Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Garland Moore
08-18-2017
Stats
Member since
07-09-2012
33
Posts
0
Helpful
0
Solutions
03-06-2016
09:47 AM
Thank you both dmoudgil and MariusGunnerud for your thorough responses. My question concerning the order of the interfaces comes from some confusion when dealing with pre 8.3 nat statements.
For instances(8.2 nat command):
hostname(config)# static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255
I never understood why you had to list the inside interface first then list the public IP before the internal IP when mapping an inside address to an outside address. Would I be correct to say this has changed in 8.3+?
... View more
03-05-2016
03:51 PM
Hello all,
I've been doing a lot of reading to really understand how NAT works in ASA version 8.3 and higher. I haven't been able to quite find any documentation that addresses my particular question, so I figured I would try here. I would like it if someone could explain to me the nat command and traffic flows when allowing internal host to be accessible via the internet.
In order to allow access to the internal server via the internet you need three things:
network object identifying the internal host
nat statement within the network object
ACL permitting the traffic against the security levels
Take the following example
object network WebServer
host 192.168.1.5 nat (inside,outside) static 1.1.1.1 service tcp 80 80
access-list OutsideToInside permit tcp any host 192.168.1.5 eq 80
access-group OutsideToInside in interface outside
My question is, does the nat command only apply to the return traffic from the web server since the ACL will forward the HTTP traffic to the internal host?
Also, can someone break down the nat command? i.e. I know the "(inside,outside)" refers to the named interfaces but the order also matters right?
when using "source" in the nat command, that is referring to the source IP correct?
Why do you not need a nat command in the reverse order "nat (outside,inside)" for the translation?
Hopefully it is clear as to what I am asking, if not please let me know.
Thanks
... View more
Labels:
09-25-2013
12:39 PM
Luis, Thanks for your reply. According to the link below it looks like this can be done on the ASA 5505, using the "switchport monitor" command, since it has switching capability. Am I understanding this correctly or is there something Im not understanding? http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/int5505.html#wp1067336
... View more
09-24-2013
10:50 PM
Hi all, I would like to setup a SPAN port on my outside interface on the ASA 5505. I would like to see all traffice whether inbound or outbound. Setting up a SPAN port seems pretty straight forward, my question is, if a packet hits the outside interface and is dropped will a copy of the packet still be sent to the SPAN destination? Or does the packet have to actually enter the ASA for a copy of the packet to be sent to the ASA? I've been unable to find a clear answer to this question but I would like to know before configuring the SPAN port. Any help is much appreciated!
... View more
Labels:
08-16-2012
10:09 PM
Here is the partial config I came up with to solve this LDAP issue... ldap attribute-map LDAPMAP map-name memberOf IETF-Radius-Class map-value memberOf CN=MOORE-APP-SSLVPNUsers-DL,OU=Groups,OU=MooreNetwork,DC=moore,DC=net SSLVPNPolicy dynamic-access-policy-record SSLVPNAccessPolicy description "Access Policy for AnyConnect VPN Users" priority 1 webvpn svc ask none default svc dynamic-access-policy-record DfltAccessPolicy action terminate aaa-server SSLVPNUsers protocol ldap aaa-server SSLVPNUsers (inside) host 172.16.1.102 ldap-base-dn DC=MOORE,DC=NET ldap-scope subtree ldap-naming-attribute sAMAccountName ldap-login-password ***** ldap-login-dn CN=LDAP Service Account,OU=ServiceAccounts,OU=MooreNetwork,DC=moore,DC=net server-type microsoft ldap-attribute-map LDAPMAP aaa-server SSLVPNUsers (inside) host 172.16.1.103 ldap-base-dn DC=MOORE,DC=NET ldap-scope subtree ldap-naming-attribute sAMAccountName ldap-login-password ***** ldap-login-dn CN=LDAP Service Account,OU=ServiceAccounts,OU=MooreNetwork,DC=moore,DC=net server-type microsoft ldap-attribute-map LDAPMAP
... View more
08-16-2012
10:07 PM
Just sent the PM again... How do I mark the question as answered?
... View more
08-13-2012
04:46 PM
Thanks for the replies, Thanks for the reply, this issue actually ended up being a misconfigured DNS address on the DHCP server. The DHCP server was handing out an address of 127.0.0.1 rather than its own address. Your response lead me to verify the configuration of all the DNS servers. Its one of those things that I assumed was correct and didnt take the time to check everything.
... View more
08-12-2012
08:00 PM
I have a Cisco ASA 5505 that has been configured to act as a router as well. I have configured 3 VLANS that have access to the internet. For some reason the "InsideWifi" and the "Guest" VLANS have very slow internet speeds and sometime web pages wont finish loading properly. The "Inside" VLAN gets the speeds that are expected. The DNS server does reside on the "Inside" VLAN. Is there anything wrong with my configuration that would cause the internet speeds on the other VLANS to be slow? My config is attached.
... View more
Labels:
08-08-2012
08:09 PM
Made the changes that you suggested and Im still unable to login with a domain account.
... View more
08-07-2012
05:19 AM
Tarik, I apologize I slightly confused on what you are asking me to do. My skills with the ASA arent that diverse, Im on version 8.2 and when I go to the group policy I dont see the option to do what youve asked me to do.
... View more
08-06-2012
10:27 PM
My apologies for the delayed response. The truncated config is below... same-security-traffic permit inter-interface
access-list inside extended permit ip any any
access-list outside extended permit ip any any
access-list guest extended permit udp any host 172.16.1.102 eq domain
access-list guest extended permit udp any host 172.16.1.103 eq domain
access-list guest extended permit udp any any range bootps tftp
access-list guest extended deny ip any 172.16.1.0 255.255.255.0 log
access-list guest extended deny ip any 172.16.2.0 255.255.255.0 log
access-list guest extended permit ip any any
access-list insidewifi extended permit ip any any
access-list Outside_In extended permit tcp any any eq 3389
access-list SSLClientProfile_SPLIT standard permit 172.16.1.0 255.255.255.0
access-list SSLClientProfile_SPLIT standard permit 172.16.2.0 255.255.255.0
access-list nonat_inside extended permit ip 172.16.1.0 255.255.255.0 172.16.9.0 255.255.255.0
access-list nonat_insidewifi extended permit ip 172.16.2.0 255.255.255.0 172.16.9.0 255.255.255.0
pager lines 50
logging enable
logging list TEST level alerts
logging buffered debugging
logging asdm informational
logging mail TEST
logging from-address FW01@fw01.com
logging recipient-address gdmoore85@gmail.com level errors
mtu outside 1500
mtu guest 1500
mtu inside 1500
mtu insidewifi 1500
ip local pool SSLClientPool 172.16.9.1-172.16.9.2 mask 255.255.255.0
ip audit name FW01-INFO info action alarm
ip audit name FW01-ATTACK attack action alarm reset
ip audit interface outside FW01-INFO
ip audit interface outside FW01-ATTACK
ip audit signature 2000 disable
ip audit signature 2001 disable
ip audit signature 2004 disable
ip audit signature 2005 disable
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo-reply outside
icmp permit any guest
icmp permit any inside
icmp permit any insidewifi
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (guest) 1 172.16.10.0 255.255.255.0
nat (inside) 0 access-list nonat_inside
nat (inside) 1 172.16.1.0 255.255.255.0
nat (insidewifi) 0 access-list nonat_insidewifi
nat (insidewifi) 1 172.16.2.0 255.255.255.0
static (inside,outside) tcp interface 3389 172.16.1.200 3389 netmask 255.255.255.255
static (inside,guest) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
static (inside,insidewifi) 172.16.1.0 172.16.1.0 netmask 255.255.255.0
access-group Outside_In in interface outside
access-group guest in interface guest
access-group inside in interface inside
access-group insidewifi in interface insidewifi
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record SSLVPNAccessPolicy
description "Access Policy for AnyConnect VPN Users"
priority 1
webvpn
svc ask none default svc
dynamic-access-policy-record DfltAccessPolicy
action terminate
aaa-server SSLVPNUsers protocol ldap
aaa-server SSLVPNUsers (inside) host 172.16.1.102
ldap-base-dn DC=MOORE,DC=NET
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn CN=LDAP Service Account,OU=ServiceAccounts,OU=MooreNetwork,DC=moore,DC=net
server-type microsoft
aaa-server SSLVPNUsers (inside) host 172.16.1.103
ldap-base-dn DC=MOORE,DC=NET
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn CN=LDAP Service Account,OU=ServiceAccounts,OU=MooreNetwork,DC=moore,DC=net
server-type microsoft
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 172.16.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
fragment chain 1 outside
sysopt noproxyarp outside
service resetoutside
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
fqdn sslvpn.moore.net
subject-name CN=sslvpn.moore.net
keypair sslvpnkeypair
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 956e1350
308201ef 30820158 a0030201 02020495 6e135030 0d06092a 864886f7 0d010105
0500303c 31193017 06035504 03131073 736c7670 6e2e6d6f 6f72652e 6e657431
1f301d06 092a8648 86f70d01 09021610 73736c76 706e2e6d 6f6f7265 2e6e6574
301e170d 31323037 32383034 34363133 5a170d32 32303732 36303434 3631335a
303c3119 30170603 55040313 1073736c 76706e2e 6d6f6f72 652e6e65 74311f30
1d06092a 864886f7 0d010902 16107373 6c76706e 2e6d6f6f 72652e6e 65743081
9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100c8 167e2c3d
04c16a6c b6639fda c60f085a 8ea6a2ea 6e0bcafb acb3ec8e 3c659274 37636c34
0df9e770 17fb97f6 c2b8641e ff3675f3 3d906e01 a7056bb0 9c0bf54c 3475729e
74caf157 068464d3 e235c46f a8525867 c3911d9c 760253d0 c7bbb7c8 84f91f92
858866c6 e0c1033d 6cfba6f0 b732158f 3d2d7ef5 9bbb0821 4d093f02 03010001
300d0609 2a864886 f70d0101 05050003 81810062 65e2455a cb4e87ea 7879099d
06ed1c5e 7eab180a 4d7564be c36810eb fe6a5bb9 94348ded 1336d811 d0949342
2718400c 8cc32395 23e7d722 3e2758a9 a2116a38 07500bd5 5b96f3c2 1d7c5769
dc5b876b 858cb447 355aa323 abbaf45d bed3814d a04f503a 21cddb47 aaecd5aa
1c82f701 22969424 f6845937 a21568a1 ecaa0e
quit
telnet timeout 5
ssh 172.16.1.0 255.255.255.0 inside
ssh timeout 20
console timeout 0
management-access inside
dhcpd dns 172.16.1.102
dhcpd ping_timeout 750
!
dhcprelay server 172.16.1.102 inside
dhcprelay enable guest
dhcprelay enable insidewifi
dhcprelay setroute guest
dhcprelay setroute insidewifi
dhcprelay timeout 60
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address 172.16.0.0 255.255.0.0
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 211.233.40.78
ntp server 61.153.197.226
ntp server 202.150.213.154 prefer
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
svc image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1
svc enable
tunnel-group-list enable
group-policy SSLClientPolicy internal
group-policy SSLClientPolicy attributes
dns-server value 172.16.1.102 172.16.1.103
vpn-tunnel-protocol svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SSLClientProfile_SPLIT
default-domain value moore.net
address-pools value SSLClientPool
username gmoore_a password fcIL7rCtqCtPWWUm encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
authentication-server-group SSLVPNUsers LOCAL
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group SSLVPNUsers LOCAL
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile general-attributes
authentication-server-group SSLVPNUsers LOCAL
default-group-policy SSLClientPolicy
tunnel-group SSLClientProfile webvpn-attributes
group-alias SSLVPNClient enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
smtp-server 68.1.17.8
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:2255d97f90c650fd6818ad3d604ba697
: end
no asdm history enable
... View more
08-01-2012
06:45 PM
Unfortunately it didnt change my luck. This is very mind boggling!
... View more
07-31-2012
04:57 PM
It does match what was retrieved by the ASA. I removed the ldap attribute and I was unable to login.
... View more
03-06-2016
Thank you both dmoudgil and MariusGunnerud for your thorough responses.
My question concerning the o...
03-05-2016
Hello all, I've been doing a lot of reading to really understand how NAT
works in ASA version 8.3 an...
09-25-2013
Luis,Thanks for your reply. According to the link below it looks like
this can be done on the ASA 55...
09-24-2013
Hi all,I would like to setup a SPAN port on my outside interface on the
ASA 5505. I would like to se...
08-16-2012
Here is the partial config I came up with to solve this LDAP
issue...ldap attribute-map LDAPMAP map-...
08-13-2012
Thanks for the replies,Thanks for the reply, this issue actually ended
up being a misconfigured DNS ...
08-12-2012
I have a Cisco ASA 5505 that has been configured to act as a router as
well. I have configured 3 VLA...
08-07-2012
Tarik,I apologize I slightly confused on what you are asking me to do.
My skills with the ASA arent ...
08-06-2012
My apologies for the delayed response. The truncated config is
below...same-security-traffic permit ...
Public Statistics
| Date Registered | 07-09-2012 09:05 PM |
| Date Last Visited | 08-18-2017 03:54 AM |
| Total Messages Posted | 33 |
Helpful Votes Given To
