1

Let me preface by saying I am not a network administrator by trade and this firewall was set up originally by a Cisco consultant who is no longer available.

We have a small office with a Cisco ASA 5505, and have an IP based printer. This printer is remotely accessible to a vendor for printing accounting docs. Because the vendor is changing ISPs I need to update the public IP address for the vendor.

If you look at the snippets below, I am not sure I understand why they did not use the exact address for the rule, instead it is xxx.xxx.xxx.0 and then they noted the specific public IP address in the description. Should that not have been better to have it as xxx.xxx.xxx.250 to begin with?

When I make the update for the new public IP address of the vendor, should I not insert the specific public IP address they are coming in from rather than allowing the entire public /24 (the network their public IP comes from)?

Here are the snippets that i can find in the config, these are not the real IPs:

name 192.168.0.106 host-prt-000.106-printing01
name 192.168.0.107 host-prt-000.107-printing02
name XXX.XXX.XXX.0 vendor-srv-PrintingVendor description Specific Print Source: XXX.XXX.XXX.250

object network vendor-srv-PrintingVendor
 subnet XXX.XXX.XXX.0 255.255.255.0
 description AccountingVendor

object network host-prt-000.106-printing01
 host 192.168.0.106
 description accounting HP 

object network host-prt-000.107-printing02
 host 192.168.0.107
 description xerox 

Thanks in advance.

David

2
  • Obfuscating the IP addresses in your config is annoying and difficult to read. – ewwhite Mar 12 '16 at 12:17
  • sorry, seemed better than putting it all out there. – david Mar 13 '16 at 1:42
2

There are no actual firewall rules here, these are just name -> IP address (range) mappings used in the configuration to make the configuration easier to read.

However, most likely the original consultant wanted to leave some flexibility for the IP address, in case the IP address of the incoming connection changes.

If you are sure that the inbound connection always comes from a particular IP address, then you can change the object IP address to that one, that is, replace the subnet line with a host line similar to the objects below.

On another note, I wouldn't let any outside IP address connect directly to an internal network, I would set up a VPN for this purpose.

1
  • Thanks for the help. It is a necessary vendor and that is how they provide their services, vpn sounds great, but not an option at this time. – david Mar 13 '16 at 1:43
2

The part of the configuration you posted does not contain NAT rules or ACLs (both of which are related to allowing a remote IP to print to a printer in your network).

object network vendor-srv-PrintingVendor

This is a network object. In Cisco routers you can define network objects by name so that you do not have to remember the IP addresses.

So for the object vendor-srv-PrintingVendor

object network vendor-srv-PrintingVendor
subnet XXX.XXX.XXX.0 255.255.255.0
description AccountingVendor

This is defining a network object. The object is a network XXX.XXX.XXX.0 255.255.255.0. The name is vendor-srv-PrintingVendor which means instead of typing XXX.XXX.XXX.0 255.255.255.255.0 each time you need to add it in your configuration you can simply reference the object using vendor-srv-PrintingVendor.

What you may want to do is change the name of the object from vendor-srv-PrintingVendor to vendor-srv-PrintingVendor-Network and create a new object named vendor-srv-PrintingVendor-PrintSource. You would create this as a host instead of a subnet so your code would be this.

object network vendor-srv-printingVendor-PrintSource
host XXX.XXX.XXX.250
description Accounting Vendor Print Source

If you can tell us if this is a Catalyst, ASA, etc., the model number and if it is an ASA the software version (not ASDM version number but the ASA version number) that will help addition questions you might have about ACLs and NAT rules.

When it comes to creating an ACL for this yes you will want to use the specific IP address and not the entire network which is what the current object gives you.

3
  • it is an asa5505. Thanks for the info. I was putting in the object since I thought I could just update the object. Next time I will put in all the rules. I am going to narrow it to the single ip, just wanted to make sure there was not some syntax here that i was not aware of that needed to have it be all of it. – david Mar 13 '16 at 1:45
  • Nope you can do that. You can also use ASDM (GUI) if you aren't very comfortable with the command line for Cisco IOS. – user5870571 Mar 13 '16 at 1:56
  • Something you will want to do though is make sure that the network object is not being used for anything else somewhere in the configuration. If you use ASDM you can right click the network object and select "Where used". – user5870571 Mar 13 '16 at 2:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.