ASA 5510 - possible to fill the 2 interfaces in routed mode

Similar Questions

• Cisco ASA 5510 L2L VPN on the backup interface

  OK, here is what I have and I even if I knew how to do this, but it has not worked for me.  I hope someone out there can help you.

  I have an ASA 5510 running 8.4 with double configuration of ISPs on 2 different interfaces: outside (primary), backup (backup).  I also have a site to site VPN ASA another in another city.  The VPN is now configured on the external interface and works very well.  What I wanted to do, is to make the VPN running on backup interface only.

  So, I changed the card encryption on the remote side to use the backup interface IP and created a tunnel-group for her.  Then, I created a map encryption for backup interface and activated ikev1 on it.  The default route is configured to use the external interface, so I created a static route that routes traffic destined for the external interface of the remote side to the backup interface default gateway.  I can get to establish tunnels, but no traffic passes through them.  I have however while I need a NAT device for the tunnel traffic to I created a NAT so but still no transmitted traffic.  I tried the packet - trace and he said: the traffic was allowed and show its crypto ipsec command, I see the configuration of the tunnel, but no traffic will pass through it.  Can anyone help?

  Ben,

  you use a code to version 8.4, I recommend starting by removing the config NAT statements at both ends. This version does not have the NAT and control, and if you don't need... I've seen instances with 8.4 (3) where a NAT even though apparently correct was causing not to pass through the traffic.

  Site A:

  NAT (inside, backup) source static obj-SiteALAN obj-SiteALAN static obj-SiteBLAN obj-SiteBLAN

  Site b:

  NAT (inside, outside) source static obj - 192.168.5.0 obj - 192.168.5.0 destination static obj - 192.168.3.0 obj - 192.168.3.0

  If possible, you should increase your AES encryption, but this is a personal point of view and should not stop the traffic through the links. You should be able to see the counters for the data transmitted / received are these incrementing?

  Do you have the ACLs that are from the inside to the outside and internal interface to the Interface of backup (duplicated.

  In this model, the control is the routing.

  Best regards

  Ju

  http://helpamunky.WordPress.com/

• ASA 5510 VPN multiple tunnels through different interfaces

  Is it possible to create VPN tunnels on more than one interface to an ASA (specifically 5510 with 8.4), or I'm doing the impossible?

  We have 2 public interfaces on our ASA connected to 2 different suppliers.

  We must work L2L tunnels of the SAA for remote offices through the interface that is our ISP 'primary' and also used as our default gateway for internet traffic.

  We are trying to install a remote office use our secondary connection for its tunnel (office of high traffic we would prefer separate away from the rest of our internet and VPN traffic).

  I can create the tunnel with the ACL appropriate for traffic tunnel, card crypto, etc., put in place a static route to force ASA to use the secondary interface for traffic destined for the public of the remote gateway IP address, and when I finished, traffic initiated by the remote site will cause the tunnel to negotiate and find - I can see the tunnel in Show crypto ikev1 his as L2L answering machine MM_ACTIVE , Show ipsec his with the right destination and correct traffic local or remote identities for interesting, but the ASA local never tries to send traffic through the tunnel.  If I use tracers of package, it never shows a VPN that is involved in the trafficking of the headquarters in the remote desktop, as if the SAA is not seeing this as for the corresponding VPN tunnel traffic.

  If I take the exact same access and crypo card statements list and change them to use the primary ISP connection (and, of course, change the remote desktop IP connects to), then the connection works as expected.

  What Miss me?

  Here is a sample of the VPN configuration: (PUBLIC_B is our second ISP link, 192.168.0.0/23 is MainOffice 192.168.3.0/24 is FieldOffice)

  permit access list range 192.168.0.0 PUBLIC_B_map 255.255.254.0 192.168.3.0 255.255.255.0

  NAT (Inside, PUBLIC_B) static source MainOffice MainOffice static FieldOffice FieldOffice

  card crypto PUBLIC_B_map 10 corresponds to the address PUBLIC_B_map

  card crypto PUBLIC_B_map 10 set counterpart x.x.x.x

  card crypto PUBLIC_B_map 10 set transform-set ESP-3DES-SHA ikev1

  PUBLIC_B_map PUBLIC_B crypto map interface

  tunnel-group x.x.x.x type ipsec-l2l

  tunnel-group ipsec-attributes x.x.x.x

  IKEv1 pre-shared-key *.

  Route PUBLIC_B x.x.x.32 255.255.255.224 y.y.y.y 1

  If I take this same exact configuration and change it to use PUBLIC (our primary connection) instead of PUBLIC_B, remove the instruction PUBLIC_B route and change the desktop to point to the ip address of the PUBLIC, then everything works, so my access list and crypto map statements must be correct.

  What I don't understand is why the ASA Head Office does not seem to recognize interesting for the tunnel traffic when the tunnel is for the second ISP connection, but works when it is intended for the main ISP.  There is no problem of connectivity with the ISP Internet B - as mentioned previously, the tunnel will come and negotiate properly when traffic is started from the desktop, but the traffic of main office is never sent to the bottom of the tunnel - it's as if the ASA does not think that traffic of 192.168.0.x to 192.168.3.x should pass through the VPN.

  Any ideas?

  Hello

  I think your problem is that there is no route for the actual remote network behind the VPN L2L through ISP B connection

  You could try adding add the following configuration

  card crypto PUBLIC_B_map 10 the value reverse-road

  This should automatically add a static route for all remote networks that are configured in the ACL Crypto, through the interface/link-ISP B.

  If this does not work, you can try to manually add a static route to the ISP B link/interface for all remote networks VPN L2L in question, and then try again.

  The route to the remote VPN peer through the ISP B does not to my knowledge.

  I would like to know if it works for you.

  It may be useful

  -Jouni

• Cisco WSA: Is it possible to use the web proxy in transparent mode without WCCP router?

  Hello!

  I would like to use Cisco WSA as a web proxy in a transparent manner (without any configuration of client web browsers), but I do not have a WCCP router. So, is it possible?

  If so, how?

  Thank you

  Stephane Walker

  Hi, Stéphane

  The only alternative to WCCP is ACB (the policy-based routing). With a simple configuration on the router, you can redirect traffic defined also interesting by the WSA access list. On the ASO you must configure transparent mode (security-> Web Proxy Services-> the settings of-> Mode Proxy: Transparent). You should also make sure proxy listens on port 80 and HTTPS proxy is enabled (on port 443) If you want to redirect HTTPS traffic as well.

  Cisco router configuration example

  !
  access-list 110 permit tcp any any eq www
  !
  proxy-redirect allowed route map 10
  corresponds to the IP 110
  set ip next-hop xxx.xxx.xxx.xxx
  !
  interface ethernet0/1
  proxy-redirect IP policy route map
  !

  xxx.xxx.xxx.xxx is the IP address of the proxy in such a case and access-list 110 sets web traffic (HTTP-TCP/80) also interesting.

  The biggest drawback of this solution is the lack of troubleshooting. If the proxy will go down because some reason router will keep redirecting traffic causing the cutoff of internet access.

  Cisco routers out material should also have an option to configure policy routing based.

  / Artur

  PS. It is not possible to place the WSA online between the clients and the internet.

• Is it possible to hide the pane "tabs" in playback mode in the most recent Acrobat Reader ms?

  I have been using the playback mode all my life. It is very convenient when you have a small screen for laptop and want to read long PDF documents... However, the most recent Acrobat Reader DC keeps this pane "tabs" even after the playback mode. So, is it possible to disable the "tabs pane" when I switch to playback mode? Here's a screenshot, so you will know what I mean...

  

  In preferences, you can turn off the display of the tabs.

• Using the Tunnel interface on router

  Hello world

  I see hew Tunnel interface on the router.

  Router is running OSPF.

  However, there is no cryptographic statements.

  tunnel configuration

  Tunnel1 interface

  10.4.x.x from IP x.x.x.x

  time 7

  source of tunnel Loopback1

  destination 10.4.x.x tunnel

  My question is when we use the interface Tunnel without any cryptographic statements?

  Thank you

  MAhesh

  This Tunnel is a plain GRE Tunnel. They are generally used without crypto when:

  (1) traffic is not sent through an untrusted network and cryptographic protection is not necessary.
  (2) the GRE traffic gets encrypted on a separate device if the end point free WILL is not able to do the necessary cryptographic protection.

  Sent by Cisco Support technique iPad App

• is it possible to install the camera raw in offline mode?

  I tried to download and install the camera raw plugin in a PC which is always offline for security reasons (it contains data of my clients).

  However, when I try to install the available page file downloads, all I get is a guest "this download is not available for you", probably since my PC is unable to download the necessary components.

  Y at - it a link to download the full installer, offline for camera raw 7.1 (or later version)?

  Frodo

  Hi MRPin1963,

  Please find the link to download camera raw: http://www.adobe.com/support/downloads/product.jsp?product=106&platform=Windows.

  Kind regards

  Romit Sinha

• How many interfaces in asa 5510

  can someone pls tell me how many interfaces in asa 5510.and we can add more interfaces to it.

  concerning

  Assane

  Hi assane,.

  When you order the ASA5510, you can choose between (option Setup/Noo-Noo fixed to add more ports interface):

  1 ASA5510 device comes with 3 x FastEthernet, more 1xmanagement port (FastEthernet)

  ASA5510-BUN-K9: Cisco ASA 5510 Firewall Edition includes 3 Fast Ethernet interfaces, 250 peers IPSec VPN, SSL VPN 2 peers 3DES/AES license, or

  2 ASA5510 comes with 5xFastEthernet, most 1xmanagement port (FastEthernet).

  Cisco ASA 5510 Security Plus Firewall Edition includes 5 interfaces Fast Ethernet, 250 VPN IPSec peers, 2 peers of SSL VPN, high availability active / standby, 3DES/AES license

  http://www.Cisco.com/en/us/products/ps6120/products_data_sheet0900aecd802930c5.html

  Rgds,

  AK

• Can't access the internet - easy question for the experts! (ASA 5510)

  Dear all

  I can't access internet from my home network!

  I don't know why!

  Router:

  Ethernet f0/0 interface: 195.xxx.xxx.17/29 (to connect to the router) IP

  THE ASA NETWORK

  The external interface e0/0: 195.xxx.xxx.18/29 IP (to connect to the router)

  Internal interface: e0/1: IP 10.10.100.1 mask 255.255.252.0

  The ASA configuration

  ASA Version 8.0 (2)

  !

  ciscoasa hostname

  domain.com domain name

  enable encrypted password xxxxxxxxxxxx

  names of

  DNS-guard

  !

  interface Ethernet0/0

  nameif Interface_to_cisco_router

  security-level 0

  IP address 195.xxx.xxx.18 255.255.255.248

  !

  interface Ethernet0/1

  nameif Int_Internal_domain

  security-level 100

  address 10.10.100.1 IP 255.255.255.0

  !

  interface Management0/0

  nameif management

  security-level 100

  IP 192.168.1.1 255.255.255.0

  management only

  !

  xxxxxxxxxxxxx encrypted passwd

  boot system Disk0: / asa802 - k8.bin

  passive FTP mode

  clock timezone WEST 0

  clock summer-time WEDT recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup Interface_to_cisco_router

  DNS domain-lookup Int_Internal_domain.com

  DNS server-group DefaultDNS

  Server name 195.22.0.136

  Server name 195.22.0.33

  domain.com domain name

  permit same-security-traffic intra-interface

  object-group Protocol TCPUDP

  object-protocol udp

  object-tcp protocol

  Interface_to_router_Cisco_access_in list extended access allowed object-group TCPUDP any any eq field

  Interface_to_router_Cisco_access_in list extended access permit tcp any any eq www

  pager lines 24

  emergency logging level list Registo_eventos_william

  emergency logging list level Registo_eventos_william class vpn

  asdm of logging of information

  exploitation forest-address recipient [email protected] / * / critical level

  management of MTU 1500

  MTU 1500 Interface_to_router_Cisco

  MTU 1500 Int_Internal_domain

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 602.bin

  don't allow no asdm history

  ARP timeout 14400

  Global interface (Interface_to_router_Cisco) 101

  NAT (management) 101 0.0.0.0 0.0.0.0

  Access-group Interface_to_router_Cisco_access_in in the Interface_to_router_Cisco interface

  Route 0.0.0.0 Interface_to_router_Cisco 0.0.0.0 195.xxx.xxx.17 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout, uauth 0:05:00 absolute

  dynamic-access-policy-registration DfltAccessPolicy

  Enable http server

  http 10.10.100.0 255.255.255.0 Int_Internal_domain

  http 10.10.10.0 255.255.255.0 management

  http 195.xxx.xxx.16 Interface_to_router_Cisco 255.255.255.248

  http 192.168.1.0 255.255.255.0 management

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  No encryption isakmp nat-traversal

  Telnet 10.10.100.0 255.255.255.0 Int_Internal_domain

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  dhcpd address 10.10.100.20 - 10.10.100.250 Int_Internal_domain

  dhcpd dns 10.10.100.2 195.22.0.136 interface Int_Internal_domain

  dhcpd lease interface 345600 Int_Internal_domain

  dhcpd domain domain.com Int_Internal_domain interface

  enable Int_Interna_domain dhcpd

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  !

  class-map inspection_default

  match default-inspection-traffic

  Thanks in advance

  MP

  Hi MP,.

  Based on the configuration below, only traffic since the possible management interface to access the internet.

  Global interface (Interface_to_router_Cisco) 101

  NAT (management) 101 0.0.0.0 0.0.0.0

  You must include your inside interface in the nat statement if you want to have the traffic within the internet go.

  Example:

  NAT (Int_Internal_domain) 101 0.0.0.0 0.0.0.0

  Kind regards

  Arul

  * Rate pls if it helps *.

• Site to Site VPN ASA 5510

  OK my forehead is painful to all keyboard strokes that I know that it must be something simple, but I am brand new to the SAA.  I had a site to site VPN configuration via routers 1751 that worked very well, but we're looking to add some more remote field offices, and I felt that it would be easier to maintain several sites is on the ASA 5510.  I have the VPN configured on the SAA and he said that the tunnel is up.  I can telnet to the ASA and ping the remote gateway on the even side of VPN and it pings fine.  If I try to ping on a local computer, I get a "Request timed out".  If I makes no changes apart from go to the computer room and replace the network cable the 1751 and then through the 1751 I can now ping the remote door way to my computer.  The remote router works obviously very well, my statement of route on my router for vpn push through the ASA (same ip address) IP traffic that has been used by the 1751 works obviously. It seems so just like ASA is not being pushed in the ethernet0/0 VPN traffic or at least it is not encrypted.  I also noticed that the ACL for NAT seems to increase in number of access either it seems, there is really just one small thing missing to make the ASA except and encrypt incoming traffic on ethernet0/0:

  My network is not configured with a DMZ is something like that, the ASA ethernet0/0 and my local network on the same subnet:

  Router (Cisco 2811)

  |

  Layer switch 2 (ProCurve)

  |                                      |

  ASA5510 LAN computers

  I'm trying to except both sides of the VPN in and out on Ethernet0/0 traffic I saw there was a framework for this "permit communication between VPN peers connected to the same interface' and I've activated this option.

  In short, I need to understand why the VPN tunnel shows that upward and I can ping the remote of the SAA, but peripheral gateway on my network can not ping to the remote gateway through the int Ethernet0/0 on the SAA.

  From the console of the ASA, I get this:

  ASA5510 # ping 192.52.128.1
  Send 5, echoes ICMP 100 bytes to 192.52.128.1, wait time is 2 seconds:
  !!!!!
  Success rate is 100 per cent (5/5), round-trip min/avg/max = 100/108/120 ms

  ASA5510 # show crypto ipsec his
  Interface: *.
  Tag crypto map: * _map, local addr: 10.52.120.23

  local ident (addr, mask, prot, port): (10.52.120.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.52.128.0/255.255.255.0/0/0)
  current_peer: x.x.x.204

  program #pkts: 9, #pkts encrypt: 9, #pkts digest: 9
  decaps #pkts: 9, #pkts decrypt: 9, #pkts check: 9
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 9, #pkts comp failed: 0, #pkts Dang failed: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 10.52.120.23, remote Start crypto. : x.x.x.204

  Path mtu 1500, fresh ipsec generals 60, media, mtu 1500
  current outbound SPI: C49EF75F

  SAS of the esp on arrival:
  SPI: 0x21FDBB9D (570276765)
  transform: esp-3des esp-md5-hmac
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 1, crypto-map: * _map
  calendar of his: service life remaining (KB/s) key: (3824999/3529)
  Size IV: 8 bytes
  support for replay detection: Y
  outgoing esp sas:
  SPI: 0xC49EF75F (3298752351)
  transform: esp-3des esp-md5-hmac
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 1, crypto-map: * _map
  calendar of his: service life remaining (KB/s) key: (3824999/3527)
  Size IV: 8 bytes
  support for replay detection: Y

  From my office on the 10.52.120.0 even the etherenet0/0 interface on the ASA network I get this:

  C:\Users\***>ping 192.52.128.1

  Ping 192.52.128.1 with 32 bytes of data:
  Request timed out.
  Request timed out.
  Request timed out.
  Request timed out.

  Ping statistics for 192.52.128.1:
  Packets: Sent = 4, received = 0, lost = 4 (100% loss)

  C:\Users\***>ping 10.52.120.23

  Ping 10.52.120.23 with 32 bytes of data:
  Reply from 10.52.120.23: bytes = 32 time = 5ms TTL = 255
  Reply from 10.52.120.23: bytes = 32 time = 3ms TTL = 255
  Reply from 10.52.120.23: bytes = 32 time = 1ms TTL = 255
  Reply from 10.52.120.23: bytes = 32 time = 1ms TTL = 255

  Ping statistics for 10.52.120.23:
  Packets: Sent = 4, received = 4, lost = 0 (0% loss),
  Time approximate round trip in milli-seconds:
  Minimum = 1ms, Maximum = 5ms, average = 2ms

  Count on VPN Tunnel ACL does not increase when I try to ping the address of the remote gateway.

  Here is the running of the ASA configuration:

  ASA Version 7.0 (2)
  names of
  !
  interface Ethernet0/0
  nameif InsideNetwork
  security-level 100
  IP 10.52.120.23 255.255.255.0
  !
  interface Ethernet0/1
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  Shutdown
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  management only
  !
  activate the encrypted password of XXXXXXXXXXXXXXXX
  passwd encrypted XXXXXXXXXXXXXXXXXXX
  ciscoasa hostname
  domain default.domain.invalid
  passive FTP mode
  permit same-security-traffic intra-interface
  Access extensive list ip 10.52.120.0 InsideNetwork_nat0_outbound allow 255.255.25
  5.0 192.52.128.0 255.255.255.0
  Access extensive list ip 10.52.120.0 InsideNetwork_cryptomap_20 allow 255.255.255
  .0 192.52.128.0 255.255.255.0
  pager lines 24
  asdm of logging of information
  management of MTU 1500
  MTU 1500 InsideNetwork
  management of the interface of the monitor
  the interface of the monitor InsideNetwork
  ASDM image disk0: / asdm - 502.bin
  don't allow no asdm history
  ARP timeout 14400
  NAT (InsideNetwork) 0-list of access InsideNetwork_nat0_outbound
  Route InsideNetwork 0.0.0.0 0.0.0.0 10.52.120.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00
  Timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  Enable http server
  http 192.168.1.0 255.255.255.0 management
  http 10.52.120.0 255.255.255.0 InsideNetwork
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  card crypto InsideNetwork_map 20 corresponds to the address InsideNetwork_cryptomap_20
  card crypto InsideNetwork_map 20 set peer x.x.x.204
  InsideNetwork_map 20 transform-set ESP-3DES-MD5 crypto card game
  InsideNetwork_map InsideNetwork crypto map interface
  ISAKMP enable InsideNetwork
  part of pre authentication ISAKMP policy 10
  ISAKMP policy 10 3des encryption
  ISAKMP policy 10 md5 hash
  10 2 ISAKMP policy group
  ISAKMP life duration strategy 10 86400
  Telnet 10.52.120.0 255.255.255.0 InsideNetwork
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  dhcpd lease 3600
  dhcpd ping_timeout 50
  enable dhcpd management
  tunnel-group x.x.x.204 type ipsec-l2l
  x.x.x.204 group of tunnel ipsec-attributes
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  Policy-map global_policy
  class inspection_default
  inspect the dns-length maximum 512
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  !
  global service-policy global_policy
  Cryptochecksum:7e478b60b3e406091de466675c52eaaa
  : end

  I haven't added anything to the config except what seemed necessary to get the job of VPN tunnel.  It should be fairly clean.

  Thanks in advance for any help... I really hope that it is something really simple as a recruit ASA just forgot

  Strange, but good news. Thanks for the update. I'm glad everything is working.

  THX

  MS

• Fill the list with Instances

  Hi all
  
  Is it possible to fill the results in a drop-down list with the name of the entity instances.
  
  for example, I instantiated instances 4 x by the name of the child as part of the entity of children.
  

  HARRY
  BARRY
  SALLY
  LARRY

  Then on a separate screen, I want a drop-down list to be filled with the name of the child.
  
  for example
  Maybe, I have a question:
  

  what is your favourite child (which is a drop down showing 4 instance names (HARRY,BARRY,SALLY,LARRY)

  I'm on v10.1
  
  
  See you soon

  Hello

  There is a way to make this out-of-the-box, but all depends on your data model.

  I assume here that you have 2 entities, the person and the child. The child has an attribute called 'name of the child. "

  Creates a one-to-one between the person and the child relationship, that he calls "the child preferred person '...

  Then, create an individual question screen. Add a control to the "relationship of entry" to the screen in question. For the 'legend', write something like "Please choose your favorite child." For the "attribute" display, choose the name of the child.

  This will display the question exactly as you want - it will ask the user to select from a list of all children.
  Of course, if the person can have many favorite children, create a relationship one - several. However, this will display the names of the children as the boxes, because the user is now allowed to select more than one.

  If the relationship is just together, you can then use this relationship to access the name of the favourite on the level of the individual child (using InstanceValueIf), or you can run the rules that apply only to the favorite child.

  It's just a suggestion that Ive just tested in 10.3, I did 10.1 at hand at the moment but don't remember which is new to the brand (others, please correct me if I'm wrong). Give it a go, see if it works and get back to me, if it's not. If this does not work on 10.1 you should certainly consider the upgrade to 10.3 for a host of other reasons too. Otherwise, it is achievable with a custom control.

  See you soon,.
  Ben

  Ben Rogers
  Senior Consultant - Monad Solutions
  http://www.monadsolutions.com

• Maybe it's to rewrite the BIOS with crisis recovery mode?

  Hey everybody,

  my laptop 'freezes' during BIOS 'PHOENIX' updated 2 years ago.
  SERVICE told to change the motherboard, the price as new pc, so I bought new laptop.

  I keep looking at the toshiba forum always, so I read a lot of information on the MODE of RECOVERY from CRISIS.
  so I tried to check my laptop died after 2 years.

  My satellite M100 starts in crisis recovery mode Fn + B.
  my laptop starts up to CRISIS MODE, but do not read the USB STICK
  I did the flash with the CRISDISK 1.0.0.4 USB key program, but I'm not sure I did it way right!

  My question is:
  is it really possible to REWRITE the bios with crisis recovery mode, where I can read more information on how to do it.

  I want back my M100 :)))

  Hey,.

  As Akuma writes that you should try a USB FDD instead a USB key. Key USB is supported only on new models of laptops, but as far as I know USB FDD will be always supported.

  In any case, just for your information: you should know what you're doing. It is a delicate and risky procedure and in the worst cases you might destroy the whole ROM module but if you already have a new laptop I think that it s a problem for you. ;)

• Allow specific access through the Interfaces ASA 5510

  Hi all

  In my quest to learn Cisco IOS and devices, I need help in smoothing traffic, or access lists, allowing traffic between internal interfaces on the SAA specifically.

  I have an ASA 5510:

  WAN/LAN/DMZ ports labled E0/0 (LAN), E0/1 (WAN), E0/2 (DMZ).

  Connected to the port E0/0 is a 2811 router

  Connected to the port E0/1 is the (external) Internet

  Connected to the port E0/2 is a 2821

  (I'll add a 3745 for VOIP) port E0/3, but it has not yet happened.

  I want to allow traffic between the 2821 and the 2811 routers so that devices on the networks behind them can talk to each other.

  I've specified specific subnets between the ASA and the routers because I want to learn how to shape traffic behind routers, as well as on the ASA. So behind the routers I have different VLANS, but I'm not restrict access between them, still, at least I don't think I am. But as it is, behind the 2821 devices cannot access the DNS / DOMAIN SERVER that is located behind the 2811. Right now I have the routers DHCP power, who works there. Currently devices behind the router 2821-3560 switch cannot access the domain server, primary dns server.

  How can I set the ASA to allow traffic to flow between the two routers and their VLANS?

  Here's the configs of each device and I have also included my switch configs, incase something should be set on them. I only removed the passwords and the parts of the external IP address. I appreciate the help in which States to create and on which devices.

  I think it is best that I put the links to the files of text here.

  Thank you!

  You must remove the following statements on the two routers:
  -# ip nat inside source... overload
  -for each # ip nat inside/outside interface, if they have configured.

  Remove ads rip of the networks that are not directly connected:
  -2821: 172.16.0.0, 192.168.1.0, 199.195.xxx.0
  -2811: 199.195.xxx.0
  -ASA: 128.0.0.0

  No way should be added to the routers, since he is the one by default, put in scene to ASA.

  Check the tables of routing on routers and the ASA.

  On ASA:

  -Remove:
  object-group network # PAT - SOURCE
  # nat (indoor, outdoor) automatic interface after PAT-SOURCE dynamic source

  -create objects of the networks behind the LAN router and enable dynamic NAT:
  network object #.
  subnet
  NAT (inside, outside) dynamic interface

  -review remains NAT rules.

  -to set/adjust the lists access penetration on the interfaces. Do not forget to allow the rip on the LAN and DMZ interfaces.

  -Disable rip on the outside interface.

• ASA 5510 Configuration. How to set up 2 outside the interface.

  Hello

  I have Cisco ASA 5510 and the desktop, I want to create a new route to another (external) router to my ISP.

  The workstation I can Ping ASA E0/2 interface but I cannot ping the router ISP B inside and outside of the interface.

  I based my setup on the existing configuration. which so far is working

  interface Ethernet0/0
  Outside of the interface description
  nameif outside
  security-level 0
  IP 122.55.71.138 address 255.255.255.2
  !
  interface Ethernet0/1
  Inside the interface description
  nameif inside
  security-level 100
  IP 10.34.63.252 255.255.240.0
  !
  interface Ethernet0/2
  Outside of the interface description
  nameif outside
  security-level 0
  IP 121.97.64.178 255.255.255.240
  !

  Global 1 interface (outside)

  global (outside) 2 interface (I created this for E0/2)
  NAT (inside) 0 access-list sheep

  NAT (inside) 1 10.34.48.11 255.255.255.255 (work: router ISP inside and outside interface E0/0)

  NAT (inside) 2 10.34.48.32 255.255.255.255 (work: E0/2 router ISP on the inside interface only but cant outside ping).

  Route outside 0.0.0.0 0.0.0.0 122.55.71.139 1 (work)

  Route outside 10.34.48.32 255.255.255.255 121.97.64.179 1 (the new Road Test)

  Router ISP, that a job can ping and I can access the internet

  interface FastEthernet0/0
  Description Connection to ASA5510
  IP 122.55.71.139 255.255.255.248
  no ip redirection
  no ip proxy-arp
  IP nat inside
  automatic duplex
  automatic speed
  !
  the interface S0/0
  IP 111.54.29.122 255.255.255.252
  no ip redirection
  no ip proxy-arp
  NAT outside IP
  !
  IP nat inside source static 122.55.71.139 111.54.29.122
  IP http server
  IP classless
  IP route 0.0.0.0 0.0.0.0 Serial0/0

  FAI 2

  interface FastEthernet0/0 (SAA can ping this interface)
  Description Connection to ASA5510
  IP 121.97.64.179 255.255.255.248
  no ip redirection
  no ip proxy-arp
  IP nat inside
  automatic duplex
  automatic speed
  !
  interface E0/0 (ASA Can not ping this interface)
  IP 121.97.69.122 255.255.255.252
  no ip redirection
  no ip proxy-arp
  NAT outside IP
  !
  IP nat inside source static 121.97.64.179 121.97.69.122
  IP http server
  IP classless
  IP route 0.0.0.0 0.0.0.0 E0/0

  CABLES

  ASA to router ISP B (straight cable)

  Router ISP in the UDI (straight cable)

  Hope you could give some advice and the solution for this kind of problem please

  Hello

  Are you able to ping the router IP of the interface of the device of the ASA? If so, try a trace of package on the device of the SAA for traffic to the IP address of the router.

  Thank you and best regards,

  Maryse Amrodia

• ASA 5510 using only the GB interfaces

  I am looking for should I use a 5510 to activate two interfaces for VPN connections broadband from only a few sites. Our 5505 s (I have dozens) can not manage speeds of more than 100 MB and I have now a few FIOS beyond that--150 to 300mpbs.  I want a 5510 basis who needs to manage a few voice / data sites and just use two interfaces. A basic 5510 allow 2 gigabytes or just ports FE interfaces?  I have to be able to use 2 GB interfaces and no one else. I don't know that the 5510 will probably support the same QOS settings that I use on the 5505 s... I just need more speed interface so that I'm not bottlenecking data (I know I could use several 5505 s and extend the charges but is not how I want to do it for other reasons). Thank you

  Hello

  To my knowledge the ASA5510 supports 2 x 1 Gbps interfaces when you the Security license for the SAA. The basic license counts 100Mbps interfaces.

  Take a look at this document for more information on licensing above

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/license/license82.html#wp190732

  Its a document from the 8.2 version but its still even to 9.x on the license requirement more security get the 2 x 1 Gbps interfaces

  The documentation for ASA5500 series promises an 300Mbps for the ASA5510 model flow, but I guess that's a value of location. In the most recent document, two values of max flow max and Multiprotocol are given.

  Here's a link to the document

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd80285492.PDF

  -Jouni