How to open all ports through a VPN

I'll put up a second exchange server 2010 in a place of DR and a few problems.  The two sites are connected by a pair of ASA5510 via the VPN, point-to-point.  I want to exclude any possible VPN problems which maybe blocking ports and I wanted to know if there is an easy way to do it and just allow all unrestricted traffic between the two ASAs.  I have attached the configs recurees here... Ewing is the main site and DBSi's DR site.  I would appreciate help on this one!

Hello

Seems to me at least that they both have "sysopt" configuration which controls the VPN traffic entering the "external" to its default interface

And the default setting is that all traffic entering the ASA via a VPN connection will bypass the ACL attached to the "outside" interface

The command is "vpn sysopt connection permit". By default put in is not indicated when you issue the command 'show sysopt run '. So you can't really see in your running configuration.

Personally, if I don't get something not working after doing the settings, then I trust simply is newspapers that ASA sent to Syslog server or I followed the newspapers in real-time through ASDM.

If that gives no idea of what is the problem, I probably set up a capture on the ASA to confirm that when I see a link that I also see the return of traffic for this connection.

I also use the command of "packet - trace" often enough to verify that the appropriate NAT configuration is applied to the connection that a user tries.

Format of the command would be

entry Packet-trace

-Jouni

Tags: Cisco Security

Similar Questions

  • How to send all traffic through the VPN, RV082 material v3

    Hello

    I found this guide to send all traffic to RV042 branch to the RV082 of central office:

    https://supportforums.Cisco.com/servlet/JiveServlet/downloadBody/10261-102-1-22927/Small_Business_router_tunnel_Branch_to_Main.doc

    But this guide is for the material of v2. I tried and did not work, so I wonder if there are new modules for hardware v3 (firmware v4.2)

    I have a RV042 brach office connected through the VPN Tunnel work to a central office RV082. I want to route all traffic

    Office of brach in the RV082 from the central office.

    Thank you very much

    Oliver

    Hi Oliver, this is called esp wildcard forwarding (full tunnel).

    Here are a few useful topics

    https://supportforums.Cisco.com/message/3766661

    https://supportforums.Cisco.com/message/3816181

    -Tom
    Please mark replied messages useful

  • Send all traffic through the vpn tunnel

    Does anyone know how to send all traffic through the tunnel vpn on both sides?  I have a server EZVpn on one side and one EZVpn client on the other.  I'm not natting on each side.  I use the value default 'tunnelall' for the attributes of group policy.  On the client side all traffic, even if not intended for the subnet of the side server, seems to pass through the tunnel.  But if I ping the side server, the same rules don't seem to apply.  Traffic destined for rates aside customer through the tunnel, but the traffic that is not pumped on the external interface in the clear.  That's not cool.

    Hello

    Clinet traffic to server through tunnel, that's right, right?

    Traffic from server to client through tunnel, but the rest of the traffic is not, no?

    This works as expected because in ezvpn, politics of "tunnel all ' is for traffic is coming from the client., do not leave the server.

    Side server, customer traffic will pass through tunnel, the rest used.

    Sian

  • I can't figure out how to open the port of CD.

    * Original title: CD player

    I can't figure out how to open the port of CD. There are no buttons, and online forums have not helped. Any suggestions?

    Of course - just go on this PC (or computer) and r / click on the DVD/CD drive - you should see "eject" as shown below. Usually there will be a button in the center of the disc too... but sometimes well hidden tray! -Ric.

  • Allowing ports through a VPN tunnel question

    I have a VPN tunnel established and I can ping above but my application fails and I think its because I encouraged not 2 ports (ports TCP 19813 and 19814) through. I'm not clear how should I do for allowing these ports through. I need to add a statement to permit to access my list 'sheep' or what I need to add a statement of license to my list of access interface "external"?

    Remote users have an IP address of 172.16.5.x 24 and they're trying to connect to users on the 192.168.200.x 24 192.168.201.x 24. I can't do a ping of the 24 192.168.200.x to the 172.16.5.0/24.

    The commands below are what I currently have in my PIX.

    My current sheep-access list:

    IP 192.168.201.0 allow Access-list sheep 255.255.255.0 172.16.5.0 255.255.255.0

    IP 192.168.200.0 allow Access-list sheep 255.255.255.0 172.16.5.0 255.255.255.0

    My current outside of the access-list interface:

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq smtp

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq - ica citrix

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq 500

    acl_inbound esp allowed access list any host xx.xx.xx.xx

    acl_inbound list access permit icmp any any echo response

    access-list acl_inbound allow icmp all once exceed

    acl_inbound list all permitted access all unreachable icmp

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

    acl_inbound list access permit tcp any host xx.xx.xx.xx eq https

    first of all, you disable the commnad "sysopt connection permit-ipsec" on the pix? with this enabled command, which is enabled by default, the pix will ignore any ACLs for encrypted traffic. so if you have Hell no this command, then the acl that you applied on the outside int won't make a difference.

    However, if "sysopt connection permit-ipsec" is always on, and then all the port/protocol should be allowed.

    you said you could do a ping of 192.168.200.0 to 172.16.5.0. How about you 172.16.5.0 to 192.168.200.0 and 192.168.201.0?

    also, just wondering if the vpn lan-to-lan or access remote vpn (i.e. using the cisco vpn client).

  • How to open a port that is closed? Have Vista Home premium 64-bit

    I get this message when you try to get to oracle - OEM
    "Ip_address here" is not set up to establish a connection on port "5500" with this computer. The ip address is the address of the local host - all on a single pc.

    It was woprking then I changed my security/antivirus software and the port is closed.  I uninstalled the new software and the port is always closed.

    Hi Ames66,

    It happens more often because the firewall blocks the program and to allow that program to communicate through the firewall, you can usually do that by selecting the program on the Exceptions tab in Windows Firewall.

    If you have Windows Firewall on your computer, follow the steps in this link:

    Allow a program to communicate through Windows Firewall

    http://Windows.Microsoft.com/en-us/Windows-Vista/allow-a-program-to-communicate-through-Windows-Firewall

    Open a port in Windows Firewall

    http://Windows.Microsoft.com/en-us/Windows-Vista/open-a-port-in-Windows-Firewall

    If you use a third party firewall manually give exception to the program.

    Hope the helps of information. Please post back and we do know.

    Concerning
    Joel S
    Microsoft Answers Support Engineer
    Visit our Microsoft answers feedback Forum and let us know what you think.

  • Firewall: How to open a port tcp inside and out on a single line

    How can we combine the firewall command to open port 80 to tcp in and tcp out without having to publish twice?

    esxcfg-firewall - o 80, tcp, in, web

    esxcfg-firewall - o 80, tcp, out, web

    N ° because it is a completely different situation.

    When you open in port - allow you to access port 80 on the local computer from the network. When you open port - allow you to access port 80 on remote computers from the local computer. Usually there is no need to open the ports both in.

    ---

    MCSA, MCTS, VCP, VMware vExpert 2009

    http://blog.vadmin.ru

  • How to open the port 161 on the ASA and Cisco switches for monitoring of BB

    Dear all,

    I want to install BB to monitor snmptraps suffering of failure.

    The newspaper shows BB cannot connect to all ports of the switch 161, and I even can't telnet to 161 XXX_17f for example.

    My switches are Cisco C3550, C2950, etc. of the ASA.

    Mon 7 Nov 15:43:03 2011 bbnet cannot connect to the server XXX_17f on port 161

    Mon 7 Nov 15:43:03 2011 bbnet cannot connect to the server XXX_9f on port 161

    Mon 7 Nov 15:43:03 2011 bbnet can't connect to XXX server on port 161

    Thank you

    Anson

    no need to adjust anything in bb-hosts. If you have added setings in bb-hosts, delete them. Also remove associated in bbvar/logs log files. (otherwise, you'll have purple when you delete the SNMP, trap tags bb-hosts)

    A column of trap will be that no show until the device sends a trap to BB.

  • Unable to opena a port through Windows Firewall in Windows 7 Home Premium

    Original title: opening a port on Windows 7 Home Premium

    Each answer to this question does not apply to my pc because of this: when I open the Panel it is not a Security tab, but there is a tab to go directly to the firewall, and there is no button in the firewall to add a port.

    Any help would be massively appreciated, thanks :)

    Hello

    According to the description, I understand that you are not able to open a port in Windows 7 Home premium.

    Please follow the steps below to check if his help.

    1. Open Windows Firewall by clicking the Start button, click on the Control Panel, clicking Security, and then click Windows Firewall.

    2. On the left, click on advanced settings.

    3. On the left, click inbound rules. Then, on the right, under Actions, click the link of the new rule.

    4. Select the Port marked option and click Next.

    5. In the specific local Ports box, type the ports that you want to open, separated by commas, and then click Next. (For example, in this case, the TCP ports must be open are 418, 419, 420 and 421.) The wizard takes measures and open ports to receive data.)

    6. Select allow the connection, and click Next.

    7. Check the boxes for private or any other type of desired network and then click Next.

    8. Type a name (usually the name of any program to open). Click Finish.

    Hope this information is useful, if the problem persists please write us back with the quick information so that we can help you further.

  • In Microsoft 2010 how you open all the worksheets at the same time in a folder? 'Open all' is not an option on right click.

    I need to open a month with a value of Excel spreadsheets in a folder. The only way I can understand them open is to open one at a time. My old version of Microsoft has an option 'open all' when I highlighted all the & right click. This is not an option in the 2010 version. I can't imagine that this is not an option in the latest version. Am I missing something?

    Open Excel, and then click file and 'open '. Navigate to the folder containing your Excel files, and select all the worksheets, that you want to open. You can drag a rectangle around them, use control + click, or use SHIFT + click to select more than one. And then click Open. It should open all the excel files.

  • How to open all the text files in a folder at a time so that they cross my VI in good order and the VI should only be run once per file?

    Hello

    I am currently looking to browse hundreds of text files my VI to run the VI once and having labview to open each text file in the order numberical that are contained in a single folder.

    In general, I ran each file one at a time through the VI, hours to browse all text files. I'm wondering if there is a way I can specify a target folder and then open each text file in the target folder and walked through my VI in numberical order (each file is located in the order that is MM_01, MM_02, MM_03...). Currently I open a file at the same time, through "the spreadsheet read", then the index table, and then run through filters etc to get the data I need. I hope there is a way to do it, because he will save days of work.

    Thanks in advance for your help.

  • How to open a port and limit the range of addresses that use it on PIX 515?

    I have a Pix 515 v6.3 and a new piece of software that I'm getting soon need aura 5080 open port for incoming & outgoing HTTP traffic. The server will be in my DMZ to 10.0.0.1

    I would like to restrict inbound access to this port so that it can be used in 4 specific IP adderess foreign xxx.xxx.xxx.24 through xxx.xxx.xxx.27 and also, if possible, limit the outbound destination using this port to a single specific foreign IP address xxx.xxx.xxx.30.

    Could you please tell me the best way to do it.

    Thank you in advance for a relative novice to PIX.

    PIX (config) # access list acl-outside permit tcp host xxx.xxx.xxx.24 host MyWWWPublicIP eq 5080

    PIX (config) # access list acl-outside permit tcp host xxx.xxx.xxx.25 host MyWWWPublicIP eq 5080

    PIX (config) # access list acl-outside permit tcp host MyWWWPublicIP eq xxx.xxx.xxx.26 host 5080

    PIX (config) # access list acl-outside permit tcp host MyWWWPublicIP eq xxx.xxx.xxx.27 host 5080

    PIX (config) # access - group acl-outside in interface outside

    PIX (config) # access list acl - dmx permit tcp host 10.0.0.1 xxx.xxx.xxx.30 eq 5080

    PIX (config) # access - group acl - dmz dmz interface

    static (inside, outside) MyWWWPublicIP 10.0.0.1 netmask 255.255.255.255 0 0

    See also:

    PIX 500 series firewall

    http://www.Cisco.com/pcgi-bin/support/browse/psp_view.pl?p=hardware:PIX & s = Software_Configuration

    Configuration of the PIX Firewall with access to the Mail Server on the DMZ network

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008015efa9.shtml

    sincerely

    Patrick

  • How to open a port on VCSA 6.0?

    I try to open a specific TCP port on the firewall on vCenter Server Appliance 6.0. I found the documentation here , but it doesn't seem to allow me to specify a port. When I telnet to my VCSA from the IP address, the port times out.

    root @ < Server >: ~ # telnet < vcsa > < tcp port >

    Try < vcsa >...

    Telnet: connect to address < vcsa >: operation timed out

    Telnet: unable to connect to the remote host

    The thing turns out to be the command IPTABLES

  • I try to open my ports for games on CoD4

    I've seen XP how to open ports manually, but there is not a Vista one. Help, please!

    Hello

    If you have a router, you must open the port through the router first.

    Native Firewall for Vista here, http://windows.microsoft.com/en-US/windows-vista/Open-a-port-in-Windows-Firewall

    Jack-MVP Windows Networking. WWW.EZLAN.NET

  • Open all relays on NI2569 using DAQmx in Labview2009

    How to open all relays on a map of 2569 with DAQmx in LV2009?

    I looked at the help and it says select (using shiiping examplecontrol witch individual relay) BROWSE from the dropdown under the relay.

    Then that's it!  I tried 'CTRL' then the channels I wanted... nothing...  I tried 'SHIFT', then the channels I wanted... still nothing.

    I think that the help file is missing something!

    See attachment.


Maybe you are looking for