Hello ketansoni1, I would like help you but I don't have enough time now. I think the best and quickly option is that you search in Google some examples of high level network design and then you modify it with your own data. Here there is a sample HLD: http://core0.staticworld.net/downloads/idge/imported/article/nww/2007/07/template.pdf And here a lot Cisco's stencil. http://www.cisco.com/c/en/us/about/brand-center/network-topology-icons.html http://www.cisco.com/c/en/us/products/visio-stencil-listing.html Best regards.- ... View more

Hello, I think that you must keep in mind many factor for choose the right Firewall. But doubtlessly you have to know what kind of traffic will pass to match the throughput. In this link you can compare the differents firewalls: https://apps.cisco.com/ccw/cpc/guest/content/ucsSeriesDetails/series_asa5500 Regards. ... View more

Hi, thanks for the post. These are helpful tools. The link Cisco Technical Services Newsletter doesn't work for me, do you know if changed? Regards.- ... View more

Hi! You are right, this flow should not be caught by the ASA. But if you have the log it's because something is wrong with the configuration. This is the description of the message: Error Message %ASA-2-106001: Inbound TCP connection denied from IP_address/port to IP_address/port flags tcp_flags on interface interface_name Explanation An attempt was made to connect to an inside address is denied by the security policy that is defined for the specified traffic type. The IP address displayed is the real IP address instead of the IP address that appears through NAT. Possible tcp_flags values correspond to the flags in the TCP header that were present when the connection was denied. For example, a TCP packet arrived for which no connection state exists in the ASA, and it was dropped. The tcp_flags in this packet are FIN and ACK. The tcp_flags are as follows: ACK—The acknowledgment number was received FIN—Data was sent PSH—The receiver passed data to the application RST—The connection was reset SYN—Sequence numbers were synchronized to start a connection URG—The urgent pointer was declared valid Is the issue always with these two IP? It may be that the problem comes for this reason. Remember, the ASA5505 is a mix of switch and firewall. When you ran "show arp". Do you see OK the table ARP? Maybe the moving of the laptop makes some noise with arp , xlate or conn. Check this command: packet-tracer input inside tcp 192.168.2.210 1245 192.168.2.200 7680 Do you have NAT to the flow by internet? Is the connection denied by spoofing? Regards.- ... View more

Hi marc@taylorcorp.co.nz! 1) The inside interface is 192.168.2.0/24 and I can ping and remote desktop all machines on the inside interface. What device do you have? If you have a net /24 all traffic should communicate by layer 2, so it is okay that you have all permitted. . 2) The dst machine is more often than not 192.168.2.200 which is always connected to the network (wifi). Which is the interface wifi, inside too? 3) The dst port is always 7680 which appears to be used for windows 10 updates?? I don't know what is this port. Run the follows commands: show running-config same-security-traffic To check if you've permit communication in and out the same interface. It is used generally in environments of VPN. show route | grep 192.168.2. To check if both hosts are in the same interface, that it should be "inside". show arp | grep 192.168. To check the layer 2. Regards. ... View more

Excelente idea!. Seria interesante que el concurso se haga regularmente durante el año. Saludos.- ... View more

Hi  handsy , you may try with: object network OBJ-10.92.200.1 subnet 10.92.200.1 255.255.255.255 nat (inside,outside) source static any OBJ-66.77.88.1 destination static OBJ-10.92.200.1 OBJ-10.92.200.1 Kind regards.- PS: Please don't forget to rate and mark as correct answer if this answered your question  ... View more

Hi Raimund Schimanovits , Only for ICMP, if you match correctly source and destination on the ACL, this should work. Also, you can check with packet tracer if traffic is matching with ACL. Regards.- ... View more