Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About michaelgbenga
Stats
Member since
03-17-2014
3
Posts
0
Helpful
0
Solutions
09-25-2014
07:42 AM
The following is an output from a 5515-X ASA. All attempts to reach the server in the DMZ wither from the LAN or internet isn't possible. I think the issue lies in the DMZ webserver itself. Please, take a look at the capture and suggest. Thanks in advance. ciscoasa(config)# show cap ciscoasa(config)# show capture capo 96 packets captured 1: 11:22:28.518680 41.58.192.110.56382 > 197.253.4.13.80: . 185938744:185938745(1) ack 1999498768 win 668 2: 11:22:28.518909 197.253.4.13.80 > 41.58.192.110.56382: . ack 185938745 win 258 <nop,nop,sack sack 1 {185938744:185938745} > 3: 11:22:56.074535 41.58.192.110.56443 > 197.253.4.13.80: S 225050592:225050592(0) win 8192 <mss 1400,nop,wscale 8,nop,nop,sackOK> 4: 11:22:56.074947 197.253.4.13.80 > 41.58.192.110.56443: S 2143290466:2143290466(0) ack 225050593 win 8192 <mss 1380,nop,wscale 8,nop,nop,sackOK> 5: 11:22:56.096369 41.58.192.110.56382 > 197.253.4.13.80: P 185938745:185939148(403) ack 1999498768 win 668 6: 11:22:56.097147 197.253.4.13.80 > 41.58.192.110.56382: P 1999498768:1999499147(379) ack 185939148 win 257 7: 11:22:56.097407 41.58.192.110.56444 > 197.253.4.13.80: S 3177908077:3177908077(0) win 8192 <mss 1400,nop,wscale 8,nop,nop,sackOK> 8: 11:22:56.097864 197.253.4.13.80 > 41.58.192.110.56444: S 3709476046:3709476046(0) ack 3177908078 win 8192 <mss 1380,nop,wscale 8,nop,nop,sackOK> 9: 11:22:56.124032 41.58.192.110.56443 > 197.253.4.13.80: . ack 2143290467 win 64 10: 11:22:56.139275 41.58.192.110.56382 > 197.253.4.13.80: P 185939148:185939552(404) ack 1999499147 win 666 11: 11:22:56.139305 41.58.192.110.56444 > 197.253.4.13.80: . ack 3709476047 win 64 12: 11:22:56.141029 197.253.4.13.80 > 41.58.192.110.56382: P 1999499147:1999499496(349) ack 185939552 win 255 13: 11:22:56.289337 41.58.192.110.56382 > 197.253.4.13.80: P 185939552:185939971(419) ack 1999499496 win 665 14: 11:22:56.498036 197.253.4.13.80 > 41.58.192.110.56382: . ack 185939971 win 253 15: 11:23:14.245730 41.58.192.110.56443 > 197.253.4.13.80: F 225050593:225050593(0) ack 2143290467 win 64 16: 11:23:14.246157 197.253.4.13.80 > 41.58.192.110.56443: R 2143290467:2143290467(0) ack 225050594 win 0 17: 11:23:14.260347 41.58.192.110.56444 > 197.253.4.13.80: F 3177908078:3177908078(0) ack 3709476047 win 64 18: 11:23:14.260743 197.253.4.13.80 > 41.58.192.110.56444: R 3709476047:3709476047(0) ack 3177908079 win 0
... View more
Created by
michaelgbenga
in Firewalls
in Firewalls
09-23-2014
08:38 AM
09-23-2014
08:38 AM
Hi All, I have a firewall (Cisco ASA 5520) running; acting as Internet edge with interfaces going to DMZ, Internet and LAN. I have been able to copy/translate the config from the 5520 to 5515-X; LAN users can get to the internet, but sessions going from the LAN browser to the DMZ webserver gets reset, also access to the webserver isn't possible from the internet. Here is a capture of the activity done on the 5515-X box. Does anyone have an idea why the reset is coming from the webserver? Because it appears that the 5515-X is passing traffic normally. DMZ webserver public IP address: 197.253.4.13.80 The attached capture is a session from firewall showing sessions of my attempts trying to reach the webserver from the internet. Strangely, LAN users cannot reach the webserver from their web browser.
... View more
Labels:
Created by
michaelgbenga
in Security Management
in Security Management
08-27-2014
02:29 PM
08-27-2014
02:29 PM
Hello everyone, I want to migrate a client network from ASA 8.2 to 9.1. Presently, the 8.2 box takes LAN users to the internet, and to a webserver in the DMZ. The DMZ server is assessed both from the LAN with a private IP address and from the internet using its public IP address. After translating the current 8.2 config, LAN users can assess the internet, but cannot browse the webserver in the DMZ; but 'weirdly' can ping it; so icmp is going to the webserver from the LAN, but can't be reached by http. Kindly share a sample config, if you have conquered this before. Bear in mind that NAT is different in 9.1 compared to 8.2. Here is a part of the config. interface GigabitEthernet0/0 nameif outsideif security-level 0 ip address outside-if 255.255.255.248 ! interface GigabitEthernet0/1 nameif insideif security-level 100 ip address inside-if 255.255.255.248 ! interface GigabitEthernet0/2 nameif dmzif security-level 50 ip address dmz-if 255.255.255.0 ! object network DMZ-webserver host 192.168.0.4 ! object network DMZ-webserver_public_IP host 1XX.2X.4.13 ! access-list outsideacl extended permit tcp any object DMZ-webserver eq www access-list dmzacl extended permit ip any any ! nat (dmzif,outsideif) source static DMZ-webserver DMZ-webserver_public_IP object network inside-lan_outside nat (insideif,outsideif) dynamic interface route outsideif 0.0.0.0 0.0.0.0 outside-router 1 route insideif 10.0.0.0 255.0.0.0 inside-router 1 There are no other access-lists in the running config. Many thanks in advance.
... View more
Labels:
09-25-2014
The following is an output from a 5515-X ASA. All attempts to reach the
server in the DMZ wither fro...
Created by
michaelgbenga
in Firewalls
09-23-2014
09-23-2014
Hi All,I have a firewall (Cisco ASA 5520) running; acting as Internet
edge with interfaces going to ...
08-27-2014
Hello everyone,I want to migrate a client network from ASA 8.2 to 9.1.
Presently, the 8.2 box takes ...
Created by
michaelgbenga
in TelePresence and Video Infrastructure
03-17-2014
03-17-2014
Hello,A customer needs me to deploy Telepresence SX 20 at 2 sites, but
these sites do not have a WAN...
Public Statistics
| Date Registered | 03-17-2014 06:28 AM |
| Date Last Visited | 08-18-2017 04:02 AM |
| Total Messages Posted | 3 |
