Cisco ASA Cisco 831 routing static. help with ACL, maybe?
Hi all
What should be a simple task turns out to be difficult and I really need help.
The Cisco ASA obviously isn't a strong point on mine and could do with a point in the right direction. I hope that this will allow me to learn more about the ASA 5505.
OK so I have an ASA 5505. VLAN 1 is 192.168.254.1 and VLAN 2 DHCP of my cable modem.
I have a cisco 831 Ethernet router that will sit between my main LAN and my LAN test I want to implement for multicasting. the Cisco 831 has 1 Ethernet as 192.168.254.254 and Ethernet 0 is 10.1.1.1.
The ASA I have an interior route 10.0.0.0 255.0.0.0 192.168.254.254.
On the Cisco 831, there is a route 0.0.0.0 0.0.0.0 192.168.254.1. I can pass traffic via Cisco 831 to the ASA 5505 and internet, for example I can ping 8.8.8.8 and access everything on my main local network, but the other wan of any host inside the ASA 5505 is unable to ping anything on 10.1.1.x.
Where I'm going wrong? I did all my access to my a whole ASA, but it is still unable to do anything.
I will attached my configs with deleted passwords here and would like a good kick in the right direction. Without a doubt, it's something simple I'm missing and I'm sure it's with the ACL on the ASA 5505 like the packet tracer said that the package is abandoned due to the ACL
Thank you. :)
Thus, all traffic between these two LANs will travel on ASA, on the same interface.
Then please add this command in the global configuration of the ASA:
permit same-security-traffic intra-interface
Tags: Cisco Network
Similar Questions
-
VPN on ASA 5506 without internet access, help with NAT?
Hello
I have upgraded to a Cisco ASA 5505 to a 5506 X and as such have climbed to ASA 9.5
For this reason, I'm a bit stuck on how to implement the VPN. I followed the wizard and I can now establish inbound connections, but when connected (all traffic is tunnel) there is no internet connectivity.
Our offices internal (inside) network is 192.168.2.0/24
Our VPN pool is 192.168.4.0/24
I guess that I'm missing a NAT rule, but in all honesty, I'm a user ASDM and as everything is changed, I am struggling to recreate it?
Here is my config:
Result of the command: "sh run" : Saved : : Serial Number: JAD194306H5 : Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores) : ASA Version 9.5(1) ! hostname ciscoasanew domain-name work.internal enable password ... encrypted names ip local pool RemoteVPNPool 192.168.4.1-192.168.4.254 mask 255.255.255.0 ! interface GigabitEthernet1/1 nameif outside security-level 0 ip address 192.168.3.4 255.255.255.0 ! interface GigabitEthernet1/2 nameif inside security-level 100 ip address 192.168.2.197 255.255.255.0 ! interface GigabitEthernet1/3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/5 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/6 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/7 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/8 shutdown no nameif no security-level no ip address ! interface Management1/1 management-only nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 ! ftp mode passive clock timezone GMT 0 dns domain-lookup inside dns domain-lookup management dns server-group DefaultDNS name-server 192.168.2.199 domain-name work.internal same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj_any subnet 0.0.0.0 0.0.0.0 object network 173.0.82.0 host 173.0.82.0 object network 173.0.82.1 subnet 66.211.0.0 255.255.255.0 object network 216.113.0.0 subnet 216.113.0.0 255.255.255.0 object network 64.4.0.0 subnet 64.4.0.0 255.255.255.0 object network 66.135.0.0 subnet 66.135.0.0 255.255.255.0 object network a host 192.168.7.7 object network devweb host 192.168.2.205 object network DevwebSSH host 192.168.2.205 object network DEV-WEB-SSH host 192.168.2.205 object network DEVWEB-SSH host 192.168.2.205 object network vpn-network subnet 192.168.4.0 255.255.255.0 object network NETWORK_OBJ_192.168.4.0_24 subnet 192.168.4.0 255.255.255.0 object network NETWORK_OBJ_192.168.2.0_24 subnet 192.168.2.0 255.255.255.0 object-group network EC2ExternalIPs network-object host 52.18.73.220 network-object host 54.154.134.173 network-object host 54.194.224.47 network-object host 54.194.224.48 network-object host 54.76.189.66 network-object host 54.76.5.79 object-group network PayPal network-object object 173.0.82.0 network-object object 173.0.82.1 network-object object 216.113.0.0 network-object object 64.4.0.0 network-object object 66.135.0.0 object-group service DM_INLINE_SERVICE_1 service-object icmp service-object icmp6 service-object icmp alternate-address service-object icmp conversion-error service-object icmp echo service-object icmp information-reply service-object icmp information-request access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object DEVWEB-SSH eq ssh access-list outside_access_in remark AWS Servers access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object devweb eq ssh log debugging inactive access-list outside_access_in extended permit ip any any inactive access-list outside_access_in remark Ping reply access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any interface outside access-list outside_access_in remark Alarm access-list outside_access_in extended permit tcp any interface outside eq 10001 access-list outside_access_in remark CCTV access-list outside_access_in extended permit tcp any interface outside eq 7443 access-list outside_access_in extended deny ip any any access-list workvpn_splitTunnelAcl_1 standard permit 192.168.2.0 255.255.255.0 access-list workvpn_splitTunnelAcl_1 standard permit 162.13.130.12 255.255.255.252 access-list workvpn_splitTunnelAcl_1 standard permit 162.13.133.72 255.255.255.252 access-list workvpn_splitTunnelAcl_1 standard permit 164.177.128.200 255.255.255.252 access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.16 255.255.255.252 access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.72 255.255.255.252 access-list workvpn_splitTunnelAcl_1 standard permit 212.64.147.184 255.255.255.248 access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.116 255.255.255.254 access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.118 255.255.255.254 access-list workvpn_splitTunnelAcl_1 standard permit host 95.138.147.118 access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.120 255.255.255.254 access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.4.0 255.255.255.0 access-list workvpn2_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0 access-list workVPN2016_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0 pager lines 24 logging enable logging buffer-size 16000 logging asdm-buffer-size 512 logging asdm warnings logging flash-bufferwrap mtu outside 1500 mtu inside 1500 mtu management 1500 icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 7200 no arp permit-nonconnected nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup ! object network obj_any nat (any,outside) dynamic interface object network DEVWEB-SSH nat (inside,outside) static interface service tcp ssh ssh access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 192.168.3.3 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 user-identity default-domain LOCAL http server enable http 192.168.1.0 255.255.255.0 inside http 192.168.2.0 255.255.255.0 inside no snmp-server location no snmp-server contact service sw-reset-button crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0 enrollment self fqdn none subject-name CN=192.168.2.197,CN=ciscoasanew keypair ASDM_LAUNCHER crl configure snip dhcpd auto_config outside ! dhcpd address 192.168.1.2-192.168.1.254 management dhcpd enable management ! no threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ssl-client group-policy workVPN2016 internal group-policy workVPN2016 attributes dns-server value 192.168.2.199 vpn-tunnel-protocol ikev1 split-tunnel-policy tunnelall ipv6-split-tunnel-policy tunnelall default-domain value work.internal split-dns value work.internal split-tunnel-all-dns enable dynamic-access-policy-record DfltAccessPolicy ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options ! service-policy global_policy global prompt hostname context call-home reporting anonymous hpm topN enable Cryptochecksum: : end
Hi Ben-
What you are trying to accomplish is called VPN crossed. Depending on your initial configuration, you have 2 NAT problems. The first has to do with the NAT you place your order. In the code later that we are dealing with two NAT ASA 8.3 times and who are ranked 2 sections going on before and after the device NAT. object
My general rule for control of NAT is like this:
- Twice NAT (front) - use this section for exemptions from NAT or unusual configurations that have to go first
- Purpose of NAT - Use this section to the static NAT instructions for servers
- Twice NAT (after) - use this section to your global declarations of NAT, basically a catch-all
Then, never use 'all' as an interface for all training of NAT. This may seem like a good idea, but it will bite you. Remember, it is more the notion of control NAT, then 'all' interface is bit VPN configurations and similar DMZ. Always be specific about your interface for NAT pairs.
To this end, here is what I suggest that your NAT configuration should resemble:
nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup!object network DEVWEB-SSH nat (inside,outside) static interface service tcp ssh ssh !nat (inside,outside) after-auto source dynamic any interfacenat (outside,outside) after-auto source dynamic any interface
The key is that you need a NAT device explicitly reflecting the VPN traffic. PSC -
IOS VPN with NAT need help with ACL?
What I forget? I have tried other positions, studied bugs known with 12.2 (13) T1, etc. workaround solutions, but perhaps my other choice of configuration interfere with my VPN configuration.
I can connect, authenticate locally, very well. Stats of Cisco VPN client 3.6.3 show I'm Encrypting traffic on the protected networks, but I can not all traffic through internal hosts once I've connected.
I removed security tags and replaced all the public IP addresses to fake in hope that someone can point me to what is obvious!
Thank you very much.
----------
Current configuration: 5508 bytes
!
! 22:24:38 PST configuration was last modified Thursday February 20, 2003 by kevin
!
version 12.2
horodateurs service debug uptime
Log service timestamps uptime
encryption password service
!
AAA new-model
!
AAA authentication login userauthen local
AAA authorization groupauthor LAN
AAA - the id of the joint session
IP subnet zero
!
IP domain name mondomaine.fr
name of the IP-server 199.13.28.12
name of the IP-server 199.13.29.12
!
IP inspect the audit trail
IP inspect high 1100 max-incomplete
IP inspect a high minute 1100
inspect the tcp IP Ethernet_0_1 name
inspect the IP udp Ethernet_0_1 name
inspect the IP name Ethernet_0_1 cuseeme
inspect the IP name Ethernet_0_1 ftp
inspect the IP h323 Ethernet_0_1 name
inspect the IP rcmd Ethernet_0_1 name
inspect the IP name Ethernet_0_1 realaudio
inspect the IP name smtp Ethernet_0_1
inspect the name Ethernet_0_1 streamworks IP
inspect the name Ethernet_0_1 vdolive IP
inspect the IP name Ethernet_0_1 sqlnet
inspect the name Ethernet_0_1 tftp IP
inspect the IP name Ethernet_0_1 http java-list 99
inspect the name Ethernet_0_1 rtsp IP
inspect the IP name Ethernet_0_1 netshow
inspect the tcp IP Ethernet_0_0 name
inspect the IP name Ethernet_0_0 ftp
inspect the IP udp Ethernet_0_0 name
audit of IP notify Journal
Max-events of po verification IP 100
!
crypto ISAKMP policy 3
BA 3des
preshared authentication
Group 2
ISAKMP crypto nat keepalive 20
!
ISAKMP crypto client configuration group vpngroup
xxxxxxxxx key
DNS 199.13.28.12 199.13.29.12
domain mydomain.com
pool vpnpool
ACL 110
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
!
Crypto-map dynamic dynmap 10
Set transform-set RIGHT
!
!
map clientmap client to authenticate crypto list userauthen
card crypto clientmap isakmp authorization list groupauthor
client configuration address map clientmap crypto answer
10 ipsec-isakmp crypto map clientmap Dynamics dynmap
!
MTA receive maximum-recipients 0
!
!
interface Ethernet0/0
Description connected to the Internet
IP 199.201.44.198 255.255.255.248
IP access-group 101 in
NAT outside IP
inspect the IP Ethernet_0_0 in
no ip route cache
no ip mroute-cache
Half duplex
clientmap card crypto
!
interface Serial0/0
no ip address
Shutdown
!
interface Ethernet0/1
Connected to the private description
IP 192.168.1.254 255.255.255.0
IP access-group 100 to
IP nat inside
inspect the IP Ethernet_0_1 in
Half duplex
!
IP local pool vpnpool 192.168.2.201 192.168.2.210
period of translation nat IP 119
!!
!! -removed the following line for VPN configuration
!! IP nat inside source list 1 interface Ethernet0/0 overload
!! -replaced by the next line...
IP nat inside source map route sheep interface Ethernet0/0 overload
IP nat inside source 192.168.1.1 static 199.201.44.197
IP classless
IP route 0.0.0.0 0.0.0.0 199.201.44.193 permanent
IP http server
7 class IP http access
local IP http authentication
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 5 permit 192.5.41.40
access-list 5 permit 192.5.41.41
access-list 5 refuse any
access-list 7 permit 192.168.1.0 0.0.0.255
access-list 7 refuse any
access-list 99 refuse any
access-list 100 permit udp any eq rip all rip eq
access-list 100 permit tcp 192.168.1.1 host any eq www
access-list 100 permit ip 192.168.1.1 host everything
access list 100 permit tcp host 192.168.1.2 any eq www
access-list 100 permit ip 192.168.1.2 host everything
access-list 100 deny ip 192.168.1.253 host everything
access ip-list 100 permit a whole
access-list 101 deny host ip 199.201.44.197 all
access-list 101 permit tcp any host 199.201.44.197 eq 22
access-list 101 permit tcp any host 199.201.44.197 eq www
access-list 101 permit tcp any host 199.201.44.197 eq 115
access-list 101 permit icmp any host 199.201.44.197
access list 101 ip allow any host 199.201.44.198
access-list 101 permit tcp any host 199.201.44.197 eq 8000
access-list 101 permit tcp any host 199.201.44.197 eq 8080
access-list 101 permit tcp any host 199.201.44.197 eq 9090
access-list 101 permit udp any host 199.201.44.197 eq 7070
access-list 101 permit udp any host 199.201.44.197 eq 554
access-list 110 permit ip 192.168.1.0 0.0.0.255 any
access-list 115 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 115 permit ip 192.168.1.0 0.0.0.255 any
!
sheep allowed 10 route map
corresponds to the IP 115
!
Line con 0
exec-timeout 0 0
password 7 XXXXXXXXXXXXXXX
line to 0
line vty 0 4
password 7 XXXXXXXXXXXXXXXX
!
NTP-period clock 17208655
source NTP Ethernet0/0
peer NTP access-Group 5
NTP 7 use only group-access
NTP master 3
NTP 192.5.41.41 Server
NTP 192.5.41.40 Server
!
end
----------
Config looks OK, you should be able to get for each internal host EXCEPT 192.168.1.1 with this configuration. If you do a ' sho cry ipsec his 'you see Pkts Decaps increment, indicating that you see the traffic of the remote client? " Do you not see Pkts Encaps increment, indicating that you send a response réécrirait the client to the internal host.
For what is 192.168.1.1, because you have this:
> ip nat inside source 192.168.1.1 static 199.201.44.197
It substitutes for this:
> ip nat inside source map route sheep interface Ethernet0/0 overload
for this host traffic only and therefore back for just this host is always NAT would have even if you don't want it to be. To work around to send traffic to this host through an interface of closure with no NAT enabled on it, that it is NAT would have stops and allows you to connect via VPN. You can see http://www.cisco.com/warp/public/707/static.html for a detailed explanation, but basically, we must add this:
loopback interface 0
IP 1.1.1.1 255.255.255.0
interface ethernet0/1
Static IP policy route map
permissible static route map 10
match address 120
set ip next-hop 1.1.1.2
access-list 120 allow host ip 192.168.1.1 192.168.2.0 0.0.0.255
-
I'm trying to block all traffic with the address 192.168.5.6 port 25 out a router. All port 25 traffic is assumed from a mail server on 192.168.5.201.
the configuration is a server terminal server on 192.168.5.6 and the mail server is 192.168.5.201
all users sending a message via e-mail via outlook server to the mail server, so any attempt to send a message through any device or system is Aotearoa.
If I'm not mistaken, the acl would look like the following:
access-list 110 permit tcp 192.168.5.201 0.0.0.255 eq 25
access-list 110 tcp 192.168.5.6 refuse 0.0.0.255 eq 25
Is to correct what precedes, or do I need to dig deeper?
You can configure the following list of access, and it will also ensure that all your traffic is not blocked:
access-list 110 permit tcp 192.168.5.201 host any eq 25
access-list 110 tcp 192.168.5.0 refuse 0.0.0.255 any eq 25
access ip-list 110 permit a whole
First line will allow only 192.168.5.201 will send e-mail on port 25
Second line block / refuse any ip subnet 192.168.5.0/24 address will send e-mail on port 25
Third line will allow everything to go.
I hope this helps.
-
We recently received a SG300-10 switch and we need assistance in the creation of an access list for SSH access. The switch is running
1.3.0.62 SW version. We want to make sure the SSH access is allowed only from the 192.168.1.0 network. We would also like all attempts to the connected port tcp 22 for SSH. Right, SSH is now accessible from any IP including external (Internet). Here's what we have at the moment. The switch has an IP address of 192.168.1.7.
...
SSH_access extended IP access list
ip permit 192.168.1.0 0.0.0.255 192.168.1.7 0.0.0.0
output
ssh line
exec-timeout 0
output
...
The external (Internet) users can still try and SSH in. Please notify.
You have defined an ip access list. Those who are for routed traffic filtering, is not to control access to the switch itself. What more, it seems that you don't activate it on any interface (via the access-class command), so it has no effect at all.
To control access to the switch itself, you must define a list of management access and activate it with the management access-class command. Unfortunately the syntax of these differs slightly from the standard ACL. For example:
management of the access-list SSH_access
ip-source service permit 192.168.1.0 mask 24 ssh
https service permit
deny
output
management of the access-class SSH_access
allow SSH for the 192.168.1.0 network and HTTPS everywhere, but reject everything else (IE. Telnet or HTTP). Details can be found in ch. 11 "ACL management orders" the CLI Guide 300 series.
HTH
Tilman
-
How to install the VPN Client and the tunnel from site to site on Cisco 831
How can I configure a Cisco 831 router (Branch Office) so that it will accept incoming VPN Client connections and initiate tunneling IPSec site to site on our hub site that uses a VPN 3005 concentrator? I could get the tunnel to work by configuring it in a dynamic encryption card, but interesting traffic side Cisco 831 would not bring the tunnel upward. I could only put on the side of the hub. If I use a static encryption card and apply it to the external interface of the 831 I can get this working but then I couldn't get the VPN Client to work.
Thank you.
The dynamic map is called clientmap
The static map is called mymapYou should have:
no card crypto not outmap 10-isakmp ipsec dynamic dynmap
map mymap 10-isakmp ipsec crypto dynamic clientmapinterface Ethernet1
crypto mymap mapFederico.
-
IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static
Hello
My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:
"Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)
NAT takes place before the encryption verification!
In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?
Thanks for any help
Best regards
Heiko
Hello
Try to change your static NAT with static NAT based policy.
That is to say the static NAT should not be applicable for VPN traffic
permissible static route map 1
corresponds to the IP 104
access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0
access-list 104 allow the host ip 10.1.110.10 all
IP nat inside source static 10.1.110.10 81.222.33.90 map of static route
HTH
Kind regards
GE.
-
Cisco SG300 / ASA 5505 intervlan routing problem
Dear all
I have a problem with the configuration correctly sg300 layer 3 behind the ASA 5505 switch (incl. license more security)
The configuration is the following:
CISCO SG300 is configured as a layer 3 switch
VLAN native 1: 192.168.1.254, default route ip address (inside interface ASA 192.168.1.1)
VLAN defined additional switch
VLAN 100 with 192.168.100.0/24, default gateway 192.168.100.254
VLAN 110 with 192.168.110.0/24, default gateway 192.168.110.254
VLAN 120 with 172.16.0.0/16, default gateway 172.16.10.254
Of the VLANS (100,110,120) different, I am able to connect to all devices on the other VIRTUAL local networks (with the exception of Native VLAN 1; is not the ping requests)
From the switch cli I can ping my firewall (192.168.1.1) and all the other gateways of VLANs and vlan (VLAN1, 100, 110, 120) devices
Asa cli I can only ping my switch (192.168.1.254) port, but no other devices in other VLAN
My question is this. What should I change or installation in the switch configuration or asa so that other VLANs to access the Internet through the ASA. I will not use the ASA as intervlan routing device, because the switch does this for me
I tried to change the asa int e0/1 in trunkport (uplink port switch also), to enable all the VLANS, but as soon as I do that, I can not ping 192.168.1.254 ASA cli more.
Any help is greatly appreciated
Concerning
Edwin
Hi Edwin, because the switch is layer 3, the only necessary behavior is to ensure that default gateways to the computer are set on the SVI interface connection to the switch to make sure that the switch is transfer traffic wished to the ASA.
The configuration between the ASA and the switch must stay true by dot1q, such as the vlan all other, unidentified native VLAN tagged.
Also, if I'm not wrong, on the SAA you must set the security level of the port to 100.
-Tom
Please evaluate the useful messages -
Need help with configuration on cisco vpn client settings 1941
Hey all,.
I just bought a new router 1941 SRI and need help with the configuration of the parameters of the VPN client. Orders aspect a little different here, as I'm used to the configuration of ASA and PIX for vpn, routers not...
If anyone can help with orders?
I need the installation:
user names, authentication group etc.
Thank you!
Take a peek inside has the below examples of config - everything you need: -.
http://www.Cisco.com/en/us/products/ps5854/prod_configuration_examples_list.html
HTH >
Andrew.
-
Newbie Help Needed: Cisco 1941 router site to site VPN traffic routing issue
Hello
Please I need help with a VPN site-to site, I installed a router Cisco 1941 and a VPN concentrator based on Linux (Sophos UTM).
The VPN is established between them, but I can't say the cisco router to send and receive traffic through the tunnel.
Please, what missing am me?
A few exits:
ISAKMP crypto to show her:
isakmp crypto #show her
IPv4 Crypto ISAKMP Security Association
DST CBC conn-State id
62.173.32.122 62.173.32.50 QM_IDLE 1045 ACTIVE
IPv6 Crypto ISAKMP Security Association
Crypto ipsec to show her:
Interface: GigabitEthernet0/0
Tag crypto map: QRIOSMAP, local addr 62.173.32.122
protégé of the vrf: (none)
local ident (addr, mask, prot, port): (192.168.20.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.2.0/255.255.255.0/0/0)
current_peer 62.173.32.50 port 500
LICENCE, flags is {origin_is_acl},
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 52, #pkts decrypt: 52, #pkts check: 52
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, #pkts compr. has failed: 0
#pkts not unpacked: 0, #pkts decompress failed: 0
Errors #send 0, #recv 0 errors
local crypto endpt. : 62.173.32.122, remote Start crypto. : 62.173.32.50
Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0
current outbound SPI: 0x4D7E4817 (1300121623)
PFS (Y/N): Y, Diffie-Hellman group: group2
SAS of the esp on arrival:
SPI: 0xEACF9A (15388570)
transform: esp-3des esp-md5-hmac.
running parameters = {Tunnel}
Conn ID: 2277, flow_id: VPN:277 on board, sibling_flags 80000046, crypto card: QRIOSMAP
calendar of his: service life remaining (k/s) key: (4491222/1015)
Size IV: 8 bytes
support for replay detection: Y
Status: ACTIVE
Please see my config:
crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
encryption... isakmp key address 62.X.X... 50
ISAKMP crypto keepalive 10 periodicals
!
!
Crypto ipsec transform-set esp-3des esp-md5-hmac TS-QRIOS
!
QRIOSMAP 10 ipsec-isakmp crypto map
peer 62.X.X set... 50
transformation-TS-QRIOS game
PFS group2 Set
match address 100
!
!
!
!
!
interface GigabitEthernet0/0
Description WAN CONNECTION
62.X.X IP... 124 255.255.255.248 secondary
62.X.X IP... 123 255.255.255.248 secondary
62.X.X IP... 122 255.255.255.248
NAT outside IP
IP virtual-reassembly in
automatic duplex
automatic speed
card crypto QRIOSMAP
!
interface GigabitEthernet0/0.2
!
interface GigabitEthernet0/1
LAN CONNECTION description $ES_LAN$
address 192.168.20.1 255.255.255.0
IP nat inside
IP virtual-reassembly in
automatic duplex
automatic speed
!
IP nat pool mypool 62.X.X... ... Of 122 62.X.X 122 30 prefix length
IP nat inside source list 1 pool mypool overload
overload of IP nat inside source list 100 interface GigabitEthernet0/0
!
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 2 allow 10.2.0.0 0.0.0.255
Note access-list 100 category QRIOSVPNTRAFFIC = 4
Note access-list 100 IPSec rule
access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 permit esp 62.X.X host... 50 62.X.X host... 122
access list 101 permit udp host 62.X.X... 50 62.X.X... host isakmp EQ. 122
access-list 101 permit ahp host 62.X.X... 50 62.X.X host... 122
access-list 101 deny ip any any newspaper
access-list 110 deny ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 110 permit ip 192.168.20.0 0.0.0.255 any
!
!
!
!
sheep allowed 10 route map
corresponds to the IP 110
The parts of the configuration you posted seem better than earlier versions of the config. The initial problem was that traffic was not in the VPN tunnel. That works now?
Here are the things I see in your config
I don't understand the relationship of these 2 static routes by default. It identifies completely the next hop and a mask the bytes of Middleweight of the next hop. Sort of, it seems that they might be the same. But if they were the same, I don't understand why they both make their appearance in the config. Can provide you details?
IP route 0.0.0.0 0.0.0.0 62.X.X... 121
IP route 0.0.0.0 0.0.0.0 62.172.32.121
This static route implies that there is another network (10.2.0/24) connected through the LAN. But there is no other reference to it and especially not for this translation. So I wonder how it works?
IP route 10.2.0.0 255.255.255.0 192.168.20.2
In this pair of static routes, the second route is a specific subnet more and would be included in the first and routes for the next of the same break. So I wonder why they are there are. There is not necessarily a problem, but is perhaps something that could be cleaned up.
IP route 172.17.0.0 255.255.0.0 Tunnel20
IP route 172.17.2.0 255.255.255.0 Tunnel20
And these 2 static routes are similar. The second is a more precise indication and would be included in the first. And it is referred to the same next hop. So why have the other?
IP route 172.18.0.0 255.255.0.0 Tunnel20
IP route 172.18.0.0 Tunnel20 255.255.255.252
HTH
Rick
-
Hello world
I need help.
On my cisco switch/router I created 4 VLAN using the underside of the interfaces
192.168.1.254 if ip address of the switch
port 1 which is vlan1 connected to my router Netgear WDNR4500 wireless
Port remains connected to the separate NICs on my VMWare Esxi host.
When I create VM in each individual communication vlan is fine and I can ping the virtual machines on different VLANs.
My problem is that I don't get any internet access from any device connected to the VLAN specified, with the exception of vlan1
If I ssh into my switch I am able to ping the dns servers of my ISP 194.168.4.100, for all other VLANs, but this is not possible.
Not really sure what I did wrong or what I need to access the internet for my vm.
In my netgear router, which is 192.168.1.1 I have configured the following routes of statis.
All the vm connected to different VLANs can ping 192.168.1.1, but it seems communication stops there, he cannot go beyond.
When I do a track of a virtual machine connected to the vlan 10, I get timeouts once received at 192.168.1.1
My laptop which is connected to 192.168.1 network is capable of tracert beyong my router.
If someone could help or provide feedback, it would be appreciated.
More information is needed please let me know, I am a novice, so why I don't know how to solve this problem.
Thanks to you all.
Hi houta, this is correct behavior. The default gateway should be the interface vlan Ip address.
If vlan 20 is 192.168.20.1 any machine linking in vlan20 gateway should then be 192.168.20.1
-Tom
Please mark replied messages useful -
Cisco router restarts randomly with Bus error
Cisco router restarts randomly with the following error:
System has been restarted by error of bus to PC 0x4183614C, speech 0 x 95848 at 09:30:28 UTC Tuesday, April 23, 2013
I've pasted below see the chimneys and release the version.
view the stacks
Minimum factory chimneys:
Format name / free
5396/6000 inspect Init Msg
Subsystem SPAN 5368/6000
58920/60000 EEM Auto record Proc
Automatic start of 4772/6000 upgrade process
DIB 5164/6000 error message
HAND OF SASL 5396/6000
4968/6000 LICENSE DEFAULT AGENT
5368/12000 Init
4216/6000 update prst
4384/6000 VPN_HW_MIB_CREATION
5188/6000 RADIUS INITCONFIG
Update process random rom 2128/3000
8356/12000 SSH process
Stats URPF 5316/6000
Interruption of battery level:
Level named format / unused
Network interfaces 1 1484828 6284/9000
2 3264990 8548/9000 DMA/Timer Interrupt
3 1 8388/9000 PA Int management Manager
Console 4 115 8612/9000 Uart
External interrupt 5 0 9000/9000
NMI 7 223352 8564/9000 interrupt handler
Spurious interrupts: 11
System has been restarted by error of bus to PC 0x4183614C, speech 0 x 95848 at 09:30:28 UTC Tuesday, April 23, 2013
Software of 2800 (C2800NM-ADVSECURITYK9-M), Version 12.4 (24) T, RELEASE SOFTWARE (fc1)
Technical support: http://www.cisco.com/techsupport
Updated Thursday 25 February 09 17:55 by prod_rel_team
Image text-base: 0 x 40011240, database: 0x42B41940
The failure of the system stack trace:
FP: 0X472252B8, RA: 0X4183614C
FP: 0 X 47225310, RA: 0X418312F8
FP: 0 X 47225348, RA: 0X41647DC0
FP: 0X472253A8, RA: 0X4164A8F4
FP: 0 X 47225428, RA: 0X4164B248
See the version
Cisco IOS software, 2800 Software (C2800NM-ADVSECURITYK9-M), Version 12.4 (24) T, RELEASE SOFTWARE (fc1)
Technical support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Updated Thursday 25 February 09 17:55 by prod_rel_team
ROM: System Bootstrap, Version 12.4 (1r) [hqluong 1r], RELEASE SOFTWARE (fc1)
availability of Cisco is 28 minutes
System returned to ROM by bus to the 0x4183614C PC error, address 0 x 95848 at 09:30:28 UTC Tuesday, April 23, 2013
System image file is "flash: c2800nm-advsecurityk9 - mz.124 - 24.T.bin".
This product contains cryptographic features and is under the United States
States and local laws governing the import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third party approval to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. laws and local countries. By using this product you
agree to comply with the regulations and laws in force. If you are unable
to satisfy the United States and local laws, return the product.
A summary of U.S. laws governing Cisco cryptographic products to:
http://www.Cisco.com/WWL/export/crypto/tool/stqrg.html
If you need assistance please contact us by mail at
Cisco 2821 (revision 53.51) with 1036288K / 12288K bytes of memory.
Card processor ID FCZ1017732F
2 gigabit Ethernet interfaces
2 modules of virtual private network (VPN)
Configuration of DRAM is wide with parity 64-bit capable.
239K bytes of non-volatile configuration memory.
250880K bytes of ATA CompactFlash (read/write)
Configuration register is 0 x 2102
You want to use the tool interpreter of output for this work:
http://www.Cisco.com/pcgi-bin/support/OutputInterpreter/home.p
For more information about the resolution of crashes, see this article:
http://www.Cisco.com/en/us/products/HW/IAD/ps397/products_tech_note09186a00800b4447.shtml
In this case, it looks like CSCsy09250, described here:
http://www.Cisco.com/en/us/products/CSA/Cisco-SA-20100324-SCCP.html
You should contact Cisco for the software updated by following the instructions of this bulletin.
That crash possibly caused by part of sone intentionally sends out packets malformed to your device, so if you have reason to believe that someone in your community could run metasploit or similar "Penetration Testing" tools, you can look into that as well.
-
Client VPN Cisco ASA 5505 Cisco 1841 router
Hello. I'm doing a connection during a cisco vpn client and a vpn on one server asa 5505 behind a 1841 router (internet adsl2 + and NAT router).
My topology is almost as follows
customer - tunnel - 1841 - ASA - PC
ASA is the endpoint vpn (outside interface) device. I forward udp port 500 and 4500 on my router to the ASA and the tunnel rises. I exempt nat'ting on the asa and the router to the IP in dhcp vpn pool. I can connect to my tunnel but I can't "see" anything in the internal network. I allowed all traffic from the outside inwards buy from the ip vpn pool and I still send packets through the tunnel and I get nothing. I take a look at the statistics on the vpn client and I 2597 bytes (ping traffic) and there are no bytes. Any idea?
Where you you logged in when you took the "crypto ipsec to show his"? If this isn't the case then try again, also this option allows IPSEC over UDP 4500 and it is disabled, enable it.
ISAKMP nat-traversal crypto
Just enter the command as it is, then try to connect again after activation of this option and get the same result to see the.
-
Support stand not provided my replacement WRT-ngn350 - need help with Cisco contact
Hello!
I'm starting to feel like Michael Douglas in the movie Falling Down and need help.
History:
Finally, I sent to my bad WRT-ngn350 router and when I got the replacement of all but the plastic leg support has been included. I want to have my router stand up to save desktop space, but now I have no foot."OK, should not be difficult to get Linksys to send me the missing foot stand" was my thought. Now, I called the online RMA and also emailed them and I get a similar response as Michael Douglas took with a smile
I hear that I can't get the part because it is not on the list the content of the product. As this is * my * problem. I want the part and do not care if it's on a list or not. It is the part on the router in the image. I even asked the representative of Linksys to Google a little bit WRT-ngn350 and there are foot stands on almost all of the images and it is certainly included in the box. I was told that I could go nowhere elsewhere to help with that. I really some doubt but fail to find a channel of Linksys, which may be able to help.
If some representative of Linksys sees this please help me!
Thanks, Niklas
RMA XXXXX - lack of router support/foot
(Mod Note: under the guidance of the compliance of the directive.) E-mail deleted conversation.)
SOLVED!
The representative of Linksys has managed to dig a booth for me to a warehouse. It is mentioned that it is a unique thing because some parts should be sent. Don't forget to remove the stand and send only: router, power and eventually cable NW.
Thanks to Linksys representative.
-
Drop ' n Go subnet to breast pre-existing network - Help with routing please
Hi all
I consider myself the best entry level when it comes to the Cisco ASA 5505, and I appreciate help or direction that someone would be able to provide regarding this question, I'll have. I'm sure there is something out there for this, but I was still not able to understand this with what I found.
We currently have our installation of infrastructure like this: modem(69.14.72.6/255.255.255.248)-> ASA (192.168.1.1)-> Switch-> hosts and Servers(192.168.0.X\24).
What I'm trying to do is to drop in a small router somewhere within this network with its own subnet and be able to communicate back him 192.168.0.X network, so it will look something like this: modem-> ASA-> Switch-> hosts and Servers(192.168.0.X\24) & hosts and Servers(192.168.1.X\24).
I will allow this traffic if all goes well, then that only have 2 interfaces configured on the SAA (0/0 and 0/1-0/5 inside) outside and without changing the configuration of the switch. A few key phrases that come to mind from my research so far are "Hair pin" and "permit same-security-traffic intra-interface". Also, I am aware of the port-forwarding and as I understand it would not as convenient to configure a rule for each device connected to the 192.168.1.X\24 network.
I hope someone can help me with this question, I've been at this for 3 weeks now.
Thanks again to all!
EDIT: Here is a diagram to help explain what I'm trying to do. The area in red is what I'm trying to add to the others that I already have.
Hi James,
For the route between the 2 networks, that you will need to either use a layer 3 switch or a "router on a stick".
Installation of a layer 3 switch would interrupt less to your existing network.
You are then ASA "inside" interface--> Layer 3 Distribution Switch--> 2 or more switches to access
Maybe you are looking for
-
Memory should what upgrade I buy for my Satellite Pro A60?
Hi, I have a Satellite Pro A60 PSA65E, who currently has 192 MB of RAM and 2.8 GHz Celeron processor. My problem came when I tried to install Adobe Creative Suite 2 on it, but it would not allow me to do so because he needed 384 MB of RAM to run it.
-
The update that HP did on my computer - brand new HP with Windows 10 broke my wireless adapter. Intermittently, it disables it. Also internet is slow sometimes before all the locks to the top (I use the latest browser Chrome - same problem is in inte
-
Equium L20-264: how to get the restore CD
When I bought my laptop, I him have been repackaged from a local retailer. I have been having some problems with it recently and think that I really need to do a complete restore of the system. Only problem my laptop did come with restore disks, anyo
-
Satellite L300 - IP-Configuration invalid
I just upgraded my Vista Home Premium to Windows 7 Home Premium. I have good connection with my WIFI but can't get on the internet. The diagnsotics tool returns the following problem... "doesn't have an IP Configuration". valid I tried other wireless
-
Can after get values a RGB pixel, hoe I write the name of the color?
Team, I'm quite new to LabVIEW and I'm working on an application using USB webcam to capture the color of the object. So far, it's finished, but now I need to write the name of the color on the screen. Please, could someone help identify if IMAQ or L