Hi. I don't know much about routers, but lately I've been playing around with router configuration and getting better but I am kind of stuck now. The scenario is this. I have 3 ip net from the ISP: 178.249.51.0/255.255.255.248 Gateway 178.249.51.1 178.249.51.8/255.255.255.248 Gateway 178.249.51.9 178.249.51.16/255.255.255.248 Gateway 178.249.51.17 I have a Cisco 1800 router where I have made 3 "inside" VLANs with DHCP which works just fine. VLAN1 = 192.168.100.0 VLAN2 = 192.168.101.0 VLAN3 = 192.168.102.0 Just for testing I have assigned a vlan to a port: VLAN1 = Port 2 VLAN2 = Port 3 VLAN3 = Port 4 I am pretty sure I have a problem with routes. If I add 0.0.0.0 0.0.0.0 178.249.51.1 (as a default route) I can access the Internet with the public IP 178.249.51.2 (my routers IP on int fa0) from all VLANs. If I remove the default route and add these three routes I have no Internet access: ip route 192.168.100.0 255.255.255.0 178.249.51.1 ip route 192.168.101.0 255.255.255.0 178.249.51.9 ip route 192.168.102.0 255.255.255.0 178.249.51.17 What I would like to be able to do is access the Internet from: VLAN1 with public IP 178.249.51.2 VLAN2 with public IP 178.249.51.10 VLAN3 with public IP 178.249.51.18 The ISP deliver the 3 IP net from their router like this: interface GigabitEthernet0/1.700 encapsulation dot1Q 700 ip address 178.249.51.1 255.255.255.248 secondary ip address 178.249.51.17 255.255.255.248 secondary ip address 178.249.51.9 255.255.255.248 service-policy input 100M-police service-policy output 100M-police I am also not sure if I have to add the secondary addresses to my WAN port Fa0? Or if I did it correctly? I have attached my configuration from the router and hope someone can give some advice. I am also wondering - when we get more public IP net from the ISP, is this the correct way to do it? Or is there some other way to do this? Thanks in advance. /Ulrik ... View more

Hi. We have an annoying problem which we've been spending some time on now, but we gave up now. We have a customer who upgraded their ASA5505 from 8.4(1) to 8.4(2). Usually the customer can access the firewall with Anyconnect and manage it with ASDM or SSH from a remote location. After the upgrade they can still connect with Anyconnect, see the inside network, but can't access the firewall with ASDM or SSH anymore. We wanted to make a test on our LAB-ASA5505 and made a setup like our customer. We configured Anyconnect access and made sure we could access the firewall with ASDM from a remote location. We made sure we had access from the Anyconnect VPN-Pool 172.16.150.0 and set the management interface. This setup is running fine in version 8.4(1). http 172.16.150.0 255.255.255.0 inside.30.LAN management-access inside.30.LAN Then we make a firmware upgrade to 8.4(2) and then, like our customer, it is not possible to access ASDM on the Anyconnect connection. We have not made any changes in the configuration. Looking at the difference between the configuration 8.4(1) and 8.4(2) it seems like the firmware upgrade make a few changes. 1) the interface vlan xx's are moved below interface FastEthernetx/x 2) there is a new command "user-identity default-domain LOCAL" Otherwise the two configurations looks identical. If we disable "user-identity default-domain LOCAL", it doesn't change anything. So we are wondering what to do now. Perhaps someone can give us a clue? We have attached both configurations: 8.4(1) = before.txt 8.4(2) = after.txt Any help is appreciated. Thanks in advance. /Ulrik ... View more

Hi. We have just setup a SA520 at a customer location. It is running firmware version 1.1.65. It seems to be operating fine, except PPTP VPN. Looking at the log from the SA520 it forwards port 1723 and 500 to the correct PPTP server in the network. But it seems like this machine it not receiving the PPTP VPN request. On the server is also running a FTP service which works fine - so the server is alive. Is there something about we also need to use GRE (Protocol 47) when using PPTP? We have looked everywhere in the SA520, but can't find it. Any help appreciated, thanks! /Ulrik Attached: SA520-log, PPTP-server-log, Firewall-rules. ... View more

Hi all! I am having a NAT/ACL problem in my home network after I’ve migrated from Zyxel to Cisco. I used to have a Zywall5 with LAN and DMZ network. The LAN was for my own units and the DMZ was for visitors in my home. On my LAN I had a printserver which DMZ users needed access to sometimes. I just made a firewall rule allowing TCP/515 from DMZ to LAN on the Zywall5 – working fine. Now I am trying to do the same with my Cisco ASA – and OMG – this is not easy. I have to allow traffic from a VLAN with security level 50 to a VLAN with security level 100 – but only to the printserver. I am not a CLI expert, so I have been working on this problem in ASDM. I tried many different things suggested by Cisco support documents without any luck. It doesn’t make it easier with Ciscos new NAT-concept, as I am on firmware 8.3(1) on my 5505. I worked a little with ASAs some time ago and I recall NAT exempt, but this doesn’t exist anymore. As I see it, Cisco suggest you make two static NAT rules to do this, and some ACL magic, and this is where I am stuck now. It should be very simple – I just need traffic (all or just tcp/515) from my 10.20.33.0/24 network to one host (printserver 10.20.30.3) on my 10.20.30.0/24 network. I have attached a simple network diagram and my running-config from the ASA. Hope someone can guide me a little. Thanks in advance. /Ulrik ** running-config ** : Saved : ASA Version 8.3(1) ! hostname asa5505 domain-name cisco.com enable password xxxxxxx encrypted passwd xxxxxx encrypted names ! interface Vlan1 shutdown no nameif no security-level no ip address ! interface Vlan2 nameif outside security-level 0 ip address dhcp setroute ! interface Vlan30 nameif inside.30.LAN security-level 100 ip address 10.20.30.1 255.255.255.0 ! interface Vlan31 nameif inside.31.DMZ security-level 30 ip address 10.20.31.1 255.255.255.0 ! interface Vlan32 nameif inside.32.PIR security-level 50 ip address 10.20.32.1 255.255.255.0 ! interface Vlan33 nameif inside.33.LAN2 security-level 50 ip address 10.20.33.1 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 switchport access vlan 30 ! interface Ethernet0/2 switchport access vlan 30 ! interface Ethernet0/3 switchport access vlan 30 ! interface Ethernet0/4 switchport access vlan 30 switchport trunk allowed vlan 30-33 switchport trunk native vlan 30 switchport mode trunk ! interface Ethernet0/5 switchport access vlan 30 switchport trunk allowed vlan 30-33 switchport trunk native vlan 30 switchport mode trunk ! interface Ethernet0/6 switchport access vlan 30 ! interface Ethernet0/7 switchport access vlan 30 ! ftp mode passive clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns server-group DefaultDNS domain-name thorup.dk object network obj-10.20.30.0 subnet 10.20.30.0 255.255.255.0 object network obj-10.20.31.0 subnet 10.20.31.0 255.255.255.0 object network obj-10.20.32.0 subnet 10.20.32.0 255.255.255.0 object network obj-10.20.33.0 subnet 10.20.33.0 255.255.255.0 object network obj-10.20.32.30 host 10.20.32.30 access-list outside_access_in remark share access-list outside_access_in extended permit tcp any object obj-10.20.32.30 eq 56000 pager lines 24 logging enable logging trap notifications logging asdm notifications logging host inside.30.LAN 10.20.30.11 mtu outside 1500 mtu inside.30.LAN 1500 mtu inside.31.DMZ 1500 mtu inside.32.PIR 1500 mtu inside.33.LAN2 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm history enable arp timeout 14400 ! object network obj-10.20.30.0 nat (inside.30.LAN,outside) dynamic interface object network obj-10.20.31.0 nat (inside.31.DMZ,outside) dynamic interface object network obj-10.20.32.0 nat (inside.32.PIR,outside) dynamic interface object network obj-10.20.33.0 nat (inside.33.LAN2,outside) dynamic interface object network obj-10.20.32.30 nat (inside.32.PIR,outside) static interface service tcp 56000 56000 access-group outside_access_in in interface outside timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL http server enable http 10.20.30.0 255.255.255.0 inside.30.LAN http 10.20.32.30 255.255.255.255 inside.32.PIR no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet timeout 5 ssh 10.20.30.0 255.255.255.0 inside.30.LAN ssh timeout 10 console timeout 0 dhcpd address 10.20.30.30-10.20.30.100 inside.30.LAN dhcpd auto_config outside interface inside.30.LAN dhcpd enable inside.30.LAN ! dhcpd address 10.20.31.30-10.20.31.100 inside.31.DMZ dhcpd auto_config outside interface inside.31.DMZ dhcpd enable inside.31.DMZ ! dhcpd address 10.20.32.30-10.20.32.30 inside.32.PIR dhcpd dns 208.67.222.222 208.67.220.220 interface inside.32.PIR dhcpd enable inside.32.PIR ! dhcpd address 10.20.33.30-10.20.33.100 inside.33.LAN2 dhcpd auto_config outside interface inside.33.LAN2 dhcpd enable inside.33.LAN2 ! threat-detection basic-threat threat-detection scanning-threat shun except ip-address 10.20.30.0 255.255.255.0 threat-detection scanning-threat shun except ip-address 10.20.32.0 255.255.255.0 threat-detection scanning-threat shun duration 300 threat-detection statistics host number-of-rate 3 threat-detection statistics port number-of-rate 3 threat-detection statistics protocol number-of-rate 3 threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ntp server 195.234.155.123 source outside ntp server 78.109.215.91 source outside ntp server 77.233.251.106 source outside webvpn username ulrik password LlM1zI1mbsdx0S1t encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect ip-options   inspect netbios   inspect rsh   inspect rtsp   inspect skinny    inspect esmtp   inspect sqlnet   inspect sunrpc   inspect tftp   inspect sip    inspect xdmcp ! service-policy global_policy global prompt hostname context call-home profile CiscoTAC-1   no active   destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService   destination address email callhome@cisco.com   destination transport-method http   subscribe-to-alert-group diagnostic   subscribe-to-alert-group environment   subscribe-to-alert-group inventory periodic monthly   subscribe-to-alert-group configuration periodic monthly   subscribe-to-alert-group telemetry periodic daily hpm topN enable Cryptochecksum:9ab4e2078ada23e631e450690f31c5e9 : end ... View more