Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Julio Carvajal
11-23-2017
Julio Carvajal
Advisor
ulio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Awards
Recent Badges
Stats
Member since
07-25-2011
5741
Posts
3513
Helpful
1008
Solutions
11-23-2017
02:43 PM
The switch SVI should be in VLAN 10 according to the IP address assignment in your network.
So port 9 on the switch connects to the asa trunk interface.
Can you share the output of show int trunk on the switch?
... View more
11-23-2017
07:33 AM
Hello,
Can you share the output of
show dhcpd statistics
We might need to run debugs and captures later but after checking the config, everything seems good.
PD: You did not share the switch config, I hope that one is correct :)
... View more
11-22-2017
01:45 PM
Hey Coffee,
no, the only way to redirect the traffic is from the ASA itself (on this model).
... View more
Created by
Julio Carvajal
in Firewalls
in Firewalls
11-22-2017
01:30 PM
11-22-2017
01:30 PM
Hello,
Are you using the FirePower for HTTP inspection?
Do you have any active policies for HTTP?
We probably need to check the logs on the Firepower.
... View more
11-22-2017
01:26 PM
Hi,
I just checked the ACL configuration (very quickly) and I can tell you there is no need to have that ACL.
You would have that ACL only if you are troubleshooting the fw (only for a minute or so) and you want to check whether the FW is dropping a TCP connection or not but having it in production it's basically like having no firewall for TCP session (please allow any TCP session from anyone on the outside to any asset on the inside {Of course that asset needs to be advertised by NAT and you have a few of those}).
You can remove it as this is not safe @ all
Regards
... View more
Created by
Julio Carvajal
in Discusiones Seguridad
in Discusiones Seguridad
11-21-2017
07:19 PM
11-21-2017
07:19 PM
Buenas,
Es correcto.
Con el FMC se puede administrar el 2140.
Saludos
... View more
Created by
Julio Carvajal
in Discusiones Seguridad
in Discusiones Seguridad
11-21-2017
07:16 PM
11-21-2017
07:16 PM
Buenas Cristhian,
Como parte de un control de seguridad en los cortafuegos ASA FTD no se puede acceder a la IP de una interfaz distante.
Ejemplo:
Si yo estoy detrás de la interface del Inside, no existirá forma de que puedas comunicarte con la IP de la interface del outside.
Saludos
Saludos
... View more
11-21-2017
06:45 PM
Hi,
Unfortunately No.
You have to run it in Transparent mode in order to make this happen.
Regards
... View more
11-21-2017
06:29 PM
Hi Scott,
The Packet tracer is not properly written.
I would first recommend you to write the nats from inside to outside.... just to be more organized.
so do
no static (Outside,Plex) tcp 10.10.X.X 32400 159.118.X.X 32400 netmask 255.255.255.255 no static (Outside,Plex) tcp 10.10.X.X 8989 159.118.X.X 8989 netmask 255.255.255.255 no static (Outside,Plex) tcp 10.10.X.X 8080 159.118.X.X 8080 netmask 255.255.255.255 no static (Outside,Plex) tcp 10.10.X.X 5050 159.118.X.X 5050 netmask 255.255.255.255 no static (Outside,Plex) udp 10.10.X.X 22 159.118.X.X 20122 netmask 255.255.255.255
static (Plex,Outside) tcp 159.118.x.x 32400 10.10.x.x 32400
static (Plex,Outside) tcp 159.118.x.x 8989 10.10.x.x 8989
static (Plex,Outside) tcp 159.118.x.x 8080 10.10.x.x 8080
static (Plex,Outside) tcp 159.118.x.x 5050 10.10.x.x 5050
Then run the following packet tracer
packet-tracer input outside tcp 11.10.9.8 1025 159.118.x.x 32400
Please provide us the output as we might need to run captures depending on the result.
Regards,
Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
... View more
Re: RTBH utilizando el ASA Firewall
in Documentos Seguridad
11-18-2017
06:07 PM
11-18-2017
06:07 PM
Excelente Documento Maykol!
... View more
11-18-2017
05:52 PM
Hello,
The Server port that you need to access is 3389 right?
If that is the case then the ACL should be pointing to that IP.
Remember that starting on 8.3 NAT takes place before the ACL so you should always point to the private side of things.
PD: try to avoid use any any on a ACL, even if it's for a specific port.
... View more
Created by
Julio Carvajal
in Firewalls
in Firewalls
11-18-2017
05:49 PM
11-18-2017
05:49 PM
Hi There,
In the case of multiple sub-interfaces with the same security level, I only want specific ones to talk to each other. Would a ACLs be used in this case?
A/If you want to filter traffic between interfaces or sub-interfaces with the same security level you will have to use ACLs (do not enable the " same - security - traffic permit inter-interface ce" feature as that would do the opposite as of what you are looking for)
Also, would there be any need to NAT the traffic?
A/You got to be careful in here!!! NAT should only be used when you need it (for example when having to use a public Ip to be routable).
In this case I would assume the sub-interfaces are private IP addresses so NAT wont be needed.
Is there any specific licensing requirements to create vlan subinterfaces.
No, there are not
Regards
... View more
11-18-2017
05:44 PM
Hello Phil,
Yes you can!
Starting on version 9.7 you can use something named "BVI interface" where you can have multiple ports on the ASA on a defined VLAN/Subnet.
I believe this link should be good enough for you to start :)
https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.html
Any queries, let me know
... View more
05-25-2016
10:53 AM
Hello,
Config wise as Aditya said you are good.
There are certain things that I would change (just for a clean up) like the access-groups and the ACLs you are using at the moment as you are anyway permitting everything on the inside and most important the fixup protocol ICMP would take care of the echo replies so no need for the inbound ACL on the outside interface.
Make sure that you can ping from the ASA to your default gateway 207.70.142.254.
If that works then ping from your ASA to 4.2.2.2
Keep us posted
Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIS-SEC
Rate all the helpful posts
... View more
11-23-2017
The switch SVI should be in VLAN 10 according to the IP address
assignment in your network. So port ...
11-23-2017
Hello, Can you share the output of show dhcpd statistics We might need
to run debugs and captures la...
11-22-2017
Hey Coffee, no, the only way to redirect the traffic is from the ASA
itself (on this model).
Created by
Julio Carvajal
in Firewalls
11-22-2017
11-22-2017
Hello, Are you using the FirePower for HTTP inspection? Do you have any
active policies for HTTP? We...
11-22-2017
Hi, I just checked the ACL configuration (very quickly) and I can tell
you there is no need to have ...
Created by
Julio Carvajal
in Discusiones Seguridad
11-21-2017
11-21-2017
Buenas, Es correcto. Con el FMC se puede administrar el 2140. Saludos
Created by
Julio Carvajal
in Discusiones Seguridad
11-21-2017
11-21-2017
Buenas Cristhian, Como parte de un control de seguridad en los
cortafuegos ASA FTD no se puede acced...
11-21-2017
Hi, Unfortunately No. You have to run it in Transparent mode in order to
make this happen. Regards
11-21-2017
Hi Scott, The Packet tracer is not properly written. I would first
recommend you to write the nats f...
11-18-2017
Hello, The Server port that you need to access is 3389 right? If that is
the case then the ACL shoul...
Created by
Julio Carvajal
in Firewalls
11-18-2017
11-18-2017
Hi There, In the case of multiple sub-interfaces with the same security
level, I only want specific ...
11-18-2017
Hello Phil, Yes you can! Starting on version 9.7 you can use something
named "BVI interface" where y...
Public Statistics
| Date Registered | 07-25-2011 05:35 PM |
| Date Last Visited | 11-23-2017 06:15 PM |
| Total Messages Posted | 5,741 |
| Total Helpful Votes Received | 3513 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 10 | |
| 5 | |
| 5 | |
| 5 |
.jpg "Hall of Fame Master"){kind=icon}
Awards
Cisco Designated VIPs
2015 Security
Cisco Designated VIPs
2014 Security
Community Spotlight Award
Premio "El Favorito" Enerodel 2016.
Community Spotlight Award
Spanish Member's Choice, January 2016
Community Spotlight Award
Questions Answered, October 2013
Community Spotlight Award
Premio"Mejor Publicación"Diciembre del 2013.
Event Top Contributor
2014
