Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About uber_cookie
Stats
Member since
11-19-2007
10
Posts
5
Helpful
1
Solution
08-14-2012
01:46 AM
Hi Could anyone tell me why this statement does not work? (No real IPs useD) DMZ Interface is 10.0.0.1/24 nat (outside,dmz) source dynamic any interface destination static OBJECT-01 OBJECT-01 ! object network OBJECT-01 host 10.0.0.2 nat (dmz,outside) static 1.1.1.1 dns Also tested: nat (outside,dmz) source dynamic any interface destination static OBJECT-01-out OBJECT-01-in ! object network OBJECT-01-out host 1.1.1.1 ! object network OBJECT-01 host 10.0.0.2 nat (dmz,outside) static 1.1.1.1 dns It works fine as following: nat (outside,dmz) source dynamic any PAT-DMZ destination static OBJECT-01-out OBJECT-01-in ! object network OBJECT-01-out host 10.0.0.254 ! object network OBJECT-01-out host 1.1.1.1 ! object network OBJECT-01 host 10.0.0.2 nat (dmz,outside) static 1.1.1.1 dns Thank you
... View more
Labels:
02-28-2011
03:24 AM
Current version below, I have tried them all 8.2 and 8.3 the minute I enable botnet it crashes after 30-1hour, this firewall was rebooted 1 day again, it was stable for 98days with botnet disabled so it cannot be hardware. Result of the command: "sh version" Cisco Adaptive Security Appliance Software Version 8.4(1) Device Manager Version 6.4(1) Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz Internal ATA Compact Flash, 128MB BIOS Flash M50FW016 @ 0xfff00000, 2048KB Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0) Boot microcode : CN1000-MC-BOOT-2.00 SSL/IKE microcode : CNLite-MC-SSLm-PLUS-2.03 IPSec microcode : CNlite-MC-IPSECm-MAIN-2.06 Number of accelerators: 1 Licensed features for this platform: Maximum Physical Interfaces : 8 perpetual VLANs : 20 DMZ Unrestricted Dual ISPs : Enabled perpetual VLAN Trunk Ports : 8 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Standby perpetual VPN-DES : Enabled perpetual VPN-3DES-AES : Enabled perpetual AnyConnect Premium Peers : 2 perpetual AnyConnect Essentials : Disabled perpetual Other VPN Peers : 25 perpetual Total VPN Peers : 25 perpetual Shared License : Disabled perpetual AnyConnect for Mobile : Disabled perpetual AnyConnect for Cisco VPN Phone : Disabled perpetual Advanced Endpoint Assessment : Disabled perpetual UC Phone Proxy Sessions : 2 perpetual Total UC Proxy Sessions : 2 perpetual Botnet Traffic Filter : Enabled 240 days Intercompany Media Engine : Disabled perpetual
... View more
02-27-2011
03:55 AM
Hi, I have a problem with my ASA5505 after enabling botnet filter my ASA reboots. Also while booting it usualy takes around 30minutes of random cycles before loading the OS. It seems to be falling at the license check. To fix the boot I usualy unplug the ASA for about 15minutes and then it will boot up fine. Any ideas of what may cause this issue, or how to fix/troubleshoot it? Thank you, Cookie
... View more
Labels:
Created by
uber_cookie
in Network Security
in Network Security
02-23-2011
12:40 AM
02-23-2011
12:40 AM
I am aware of these commands my issue would be if someone has made changes to the standby and primary and did not save the configuration across using wr active or wr stanby. Simply put, Active access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http access-list inside_in extended permit tcp host 1.0.0.0 host 1.0.0.0 eq http access-list inside_in extended permit host 5.0.0.0 host 5.0.0.0 eq http Standby access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http access-list inside_in extended permit tcp host 7.0.0.0 host 7.0.0.0 eq http access-list inside_in extended permit ip object-group A-SERVERS object-group MORE-SERVERS eq PORTS This is minor expample but when multiplied by 10 or more makes it dificult to troubleshoot PS As for comparing offloaded configs to a file I have always relied on Notepad++ compare extension
... View more
Created by
uber_cookie
in Network Security
in Network Security
02-22-2011
11:51 PM
02-22-2011
11:51 PM
Just want to check, is there a command that will compare configuration of Active and Standby unit or at least indicate out of sync configuration. For some reason I think there was or is...
... View more
Labels:
Created by
uber_cookie
in Network Security
in Network Security
02-22-2011
11:47 PM
02-22-2011
11:47 PM
ICMP Inspection An ICMP inspection session is on the basis of the source address of the inside host that originates the ICMP packet. Dynamic Access Control Lists (ACLs) are created for return ICMP packets of the allowed types (echo-reply, time-exceeded, destination unreachable, and timestamp reply) for each session. There are no port numbers associated with an ICMP session, and the permitted IP address of the return packet is wild-carded in the ACL. The wild-card address is because the IP address of the return packet cannot be known in advance for time-exceeded and destination-unreachable replies. These replies can come from intermediate devices rather than the intended destination. http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ftfwicmp.html UDP and ICMP do not themselves contain any connection information (such as sequence numbers). However, at the very minimum, they contain an IP address pair. UDP also contains port pairs, and ICMP has type and code information. All of these data can be analyzed in order to build "virtual connections" in the cache. For instance, a cache entry will be created by any UDP packet which originates on the LAN. Its IP address and port pairs will be stored. For a short period of time, UDP packets from the WAN which have matching IP and UDP information will be allowed back in through the firewall. http://www.ssimail.com/Stateful.htm
... View more
08-31-2010
06:00 AM
Yep so for example inside_tunnel will only be accessible from the inside interface
... View more
08-31-2010
02:59 AM
08-02-2010
06:30 AM
We are actually looking in permitting the games, but it is difficult to make the actual connections secure since majority of the ports that need to be open for games can be abused for p2p. To make things even worst WoW uses torrent to update itself. Other vendors such as SonicWall offer built-in signatures for that, but since we are running Cisco environment we would prefer to stay with Cisco.
... View more
08-02-2010
12:25 AM
Hi guys, Does Cisco have any pre-defined application inspection regexes for video games such as World of Warcraft, Steam, PlayStation Network, etc… Or is there a community site where these could be obtained? Thank you.
... View more
Labels:
08-14-2012
Hi Could anyone tell me why this statement does not work? (No real IPs
useD) DMZ Interface is 10.0.0...
02-28-2011
Current version below, I have tried them all 8.2 and 8.3 the minute I
enable botnet it crashes after...
02-27-2011
Hi,I have a problem with my ASA5505 after enabling botnet filter my ASA
reboots.Also while booting i...
02-23-2011
I am aware of these commands my issue would be if someone has made
changes to the standby and primar...
02-22-2011
Just want to check, is there a command that will compare configuration
of Active and Standby unit or...
Created by
uber_cookie
in Network Security
02-22-2011
02-22-2011
ICMP InspectionAn ICMP inspection session is on the basis of the source
address of the inside host t...
08-31-2010
Hi,I was wondering can you limit on who can access VPN. if you have 2
interfaces for example inside ...
08-02-2010
/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table
Normal"; mso-tstyle-rowband-size...
Public Statistics
| Date Registered | 11-19-2007 02:17 AM |
| Date Last Visited | 08-18-2017 03:54 AM |
| Total Messages Posted | 10 |
| Total Helpful Votes Received | 5 |
