About Julio Carvajal

Julio Carvajal · ‎11-23-2017

The switch SVI should be in VLAN 10 according to the IP address assignment in your network. So port 9 on the switch connects to the asa trunk interface. Can you share the output of show int trunk on the switch?

Julio Carvajal · ‎11-23-2017

Hello, Can you share the output of show dhcpd statistics We might need to run debugs and captures later but after checking the config, everything seems good. PD: You did not share the switch config, I hope that one is correct :)

Julio Carvajal · ‎11-22-2017

Hey Coffee, no, the only way to redirect the traffic is from the ASA itself (on this model).

Julio Carvajal · ‎11-22-2017

Hello, Are you using the FirePower for HTTP inspection? Do you have any active policies for HTTP? We probably need to check the logs on the Firepower.

Julio Carvajal · ‎11-22-2017

Hi, I just checked the ACL configuration (very quickly) and I can tell you there is no need to have that ACL. You would have that ACL only if you are troubleshooting the fw (only for a minute or so) and you want to check whether the FW is dropping a TCP connection or not but having it in production it's basically like having no firewall for TCP session (please allow any TCP session from anyone on the outside to any asset on the inside {Of course that asset needs to be advertised by NAT and you have a few of those}). You can remove it as this is not safe @ all Regards

Julio Carvajal · ‎11-22-2017

Sweet! Glad to know that I could help mate

Julio Carvajal · ‎11-21-2017

Buenas, Es correcto. Con el FMC se puede administrar el 2140. Saludos

Julio Carvajal · ‎11-21-2017

Buenas Cristhian, Como parte de un control de seguridad en los cortafuegos ASA FTD no se puede acceder a la IP de una interfaz distante. Ejemplo: Si yo estoy detrás de la interface del Inside, no existirá forma de que puedas comunicarte con la IP de la interface del outside. Saludos Saludos

Julio Carvajal · ‎11-21-2017

Hi, Unfortunately No. You have to run it in Transparent mode in order to make this happen. Regards

Julio Carvajal · ‎11-21-2017

Hi Scott, The Packet tracer is not properly written. I would first recommend you to write the nats from inside to outside.... just to be more organized. so do no static (Outside,Plex) tcp 10.10.X.X 32400 159.118.X.X 32400 netmask 255.255.255.255 no static (Outside,Plex) tcp 10.10.X.X 8989 159.118.X.X 8989 netmask 255.255.255.255 no static (Outside,Plex) tcp 10.10.X.X 8080 159.118.X.X 8080 netmask 255.255.255.255 no static (Outside,Plex) tcp 10.10.X.X 5050 159.118.X.X 5050 netmask 255.255.255.255 no static (Outside,Plex) udp 10.10.X.X 22 159.118.X.X 20122 netmask 255.255.255.255 static (Plex,Outside) tcp 159.118.x.x 32400 10.10.x.x 32400 static (Plex,Outside) tcp 159.118.x.x 8989 10.10.x.x 8989 static (Plex,Outside) tcp 159.118.x.x 8080 10.10.x.x 8080 static (Plex,Outside) tcp 159.118.x.x 5050 10.10.x.x 5050 Then run the following packet tracer packet-tracer input outside tcp 11.10.9.8 1025 159.118.x.x 32400 Please provide us the output as we might need to run captures depending on the result. Regards, Julio Carvajal Senior Network Security and Core Specialist CCIE #42930, 2xCCNP, JNCIP-SEC

Julio Carvajal · ‎11-18-2017

Excelente Documento Maykol!

Julio Carvajal · ‎11-18-2017

Hello, The Server port that you need to access is 3389 right? If that is the case then the ACL should be pointing to that IP. Remember that starting on 8.3 NAT takes place before the ACL so you should always point to the private side of things. PD: try to avoid use any any on a ACL, even if it's for a specific port.

Julio Carvajal · ‎11-18-2017

Hi There, In the case of multiple sub-interfaces with the same security level, I only want specific ones to talk to each other. Would a ACLs be used in this case? A/If you want to filter traffic between interfaces or sub-interfaces with the same security level you will have to use ACLs (do not enable the " same - security - traffic permit inter-interface ce" feature as that would do the opposite as of what you are looking for) Also, would there be any need to NAT the traffic? A/You got to be careful in here!!! NAT should only be used when you need it (for example when having to use a public Ip to be routable). In this case I would assume the sub-interfaces are private IP addresses so NAT wont be needed. Is there any specific licensing requirements to create vlan subinterfaces. No, there are not Regards

Julio Carvajal · ‎11-18-2017

Hello Phil, Yes you can! Starting on version 9.7 you can use something named "BVI interface" where you can have multiple ports on the ASA on a defined VLAN/Subnet. I believe this link should be good enough for you to start :) https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.html Any queries, let me know

Julio Carvajal · ‎05-25-2016

Hello, Config wise as Aditya said you are good. There are certain things that I would change (just for a clean up) like the access-groups and the ACLs you are using at the moment as you are anyway permitting everything on the inside and most important the fixup protocol ICMP would take care of the echo replies so no need for the inbound ACL on the outside interface. Make sure that you can ping from the ASA to your default gateway 207.70.142.254. If that works then ping from your ASA to 4.2.2.2 Keep us posted Julio Carvajal Senior Network Security and Core Specialist CCIE #42930, 2xCCNP, JNCIS-SEC Rate all the helpful posts

Date Registered	‎07-25-2011 05:35 PM
Date Last Visited	‎11-23-2017 06:15 PM
Total Messages Posted	5,741
Total Helpful Votes Received	3714

Re: ASA 5505 - DHCP pool per VLAN

Re: ASA 5505 - DHCP pool per VLAN

Re: ASA FirePower Passive Monitor-Only

Re: Single website not showing up as it...

Re: ASA command

Re: ASA 8.2 global and static nat issue

Re: Firepower 2140 modos de operacion y...

Re: conexion desde la inside a la inter...

Re: ASA FirePower Passive Monitor-Only

Re: ASA 8.2 global and static nat issue

Re: RTBH utilizando el ASA Firewall

Re: ASA-5515X PAT Query

Re: Cisco ASA 5555 X with FTD Specific ...

Re: Bind multiple interfaces on 5506-x

Hello,