Questions tagged [cisco-asa]
The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.
772
questions
0
votes
0
answers
548
views
Cisco ASA 5505 access external IP address from internal
Got a bit of a head scratcher.
ASA Version: 8.3(1)
ASDM Version: 6.3(1)
So I have an ASA 5505 with 3 interfaces (Inside, outside and Hosting). The inside interface has the IP range of 10.0.0.X and ...
1
vote
0
answers
174
views
Cisco ASA l2l tunnel established, can receive pings but cannot reply
I'm a bit new to managing a Cisco ASA appliance and I'm doing my best to learn, however I got a problem here.
Long story short, we are trying to connect a hospital's ADT HL7 feed to our remote ...
0
votes
1
answer
2k
views
Cisco ASDM issue "cannot open device"
I've just gotten my ASA 5510 set up to run AnyConnect VPN (w/ client). Unfortunately, it appears that I broke whatever allows the ASDM to connect in somewhere during that process. I get a "cannot open ...
0
votes
0
answers
392
views
VMware ESXI Behind ASA5506-Xs using Public IP is Not Communicating
Here is the lay of the land. Everything works but I cannot get data flow from ESXI Server or it's VM's
I want them using public addresses from behind the router.
The Vmware ESXI Hypervisor on a Bare ...
1
vote
1
answer
241
views
Multiple public IPs routed via Cisco ASA to Proxmox VMs
I have a network with IP 199.221.2.136 (/29). I would like the Cisco ASA5505 [1] to work on .137 as router and use two public IPs (.138 and .139) on two VMs on a Proxmox server. Not sure how to route ...
0
votes
0
answers
323
views
Unable to ping or RDP to servers via remote access VPN after DNS server change Cisco ASA
We have a setup here were users can remote into our network via VPN and then remote to their desktops.
This was all working fine.
The other day, we moved DNS from one server to another. I changed ...
1
vote
0
answers
253
views
udp 300 - acl drop - flow is denied
I am facing below issue after connecting l2tp with Cisco asa.
Split tunnel is configured.
It drops dhcp packets. Here is capture and config.
29: 22:39:38.733909 192.168.255.1.68 > 255.255.255....
2
votes
1
answer
1k
views
Multiple DHCP servers in multiple subnets, one DNS server
I have existing network with two subnets - one is the main company subnet (192.168.1.0/24), the other is completely separate VLAN for Guest Wireless and BYOD devices (192.168.2.0/24). There's Windows ...
0
votes
1
answer
5k
views
Cisco ASA 5550 rebooted itself, logs cleared
we had Cisco ASA5550 in Active/standby mode which worked without any issue for over 1 year. Recently, we started having issue where the VPN tunnels would drop to sites and have internet outages.
We ...
0
votes
1
answer
1k
views
Wireless authentication with DD-WRT, Cisco and Microsoft
I'm looking for a way to authenticate my wireless users beyond them just knowing the wireless password. Ideally they would join the access point then get dumped to the login portal that they'd have to ...
0
votes
1
answer
132
views
What is the proper way to create a vlan?
My goal is to create a separate VLAN, that will be isolated from the rest of the office, I just want them to have internet.
Normal pc stations x1 HP Procurve switch V1910 x1 cisco asa 5512-x
What I'...
0
votes
1
answer
1k
views
ASA5505 don't allow FTP traffic
I'm new to CISCO and ACLs and NATs but I''m willing to learn.
I am having problems allowing FTP access through my ASA5505 ASA 9.2 (2) ASDM 7.3(3)
This is my problem, I have a domain which has my ASA ...
3
votes
1
answer
3k
views
ASA 5505: How do I access the DMZ web server from the inside using the public IP?
We are using a 5505 ASA Sec+ (8.2). There are three interfaces: inside (172.17.0.0/24), dmz (172.16.0.0/24) and outside (1.2.3.4 for the example).
There are static NAT rules set up translating 1.2.3....
4
votes
0
answers
579
views
Cisco ASA failback to preferred IPsec peer
I just configured my Cisco ASA 5505 to failover to a backup internet line when the main outside interface is down. This all works fine.
Also, I have a site-to-site IPSEC VPN tunnel from this ISP-...
2
votes
1
answer
8k
views
Cisco ASA site-to-site VPN up but no traffic
I currently have site to site VPN tunnel up between Cisco ASA 5550 & Cisco ASA5506-X. I can see the vpn tunnel is up on both end but no traffic is passing through. Cisco ASA 5550 is receiving ...
1
vote
0
answers
399
views
Cisco ASA 5505 no NAT
I have a cisco asa 5505. The outside and inside IPs are private IPs so I do not want to NAT the inside IPs as they go out the Outside interface (there is a router upstream of the ASA 5505. Would I do ...
1
vote
0
answers
1k
views
Allow Ports 80, 443 and 81 through ASA 5510
We are switching our VoIP provisioning method from TFTP to HTTP provisioning and have been asked by the VoIP provider to allow inbound access on ports 80, 81 and 443 from their two network networks on ...
1
vote
1
answer
736
views
CISCO ASA: Add specific command to a privilege level
i am facing the following issue, created a new account with a "read-only" access on a CISCO ASA 5510. This account will be used in a script that will back up the running-config of the ASA.
the ...
0
votes
0
answers
864
views
asa5512x: ipsec site-to-site vpn with tcp instead of udp? is it possible?
the cisco documentation for ASA 9.1 (I have 9.1.2) seems to imply that ipsec vpn with tcp/ip is only for remote clients, not site to site vpn.
But I repeatedly see people mention vpn over tcp to ...
2
votes
0
answers
403
views
Tethered VPN on Macbook fails to connect, but standard VPN over WiFi works [closed]
I have a MacBook using the Cisco client and it works fine except when I use the special Mac/iPad ability to tether over the iPad data connection.
For those that are unfamiliar with this, the Mac and ...
0
votes
1
answer
153
views
cisco asa 5512-x policing
I have a single 100mb leased line that will be shared by three unrelated companies.
We are looking to buy a cisco ASA 5512-X and I need to use policing to ensure that each company receives 1/3 of ...
1
vote
1
answer
76
views
Cisco ASA separating networks
We are using a Cisco ASA 5505 running ver 9.0 to separate our corporate (inside) network from a dev lab (outside) network. We would like to use NAT or PAT to forward the inside interface IP to a set ...
-1
votes
3
answers
9k
views
Why can I not ping my host behind the firewall? Cisco asa 5505 [closed]
Can anyone please help me to figure out, what in my configuration of the Cisco asa 5505 is wrong or missing? I have multiple host behind my firewall. These hosts run different websites on port 80. I ...
5
votes
1
answer
5k
views
Nmap external scan shows port open, ASA says port is not open, but do get an socket
Folks, have a weird one, need your expert help. For one of our heavily used external facing server which came up in an audit, nmap -Pn scan shows the following:
Starting Nmap 5.51 ...
Host ...
0
votes
0
answers
3k
views
Site-to site Configuration between OpenSwan and Cisco ASA
I am making site-to-site vpn connection using amazon ec2 linux and cisco asa router ( please note i donot have access to router only configuration is provided.)
CISCO ASA CONFIGURATION :
...
0
votes
0
answers
289
views
Cisco ASA 5505 VPN users access to local LAN denied
I have this running config:
: Saved
:
ASA Version 8.2(5)
!
hostname TESTATES
domain-name TEST.com
names
name 192.168.1.0 AsusWireless
!
interface Ethernet0/0
switchport access vlan 2
!
interface ...
9
votes
4
answers
24k
views
OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx
I have exported an existing certificate+key from an ASA 5510:
asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD
Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
1
vote
2
answers
3k
views
HttpServletRequest.getRemoteAddr() always returns 127.0.0.1
We're attempting to identify where specific requests are coming from inside our Java application. We have changed the log files to include the IP address and we're using httpServletRequest....
-1
votes
1
answer
3k
views
Find source(s) of dropped packages in Cisco ASA GUI
we are using pair of ASA 5520 Firewalls with ASDM 6.4.
Can someone enlighten me, how to find out which is(are) the source or target ip(s) when we got a hugh bunch of dropped packages come in (by ASDM ...
0
votes
1
answer
559
views
Need help understanding a bandwidth restriction on a Cisco ASA
We have a guest wireless network here and it's bandwidth is limited too 1 Meg per second. I did not configure this and am trying to pick it up.
I've found these lines in the cisco config but i'm not ...
1
vote
5
answers
444
views
Multiple Computers Running IIS with a Singular Public IP how to handle incoming communications?
At our company, we have three separate servers that house IIS currently. Each of these three servers have the same public IP address and essentially reside on the same network under different subnets.
...
0
votes
0
answers
1k
views
Cisco ASA firewall blocking requests to internally hosted DNS server
I have a DNS server behind a Cisco ASA firewall. The Cisco firewall is performing NAT. When inside the network, I can NSLOOKUP directly to the server. When the client is external, requests time out.
...
0
votes
2
answers
989
views
Cisco Easy VPN - Port forwarding needed at remote end?
I was in the process of setting up a site-to-site ipsec vpn tunnel behind a mobile broadband router when i found out that i wasnt able to port forward on that network so i wont be able to use the ...
1
vote
1
answer
585
views
WatchGuard Authentication equivalent with Cisco ASA X series
I am in the process of implementing Cisco ASA 5512-X devices with FirePOWER to replace WatchGuard firewalls. The WatchGuard devices in use are currently wrapping access to various services with a ...
2
votes
3
answers
412
views
Cisco ASA NAT - internal host see its public ip
I have a server hosted by a provider which uses Cisco ASA to do nat.
The problem I have is that the internal server that is nat-ed with a public ip will see its
public ip as source ip. This basically ...
1
vote
1
answer
141
views
Cisco ASA 5505 with separate subnets and separate ISPs
I am trying to join two networks together thru the ASA.
I have a 192.168.0.1 network that is the main domain and has its own ISP and is administered by Windows Server 2008 for DNS and DHCP.
I also ...
1
vote
1
answer
9k
views
Cisco ASA - difference between inside_access_in and inside_access_out?
So a minor problem we have is any internal servers have no (non-icmp) access to the outside is being blocked.
Our current config is:
inside_access_in any ---> any ---> icmp
inside_access_out ...
0
votes
0
answers
432
views
Route Email to external IP Cisco ASA 5515
I have a cisco ASA 5515X with two WAN connections and one LAN connection.
As far as I understand, I hace the firewall configured to allow SMTP traffic through WAN2 interface, but not through WAN1.
...
-2
votes
1
answer
400
views
Can I use ASA5505 to spoof the reply to a heartbeat request?
I have a CISCO ASA 5505 in a home office. It has two subnet, public and private. There is a wifi belkin router on the private net, which provides wifi for some users. That belkin router sends out ...
1
vote
1
answer
4k
views
NAT Rule changes from ASA software 8.0 to 8.4
I have an Access Rule and a NAT rule that works fine with on the Security Appliance Software Version 8.0
The rule is as follows:
However, I am having trouble making the same rule work on an ASA ...
0
votes
2
answers
1k
views
ASA is not forwarding packets to egress interface
We are seeing some very strange behaviour from our Cisco ASA 5505 running 9.1(2)
We have a SIP PBX inside our network. It's got a bit of an odd configuration, it listens for inbound SIP requests for ...
3
votes
2
answers
714
views
High number connections coming from an IP
On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
1
answer
7k
views
Cisco ASA 5510 needs "clear arp <Interface>" periodically to reach a single host
ASA 9.0(3)
The symptom is that I can ping from the ASA to any other host in that interface's subnet, save one particular host (that host can ping the interface on the ASA however). If I do "clear arp ...
0
votes
1
answer
240
views
Secondary IPs on DMZ machines not working
I am moving some virtual machines from my DMZ in a bladecenter over to my new cisco UCS. We are using Hyper-V, and are running Server 2012 on the old bladecenter, and Server 2012r2 on the new UCS.
...
1
vote
1
answer
189
views
vpn connection is OK but can't route some IPs
Our Network is laid out as in the diagram below
PC1 can successfully connect to server 2 (with 10.120.20.x/24), and
PC4 can successfully connect to server 1 (with 10.120.30.x/24).
Our problem is ...
0
votes
3
answers
1k
views
How to see traffic traversing a Cisco ASA by inside host?
I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
4
votes
1
answer
33k
views
Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule
During VPN reconfiguration we have met quite big issue with VPN traffic not passing to peer. Using packet-tracer we have have got following debug:
Phase 1 to Phase 9 passed successfully.
[...]
Phase:...
1
vote
1
answer
1k
views
Force Cisco ASA to change source port NAT
I have a 2 devices, a Cisco ASA and sitting behind it another device. Both the Cisco and the other device have IPsec tunnels but to different locations. I need to ensure that the source port of the ...
1
vote
1
answer
1k
views
cisco ASA 5505 l2tp vpn
I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but:
when i have "use default gateway on remote network" on NIC enabled i have access to ...
1
vote
0
answers
1k
views
Configuring ASA 5510 for multiple port-forwarding using TCP-UDP service group
I'm currently trying to configure two different ASA 5510s to properly forward all ports used in h323 video conferencing to the proper video conferencing equipment setup on the internal network on each ...