Cisco WAN :: Setting Up ASA 5505 Behind 5510?

Aug 14, 2011

My company has leased some office space to an outside company that handed me a 5505 and said "We want to VPN to our HQ through your Internet". I have two issues: I need this to work and I need to be able to access the 5505 from the management network. I don't care about the VPN aspect as much as making sure that I have basic communication down. I have everything configured per the diagram, but I can't ping the 5505 outside (Vlan 2) interface. I want to be able to configure and test the VPN setup on the 5505 from Putty on my PC.
 
The default route on the 5520 sends traffic to 10.10.1.1 and the default route on the 5510 sends traffic to the WAN interface. I added this route on the 5510:
 
outside 10.94.4.0 255.255.255.0 10.10.8.1
 
I still can't ping the default gateway on the 5505. There is a switch between my PC and the 5520 but the default route passes the traffic to the 5520. However on my tracert I don't even get to the 5520. What's going on here? Do I have to add a route to the switch just to manage the ASA 5505?

View 30 Replies


ADVERTISEMENT

Cisco VPN :: Setting Up VPN Through 2 ASA 5510 Firewalls

Jan 10, 2012

'm trying to set up a vpn connection through two ASA 5510 firewalls.My network is as follows:
 
PC | FW A | Internet |FW B| - lan |
 
I am trying to achieve the following:
 
PC | FW A | Internet |FW B| - | DMZ | - | FW C| - | lan |
 
However, I am not sure where the VPNs will need to terminate and how I will achieve this taking into account the WAN IPs.

View 1 Replies View Related

Cisco VPN :: 5510 - Setting Up Second VPN Connection

May 3, 2011

I have multiple offices that I want to vpn into one office....  So is there anything special I have to do to establish this....Or can i do the same set up for one office then copy those setting to the next office?

Office 1 - main office .........asa 5510......ip 111.111.111.111
Office 2 - remote office......asa 5505......ip  222.222.222.222
Office 3 - remote office......asa 5505......ip 333.3333.333.333

I want office 2 and 3 to be able to vpn into office 1.
 
Currently I have already set up the vpn connection for office 2 to office 1.  Everything works well with that so I know it is good! So could I basicly copy those setting to office 3?  Or is there some weird settings or anything I should do or avoid by now setting out office 3 to vpn into office 1??

View 2 Replies View Related

Cisco Firewall :: Setting Up DMZ On ASA 5505?

Nov 14, 2011

I am trying to set up a DMZ on my Cisco ASA 5505, so that the wireless clients are connected behind the DMZ, the LAN clients are connected behind the inside interface and both groups of clients can get to the Internet.  I have been able to configure the ASA for both wireless and LAN, but the wireless clients still cannot get to the Internet.  The LAN clients can get to the Internet.  I do not want the wireless clients and the LAN clients to be able to be able to communicate with each other. What commands do I need to run in order to allow the wireless clients to access the Internet? 

View 11 Replies View Related

Cisco :: ASA 5505 - Setting A VPN Connection

Apr 4, 2011

I am wondering if this Cisco ASA 5505 Box is overkill for what I need?I have just become network admin to a small office that host two domains.

[code]...

Some of the clients are requesting a connection to the office from remote locations for file access and what not. So would implementing a Cisco ASA 5505 be overkill? I am a bit nervous of going forward as I have never had to "setup" an ASA box and dont want to kill the network.If I should NOT use this box, what should I use for a VPN connection?

View 6 Replies View Related

Cisco WAN :: Setting Up Routes On ASA 5505?

Dec 12, 2012

I'm trying to set up a Cisco ASA 5505. I'm mainly setting things up through ASDM but I also have console access. Right now while I'm setting it up I have the outside/Vlan2 port attached to my existing network and a laptop connected to the inside/Vlan1 port. More info about that:
 
interface Vlan1
nameif inside
security-level 100

[Code]....

Before I added that last "0.0.0.0" entry, the ASA would not see anything on the internet. Now I can ping any external IP address from the router's console. However, the laptop I have connected to the 'inside' port still cannot reach any IP address outside the 10.10.153.0 network. Every time I try to add a similar route for the 'inside' interface, I get the following error: "You have another route configured for this network any which has same gateway 10.10.152.1 and same metric 1. You cannot add a duplicate route." I know I'm misunderstanding something here. In order to make devices connected to the 'inside' port connect to the internet, I need to set up a new route that will direct these devices to 10.10.152.1, right?

View 9 Replies View Related

Setting Up ASA 5505 - Dual WAN

Oct 18, 2011

I have a ASA 5500 with Sec+ ?Is it possible to have Dual WAN, one WAN is used for default traffic and WAN2 would be strictly for VPN tunnels?

View 4 Replies View Related

Cisco :: Setting Up DHCP For VPN Clients On ASA 5510?

Jun 30, 2011

I'm trying to understand my options for assigning addresses to VPN clients on an ASA 5510. Under the ASDM, I have a field for DHCP servers, radio buttons: none, dhcp link, dhcp subnet, and field: client address pools. Cisco's VPN examples demonstrate setting up a client address pool, which I did, but the VPN client isn't assigned a gateway in the process so it can't connect to anything; I really don't understand the point of this. I'd like to create a DHCP pool on the ASA for VPN clients as this seems to be the standard configuration. However, I don't know where in the ASDM to configure this and how it's applied. The only DHCP options I found involved creating a DHCP server on an interface, which I don't want to do since VPN users aren't on a physical interface, right?

View 6 Replies View Related

Cisco VPN :: Setting Up Two Separate 5510 At Two Different Locations

Nov 1, 2011

I'm setting up two separate 5510's at two seperate locations. The client wants two seperate SSL-VPN's; one for the HQ and one for the COLO location. They have a single domain for which I have added a-records to point to the corrosponding ASA's thusly: [code]
 
My questions is this: do i need to buy seperate certificates for each ASA/fqdn/IP combo? I'm using godaddy to buy the certs. If I do need to buy seperate certs, that makes the installation easier, but may waste $$. If I only need to buy one cert, how do I set it up so that both combo's are verified?

View 2 Replies View Related

Cisco Firewall :: VPN Setting Keep Dropping On ASA 5510?

Jan 23, 2012

I have a Cisco ASA 5510 firewall, my problem is that when the first VPN connections is established everything is good.  But when that connections is cancel or terminated due to non connectivity.  No one can connect to that firewall through that VPN unless that firewall is restarted.

View 1 Replies View Related

Cisco Firewall :: Setting Up ASA 5510 Cannot Get SMTP To Come In

Mar 21, 2013

I have a ASA 5510 (ver 8.4) and I have been all over the support sites looking for what I am doing wrong. I have a sanitized cut n paste of the OBJECT, NAT, ACCESS-LIST and Packet Tracer output and it keeps failing on the NAT with a rpf-check. Once i get the SMTP flowing I have to open up HTTP and HTTPS to one of the servers also.
 
Here it is:
  
RVGW# sh run object
object network WiFi
subnet 172.17.100.0 255.255.255.0

[Code]......

View 1 Replies View Related

Cisco VPN :: Setting Up L2TP / IPsec VPN To ASA 5510

Jun 23, 2011

Co-worker just got a Blackberry Playbook tablet and, try as I might, we cannot get the darn thing to successfully set up a working IPSEC/L2TP vpn tunnel to our ASA 5510, which acts as a multi-purpose VPN concentrator.  Any luck setting up L2TP/IPSEC VPN to ASA from Blackberry Playbook?

View 0 Replies View Related

Cisco VPN :: Setting Up 5505 VPN For Windows 7 Client

Feb 16, 2013

I have a client that has a 5505 installed. They want to VPN in with their Win7 laptop, but they don't want to shell out $1000 for the 10-pack Cisco VPN client.I have successfully setup the clientless VPN, and they can, through a browser, get to their files, but they'd like to map network drives so it's just like they're in the office.I tried setting the IP Sec up on the 5505, and then using  the built-in Win7 VPN network connection, but no go.I also do everything through the ASDM, but I realize some things cannot be done. I'd prefer to use the ASDM!Anyone else get this configured? 99% of what I see out here is how to connect the 5505 for site-to-site VPN.

View 4 Replies View Related

Cisco Firewall :: Setting Up Port Forwarding ASA 5505

Mar 15, 2012

We are trying to setup our ASA 5505 to do port forwarding to multiple internal servers and have run into some issues. A little background on what we are trying to do.
 
We have 1 static external IP. Internally we have one exsisting server (10.1.1.184) that has port 80 forwarded to it and another exsisting server (10.1.1.185) that has port 443 forwarded to it. Both of these servers are serving seperate web apps to our employees who of course use them offsite. We have now added an additional server (10.1.1.186) that needs to use both ports 80 and 443. Is there any way to set it up so that these ports can be forwarded to all the servers that need them? Also, how would this work as far knowing what traffic will need to go to which server even though it is using the same port?
 
The equipment is: ASA 5505ASA Version 7.2(4)ASDM Version 5.2(4)   I appologize in advance if what I'm trying to do is difficult/impossible. I inherted the ASA 5505 at this location and I was not here when it was initially installed. In fact no one on staff was here when it was initially installed. I did manage to find the passwords to it though. I'm not at all familiar with the ASA 5505 or Cisco secuirty appliances in general.

View 19 Replies View Related

Cisco Firewall :: ASA 5505 - Setting Up 2 LAN Networks And 2 WAN Connections?

May 16, 2013

I have an ASA 5505 with Security Bundle license.
 
I am able to create 2 LAN networks (192.168.9.0 and 172.16.9.0) Vlan1 and Vlan12 respectively. I also setup 2 outside interfaces (outside1 and outside2).
 
Network 1 (192.168.9.0 - VLAN1) has no issues going out via Outside1, however I can't get Network 2 (172.16.9.0 - VLAN 12) to go thru outside2.
 
I put in a static route (route outside 172.16.9.0 255.255.255.0 x.x.x.x), the x.x.x.x is the default gateway of my ISP.                  

View 7 Replies View Related

Cisco Firewall :: Setting Up New ASA 5505 Into Existing Network?

Mar 21, 2013

I am having a problem trying to figure out how to add a new ASA 5505 to an existing network.  My current network is:Cable Modem  >  Linksys  >  48 port switch With multiple hosts residing on the 192.168.0.x network.Now i know that the ASA comes default with 192.168.1.1 on the inside interface and i want to change that to 192.168.0.1.  I have tried to do this thru ASDM using the wizard and manually.  Once i hit ok for it to write the config, it gives me an error that it didnt take.  I then lose connection to the ASA and have to hard boot it to get it back.I am trying to do this without my external connection connected and i have a laptop connected to the ASA on port 0/2 with an IP address of 192.168.1.75.Do i need to connect my internet connection to it first and then run the wizard?  I was hoping to get it configured for my existing network before i plugged in the internet connection to limit my downtime.This ASA came with 6.4.1 ASDM and 8.2 OS installed.  i was able to upgrade the ASDM to 7.X but when i go to update the OS to 9.1, i get an error that i am not registered to use cryptographic software.   Dont know where i need to register to get it?

View 4 Replies View Related

Cisco Firewall :: Setting A Boot Image On ASA 5505?

May 1, 2011

I have an ASA 5505 that I was updating from frimware 8.04 to 8.41. Anyway, I went through the update procedure half-asleep and accidentally deleted the boot image right after I installed it (I used the CLI and put in the command del asa8*.bin then just hit enter a bunch of times, which of course means I deleted the old firmware too).
 
So now whenever I power up the ASA, I get the "Could not find boot file" error. Is there a guide somewhere that tells me how can upload another boot image to the ASA and set the ASA to boot it from teh ROMMON prompt?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Setting Up ACL To Permit Access Only To The Nat Subnet?

Apr 9, 2012

setting up an ACL on my ASA 5510 to permit access only to the Nat subnet from inside to the outside interface. This firewall is setup for the DR solution in the production network. I am applying following acl in the inbound direction on the inside interface.
 
permit ip any "Nat_subnet"
 
After appliying this acl to inside interface I observed that I can ping to the destinations in NAT'ed subnet but unable to ssh to the servers. Following is the summary of my configuration.

!
interface Ethernet0/0
nameif outside
security-level 0
ip address 192.168.135.241 255.255.255.248 standby 192.168.135.242

[code].....

View 3 Replies View Related

Cisco Firewall :: ASA 5510 - Setting Up SMTP Port Block?

Mar 5, 2012

how to go about setting up the ASA to block any SMTP traffic outbound except for our Exchange Server. This is in relationship to a SpamBot issue that blacklisted us. I have an ASA 5510 running version 6.2(5) / 8.2(2) with three ports. DMZ, Inside and the Outside interface. Up till today, I only needed to block outside traffic to our internal network which I used the ASDM to configure a rule on the outside interface for an incoming rule. I am assuming I need to create an outgoing rule on the outside interface; however, just to make sure I understand the terminology/traffic flow, I created the rule with my computer as the source (192.168.0.131) with ALL destination and the service as HTTP. My logic, which seems to fail here, is that any traffic from my computer going outbound would be blocked; however I am still able to browse... That said, if I were to change the source as the Exchange server and the Service Type to SMTP, it would not actually block traffic and therefore not solve our problem.  I even gone as far as permitting traffic from my computer, expanding the hit counter and I see no hits.  So I am no doubt doing this wrong. What I do know, is when I first created the rule, a second rule was automatically created (Implicit rule) that deny all sources and blocked all HTTP traffic until I changed it to Permit?

View 2 Replies View Related

Cisco Firewall :: ASA 5510 - Setting Up Active And Standby Firewalls

Oct 14, 2011

I have a 5510 ASA and have been given another an told to make them active and standby.  Basically the active one is working great but the second one has no config on it apart from the default one, but is the same firmware level.  I guess I need a crossover cable, and what happens with the inside and outside interfaces, would they need to go into a vlan on a switch, one inside vlan where the 2 firewalls inside interface go into and another vlan for the outside?  Otherwise if it failsover to the standby ASA the inside and outside interfaces wouldn't work. 

View 4 Replies View Related

Cisco Wireless :: Manually Assigning Channels And RRM Setting With WLC 5505

Mar 16, 2013

My wireless network consists mainly of approximately 1400 AP's 900 x 3602's, 500 x 3502's,The majority of these AP's especially the new ones have been manually optimised for channel and power settings. We paid an external surveyor to survey and optimise the AP's.   
 
We have a few 5505 WLC's and the channel assignment method is set to "Freeze" ,My question is, if someone invokes a channel update on a WLC, will the WLC override the original manual channel setting if the WLC thinks it should be changed?  And will the original setting be lost forever unless a restore is performed from the WLC Database?

View 5 Replies View Related

Cisco Firewall :: Unable To Authenticate With Common Setting With ASA 5510 Running 8.0

Nov 11, 2008

I have allways configured and run LDAP Server Groups authenticating to Active Directory Domain Controllers using LDAP, never an issue, until I hit a Domain Controller running on a Windows Server 2008. I have been unable to authenticate with the common setting with an ASA5510 running 8.0.1.

View 4 Replies View Related

Cisco VPN :: VPN Between 5510 And 5505 Won't Come Up

Apr 4, 2012

I'm trying to get a tunnel to come up between a 5510 and a 5505.  I currently have a vpn tunnel up and running from the 5510 to another remote site.  [code]

View 2 Replies View Related

Cisco VPN :: Configure VPN To ASA 5505 Behind ASA 5510?

Aug 14, 2011

Attached is a diagram of my network. My company has leased some office space to an outside company that handed me a 5505 and said "We want to VPN to our HQ through your Internet". I have two issues: I need this to work and I need to be able to access the 5505 from the management network. I don't care about the VPN aspect as much as making sure that I have basic communication down. I have everything configured per the diagram, but I can't ping the 5505 outside (Vlan 2) interface. I want to be able to configure and test the VPN setup on the 5505 from Putty on my PC.

The default route on the 5520 sends traffic to 10.10.1.1 and the default route on the 5510 sends traffic to the WAN interface. I added this route on the 5510:

outside 10.94.4.0 255.255.255.0 10.10.8.1

I still can't ping the default gateway on the 5505. There is a switch between my PC and the 5520 but the default route passes the traffic to the 5520. However on my tracert I don't even get to the 5520. Do I have to add a route to the switch just to manage the ASA 5505?

View 1 Replies View Related

Cisco VPN :: ASA 5510 Connection To ASA 5505?

Dec 10, 2011

i want to connect to asa 5505 (office 1) using vpn from ASA 5510(office 2)...The network guy in office 1 has asked me to setup ASA 5510 has hardware client mode.

i have the following details from office 1
host peer address of office 1 :  A.B.C.D,
phase 1 encryption : DES
phase 1 Authen : SHA
Diffie helman : group 2
Groupname : MNC
IP Schema remote site network : 170.31.0.0 255.255.0.0
password : Cisco$123
 
 In asa 5510 ,
 
ASA Version 8.2(5)!hostname CISCOASAenable password 5EpARJwwtf4VFC9S encryptedpasswd 5EpARJwwtf4VFC9S encryptednames!interface Ethernet0/0nameif outsidesecurity-level 0pppoe client vpdn group DADAip address pppoe setroute!interface Ethernet0/1nameif insidesecurity-level 100ip address 192.168.10.1 255.255.255.0!interface Ethernet0/2shutdownno nameifno security-levelno ip address!interface Ethernet0/3shutdownno nameifno security-levelno ip address!interface Management0/0nameif managementsecurity-level 100ip address 192.168.1.1 255.255.255.0management-only!ftp mode passiveaccess-list 124 extended permit esp any anypager lines 24logging asdm informationalmtu outside 1500mtu inside 1500mtu management 1500icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400global (outside) 1 interfacenat (inside) 1 0.0.0.0 0.0.0.0timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp

[code]......
 
What more i need to add to get the vpn connected with ASA 5510?

View 1 Replies View Related

Cisco WAN :: Migrating ASA 5510 To ASA 5505?

May 7, 2013

for testing purposues i wanted to exchange a running ASA 5510 with a ASA 5505. I included the running configs from both the ASA 5510 and the new configured ASA 5505.
  
On the running ASA 5510 there is:
 
one interface for WEB
static IP xx.xxx.xxx.178
route  0.0.0.0 xx.xxx.xxx.177

[Code].....

View 1 Replies View Related

Cisco VPN :: Connecting ASA 5505 With 5510?

Jun 29, 2011

i have a small asa 5505 trying to connect to a asa 5510
 
cisco-26834# sh crypto isakmp sa
   Active SA: 1    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)Total IKE SA: 1
1   IKE Peer: 216.**.**.146    Type    : user            Role    : initiator     Rekey   : no              State   : AM_CTCP_WAIT_REPLY
  
here's the full debug for the 5505 :
 
cisco-26834# Jun 30 03:35:26 [IKEv1 DEBUG]: IP = 216.**.**.146, IKE AM Initiator FSM error history (struct &0xc66a55b8)  <state>, <event>:  AM_DONE, EV_ERROR-->AM_CTCP_WAIT_REPLY, EV_CTCP_LINK_FAIL-->AM_CTCP_WAIT_REPLY, NullEvent-->AM_CTCP_INIT, EV_REQ_CTCP_LINK-->AM_START, EV_START_AM-->AM_START, EV_START_AM-->AM_START, EV_START_AM-->AM_START, EV_START_AM
Jun 30 03:35:26 [IKEv1 DEBUG]: IP = 216.**.**.146, IKE SA AM:c045cc52 terminating:  flags 0x01000021, refcnt 0, tuncnt 0
Jun 30 03:35:26 [IKEv1 DEBUG]: IP = 216.**.**.146, sending delete/delete with reason message
Jun 30 03:35:26 [IKEv1]: IP = 216.**.**.146, Error: Unable to remove IPSec/TCP entry

[code].....
 
what should i check on my 5510 ?

View 1 Replies View Related

Cisco VPN :: Migration From ASA 5505 To 5510

Jun 27, 2012

my company has the asa 5505 working as the remote access vpn server. my company needs more licenses for vpn than the asa 5505 give it. because of my company purchased the asa 5510. i must migrate configuration from the asa 5505 to the asa 5510. i exported configuration file from asa 5505. i made the changes on them and imported them in the asa 5510. my asa5510 doesn't work. i putted configuration files from asa 5505 and 5510.

View 10 Replies View Related

Cisco Firewall :: Information On ASA 5505 And 5510

May 22, 2011

I´m looking for a firewall for my company and am reading about both Cisco ASA 5505 with Security Plus bundle and Cisco ASA 5510 with Security Plus bundle and I have a few questions.This is the document i´m getting my information from.URL,It states the following:Cisco ASA 5505 Security Plus bundle,Includes Cisco ASA 5505, unlimited users, 8-port Fast Ethernet switch, stateful firewall, 25 IPsec VPN peers, 2 SSL VPN peers, stateless Active/Standby high availability, dual ISP support, DMZ support, 3DES/AES license, and 1 expansion slot.

View 5 Replies View Related

Cisco Firewall :: Upgrade From ASA 5505 8.2 To ASA 5510 9.0 (1)

Jan 24, 2013

I am trying to find out the best path to upgrade to two ASA 5510 running 9.0 (1).  I know there are changes in the new version. Let me know what information you need and i will post.

View 2 Replies View Related

Cisco VPN :: No Traffic Over Tunnel Between ASA 5505 And 5510

Dec 5, 2010

I've a asa 5510 on the main site and different ASA 5505 on secundary sites for VPN tunneling between the sites. The problem is that the tunnels are acomplished but no traffic is going over them. What am i doing wrong? For the moment there is a ASA 5505 on the main site managing the tunnels but I want the 5510 to take over the job.

View 5 Replies View Related

Cisco Firewall :: Traceroute Between Two ASA 5505 And 5510

Oct 15, 2012

We have a ASA 5505 and a 5510, that we are using site to site..I need to traceroute from the 5505-5510.. From the outside interfaces.. Don't want to do this through the site-to-site.I have temporarily added a few acl on the outside interfaces..
 
-access-list outside_in extended permit icmp any any unreachable
-access-list outside_in extended permit icmp any any time-exceeded
-access-list outside_in extended permit icmp any any echo-reply
 
 when i traceroute it only goes one hop.. Maybe thats the way it suppose to be? I need to know all the hops between the outside interfaces on the 5505 to the outside interface on the 5510.

View 1 Replies View Related

Cisco Firewall :: How To Configure ASA 5505 And 5510

Mar 18, 2012

I am absolutely new in the enterprise firewall world but I would like to start learning how to configure ASA 5505 and 5510. I did some research myself and I found that the material or the topic itself is a huge adventure (lots to read and understand). My company uses IOS versions until 8.2 due to the differences in the NAT-ting rules with 8.3 and 8.4.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved