New answers tagged cisco-asa
0
The first thing you may check is the traffic through firewall. Please give the result of this command:
show int
show traff
show perfmon
to determind what traffic cause your problem.
Using CLI, don't using ASDM (And I never use it), it makes your ASA load increase.
2
Iain,
What you are referring to is pretty common...you have overlapping internal subnets that won't pass traffic properly if setup on a normal IPSEC VPN tunnel (site to site).
The idea is to do a Policy NAT for the VPN traffic to change your 10.1.0.0/16 to 192.168.50.0/24 if it is tunneling over the VPN.
Cisco has a great writeup on how to do this: ...
0
I believe that route statement should work. I would suggest maybe moving the route to the device before the ASA.
1
It's not clear to me if your DMZ DHCP clients are getting addresses from the DHCP server. If they are not, have you confirmed with the Packet Capture Wizard, not sure if you have it in ASDM 5.2, that the DHCP discovery is arriving to the ASA? It will look something like 0.0.0.0.68 -> 255.255.255.255.67. I believe you will need at least UDP port 67 ...
1
The .pcf file is just a text document and it is designed to be edited just like any other INI file. It is hard to find the documentation on the format but here is a good starting point: http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client500_501/administration/5vcA.pdf#page119
Specifically Chapter 5-1 Preconfiguring the VPN ...
1
Few (unrelated) points:
- Look closely at the license - with most basic license you will see 'DMZ interface' in output of show ver , it means DMZ interface will be able to communicate ONLY with 'outside' destinations, not with other internal networks
- Have you looked at inspection ? It greatly depends on ASA OS version , but under default class-map where ...
14
The way that we deal with this is to create an separate object group for interface that we want to have redundant connectivity to, it is a little messy but it should work for what you need.
So you would have a FIOS object
object network FIOS_NYHQ_GUESTWIRELESS_10.110.6.0_24
nat (NYHQ-GUESTWIRELESS,NYHQ-OUTSIDE_FIOS) dynamic interface
and a Cogent ...
0
What you would like to do is called hair pinning and usually it is done on your internal facing interface but there is no reason you can not do it on your outside interface, though as javano mentioned it can cause a little confusion on the Internet. But it will not break anything, this is different than if you wanted to NAT an IP address that you do not ...
0
If you do not mind using LDAP you can do exactly what you need without changing anything on the server infrastructure.
The way that we do ASA LDAP integration is to us the memberOf LDAP attribute to trigger a match on the value we want to edit. For cli AAA you can configure the following attribute map:
ldap attribute-map NetworkAdministrators
map-name ...
0
I've been fiddling with that but with little success before. Some sources claim that ASA will never send icmp redirects, which is necessary to let the other clients on inside know that there's another gateway for the specific destination, while other sources claim that ASA up to 8.2(1) will not do it, implying that newer will do. IIRC, I tested on 8.3 with ...
0
Why you use "inside"? Can you post ASA "show route" command output?
If you want to reach an external ip, you can use:
route outside [External Network] [Mask] gateway
Ex: route outside 0.0.0.0 0.0.0.0 192.168.1.1
Where "outside" is the interface that connected to external network.
2
They can be created outside the client software, fortunately. They're just text files. Cisco has some documentation about the format available. Be aware that the "encryption" for any pre-shared keys isn't documented, so getting passwords into that format will probably be difficult.
0
First you will need to upgrade to ASA post-8.3. Create and object network with the range of IPs for the public. Then create an object network for the inside/real IP address of the server. Then add a nat statement calling the first object.
!
object network outside_email
range 10.10.10.1 10.10.10.2
!
!
object network inside_email
host 192.168.0.200
nat ...
Top 50 recent answers are included
