config is below for both switch and FW Cisco ASA5510....
 
TechCore-SW#ping 172.22.15.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.22.15.10, timeout is 2 seconds:

[Code].....

View 7 Replies View Related

Cisco Firewall :: ASA5505 Can't Ping New Firewall On Inside Interface

Jul 14, 2011

I've recently upgraded my old firewall from a PIX to an ASA5505 and have been trying to match up the configuration settings to no avail. I have is that I can't ping the new firewall on it's inside interface, despite having "icmp permit any inside" in the running config. Secondly, the server I have on there ("Sar") can't connect out to the internet.I've included the ASA's running config incase anybody can see if something stands out. I have a feeling it's either not letting anything onto the inside interface, or there is no nat going on. Lastly (and possibly relevant), the firewall is actually going at the end of a vlan, which is different to the firewall's inside vlan number. I don't know if this is actually the problem because the server can't connect out even if connected directly into the firewall.

View 32 Replies View Related

Cisco Firewall :: ASA5510 Cannot PING From Inside To Outside

Jul 1, 2012

I cannot seem to determine exacly why I am not able to ping from the inside to outside using the standard 100/0 security levels respectively. I am dynamic natting the inside to the outside interface, something I don't usually do but cannot see why ICMP's are not passing through.
 
The Packet trace tool says there is something in the ACL but there really isn't.
 
Is there simply an issue of Natting to the WAN interface on a 5510?

View 10 Replies View Related

Cisco Firewall :: ASA 5505 Ping Inside To Outside Don't Go

Sep 29, 2012

I have 2 ASA and would like to build a Side-to-Side VPN between these ASA. So I can learn something about configure a ASA for different thinks. But now I don`t can Ping from a Client to the Internet-Router.My Configuration is:
 
Client IP 192.168.1.100 <===> ASA Inside 192.168.1.1 /Outside 192.168.178.254 <===> Router 192.168.178.1
 
Is there something wrong at my config? or do I need inside private Adresses and at the Outside Global IP`s.
 
At the Router I have a Static Route that the 192.168.1.0 / 24 ist to find over Gateway 192.168.178.254

View 2 Replies View Related

Cisco Firewall :: New ASA 5505 / Can't Ping Inside Interface

May 10, 2011

I have a new ASA 5505 and all is working fine, I can CLI and ASDM into it, but just can't ping the inside interface, do I need to enable a feature to make this work somehow?

View 1 Replies View Related

Cisco Firewall :: ASA5505 - Can't Ping Inside Host

Sep 29, 2012

I just try to ping a internal Host but it want to go.
 
Laptop<===>ASA5505
 
Connected is the Laptop at Ethernet 0/2 Inside
 
My running-config is a clear config, only VLAN 1 has a IP and Ethernet 0/2 is up.
 
But If I try to ping to the Laptop I get the followed:
 
asa5505# ping 192.168.1.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
asa5505#
 
From the Laptop to the ASA5505 I can Ping successfully.

View 6 Replies View Related

Cisco Firewall :: ASA5510 - Cannot Ping Inside Over VPN After Upgrade

Jan 16, 2012

We currently have a central hub using an ASA5510 and then a few site-to-site VPN connections to our support staff homes. The devices at the homes are Cisco routers. We were running version 8.25 on the ASA and all was working fine. We recently upgraded to version 8.42 and although all the functionality of the network is ok and it does what it should, our support staff cannot ping, ASDM or telnet to the ASA inside interface anymore whereas they could before the upgrade. The home VPNs all run on a 10.30 subnet (i.e. 10.30.1.x, 10.30.2.x etc etc). I can post our config (security edited of course), but it is quite a big config. The command management-access inside is specified and the 10.30.0.0/16 subnet is permitted to ASDM and Telnet. Are there any extra things that have to be done in version 8.42 to get this to work as the support staff do have to access the firewall for configuration purposes. At the moment, they have to telnet to one of the routers on the local LAN and then Telnet to the firewall from there.Prior to the upgrade, they were all able to ping the inside ASA interface and also telnet and HTTPS to it from their PCs at home. Now they cannot and the only change made was an upgrade to 8.42. Immediately after the upgrade none of them can ping the interface anymore and it seems it can only be accessed from the local LAN. I cannot find any access-lists that might be blocking the packets so can only assume it's something in the way 8.42 works.

View 8 Replies View Related

Cisco Firewall :: PIX 515E Unable To Ping Outside From Inside

Dec 1, 2012

I' d like to have some support for a very-basic PIX firewall configuration. I 'm dealing with  PIX 515E. Inside hosts can ping inside interface , outside hosts outside interface and so on. Simply i cannot ping outside interface from inside hosts, Inside host-192.168.1.0

Outside - any host like google.com, or to check my isp link's dns ip. I have attached the pix configuration text file to test.

View 10 Replies View Related

Cisco Firewall :: Allow Ping From Inside To Outside In 2900 Router?

Apr 7, 2013

I have a Cisco router 2900 with firewall, i need to know how can i allow the ping from self zone to outside zone, i trried to create policy from self to outside but i still didn't allow ping or tracert, i get that message when i try to ping from cisco router: "Unrecognized host or address, or protocol not running"

View 3 Replies View Related

Cisco Firewall :: Can't Ping ASA 5510 Inside Interface

Apr 13, 2013

I  ran into a very strange icmp ping issue. The network has been working fine other than the issue listed below, L2L VPN works fine and all three data centers can access each other via L2L VPN.I have three ASA5510. [code]

View 5 Replies View Related

Cisco Firewall :: ASA5505 Cannot Ping Inside Host

Aug 2, 2011

I have Cisco ASA 5505  installed  and use as default gateway. I go to Internet through the ASA5505 Here is my Problem.I can not ping from ASA prompt(ASA#) to my Laptop connected to the ASA, but i can ping the ASA inside interface from laptop i can not use ASDM  and the VPN Tunnel is not working between the sie
  
ASA# ping 10.10.10.12
???????????
100% lost 
Laptop c
C:/ping 10.10.10.1
!!!!!!!!!!!!!!!!
 
Here is the Topology
 
INTERNET .<=========================>ASA<===============================> LAPTOP
  
I disabled window firewall on the Laptop , but no goof result.

View 3 Replies View Related

Cisco Firewall :: ASA 5540 Want To Ping Across Inside To Outside For Testing

Sep 27, 2012

ASA 5540 8.2 (5)I have tried many combinations of command line syntax suggested in this forum but none are providing success so far.
 
I want to ping from the Inside Interface across to the Outside Interface and visa versa.I have tried various ACLs as well as "inspect icmp" in the config, etc still no go.
 
I can ping each interface from the console command line but cannot ping across each interface. [code]

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - PING From Outside Into Inside Host

May 13, 2013

I have ASA 5520. I cannot ping the host(192.168.1.20) which is inside firewall from outside hosts. Inside host (192.168.1.20) is translated into (198.24.210.226) using static NAT.From outside host, I used "PING 198.24.210.226".  Is it because I used dynamic PAT for inside hosts?

interface GigabitEthernet0/0nameif outsidesecurity-level 0ip address 198.24.210.230 255.255.255.248!interface GigabitEthernet0/1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0

[Code].....

View 3 Replies View Related

Cisco Firewall :: 5505 - Can't Ping ASA Inside Interface

Dec 12, 2011

I have an ASA 5505 that I'm trying to set up a guest network on.  I've configured an interface as a trunk and allowed the 2 vlans but I'm not getting any layer 3 to it.  The switch connected to it is a 3560 and port is configured as a trunk with the same vlans.
 
I can't ping the ASA inside interface but I see its MAC address in the swtich's table.
 
[code]....

View 4 Replies View Related

Cisco Firewall :: Cannot Ssh Or Ping ASA 5510 From Inside Interface

Apr 4, 2012

The ASA is configured in very simple transparent mode. As desired, traffic can flow in each direction between inside and outside. I can manage the ASA via console and direct connection to the management interface. The problem is that I cannot ping or ssh to the ASA via the inside interface. I need to be able to manage the ASA from any PC on the inside LAN. I suspect I am missing some easy aspect of the configuration but after a lot of hours I'm about at the end of my patience with it. Here is what I believe to be the relevant parts of the config. 
 
ASA Version 8.2(1)
!
firewall transparent
hostname issr1
enable password 2alej83t5cqT0FWd encrypted
passwd 4kleUY438I93.4ljdh encrypted
names

[code]....

View 4 Replies View Related

Cisco VPN :: ASA 8.4 Cannot Reach VPN Clients From Inside Hosts

Jun 18, 2012

I am able to reach VPN clients (Anyconnect) only from hosts directly connected to the ASA's inside interface subnet. However, hosts on other internal subnets (177.1.10.0 & 177.1.11.0) are unable to connect to clients on VPN. The ASA is running ver 8.4. [code]

View 8 Replies View Related

Cisco VPN :: ISR 891 - Unable To Connect To Inside Hosts

Sep 27, 2011

I am able to  connect to my Cisco ISR 891 via VPN with the Cisco VPN Client 5.0.07.0440, but once connected I cannot access hosts on the inside. If I ping a host on the inside by name, nothing resolves. If I ping by IP, I get a reply from the public IP of the router. [code]

View 2 Replies View Related

Cisco Firewall :: ASA 5505 / Cannot Access Internet Or Ping From Inside Interface?

Jul 26, 2011

I am having a problem configuring my ASA 5505 for NAT.

View 3 Replies View Related

Cisco Firewall :: 2800 Routers / ASA 5510 Cannot Ping Via Route Inside?

Mar 3, 2013

I recently added a business cable modem to relieve some of the congestion I was getting on my T1 for our MPLS network.  There was an ASA 5510 collecting dust in a closet here and I thought it would be the perfect device for firewalling the traffic coming in from the Cable modem, and handling the routing of our internal MPLS traffic as well.  Internet setup was cake.  The test laptop I have using the ASA as it's gateway has great internet service but it cannot ping across either of our MPLS networks.  I have one MPLS with AT&T and one MPLS with EarthLink.  My hope was to use the cable modem as the Default route for all unspecified internet traffic and route our internal MPLS traffic to the cisco 2800 routers that are currently in place for the MPLS.  I can ping across the MPLS when I telnet to the ASA, but I cannot ping across the MPLS from the client that is connected to the ASA.
 
Here's the topology I'm working with
 
Internet
|
Cable Modem
|
ASA 5510 10.52.120.23

[Code].....

View 8 Replies View Related

Cisco Firewall :: Unable To Ping Inter Interface (inside To Outside) Of ASA 5520

Jul 26, 2011

I am unable to ping inside interface (Rin) to outside interface (Rout) of my Cisco ASA 5520 runing on ASA Version 8.4(1). 
 
ASA Version 8.4(1)
!
hostname FW5520

[Code].....

View 10 Replies View Related

Cisco Firewall :: Unable To Ping Host From Inside Interface From PIX525

Feb 3, 2012

When I tried to upgrading PIX525  6.3 to  7.0 , Not able to Ping the host from the PIX 525 Inside interface  which is on the same subnet,  Also from the host to Inside Interface ,  Tried with Directly connected  laptop with Cross cable and using Straight cable via switch, But the  results end with fail.

View 2 Replies View Related

Cisco WAN :: 2811 - Cannot Ping Inside Global IP From Inside Network

Dec 18, 2010

I have 2 questions.Om my cisco 2811 (IOS 12.4(15) T9 IPBASE W/O Crypto) i am using 3 interfaces.And i have a pool of Global addresses: 200.x.z.97-200.x.z.126 255.255.255.0
 
FastEthernet 0/1 description WAN interfaceip nat outsideip address 200.x.y.253 255.255.255.0
 
GigabitInterface 0/2/0description DMZ interfaceip nat insideip address 10.0.0.1 255.255.255.0
 
GigabitInterface 0/3/0description LAN interfaceip nat insideip address 192.168.0.251 255.255.255.0
[Code]....

View 8 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved