About dpatkins

dpatkins · ‎08-25-2014

Good afternoon, I appreciate the quick responses but I am confused on the proper syntax. I have been looking at dynamic NAT all day. I am hoping this is where I would need to look. I would like to allow any ip address on our local network that is destined for 3 IP addresses on a report site to go through the ASA, be natted to a 10.254.254.0 subnet dynamically. So I guess what I could do is take 10.254.254.10 - 10.254.254.250 and make it a NAT pool for this process and then take 10.254.254.254 and make it a PAT address just in case we run out of address space. What is the proper syntax to configure this? Is it nat (any, outside) 3 any any 10.254.254.0 10.254.254.0 ? Thank you for your assistance. Dwane

dpatkins · ‎08-05-2014

We have created an IPSec site to site tunnel . Originally only two IP address were authorized to access the tunnel. Now they are asking for all addresses. My question is, if I use access-list inside_access_in extended permit ip any host 10.60.55.10, do I also need to do a NAT statement that permits this? And when we modify the Site to Site VPN connection profile, I am going to have to allow any across this tunnel as well, correct? Thank you and hope this makes sense. We were originally thinking policy based routing on core closest to the source. Dwane

dpatkins · ‎02-19-2014

Itzcoati, Will this PAT be bidirectional if configured this way? Dwane

dpatkins · ‎02-19-2014

All, I have set up a Site to Site VPN tunnel. In this tunnel, the end users traffic of interest is already a subnet we use on our network, 192.168.20.0/24. What I would like to do is set up a PAT on our tunnel will be NATTED. Our appliance locally will point to our patted address of 10.10.10.10. So it would be: So any traffic being generated from our inside address of 10.20.10.10 and 10.20.10.11 going to 192.168.20.0/24 will actually route to 10.10.10.10 and the ASA will translate it to whatever the 192.168.20.0/24 address will be. And if traffic is coming into the ASA from 192.168.20.0/24, it will PAT is to 10.10.10.10 and route it to the 10.20.10.10 and 10.20.10.11. Basically, I do not want our side to see the 192.168.20.0/24 from the remote site and I do not want the remote site to see the 10.10.10.10 PATTED address. Does this make sense? Thanks Dwane

dpatkins · ‎12-06-2013

We currently have Cisco ASA 5520s with 8.4.3. What we would like to do is configure a Cisco SSL VPN where we would have a user web into a site, https://oursite.oursite.com and have an agent download once authentication has been accepted. When done, we would reserve the right to have the agent remain on the device or remove it completely with no residual. Can this be done today on teh Cisco ASA? Are there configuration examples for this? Would I need to download the latest anyconnect file? Thank you all Dwane

dpatkins · ‎12-06-2013

Thank you all for your quick response. We went entirely with a seperate SSID with WPA2/PSK. It was a quick set up and works good. Have a great day.

dpatkins · ‎11-26-2013

Good day, We are trying to set up Apple TV on our 802.1x SSID. So far, we have input authentication as well as loaded two certificates from our Cisco ACS. I believe this did not need to be done. Is there a way we can configure APPLE TV on our wireless network? And is there a Guide that I can follow to get this done? I have seen many documents but I have not seen that one that says, "do it this way, it works". Thank you Dwane

dpatkins · ‎06-21-2013

I am guessing that all Vlans can go to xxxx? If that is the case, why not use ACLs to restrict access to the internet at your border? You could either permit the Vlan subnet you want or deny the ones you do not want to go out. Dwane

dpatkins · ‎06-21-2013

When I configure each port to full 100, I lose layer 2 on the router. Isn't their a non-negotiate I can configure on the 6500. The show interface will alway show the port a half/10 when in auto negotiate. Yes mfurnival, I do realize I cannot configure "speed 1000" on the gig side. . I apprecaite the response.

dpatkins · ‎06-21-2013

I am trying to bring back up a Cisco 3640 router. Fa1/0 is connected to gig card (6748) on a 6500. Config on Gig port 1/47: Current configuration : 156 bytes ! interface GigabitEthernet1/47 description CR3640 switchport switchport mode access switchport nonegotiate no keepalive speed 100 duplex full end Config on fa1/0: Current configuration : 158 bytes ! interface FastEthernet1/0 description To Cisco 6509 ip address 129.111.99.18 255.255.255.192 no ip mroute-cache no keepalive speed 100 full-duplex I was not sure if I need the non-negotiate on the gig port. If I add speed and duplex to the gig port, port and line protocol show down/down. If I remove it, it is up and up and the port is up but line protocol shows up but I think it is because I removed keepalives. Any ideas? Thank you

dpatkins · ‎03-07-2013

William, Does this look better? I assigned the routemap to the external interface and change the direction of the ACLs. Dwane i nterface FastEthernet0/0 ip address dhcp client-id FastEthernet0/0 ip nat outside no ip virtual-reassembly no ip route-cache cef no ip route-cache ip policy route-map tcp-pf duplex auto speed auto no cdp enable ! interface FastEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip nat inside no ip virtual-reassembly no ip route-cache cef no ip route-cache duplex auto speed auto ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ip nat inside source static tcp 192.168.1.200 80 interface FastEthernet0/0 8081 ip nat inside source route-map tcp-pf interface FastEthernet0/0 overload ! access-list 102 permit tcp any host 192.168.1.200 eq www access-list 102 permit tcp any host 192.168.1.201 eq www access-list 102 deny ip any host 192.168.1.200 access-list 102 deny ip any host 192.168.1.201 access-list 102 permit ip any 192.168.1.0 0.0.0.255 ! ! ! route-map tcp-pf permit 10 match ip address 102 !

dpatkins · ‎03-07-2013

William, Can you give me a better understanding of what you are trying to say? I know my example has port 80 and 8081 defined but I did attemtpt it with TCP port 23. Shouldn't the access-list be reversed? Shouldn't it be access-list 102 permit tcp host 192.168.1.200 any eq 23 and then a deny statement for ip to 192.168.1.200? Thank you Dwane

dpatkins · ‎03-06-2013

William, I am sorry but I could not get this configuration to work. Do you have the routemap configuration? ip nat inside source static tcp 192.168.1.200 80 interface FastEthernet0/0 8081 ip nat inside source route-map tcp-pf interface FastEthernet0/0 overload ! access-list 102 deny ip host 192.168.1.200 any access-list 102 deny ip host 192.168.1.201 any access-list 102 permit ip 192.168.1.0 0.0.0.255 any no cdp run ! ! ! route-map tcp-pf permit 10 match ip address 102 This is how it is configured. Any ideas? Thanks Dwane

dpatkins · ‎02-18-2013

All, I am stuck. We have configured a site to site tunnel from our ASA to another organizations Cisco 3030. It appears to have just one way initiation. We can do a ping to a device on the remote site and it will ping just fine. however, when the tunnel needs to be initiated from the remote site, it will not work until we have initiated the tunnel and then everything works. I continue to see Error processing payload: Payload ID: 1 errors on the ASDM logs. It appears that all the configuration is in place because we can in fact establish the IPSec tunnel unidirectional. And once established, traffic can flow bidirectional. Any ideas? Thank you

dpatkins · ‎02-01-2013

My ip nat translation shows: tcp 10.10.10.10:8081 192.168.1.200:80 10.50.10.10:41914 10.50.10.10:41914 tcp 10.10.10.10:8081 192.168.1.200:80 10.50.10.10:41915 10.50.10.10:41915 tcp 10.10.10.10:8081 192.168.1.200:80 10.50.10.10:41916 10.50.10.10:41916 where 10.10.10.10 represents our external ISP address we are trying to use. 10.50.10.10 represents the ip address I am attempting the 10.10.10.10:8081 request. So it does see it hitting the address. I can ping the 192.168.1.200 from the router. Any other ideas or can I debug maybe the IP nat to see what is taking place? I am stuck on this one. It should work. Thanks for your help

Date Registered	‎02-07-2002 07:19 AM
Date Last Visited	‎09-14-2018 01:08 PM
Total Messages Posted	382
Total Helpful Votes Received	12

Good afternoon, I appreciate

Cisco ASA tunnel access-list question

Re: Cisco ASA Port Address Translation

Cisco ASA Port Address Translation

Cisco SSL VPN

Cisco Wireless and Apple TV

Cisco Wireless and Apple TV

Vacl or Route-map ??

Cisco 3640 fa 1/0 connected to a Cisco ...

Cisco 3640 fa 1/0 connected to a Cisco ...

Re: Multiple webservers using Nat/Pat

Re: Multiple webservers using Nat/Pat

Re: Multiple webservers using Nat/Pat

Establish Site to Site IPSec tunnel bet...

Multiple webservers using Nat/Pat