Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Alex Samad
Stats
Member since
12-27-2011
38
Posts
0
Helpful
0
Solutions
02-28-2015
11:31 PM
Hi I have a asa5520, with 8.5 on it. I am having issues setting up multicast routing through the device. when i test to see if PIM packets can make it to my inside interface, it seems to fail on reverse path check ! But 10.10.10.4 is direct attached packet-tracer input ybman19 rawip 10.10.10.4 103 224.0.0.13 detailed Phase: 1 Type: FLOW-LOOKUP Subtype: Result: ALLOW Config: Additional Information: Found flow with id 227703752, using existing flow Module information for forward flow ... snp_fp_inspect_ip_options snp_fp_mcast snp_sp_mcast snp_fp_punt <IPv4 PIM> snp_fp_adjacency snp_fp_fragment snp_ifc_stat Module information for reverse flow ... Result: input-interface: ybman19 input-status: up input-line-status: up Action: drop Drop-reason: (security-failed) Early security checks failed My setup is ext router VV DMZ VLAN VV ASA5520 VV MAN Network VV Int Router VV WAN link VV secondary rtr VV test vlan Test box on the test vlan. I have had this boxed directly attached to the DMZ vlan and it can setup and start to receive MC traffic from my provider when i test it on the test vlan, I can see IGMPv2 to the secondary rtr, it talks to the int router via pim. But I see nothing on the ASA. for the inter rtr have a manual RP -> 10.10.10.1 (ASA5520). The asa has a rp-address points to the ext rtr. The ASA seems to be blocking or ??? I have tried to setup a static IGMP request on the RP, but still nothing on the ext rtr .. help :)
... View more
- Tags:
- multicast pim igmp
Labels:
10-10-2014
01:52 PM
I have 2 ASA 5520 setup in routed failover cluster. The primary active unit has all the right information. The secondary standby unit seems to have the right routing info but when i log in there and attempt to ping something not on a local connected network it fails. sh ro show me the same route table as the primary active unit. This used to work. it seemed to stop working around the time i did some fail over testing. Now I can't seem to ping it from remote locations, which is interesting as I can ssh to it !
... View more
- Tags:
- #5520 #ASA
Labels:
05-09-2014
11:47 PM
Hi I have 2 OSPF process on my ASA5520 but have backbone areas, but there doesn't seem to be a way to allocate interface to specific OSPF processes. I am running 8.4(7)
... View more
Labels:
04-05-2014
04:05 AM
I thought I would follow up just in case there are others out there who would like to do this. I did find another name for it apart from identity NAT, ... NAT exemption. So basically what I want the ASA to do on an external interface with publicly routable /24 So now I have the ASA on 1 interface *) with ip address assigned to the interface *) arp replying for Object NAT *) arp replying for Identity NAT and it is using the routing table not the assign interface ! (this covered it https://supportforums.cisco.com/document/44566/asa-83-nat-exemption-example-basic-l2l-vpn-and-basic-ra-vpn) the last one allows for some of the range to route internally !
... View more
03-25-2014
08:50 PM
Hmm well currently it is my default gw for a lot of my networks, it used to be the dgw for all, but I am moving internal/core stuff off it. So I agree its not sold as a router, but it definitely does route. So from my reading what I am planning is actually possible, again I could wrong, I will wait and see if any one else can add or untill I get some time to try it. if you check out the nat identity examples they say you can, but they examples don't include object nat and object identity nat http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/asdm63/configuration_guide/config/nat_overview.html#wp1102289 undery identity NAT, but its not 100% clear for my scenario thanks for you input EDIT: note the /32 is nothing special, i believe it is CISCO best practise for routerID's... This is assignig a /32 to a loopback address and advertising via a routing protocol
... View more
03-25-2014
07:58 PM
Hmm Interesting I already have this setup. I have a /32 on a loop back interface on an internal router/nat box, internally I am using ospf to propogate the route... as its a /32 its on that address that is being routed and not the whole subnet. I am doing my NAT closer to where I need it and not on the outside firewall (asa5520) from my reading of the nat stuff on the asa, identity nat will force the ASA to stop looking at any other nat rules and drop down into the routing table. My concern is I don't really have a test bed so was hoping to see if any one has done the same thing. Which bascially is some of the /24 is object nat'ed and some is identity object nat'ed
... View more
03-25-2014
05:50 PM
Hi I have a class c 1.2.3.0/24 that i have on the internet side of my asa5520 currently I use object nat to translate 1.2.3.x to inside addresses like 10.10.24.x I want to route one of these addresses inside now so 1.2.3.10 is NAT to 10.10.10.24 1.2.3.11 is to be routed inside via the route table. so can I setup a identity nat (can i do that with object nat ?) Will this reply to arp request on the outside. So the ASA will arp reply for 1.2.3.10 in the above example will it also arp reply to 1.2.3.11 ta Alex
... View more
Labels:
02-14-2014
05:46 PM
Nope found this Order of NAT Rules. – Network object NAT—Automatically ordered in the NAT table. – Twice NAT—Manually ordered in the NAT table (before or after network object NAT rules). I have a network onbject nat rule object network dev.yieldbroker.com host 192.168.21.21 nat (dmzrp,any) static 1.2.3.129 service tcp 10001 https what i want is any one that comes from interface man that goes to 1.2.3.129, need to be src natted, then i want the above rule to kick in not sure how I am going to to this
... View more
02-13-2014
07:57 PM
Hi I have a ASA5520, that was the core firewall for inside and outside, default gateway etc etc... my internal addresses are 192.168.0.0/16 - broken into /24's my public internet address 1.2.3.0/24 I have quiet a few network object nats object network www host 192.168.10.20 nat (dmzrp,any) static 1.2.3.9 service tcp 10001 https so dmzrp is where I have my reverse proxies. I also have this at the top of the list nat (any,any) source static inside-net inside-net destination static inside-net inside-net no-proxy-arp object network inside-net subnet 192.168.0.0 255.255.0.0 Now I am in the process of moving to another router for my core routing so a lot of vlan's ip networks are moving off the asa5520 I have an interface called MAN it connect to a share network, where I run ospf I have my new router connected here. so when I try to connect to the www address about 192.168.20.10 -> 1.2.3.9:443 the forward packet gets to 192.168.10.20, but the source address is 192.168.20.10, which routes back to the original server without going via the asa5520 to un NAT it, so it fails. So I presume I need to twice NAT ? I was going to do some thing like object network in_nat_src host 1.2.3..13 object-group network public-network network-object 1.2.3.0 255.255.255.0 nat (internet,man) source dynamic inside-net in_nat_src destination static public-network public-network no-proxy-arp nat (any,any) source static inside-net inside-net destination static inside-net inside-net no-proxy-arp I don't really have a asa to test on. But my presumption is that will set my src address and then the object network will then work, so from my reading thats nat is stage 1 and object network is stage 2
... View more
Labels:
01-21-2014
08:53 PM
Hi I currently have on my router interface GigabitEthernet0/0/2 shutdown ! interface GigabitEthernet0/0/3 description sw1 no interface Vlan1 description to single link ip address 2.4.2.253 255.255.255.0 no ip redirects standby 0 ip 2.4.2.254 standby 0 priority 105 standby 0 preempt standby 0 authentication md5 key-string XXXX standby 0 name net1 I want to change it to interface Port-channel 1 description "LAG to sw1" interface GigabitEthernet0/0/2 shutdown no shutdown channel-group 1 mode on interface GigabitEthernet0/0/3 description sw1 channel-group 1 mode on no interface Vlan1 interface Vlan10 description to YB firewall ip address 2.4.2.253 255.255.255.0 no ip redirects standby 0 ip 2.4.2.254 standby 0 priority 105 standby 0 preempt standby 0 authentication md5 key-string XXXX standby 0 name net1 I want to limit the lag to vlan 10 traffic. On the switch I have interface Port-channel2 description sw1 lag to router1 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk allowed vlan 10 bandwidth 2000000 interface GigabitEthernet1/0/12 description router1 gi0/0/2 no switchport access vlan channel-group 2 mode active interface GigabitEthernet1/0/21 description router1 Gi0/0/3 no switchport access vlan channel-group 2 mode active I have yet to try it, I am still missing the config to set the vlan to just 10 on the port-channel
... View more
- Tags:
- 2901
- lag
- port-channel
Labels:
01-13-2014
04:56 PM
Hi I have a ASA5500 that used to be the core router/firewall and I am in the process of moving the non internet facing routing/firewall away from it. I have come across an issue with, what seems to be a asym routing problem vlan67 is my WAN vlan - basically a bonded pair of ports on a switch to a L2 connection between site) I am using OSPF and vlan67 192.168.67.0/24 is area 0.0.0.0 at the other end is pair of routers handling OSPF and routing in that DC at my DC with the ASA I have vlan 68 - this is my internal vlan 192.168 .68.0/24 which is the interconnect with my main DC internal routers again with OSPF ASA5500 -> 192.168 .68.1 -> router A 192.168.68.2 router A is the DGW for network 192.168.69.0/24 and publishes this via 192.168.68.0/24 network The 192.168.69.0/24 is a management network .. I have VMWare VC here and other managemen box and iLo, Dracs etc.... I also tried to place the management port of the ASA5500 on here so 192.168.69.254 (&192.168.69.253 ... its a cluster) I have a tftp server on 192.168.69.7 when I am on console on the ASA5500 and run copy running t ftp://192.168.69.7/ <filename> it sometimes fails. it seems like it wants to send via OSPF route... so it has 2 paths to 192.168.69.0/24 1 via the direct connect management 0/0 (I tried this as a vlan on off one of the 1G ports as well) and 1 via 192.168.68.2 That really should be a problem I did think, but I saw no errors in the log I saw no packets on the 192.168.69.0 network ! the tftp would fail ... or work with an empty file The other annoying thing is that the VC 192.168.69.200 couldn't connect to any esxh hosts in the second data center. I believe the path was outgoing 192.168.69.200 -> 192.168.69.1 ..(routerA).. 192.168.68.2 -> 192.168.68.1 (asa5500) 192.168.17.1 -> 192.168.17.2 (other DC) return (other DC) 192.168.17.2 -> 192.168.17.1 (ASA5500) 192.168.69.254 -> 192.168.69.200 the ASA knows about the directly connect path and i think its having issues with that. But again no error messages in the log ! So I am stuck ... I do have plans on bring the WAN interface over to router A, but I want to make sure its an issue with ASA5500 and I would like to understand what the issue is... Why did the tftp fail ! Thanks Is this the right forum ???
... View more
Labels:
11-05-2013
10:03 PM
OKay, so I applied the configuration to each interface and remove the network command from the router ospf 2 config then i added in a area 10.172.0.0 range 10.172.0.0 255.255.0 to ospf 1 and now only the summary address is being broadcast back to the backbone Thanks
... View more
11-05-2013
09:49 PM
No they are not, should I have an entry in the interface for them so i was reading that there is 2 ways to do it. 1) with the network commen in the router ospf statement or 2) ip ospf in the interface definition I think 2 is the prefered way yes ?
... View more
11-05-2013
08:51 PM
Hi Thanks looks like I am nearly there this is what i used no ip prefix-list FilterOut seq 10 ip prefix-list FilterOut seq 10 permit 10.172.0.0/16 le 32 no route-map 10_172_ONLY route-map 10_172_ONLY permit 10 match ip address prefix-list FilterOut no route-map filter_ospf1 route-map filter_ospf1 deny 10 match tag 1 route-map filter_ospf1 permit 20 no route-map filter_ospf2 route-map filter_ospf2 deny 10 match tag 2 route-map filter_ospf2 permit 20 no router ospf 1 router ospf 1 router-id 10.31.19.253 log-adjacency-changes area 0.0.0.0 authentication message-digest redistribute ospf 2 subnets tag 1 route-map 10_172_ONLY network 10.31.19.0 0.0.0.255 area 0.0.0.0 distribute-list route-map filter_ospf2 in no router ospf 2 router ospf 2 router-id 10.172.255.2 log-adjacency-changes area 10.172.0.0 authentication message-digest area 10.172.0.0 nssa redistribute connected redistribute ospf 1 subnets tag 2 network 10.172.201.0 0.0.0.255 area 10.172.0.0 network 10.172.202.0 0.0.0.255 area 10.172.0.0 network 10.172.203.0 0.0.0.255 area 10.172.0.0 network 10.172.204.0 0.0.0.255 area 10.172.0.0 network 10.172.205.0 0.0.0.255 area 10.172.0.0 network 10.172.207.0 0.0.0.255 area 10.172.0.0 network 10.172.208.0 0.0.0.255 area 10.172.0.0 network 10.172.212.0 0.0.0.255 area 10.172.0.0 network 10.172.213.0 0.0.0.255 area 10.172.0.0 network 10.172.250.0 0.0.0.255 area 10.172.0.0 network 10.172.255.2 0.0.0.0 area 10.172.0.0 distribute-list route-map filter_ospf1 in problem ! sh ip ospf 1 database only shows me 10.172.209.0 10.31.19.252 15 0x80000001 0x003AAC 1 10.172.209.0 10.31.19.253 34 0x80000001 0x0034B1 1 10.172.255.2 10.31.19.252 15 0x80000001 0x00CFEF 1 10.172.255.3 10.31.19.253 34 0x80000001 0x00BFFD 1 10.172.255.6 10.31.19.252 15 0x80000001 0x0002B0 1 10.172.255.6 10.31.19.253 34 0x80000001 0x00FBB5 1 10.172.255.7 10.31.19.252 15 0x80000001 0x00F7B9 1 10.172.255.7 10.31.19.253 34 0x80000001 0x00F1BE 1 so .6 .7 .2 .3 are routerid, 209 is the network not directly attached to this switch, but all the directly attached ones are not there I have tried redistribute connected in router ospf 2 but that didn't help ..
... View more
02-28-2015
Hi I have a asa5520, with 8.5 on it. I am having issues setting up
multicast routing through the dev...
10-10-2014
I have 2 ASA 5520 setup in routed failover cluster. The primary active
unit has all the right inform...
05-09-2014
Hi I have 2 OSPF process on my ASA5520 but have backbone areas, but
there doesn't seem to be a way t...
04-05-2014
I thought I would follow up just in case there are others out there who
would like to do this.I did ...
03-25-2014
Hmmwell currently it is my default gw for a lot of my networks, it used
to be the dgw for all, but I...
03-25-2014
Hmm Interesting I already have this setup. I have a /32 on a loop back
interface on an internal rout...
03-25-2014
Hi I have a class c 1.2.3.0/24 that i have on the internet side of my
asa5520 currently I use object...
02-14-2014
Nopefound thisOrder of NAT Rules. –Network object NAT—Automatically
ordered in the NAT table. –Twice...
02-13-2014
HiI have a ASA5520, that was the core firewall for inside and outside,
default gateway etc etc...my ...
01-21-2014
HiI currently have on my routerinterface GigabitEthernet0/0/2
shutdown!interface GigabitEthernet0/0/...
01-13-2014
HiI have a ASA5500 that used to be the core router/firewall and I am in
the process of moving the no...
11-05-2013
OKay, so I applied the configuration to each interface and remove the
network command from the route...
11-05-2013
No they are not, should I have an entry in the interface for them so i
was reading that there is 2 w...
Public Statistics
| Date Registered | 12-27-2011 02:39 PM |
| Date Last Visited | 08-18-2017 03:54 AM |
| Total Messages Posted | 38 |
