3
votes
1answer
87 views
+50

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
0
votes
1answer
24 views

Cisco ASA 5510 Inter-interface routing

I'm trying to setup a Cisco 5510 to route traffic between the outside and inside interfaces where both belong to public IP subnets. Our ISP assigned us a single point-to-point IP (207.107.110.150/30) ...
-2
votes
0answers
29 views

Cisco ASA 5505 ver 7.4 port forwarding

I need sone help over ASA 5505 ver 7.4. This scenario is working with two site to site vpn and working fine. All inside clients able access internet only issue is that they are not able to call means ...
0
votes
1answer
38 views

cisco firewall access rules for intra-subnet traffic

I have a Cisco 5505 in our office, and everything is on the 10.0.1.0 network. We have a cheap wireless router that we would like to use. The router is sitting behind the inside interface, and is ...
0
votes
2answers
54 views

Open HTTP Protocol Cisco ASA

I would like to know if it's possible to open HTTP protocol (whatever the port) for one of my subnet to the outside on Cisco ASA 5510 v9.1(4) (ASDM v7.1(5)? I guess I will have to play with service ...
1
vote
1answer
119 views

Many 'Deny IPv6-ICMP reverse path check' alerts from multicast addresses on Cisco ASA

In an effort to prevent IP Source Address Spoofing (RFC 2827) I've enabled reverse path filtering (RPF) on my Cisco ASA 5505. The topology is aprox. like this. Each segment has its own IPv4 subnet ...
1
vote
1answer
72 views

How many IP addresses can I expect to block on a Cisco 5500-X Series firewall?

Considering a Cisco ASA (5500-X) firewall for our internet edge in front of our web cluster. At the moment, we use a Linux box with iptables. A log analysis system detects brute-force attacks on ...
0
votes
2answers
213 views

Cisco ASA/PIX Can't Access Internal Resources Behind NAT [duplicate]

My servers are natted 1:1 as follows, i.i.i.i maps to x.x.x.x where i is an internal IP, and x is the external IP. From an i.i.i.i machine, I cannot access x.x.x.x resources... What special ...
0
votes
1answer
58 views

ASA 5505 - Outside IPs required for VPN Tunnel?

I've set up a Site-Site VPN and it seems the config is fine as the other site can establish the tunnel fine. The problem I have is that my side never tries to bring the tunnel up. Ping/telnet ...
2
votes
0answers
303 views

How can configure Cisco ASA 5510 to allow access to Web server in DMZ from LAN with port translation?

I am trying to configure Cisco ASA 5510 firewall to allow access from LAN to DMZ web server. Web server is located in the DMZ and is using port 8080. I don't want users to type port number every time ...
0
votes
0answers
224 views

Cisco ASA 5512 and access on interfaces with same security levels

I have a new cisco asa 5512 Cisco Adaptive Security Appliance Software Version 8.6(1)2 Device Manager Version 6.6(1) with the Security Plus Licence. I have a number of VLAN's containing servers ...
3
votes
2answers
830 views

NTP client on CentOS 5 fails behind Cisco ASA firewall

I have a CentOS server on which I want to set up an NTP client to get accurate time for the server. The server is on a local subnet with NAT behind an ASA 5505 firewall, which acts as NAT router, and ...
1
vote
1answer
2k views

How can I debug Cisco Firewall ASA “Dispatch Unit” very high CPU utilisation from ASDM?

I have recently had my first firewall installed so I am very new to this whole situation. I am finding that Dispatch unit is becoming overloaded and it would appear to be the reason I get serious ...
0
votes
3answers
184 views

Cisco ASA active SwitchPort

Does anyone know how to see which switch ports are cabled from CLI or ASDM? I am configuring a 5505 and the inside has 6 interfaces associated, only one of which is actually actively linked. I can't ...
1
vote
1answer
390 views

ASA 5510 - Routing between Interface

I have a WAN interface and 2 LAN interface. I need both the LAN be able to access a server outside the network via the WAN (outside) interface. I am using a ASA 5510 firewall instead of a router, ...
2
votes
1answer
240 views

Can a Cisco ASA 5550 have multiple boot statements?

In my Cisco routers I have multiple boot statements in the event that one of the images fails to load or is accidently deleted. For example a router may have a config such as: boot system flash ...
1
vote
0answers
272 views

UDP Range Nat Translation port forwarding RPT Traffic to inside host PBX Cisco ASA 5505 8.2a

I have an Asterisk based PBX that I'm providing VoIP services with, My gateway is a Cisco ASA 5505 running 8.2 and I only have one public IP Available along with other services I provide with that IP. ...
0
votes
1answer
190 views

Cisco VPN Concepts - Connection Profiles and Group Policy

I was wondering could someone please explain the main concepts of how Cisco ASA Firewalls implement VPNs please? Specifically what are Connection Profiles and Group Policies used for? i.e. What they ...
1
vote
1answer
159 views

Dual Cisco ASA 5505 passing RSTP in transparent mode

I'm looking at moving to colocation and one area being discussed is networking redundancy. I can get a dual feed from a two different datacentre switches configured with Rapid Spanning Tree Protocol ...
1
vote
1answer
99 views

Cisco ASA 5500 - Internet connection dies when adding ICMP exception to firewall

When I add ICMP to be allowed both on inside / outside interfaces the internet connection dies. Does anyone know why this happens? I kind of observed that this behavior takes place not just for ICMP. ...
0
votes
1answer
1k views

Force failover a Cisco ASA

I have two ASA in a lan state primary\secondary configuration. None of them have "failover active" or "no failover active" in their configuration. Would it be proper to failover in a manner such as: ...
0
votes
1answer
126 views

ASA 5505 8.4 open ports for subnet

I have an ASA 5505 running 8.4 with its outside interface plugged into our internal network. I want to open up access to hosts on one of the vlans behind that ASA to hosts on our internal network. I ...
0
votes
3answers
713 views

Using a nat rule to translate 80/443 traffic to web server, but internal users cannot access it using external ip/domain name

I am using Cisco ASDM for ASA I have my internal network called soa. My outside interface is called outside. Let's say my outside IP given to me by my ISP isp is y.y.y.y I have a web server inside ...
0
votes
2answers
263 views

Convert Cisco Router config to Cisco ASA config

I'm trying to migrate a large and complex ip extended access list from a Cisco 3725 router to a Cisco ASA5325-X firewall and I don't want to rewrite it so that it will work on the ASA. My question is ...
1
vote
2answers
300 views

Cut over ASA global PAT address without connection drops

We're currently PATing everything from a particular subnet to the IP of an outside interface using our ASA5585 (dynamic PAT). We're experiencing pool exhaustion and therefore need to expand the global ...
4
votes
3answers
761 views

Can our firewall detect traffic sniffing inside the network?

We use Cisco ASA's firewall and NAT functions in our network (200 computers). Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
0
votes
1answer
228 views

Cisco ASA Determine static NAT programmatically?

Is it possible to determine the static nats on an ASA 5550 or 5540 running 8.2(x) programmatically? I don't see it as an available SNMP oid but perhaps I am missing it.
1
vote
1answer
395 views

Need help making site available externally

I'm trying to open a hole in the firewall (ASA 5505, v8.2) to allow external access to a Web application. Via ASDM (6.3?), I've added the server as a Public Server, which creates a static NAT entry ...
3
votes
2answers
580 views

Cisco ASA Port Forwarding for Newbies

I'm a contractor for a private school where I'm tasked with developing a public API to their database to use in mobile apps. They host their own website on school premises and their network is ...
0
votes
1answer
974 views

Allow access to printer between interfaces on Cisco ASA5510

I have a Cisco ASA5510 where we have to separate networks on two separate interfaces. The networks should have nothing to do with each other except that network B needs to access a printer on network ...
13
votes
4answers
4k views

Hardware firewall vs VMware firewall appliance

We have a debate in our office going on whether it's necessary to get a hardware firewall or set up a virtual one on our VMWare cluster. Our environment consists of 3 server nodes (16 cores w/ 64 GB ...
-1
votes
1answer
281 views

Linux tools to choose suitable Cisco ASA 5500 [closed]

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
3
votes
1answer
2k views

How to put my ASA 5505 into single router mode so I can restore factory defaults?

I'm trying to restore an ASA 5505 to the factory defaults. According to the instructions from several sources (e.g. ...
2
votes
3answers
180 views

Cisco ASA and Cisco Switches, how do I determine top senders / receivers?

I'm dealing with a high bandwidth situation and need to determine what host is sending / receiving the most data. How can I get the logs necessary that will contain this information? I'm OK with ...
0
votes
1answer
538 views

How can i protect my web site with cisco Asa Firewall 5520 and do url,web filtering?

I've got a cisco ASA firewall 5520 on my small organization's network, and i'm quite new to ASAs as i have just finished my SNAF course and need time and experience. My question is how can i protect ...
1
vote
0answers
2k views

How to open ports in Cisco ASA 5505 using ASDM?

am new to cisco and i badly need help in opening ports using ASDM. I already tried natting but it only allows 1 outside and 1 inside rule ex. Inside Static Rules 10.x.x.x outside 72.x.x.x Outside ...
4
votes
3answers
5k views

Denying ICMP type 3 code 4 traffic - good or bad?

Investigating a slow VPN connection (Cisco ASA IPSec) to a remote office, I noticed on our firewall a lot of access rule matches: Denied ICMP type=3, code=4 from *ip_address* on interface outside I ...
0
votes
1answer
805 views

Public subnet configuration on a Cisco ASA 5520

I'm trying to set up a Cisco ASA 5520 as the main entry point for our datacenter setup. This setup includes: Three private networks (management, SAN and backup) that are used in a cloud server ...
2
votes
1answer
744 views

Fortinet: Is there any equivalent of the ASA's packet-tracer command?

I would like to know if there is not Fortigates an equivalent of the packet-tracer command that we can find on the ASA. Here is an example of execution for those who don't know it: NAT and pass : ...
3
votes
1answer
697 views

Cisco ASA Routing, Hairpin?

Cisco ASA 5505, 8.4.3 LAN: 10.0.15.0, Security Level 100 WIRELESS: 10.0.17.0, Security Level 75 WAN: Security Level 0 From the WIRELESS interface I need to access servers on the LAN. The problem ...
5
votes
1answer
698 views

Cisco ASA Config for PCI Compliant Office

We have a small business office, but due to PCI compliance we need to segment this into two internet networks (one 'compliant' and one for any other devices to use). We currently have a Draytek ...
1
vote
2answers
5k views

NAT one public IP to two inside servers on ASA 8.4

for example I want to: NAT 5.5.5.5 tcp 85 to 192.168.1.5 tcp 85 NAT 5.5.5.5 tcp 33 to 192.168.1.9 tcp 33 NAT 6.6.6.6 tcp 80 443 to 192.168.1.20 tcp 80 443 The way I was going to do this was: ...
2
votes
1answer
264 views

Blocking GotoMyPc on ASA 5505

I am trying to block GotoMyPC traffic using a Cisco ASA 5505. On gotomypc.com they say you can block all traffic to poll.gotomypc.com to stop all access. What I have done is create a network group ...
0
votes
0answers
651 views

Internet Download Speed Slow behind Cisco ASA Firewall

It used to work fine until my ISP increased the bandwidth from 10/10 to 15/15, I am only getting 5/10. Isolating the connection directly to a laptop gave the correct speed. ISP says it is a firewall ...
0
votes
1answer
392 views

Outside or Internet users canot reach my dmz

Hi everyone out there. I have configured my aa 5520 v7. and so far im facing a problem in my connection and therefore i wish someone here can help me to sort it out. wright now Internal network can ...
3
votes
1answer
589 views

cisco asa reloading

After having both memory and code upgrades, we have a significant number of our asa 5520's (in active/standby pairs) develop problems. The problem manifests itself as losing connectivity to the other ...
-1
votes
1answer
590 views

Best switch and firewall to use in a Data Centre Rack? [closed]

Can anyone offer any suggestions on the best switch and firewall to use with Dell PowerEdge servers that are co-located in a Data Centre Half Rack? I'm looking at potentially a Cisco ASA5510 Firewall ...
2
votes
0answers
3k views

cisco asa NAT to site-to-site VPN

I'm trying to NAT an external address to an internal address which is not local, but on a remote end of a site-to-site VPN connection. Is this possible? Log says Routing failed to locate next hop for ...
1
vote
1answer
810 views

Cisco ASA logs “regular translation creation failed for icmp” for client DNS traffic

I am having an issue similar to Cisco ASA logs "regular translation creation failed for icmp …" for DNS traffic, yet it works however in my situation the source is a MacBook Pro (10.7) not running ...
1
vote
1answer
5k views

Cisco ASA inspection of FTPS (FTP explicit SSL/TLS)

I'm trying to configure my Cisco ASA 5505 to open a passive port on behalf of my FTP server. Have anyone tried this when running the FTP connection encrypted (TLS/SSL) ? The FTP client log reports ...