4
votes
4answers
626 views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
0
votes
0answers
35 views

Cisco 881W Zone Base Firewall

I cannot ping an Internal system to a DMZ system. I have checked the policy map session and everything time I do a ping the match shows the first ping was matched but none of the other pings were ...
0
votes
1answer
48 views

netscreen sn25 vs cisco asa5505 speed

Current i have 2 server direct connect to 1 juniper netscreen sn25 firewall then go to internet, the intel 350 nic is setup at 100mbps (which should be able go up to 1000mbps). the problem is this ...
1
vote
0answers
117 views

Cisco ASA 5510 multiple vlans on same interface with different security levels and routing between

Looking to setup on my 0/3 interface multiple vlans and looking to get confirmation that this will work. Ethernet 0/3.1 security-level 20 nameif dev-dmz vlan 502 ip address 172.20.2.1 ...
0
votes
1answer
38 views

cisco firewall access rules for intra-subnet traffic

I have a Cisco 5505 in our office, and everything is on the 10.0.1.0 network. We have a cheap wireless router that we would like to use. The router is sitting behind the inside interface, and is ...
-1
votes
1answer
115 views

blocking all countries except 4 at vlan level, will cisco asa 5505 hold?

First our server hold an application that only serve 4 countries. We had a repeated ddos from bonnet so would like to block all traffic except for the 4 countries that the application serve. the idea ...
0
votes
2answers
54 views

Open HTTP Protocol Cisco ASA

I would like to know if it's possible to open HTTP protocol (whatever the port) for one of my subnet to the outside on Cisco ASA 5510 v9.1(4) (ASDM v7.1(5)? I guess I will have to play with service ...
0
votes
0answers
22 views

VPN User ACL not working

i´m currently testing a Cisco 886VA router for VPN usage. First off here is my client config group: crypto isakmp client configuration group VPN_PRIV key xxxxxx dns 192.168.111.100 pool VPN_POOL acl ...
1
vote
1answer
119 views

Many 'Deny IPv6-ICMP reverse path check' alerts from multicast addresses on Cisco ASA

In an effort to prevent IP Source Address Spoofing (RFC 2827) I've enabled reverse path filtering (RPF) on my Cisco ASA 5505. The topology is aprox. like this. Each segment has its own IPv4 subnet ...
2
votes
1answer
43 views

Allow only one ipaddress through a cisco firewall without pcs knowing there is a proxy server

We have a PC behind a firewall. (ASA 5505) [PC] => [ASA Firewall] => [Corporate Proxy/Firewall/Anything] => [Internet] :- where the PC and ASA Firewall are under our control... and the rest are ...
0
votes
1answer
90 views

Configure atftp server to reply on port 69

Problem : I'm facing to a problem with TFTP server and Cisco 79XX IP phones. When on a local network, everything is working fine, but when the TFTP server is on a public server (and phones inside a ...
1
vote
1answer
72 views

How many IP addresses can I expect to block on a Cisco 5500-X Series firewall?

Considering a Cisco ASA (5500-X) firewall for our internet edge in front of our web cluster. At the moment, we use a Linux box with iptables. A log analysis system detects brute-force attacks on ...
0
votes
2answers
213 views

Cisco ASA/PIX Can't Access Internal Resources Behind NAT [duplicate]

My servers are natted 1:1 as follows, i.i.i.i maps to x.x.x.x where i is an internal IP, and x is the external IP. From an i.i.i.i machine, I cannot access x.x.x.x resources... What special ...
0
votes
1answer
58 views

ASA 5505 - Outside IPs required for VPN Tunnel?

I've set up a Site-Site VPN and it seems the config is fine as the other site can establish the tunnel fine. The problem I have is that my side never tries to bring the tunnel up. Ping/telnet ...
2
votes
0answers
303 views

How can configure Cisco ASA 5510 to allow access to Web server in DMZ from LAN with port translation?

I am trying to configure Cisco ASA 5510 firewall to allow access from LAN to DMZ web server. Web server is located in the DMZ and is using port 8080. I don't want users to type port number every time ...
0
votes
1answer
113 views

route cisco sg300 traffic through Watchguard firewall

I need help in determining what I need to research. I have two cisco SG300 switches (sg300-52 & sg300-28) and a Watchguard firewall (XTM-23). The internet connection currently passes through our ...
-2
votes
1answer
100 views

VLAN routing setup with VPN on Cisco ASAs

We currently have two ASA5515-X firewalls, what we want to do is dedicate one of them to providing AnyConnect VPN and two site to site VPNs only, with the second ASA handling firewall ACLs for ...
0
votes
0answers
224 views

Cisco ASA 5512 and access on interfaces with same security levels

I have a new cisco asa 5512 Cisco Adaptive Security Appliance Software Version 8.6(1)2 Device Manager Version 6.6(1) with the Security Plus Licence. I have a number of VLAN's containing servers ...
2
votes
2answers
62 views

Cisco Network Object NAT to get Internet?

So I've inherited a Cisco ASA 5505, and I have no experience whatsoever with the things! There are two Network Interfaces both WAN facing, and the LAN interface of course. Now in NAT rules, there are ...
0
votes
1answer
509 views

Cisco IOS Router and Azure VPN - tunnel established, but traffic is not flowing

I am trying to connect a Cisco IOS router to Azure via the IPSec VPN. I have used the Cisco ISR template to establish a tunnel from my router to Azure. In the Azure control panel, I can see that the ...
1
vote
1answer
2k views

How can I debug Cisco Firewall ASA “Dispatch Unit” very high CPU utilisation from ASDM?

I have recently had my first firewall installed so I am very new to this whole situation. I am finding that Dispatch unit is becoming overloaded and it would appear to be the reason I get serious ...
0
votes
1answer
321 views

Cisco ASA 5520 is missing management interface

The ASA 5520 show version shows the following Cisco Adaptive Security Appliance Software Version 8.4(2) System image file is "Unknown, monitor mode tftp booted image" Config file at boot was ...
-1
votes
1answer
167 views

Is it possible to log Active Directory users internet activity on a Cisco Firewall-IOS router?

We are looking at replacing our Forefront TMG server with a combination Cisco ISE VMware instance and hopefully an Active Directory integration with our edge router. We need to log all authenticated ...
0
votes
3answers
184 views

Cisco ASA active SwitchPort

Does anyone know how to see which switch ports are cabled from CLI or ASDM? I am configuring a 5505 and the inside has 6 interfaces associated, only one of which is actually actively linked. I can't ...
3
votes
1answer
572 views

Dual Cisco Router Stateful Firewall

At my company we have a single Cisco 3925sec/k9 router running BGP with 2 ISPs. Now we want to purchase a redundant router of the same model to eliminate a single point of failure. I can set up BGP ...
2
votes
1answer
240 views

Can a Cisco ASA 5550 have multiple boot statements?

In my Cisco routers I have multiple boot statements in the event that one of the images fails to load or is accidently deleted. For example a router may have a config such as: boot system flash ...
1
vote
1answer
116 views

Cisco wrv210 static IP behind comcast router too slow

So I subscribed to a Comcast business account (cable internet provider) and put a Cisco WRV210 in front of the Comcast modem. They gave me 1 static IP address which i'm planning to use to access my ...
1
vote
1answer
94 views

Cisco SA520 to Adtran 1234 no DHCP transfer

I am trying to set up a Cisco SA520 to run DHCP on my network. I have a vendor provided switch, the Adtran 1234, and it provides DHCP for our phone systems on VLAN 200. I do not have access to the ...
-2
votes
2answers
137 views

hardware antiddos solution [closed]

We have three servers on colo in datacenter for hi-load e-commerce web project connected via cisco catalyst 2960. We need to make antiddos system with hardware firewall, CISCO Guard etc. CISCO Guard ...
1
vote
1answer
159 views

Dual Cisco ASA 5505 passing RSTP in transparent mode

I'm looking at moving to colocation and one area being discussed is networking redundancy. I can get a dual feed from a two different datacentre switches configured with Rapid Spanning Tree Protocol ...
1
vote
1answer
166 views

Finding spoofed IP address on network

I have a few IP spoof dropped messages coming out of my Sonicwall firewall, we'll call them Source A and Source B. Both of these sources have the same mac address indicating they're coming from the ...
0
votes
1answer
1k views

Force failover a Cisco ASA

I have two ASA in a lan state primary\secondary configuration. None of them have "failover active" or "no failover active" in their configuration. Would it be proper to failover in a manner such as: ...
6
votes
1answer
361 views

Cisco FWSM -> ASA upgrade broke our mail server

We send mail with unicode asian characters to our mail server on the other side of our WAN... immediately after upgrading from a FWSM running 2.3(2) to an ASA5550 running 8.2(5), we saw failures on ...
0
votes
2answers
263 views

Convert Cisco Router config to Cisco ASA config

I'm trying to migrate a large and complex ip extended access list from a Cisco 3725 router to a Cisco ASA5325-X firewall and I don't want to rewrite it so that it will work on the ASA. My question is ...
1
vote
3answers
2k views

Cisco ASA Multiple Public IP

I have a Cisco ASA5510 and articles related to ASA and mulitple Public IP says this cant be done. My question is how to best solve a scenario like this: I have 3 zones, Outside, Inside and DMZ ...
1
vote
2answers
367 views

NAT translation with Cisco ASA 5505

I am trying to setup NAT translation on a ASA 5505, however the new public IP address never actually becomes available after adding it. I'm sure I'm doing something stupid, but so far the problem has ...
0
votes
1answer
228 views

Cisco ASA Determine static NAT programmatically?

Is it possible to determine the static nats on an ASA 5550 or 5540 running 8.2(x) programmatically? I don't see it as an available SNMP oid but perhaps I am missing it.
3
votes
2answers
580 views

Cisco ASA Port Forwarding for Newbies

I'm a contractor for a private school where I'm tasked with developing a public API to their database to use in mobile apps. They host their own website on school premises and their network is ...
-1
votes
1answer
281 views

Linux tools to choose suitable Cisco ASA 5500 [closed]

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
1
vote
1answer
338 views

Cisco - Zone Policy Actions (pass, inspect, drop, log) - What is the difference?

Have these commands for instance: policy-map type inspect IN-OUT_PlcyMAP class type inspect IN-OUT_ClassMAP inspect <------ policy-map type inspect IN-OUT_PlcyMap class type inspect ...
2
votes
3answers
180 views

Cisco ASA and Cisco Switches, how do I determine top senders / receivers?

I'm dealing with a high bandwidth situation and need to determine what host is sending / receiving the most data. How can I get the logs necessary that will contain this information? I'm OK with ...
-1
votes
1answer
192 views

blocking specific dns servers

We want to block specific DNS server requests on our network. We tried null routing the DNS servers that were to be blocked, and it seems DNS requests are still getting through. Any suggestions ...
1
vote
0answers
2k views

How to open ports in Cisco ASA 5505 using ASDM?

am new to cisco and i badly need help in opening ports using ASDM. I already tried natting but it only allows 1 outside and 1 inside rule ex. Inside Static Rules 10.x.x.x outside 72.x.x.x Outside ...
3
votes
1answer
697 views

Cisco ASA Routing, Hairpin?

Cisco ASA 5505, 8.4.3 LAN: 10.0.15.0, Security Level 100 WIRELESS: 10.0.17.0, Security Level 75 WAN: Security Level 0 From the WIRELESS interface I need to access servers on the LAN. The problem ...
5
votes
1answer
698 views

Cisco ASA Config for PCI Compliant Office

We have a small business office, but due to PCI compliance we need to segment this into two internet networks (one 'compliant' and one for any other devices to use). We currently have a Draytek ...
1
vote
2answers
124 views

Controlling traffic on a small subnet

I have a small network with a business-class cable modem. I have a *.192/29 block assigned to the internal side of the modem. The first usable IP, .193, is assigned to the cable modem interface. I ...
2
votes
2answers
370 views

Need help choosing main cisco WAN/firewall unit ($20kish budget) [closed]

Our IT director has left for greener pastures, and I'm acting as the interim director while we find someone new (I manage the Helpdesk). He budgeted about 20k for a new front end to our internet ...
2
votes
1answer
264 views

Blocking GotoMyPc on ASA 5505

I am trying to block GotoMyPC traffic using a Cisco ASA 5505. On gotomypc.com they say you can block all traffic to poll.gotomypc.com to stop all access. What I have done is create a network group ...
0
votes
1answer
392 views

Outside or Internet users canot reach my dmz

Hi everyone out there. I have configured my aa 5520 v7. and so far im facing a problem in my connection and therefore i wish someone here can help me to sort it out. wright now Internal network can ...
1
vote
2answers
106 views

Cisco ASA adding ISP static IP

We're about to switch from our old ISP to a new one. How do I assign static ISP-assigned IP CISCO ASA interface? Should I define it under NAT or Access Rules? Is it easier through console?