ASA as firewall

Similar Questions

• Is supported PPTP vpn cisco ASA 5520 firewall?

  Hi all

  I'm Md.kamruzzaman. My compnay buy a firewall of cisco asa 5520 and I want to configure PPTP vpn on asa 5520 firewall. Is it possible to configure the PPTP vpn to asa firewall. If possible can you please tell me what is the procedure to configure the PPTP vpn.

  Best regards

  MD.kamruzzaman

  Sorry, but the Cisco ASA firewall does not support PPTP VPN termination.

  You may terminate IPSec and SSL VPN but not of type PPTP.

  If you are new to the ASA, how best to configure the supported VPN types is via the VPN Wizard integrated into the application of management of ASSISTANT Deputy Ministers.

• ASA 5505 Firewall Transparent with a Server Web Question

  I need to replace my Sonicwall firewall and I got an ASA 5505. However, I need to have a transparent firewall, no Natting and Server Web will have a public IP with relevant ports remains open.

  The simple illustration is the Internet---> firewall Transparent - Web Server (With public IP Address)

  1. There should be no natting

  2. the web server must have a public IP address and be accessible from the internet.

  3 ports can be blocked or re-opened.

  Please let me know if its possible to conclude this agreement.

  If so, can I get a command line sequence that allows this work.

  My version is

  Cisco Adaptive Security Appliance Software Version 4,0000 5

  Version 6.4 Device Manager (9)

  Thanks in advance

  Post edited by: Don Charles

  It is a minimum configuration for your needs (runs on ASA 5520).

  !
  transparent firewall
  !
  interface GigabitEthernet0
  Description - the Internet-
  nameif outside
  Bridge-Group 1
  security-level 0
  !
  !
  interface GigabitEthernet3
  Description - connected to the LAN-
  nameif inside
  Bridge-Group 1
  security-level 100
  !
  !

  interface BVI1

  Description - for management only-
  IP 10.1.10.1 255.255.255.0
  !

  !
  network of the WWW-SERVER-OBJ object
  Description - webserver-
  host 123.123.123.123

  !
  !
  WWW-SERVER-SERVICES-TCP-OBJ tcp service object-group
  Description - Serices published on the WEB server-
  port-object eq www
  EQ object of the https port
  !
  !
  OUTSIDE-IN-ACL scopes permitted tcp access list any object WWW-SERVER-OBJ object-group WWW-SERVER-SERVICES-TCP-OBJ
  !
  !
  Access-group OUTSIDE-IN-ACL in interface outside
  !

  Samuel Petrescu

• cannot ping remote ip on ASA no firewall (VPN site to site on SAA) configired no proxy, icmp not inspect, no chance

  some help me

  (Q) ping remote ip unable on ASA is not Firewall not on pc (VPN site to site on SAA) configired no proxy, icmp not inspect, no chance

  Note - I can ping PC but not the same subnet ip on ASA2 L3

  PC---> > ASA1 - ASA2<>

  Hi Matt,

  Let me answer your question in two points:

  • You cannot ping an ASA on another interface other than the one where you are connected to the ASA of.

  For example, ASA1 and ASA2 are connected through their interfaces 'outside '. ASA1 (or any other device on the external interface) can not ping/access ASA2 on his (ASA2) within the interface. The only time wherever this can be substituted is a tunnel VPN with the command "access management" configured for other interface, for example management-access inside

  • Traffic ASA1 ping to a remote client behind ASA2 won't over the VPN tunnel and as such is not encrypted. That's because ASA1 will forward traffic based on its routing table that probably this way through its 'outside' interface Except that traffic is allowed with the ASA2 (using the ACL), it will fail.

  We can do on the routers of sourcing our ping to another interface, but it will not work on the SAA.

• ASA behind Firewall VPN

  Hello

  Does anyone know if a remote access VPN (ASA) behind another firewall with NAT (Checkpoint), works just fine?

  I need to set up a remote access SSL vpn in an ASA 5512 - X but the ASA is in a DMZ to a firewall checkpoint with the public IP address and internet connection.

  Thank you.

  Andres

  Yes. I used remote VPN SSL ASA access when the SAA outside interface is behind another firewall that is NATting address. As long as the second firewall allows tcp/443 (SSL, assuming a default configuration), it works fine.

  For a VPN IPsec, a little more ports are required (udp/500 and 4500 in general).

• ASA 5510 Firewall ACLs HITCOUNT

  I have a simple question, but I'm having a hard time getting a response. When you show command access-list on the ASA 5510 there are a number of access... .i know clearly but I want to knowis it a default timer which will clearly be the number of accesses? Or the number of access remains until I have clear the County? I'm trying to clean up ACLs and for future troubleshooting I would like to know that. I don't want to remove an ACL entry with hitcount 0 and then it is necessary.

  The counters are there until one of two things will happen; you delete them manually or you restart the device. There is no timers to clear the counters. Usually, clear us the counters, let it run for a month or so to clean it up.

  Hope that helps.

• ASA firewall inbound

  Hello everyone.

  I have a question about ASA 5505 firewall.

  Output interface is dry level 0:

  interface Vlan10
  nameif outside
  security-level 0

  ACL created to filter traffic from site to site and filtering of tunnel triggered:

  No vpn sysopt connection permit

  network ipsec_subnet object
  subnet 192.168.11.0 255.255.255.248

  l2l-filter extended permit icmp any one access-list
  access-list l2l-filter extended permit tcp any object ipsec_subnet eq www
  access-list l2l-filter extended permit tcp any object ipsec_subnet eq https
  access-list l2l-filter extended permitted tcp ipsec_subnet eq ftp objects

  l2l-filter in interface outside access-group

  Since I was only working with routers, as far as I understand, in theory ipsec peers should not be able to establish ipsec with ASA tunnels since I did not allow UDP incoming 500,4500 and work to the ESP in l2l-filter ACL but in reality tunnels.

  Can you please explain why ACL entering on the external interface allows inbound ipsec connections.

  Thank you

  Kind regards

  Alex

  Hi Alex,

  The only way to block UDP 500 traffic is to use an ACL control plan.

  We see even hits on the ACL:

  Inbound_Filter of access list lengthened 2 line denies object-group IPSEC throughout a (hitcnt = 7)

  Have you tried the connection of compensation?

  Use 'clear conn address all the ' to delete the connection.

  Kind regards

  Aditya

  Please evaluate the useful messages.

• The requirements for standby Firewall ASA

  Hello

  I have ASA 5510 firewall with security more license bundle is running in our production environment, and I am now to buy another box for Firewall ensures according to my understanding, the wait should be same as an active firewall.

  Here are the specifications for this run into our existing environment

  1 ASA 5510 Firewall (security more Bundle license, 1 GB RAM, 256 MB Flash)

  And buy the replica of above with security @ License bundle, 1 GB RAM, 256 MB of memory Flash.

  My question is, is there anything else that I'm missing for the firewall to sleep?

  Kind regards

  Saeed

  ASA failover partners must have the same number?

  Hereby I guess that you are referring to the same number of interfaces.  These interfaces must also be of the same type.  so you can't have an ASA with 4 interfaces of concert and the other with 2 interfaces Gig.  Or you can, but you will not be able to use the failover for 2 of the interfaces on the SAA with 4 Gig interfaces.  Similarly, if both ASAs have 4 interfaces but an ASA has 4 interfaces Gig while the other has 4 Fastethernet interfaces, then this only would be not supported.

  --

  Please do not forget to select a correct answer and rate useful posts

• What VPN work as a PPTP vpn firewall CISCO-ASA-5520.

  Hi all

  Can you please tell me which replace the VPN I can configure PPTP on ASA 5520 firewall. What VPN work as a PPTP vpn firewall CISCO-ASA-5520.

  You can use the wizard VPN of RA with ASDM and confiugre L2TP IPSEC VPN that does not need a VPN Client must be installed.

  Michael

  Please note all useful posts

• How to configure ASDM Cisco ASA 5505

  I have a Cisco ASA 5505 firewall, and currently it is a command-line firewall. I want to configure ASDM so that I can use it as a Web based GUI interface.

  I don't really know what to do. Can someone help me please how I can configure ASDM on my firewall.

  Kind regards

  Naushad Khan

  Hi Naushad,

  First of all, must load the image ASSDM on SAA and then use the command:

  ASDM image dosk0: / asdm645.bin (if the image name is asdm645.bin)

  then:

  Enable http server

  http 10.0.0.0 255.0.0.0 inside (if your machine is 10.0.0.0 subnet behind inside the inetrafce)

  Go to the machine, open a browser and type:

  https://

  It will open the GUI.

  Thank you

  Varun

  Please evaluate the useful messages.

• Cisco ASA 5500 Series 4-Port GE SSM

  Currently, we have 2 asa 5510 firewall and need to add the

  Cisco ASA 5500 Series 4 - Port GE SSM extension module. Can it be added when the device is turned on and running or the firewall must be turned off to install the plug-in?

  Hello

  You could try to ask this question of the team of firewall, as this page from the community for the physical security and video surveillance.  The team of firewall is located here:

  https://supportforums.Cisco.com/community/NetPro/security/firewall

• Site to site VPN - impossible to reach the other side ASA

  Hello

  Recently, I replaced a Juniper with a Cisco ASA 5505 firewall in a branch. This branch has a VPN site to another seat. Firewall at Headquarters is a Juniper and managed by third parties. I have configured the ASA and replaced Juniper. Everything at the Branch works, and can reach all subnets and servers. As the user is concerned, there is no problem.

  But corporate headquarters, I am unable to reach this ASA on the interface of data or management. See the image, I am unable to ping or join a network 192.168.10.0 and 192.168.200.0 or any other subnet 10.15.8.0 to Headquarters. However, I can ping computers from branch office which is in the same subnet as the data interface.

  You guys could help me as I need to reach the ASA headquarters branch. I welcome all networks on both sides inside and the external interface. I also created a NAT as below. Am I wrong configured NAT

  NAT (inside, outside) static source DM_INLINE_NETWORK_4 DM_INLINE_NETWORK_4 HO_Subnets HO_Subnets non-proxy-arp-search of route static destination
  !
  NAT Dynamics obj_any interface of source to auto after (indoor, outdoor)

  DIWA

  This information is useful. You try to SSH to the address inside or management? May I suggest that we focus for now on access to inside? After we get this working, we can watch access via the management.

  It does not appear in what you posted, but I'm not sure if it might be something that you have removed before posting. Do you have configured access to the administration? If this is not the case, may I suggest that you add access management inside the config.

  HTH

  Rick

• Review of the ASA 5510 Config

  Hi all, I'm about to replace an existing a new ASA 5510 firewall.  The environment is pretty simple, just an external and internal interface.  I put in correspondence configs as much as possible, but I'd like to see if there are obvious problems.  I am concerned mainly with my NAT statements.  Nothing in the following config (sterilized) seems out of place?  Thank you!!

  ------------------------------------------------------------

  ASA 4,0000 Version 5

  !

  ciscoasa hostname

  enable the encrypted password xxxxxxxxxx

  XXXXXXXXXX encrypted passwd

  names of

  !

  interface Ethernet0/0

  nameif outside

  security-level 0

  IP 40.100.2.2 255.255.255.252

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  IP 10.30.0.100 255.255.255.0

  !

  interface Ethernet0/2

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Ethernet0/3

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Management0/0

  Shutdown

  nameif management

  security-level 100

  IP 192.168.1.1 255.255.255.0

  management only

  !

  boot system Disk0: / asa844-5 - k8.bin

  passive FTP mode

  permit same-security-traffic inter-interface

  network of the 10.10.0.78 object

  Home 10.10.0.78

  Nospam description

  network of the 10.10.0.39 object

  Home 10.10.0.39

  Description exch

  network of the 55.100.20.109 object

  Home 55.100.20.109

  Description mail.oursite.com

  network of the 10.10.0.156 object

  Home 10.10.0.156

  Description

  www.oursite.com-Internal

  network of the 55.100.20.101 object

  Home 55.100.20.101

  Description

  www.oursite.com-External

  network of the 10.10.0.155 object

  Home 10.10.0.155

  Ftp description

  network of the 10.10.0.190 object

  Home 10.10.0.190

  farm www Description

  network of the 10.10.0.191 object

  Home 10.10.0.191

  farm svc Description

  network of the 10.10.0.28 object

  Home 10.10.0.28

  Vpn description

  network of the 10.10.0.57 object

  Home 10.10.0.57

  Description cust.oursite.com

  network of the 10.10.0.66 object

  Home 10.10.0.66

  Description spoint.oursite.com

  network of the 55.100.20.102 object

  Home 55.100.20.102

  Description cust.oursite.com

  network of the 55.100.20.103 object

  Home 55.100.20.103

  Ftp description

  network of the 55.100.20.104 object

  Home 55.100.20.104

  Vpn description

  network of the 55.100.20.105 object

  Home 55.100.20.105

  app www description

  network of the 55.100.20.106 object

  Home 55.100.20.106

  app svc description

  network of the 55.100.20.107 object

  Home 55.100.20.107

  Description spoint.oursite.com

  network of the 55.100.20.108 object

  Home 55.100.20.108

  Description exchange.oursite.com

  ICMP-type of object-group DM_INLINE_ICMP_1

  response to echo ICMP-object

  ICMP-object has exceeded the time

  ICMP-unreachable object

  Exchange_Inbound tcp service object-group

  EQ port 587 object

  port-object eq 993

  port-object eq www

  EQ object of the https port

  port-object eq imap4

  DM_INLINE_TCP_1 tcp service object-group

  port-object eq www

  EQ object of the https port

  object-group service DM_INLINE_SERVICE_1

  will the service object

  the purpose of the tcp destination eq pptp service

  the DM_INLINE_NETWORK_1 object-group network

  network-object, object 10.10.0.190

  network-object, object 10.10.0.191

  the DM_INLINE_NETWORK_2 object-group network

  network-object, object 10.10.0.156

  network-object, object 10.10.0.57

  DM_INLINE_TCP_2 tcp service object-group

  port-object eq www

  EQ object of the https port

  object-group service sharepoint tcp

  port-object eq 9255

  port-object eq www

  EQ object of the https port

  outside_access_in list extended access permit icmp any any DM_INLINE_ICMP_1 object-group

  outside_access_in list extended access permit tcp any object 10.10.0.78 eq smtp

  outside_access_in list extended access permit tcp any object object 10.10.0.39 - Exchange_Inbound group

  outside_access_in list extended access permit tcp any object-group DM_INLINE_NETWORK_2-group of objects DM_INLINE_TCP_1

  outside_access_in list extended access permit tcp any object 10.10.0.155 eq ftp

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_1 any object 10.10.0.28

  outside_access_in list extended access permit tcp any object-group DM_INLINE_NETWORK_1-group of objects DM_INLINE_TCP_2

  outside_access_in list extended access permit tcp any object 10.10.0.66 object-group Sharepoint

  pager lines 24

  Enable logging

  asdm of logging of information

  Outside 1500 MTU

  Within 1500 MTU

  management of MTU 1500

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm-649 - 103.bin

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (exterior, Interior) static source everything any static destination 55.100.20.109 10.10.0.78

  NAT (exterior, Interior) static source everything any static destination 55.100.20.108 one-way 10.10.0.39

  NAT (inside, outside) static source 10.10.0.39 one-way 55.100.20.109

  NAT (exterior, Interior) static source everything any static destination 55.100.20.101 10.10.0.156

  NAT (exterior, Interior) static source everything any static destination 55.100.20.102 10.10.0.57

  NAT (exterior, Interior) static source everything any static destination 55.100.20.103 10.10.0.155

  NAT (exterior, Interior) static source everything any static destination 55.100.20.104 10.10.0.28

  NAT (exterior, Interior) static source everything any static destination 55.100.20.105 10.10.0.190

  NAT (exterior, Interior) static source everything any static destination 55.100.20.106 10.10.0.191

  NAT (exterior, Interior) static source everything any static destination 55.100.20.107 10.10.0.66

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 40.100.2.1 1

  Route inside 10.10.0.0 255.255.255.0 10.30.0.1 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  Enable http server

  http 192.168.1.0 255.255.255.0 management

  http 10.10.0.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Telnet timeout 5

  SSH 10.10.0.0 255.255.255.0 inside

  SSH timeout 5

  SSH group dh-Group1-sha1 key exchange

  Console timeout 0

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  source of NTP server outside xxxxxxxxxx

  WebVPN

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  inspect the pptp

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  Cryptochecksum:40cee3a773d380834b10195ffc63a02f

  : end

  Hello

  You do nat (exterior, Interior), I'm going to do inside, outside but the configuration is always good.

  The ACL configuration is fine, Nat is fine, so you should have problems,

  Kind regards

  Julio

• I can't boot on my Cisco ASA 5505

  Hello;

  I am facing a problem with my cisco ASA 5505 firewall. When I connect my cable to console the firewall to start setting firewall load and stop until the copyright. ICN can't access to the firewall to view the configuration. I start also with Rommon but I am facing the same problem. Does anyone have an idea of this problem and can help me?

  Please, it's so urgencly!

  Hello

  What version of software is on the asa and the amount of memory is on the device?

  Thank you

  John

• ASA for DC and Internet purchasing

  Dears

  Hello

  We have a customer ASA application firewall for Internet and VOIP data center.

  for the DC Firewall: I was suggesting that generation Firewall ASA 5585 x. and I suggested to include the IPS SSP10 module with it. but when I was searching in the workflow of the trade of Cisco (CCW), IPS SSP10's end of sale. so I don't know what to use others in the design

  For the Internet firewall: I was confused to go to ASA 5525 - CX. I don't know a lot about the CX and the license, I need. I have to use first to configure CX in ASA 5585?

  for the VOIP firewall, I really have no idea if the firewall can protect VOIP traffic? It is recommended to bypass the firewall.

  Please notify

  > but I noticed that this firewall does not support allowed cluster in CCW. fact ASA CX does not support the cluster?

  No, CX is not supported with the cluster:

  http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa93/configuration/General/ASA-General-CLI/HA-cluster.html#78299