Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About sysadmin
08-18-2017
Stats
Member since
11-03-2013
11
Posts
0
Helpful
0
Solutions
02-03-2014
02:01 AM
you are right, i need to keep that to let VPN clients connect to internet. Thanks
... View more
02-03-2014
01:38 AM
Thanks a lot. I removed nat (outside) 1 10.40.170.0 255.255.255.0 and added new as suggested by you, it works. will see if everything else is fine also. Thanks again
... View more
02-03-2014
12:14 AM
Hi Thanks for answering. I already have these configurations in place. same-security-traffic permit intra-interface global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 nat (outside) 1 10.40.170.0 255.255.255.0 What i'm suspecting is that my internal network (INSIDE) is 10.40.220.x. and on ASA i have a static route: route inside 10.40.0.0 255.255.0.0 10.40.251.1 1 Do you think this is creating problem? ASA software version is 8.2(2) Message was edited by: Arthit Chinnachot
... View more
02-02-2014
11:57 PM
Hi I have a cisco ASA 5510 device configred with remote access VPN I can connect all host on INSIDE and DMZ network, but not able to access other clients connected to same VPN. For example if I have 2 clients connected to VPN, clientA and clientB, with vpn pool IP addresses as 10.40.170.160 and 10.40.170.161 respectively, these both clients are not able to communicate with each other. Any help is welcome. Thanks in advance.
... View more
Labels:
01-16-2014
01:22 AM
Thanks a lot. Dynamic PAT for a VPN Pool was missing. By the way software version of device is 8.2
... View more
01-16-2014
12:58 AM
Hi I looked for resources over net but coudn't find solution, so posting here. May be somebody can help. So the problem is that i'm trying to access a server on cloud from remote access VPN(cisco asa 5510). The server on cloud (54.54.54.54) is only accessible from outside interface(192.168.11.2) of NY firewall ( cisco asa 5510 ) I've added ACE for this in ACL of VPN split tunnel. ny-fw# access-list vpn_remote-client standard permit host 54.54.54.54 And i can see the route added to my cliet machine after connecting VPN, b ut still it cannot connect to this server. From INSIDE network i can connect to server. Thanks in advance.
... View more
Labels:
11-04-2013
12:29 AM
Fixed it. Problem was somehow the configurations went missing. I added following conf and it is working fine now. for ssh: ssh 10.40.0.0 255.255.0.0 inside for VPN authentication server configuration was missing. Added following: aaa-server vpn_bmeng_aaa (inside) host netservice ldap-base-dn ******* ldap-group-base-dn ou=Technical ldap-scope subtree ldap-naming-attribute uid ldap-login-password ***** ldap-login-dn *********** server-type auto-detect Also had to fix switch to route reverse traffic for VPN connected hosts to correct firewall.
... View more
11-03-2013
05:40 PM
I added another ASA device and have to assign 10.40.250.1 to that device. So i assigned 10.40.251.1 to this. Sorry I did not understand what you are trying to say. And also layer 3 device is connected to this ASA via G0/48 and there is a " directly connected" route to 10.40.251.1. So how does it not know the route.
... View more
11-03-2013
07:28 AM
I have one ASA which is for client VPN connections and site-to-site VPNs I changed its IP address, now i'm not able to connect to it. Here is the detail vlan522 <=> SW1 <=> g0/48(10.40.251.2) <=> e0/1 (10.40.251.1) <=> FW1-ASA 5510 FW1-ASA 5510 has futher site-to-site VPNs and also client VPN for users to connect from outside, which authenticate from a LDAP server from INSIDE and also DHCP is on INSIDE. * Now problem is i'm not able to ssh to ASA (10.40.250.1) but ping is working. * and client VPN is not working, i'm able to ping LDAP/DHCP server from ASA. attached configurations of switch and ASA.
... View more
Labels:
11-03-2013
03:05 AM
Hi I'm new to firewalls, so apologies if i'm wrong anhywhere. Here is my setup. I have a cisco C3560 switch with multiple VLans It is connected to ASA 5505 which is further connected to Internet. C3560 <--> G0/46 <--> 10.40.250.2 <--> 10.40.250.1 <--> E0/1 <--> ASA 5505 My problem is I'm not able to ping internet hosts from switch. Reverse route is fine. I'm able to ping switch and hosts on other Vlans. And from switch I'm able to ping 10.40.250.1 (ASA interface). But from switch or my desktop i'm not able to go to internet. Following are my configurations. Kindly help. ASA Configuration <code> : ASA Version 8.2(2) ! hostname sg-fw2 names ! interface Ethernet0/0 nameif OUTSIDE security-level 0 ip address dhcp setroute ! interface Ethernet0/1 nameif INSIDE security-level 100 ip address 10.40.250.1 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! ftp mode passive object-group network INTERNAL_RANGE pager lines 24 logging enable logging asdm informational logging mail critical mtu OUTSIDE 1500 mtu INSIDE 1500 icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 ! router eigrp 321 no auto-summary default-metric 100000 1 255 1 1500 network 0.0.0.0 0.0.0.0 redistribute static ! route INSIDE 10.40.0.0 255.255.0.0 10.40.250.2 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL http server enable http 10.40.0.0 255.255.0.0 INSIDE snmp-server host INSIDE 10.40.12.210 poll community ***** version 2c no snmp-server location no snmp-server contact snmp-server community ***** crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet timeout 5 ssh 10.40.0.0 255.255.0.0 INSIDE ssh timeout 5 ssh version 2 console timeout 0 threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 webvpn ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect http inspect icmp ! service-policy global_policy global prompt hostname context call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:3b4c6840cb9a7b2b490bcc2574f65371 : end </code> C3560 Swittch Configuration <code> Building configuration... Current configuration : 10370 bytes ! ! Last configuration change at 19:05:13 WST Sat Nov 2 2013 by sysadmin ! version 15.0 no service pad no service timestamps debug uptime service timestamps log datetime service password-encryption service sequence-numbers ! ! boot-start-marker boot-end-marker ! ! ! aaa new-model ! ! aaa authentication login default local ! ! ! ! ! ! aaa session-id common clock timezone WST 8 0 clock summer-time GMT recurring last Sun Mar 1:00 last Sun Oct 2:00 system mtu routing 1500 ip routing ! ! ! ip dhcp snooping vlan 522 ip dhcp snooping ! ! ! ! ! ! ! ! errdisable recovery cause udld errdisable recovery cause bpduguard errdisable recovery cause security-violation errdisable recovery cause channel-misconfig (STP) errdisable recovery cause pagp-flap errdisable recovery cause dtp-flap errdisable recovery cause link-flap errdisable recovery cause sfp-config-mismatch errdisable recovery cause gbic-invalid errdisable recovery cause l2ptguard errdisable recovery cause psecure-violation errdisable recovery cause dhcp-rate-limit errdisable recovery cause vmps errdisable recovery cause storm-control errdisable recovery cause arp-inspection errdisable recovery cause loopback ! spanning-tree mode pvst spanning-tree extend system-id spanning-tree vlan 1-999 priority 24576 ! vlan internal allocation policy ascending ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address 3.3.3.3 255.255.255.255 ! interface Port-channel1 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/1 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/2 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/3 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/4 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/5 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/6 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/7 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/8 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/9 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/10 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/11 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/12 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/13 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/14 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/15 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/16 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/17 switchport access vlan 523 ! interface GigabitEthernet0/18 description trunk to bm-sg-sw3 in other server room switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/19 description link to 3com switch for 10.40.12.x network switchport access vlan 512 ip dhcp snooping trust ! interface GigabitEthernet0/20 description link to drac card on xen server switchport access vlan 523 switchport mode access mls qos trust cos ! interface GigabitEthernet0/21 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/22 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/23 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/24 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/25 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/26 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/27 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/28 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/29 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/30 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/31 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/32 switchport access vlan 512 switchport mode access ip dhcp snooping trust ! interface GigabitEthernet0/33 description servers in engineering room switchport access vlan 523 mls qos trust cos ! interface GigabitEthernet0/34 description link to rack for engineering network switchport access vlan 523 mls qos trust cos ! interface GigabitEthernet0/35 description C1841-F0/1 switchport access vlan 600 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/36 description ASA5510-F0/1 switchport access vlan 600 switchport mode access mls qos trust cos spanning-tree portfast ! interface GigabitEthernet0/37 description C2811-F0/0 switchport access vlan 600 switchport mode access mls qos trust cos spanning-tree portfast ! interface GigabitEthernet0/38 description vmserver1 switchport access vlan 512 ip dhcp snooping trust ! interface GigabitEthernet0/39 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/40 description build server nas switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/41 description server farm b switchport access vlan 522 ! interface GigabitEthernet0/42 switchport access vlan 523 switchport mode access mls qos trust cos ! interface GigabitEthernet0/43 description hub for engineering server farm switchport access vlan 522 ! interface GigabitEthernet0/44 description connection for voip 2851 no switchport ip address 10.40.40.1 255.255.255.0 ! interface GigabitEthernet0/45 no switchport no ip address ! interface GigabitEthernet0/46 description connection to ASA inside no switchport ip address 10.40.250.2 255.255.255.0 duplex full ! interface GigabitEthernet0/47 description span port ! interface GigabitEthernet0/48 ! interface GigabitEthernet0/49 description trunk to 3560-POE switch 2 switchport trunk encapsulation dot1q switchport mode trunk channel-group 1 mode desirable ! interface GigabitEthernet0/50 ! interface GigabitEthernet0/51 ! interface GigabitEthernet0/52 ! interface Vlan1 ip address 10.10.100.1 255.255.255.0 ! interface Vlan10 ip address 10.40.10.3 255.255.255.0 ! interface Vlan300 ip address 10.40.255.1 255.255.255.248 ! interface Vlan512 description corp_serv ip address 10.40.12.1 255.255.255.0 ! interface Vlan520 description corp_con ip address 10.40.200.1 255.255.254.0 ! interface Vlan522 description workstations ip address 10.40.224.1 255.255.254.0 secondary ip address 10.40.220.1 255.255.254.0 ip helper-address 10.40.12.253 ip helper-address 10.40.12.252 ! interface Vlan523 description office_lab ip address 10.40.230.1 255.255.254.0 ip access-group vlan523_access_in in no ip unreachables ! ! router eigrp 321 network 3.0.0.0 network 10.0.0.0 eigrp stub connected summary ! ip http server ip http authentication local ip http secure-server ! ! ip route 0.0.0.0 0.0.0.0 10.40.250.1 ip route 10.1.0.0 255.255.0.0 10.40.10.254 ip route 10.1.1.0 255.255.255.0 10.40.250.1 ip route 10.40.240.0 255.255.254.0 10.40.40.2 ip route 202.56.195.121 255.255.255.255 10.40.10.254 ip route 202.152.162.174 255.255.255.255 10.40.10.254 ip route 202.152.162.177 255.255.255.255 10.40.10.254 ip route 203.145.131.152 255.255.255.255 10.40.10.254 ip route 203.196.249.7 255.255.255.255 10.40.10.254 ! ip access-list extended search_for_192.168 permit ip any host 216.246.60.14 log-input ip access-list extended vlan523_access_in remark permit any tcp connection into this vlan to return permit tcp any any established remark allow DNS query permit udp any host 10.40.12.253 eq domain remark http access to fumes permit tcp any host 10.26.156.51 eq www permit tcp any host 10.26.156.51 eq 443 remark http access to 3.0 build machine permit tcp any host 10.26.156.30 eq www permit tcp any host 10.26.156.30 eq 443 remark allow communication between 10.40.231.205 and cisco cme permit ip host 10.40.231.205 host 10.40.240.1 permit ip host 10.40.231.205 host 10.40.40.2 remark Allow IANA ephemeral port permit udp any any range 49152 65535 permit udp any any range 25000 35000 permit udp any any range 40001 45000 remark permit connection to SingNet Proxy permit tcp any host 220.255.4.9 eq 8080 remark http and NFS access to filesvr permit tcp any host 10.40.12.248 eq www permit tcp any host 10.40.12.248 eq 443 permit tcp any host 10.40.12.248 eq sunrpc permit udp any host 10.40.12.248 eq sunrpc permit tcp any host 10.40.12.248 eq 2049 permit udp any host 10.40.12.248 eq 2049 permit tcp any host 10.40.12.248 range 4000 4002 permit udp any host 10.40.12.248 range 4000 4002 remark permit sip traffic permit tcp any any range 5060 5063 permit udp any any range 5060 5063 permit udp any any range 5000 5003 permit udp any any range 5010 5013 permit udp any any range 16384 32767 remark permit access to ldap server permit tcp any host 10.40.12.247 eq 389 deny icmp any any redirect deny icmp any any mask-request permit icmp any any permit ip 0.0.0.0 255.255.254.0 0.0.0.0 255.255.254.0 permit tcp 0.0.0.0 255.255.254.0 0.0.0.0 255.255.254.0 permit ip any any permit tcp any any ! logging trap warnings logging facility syslog logging source-interface Loopback0 logging host 10.40.12.210 ! ! ! ! ! line con 0 logging synchronous line vty 0 4 privilege level 15 password 7 120F0B0F1F08545D79 transport preferred none transport input telnet transport output none line vty 5 15 privilege level 15 password 7 120F0B0F1F08545D79 transport preferred none transport input telnet transport output none ! ! monitor session 1 source vlan 1 - 4094 monitor session 1 destination interface Gi0/47 ntp server 10.40.12.253 prefer end </code>
... View more
Labels:
11-03-2013
02:58 AM
Hi I'm new to firewalls, so apologies if i'm wrong anhywhere. Here is my setup. I have a cisco C3560 switch with multiple VLans It is connected to ASA 5505 which is further connected to Internet. C3560 <--> G0/46 <--> 10.40.250.2 <--> 10.40.250.1 <--> E0/1 <--> ASA 5505 My problem is I'm not able to ping internet hosts from switch. Reverse route is fine. I'm able to ping switch and hosts on other Vlans. And from switch I'm able to ping 10.40.250.1 (ASA interface). But from switch or my desktop i'm not able to go to internet. Following are my configurations. Kindly help. ASA Configuration <code> : ASA Version 8.2(2) ! hostname sg-fw2 names ! interface Ethernet0/0 nameif OUTSIDE security-level 0 ip address dhcp setroute ! interface Ethernet0/1 nameif INSIDE security-level 100 ip address 10.40.250.1 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! ftp mode passive object-group network INTERNAL_RANGE pager lines 24 logging enable logging asdm informational logging mail critical mtu OUTSIDE 1500 mtu INSIDE 1500 icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 ! router eigrp 321 no auto-summary default-metric 100000 1 255 1 1500 network 0.0.0.0 0.0.0.0 redistribute static ! route INSIDE 10.40.0.0 255.255.0.0 10.40.250.2 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL http server enable http 10.40.0.0 255.255.0.0 INSIDE snmp-server host INSIDE 10.40.12.210 poll community ***** version 2c no snmp-server location no snmp-server contact snmp-server community ***** crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet timeout 5 ssh 10.40.0.0 255.255.0.0 INSIDE ssh timeout 5 ssh version 2 console timeout 0 threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 webvpn ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect http inspect icmp ! service-policy global_policy global prompt hostname context call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:3b4c6840cb9a7b2b490bcc2574f65371 : end </code> C3560 Swittch Configuration <code> Building configuration... Current configuration : 10370 bytes ! ! Last configuration change at 19:05:13 WST Sat Nov 2 2013 by sysadmin ! version 15.0 no service pad no service timestamps debug uptime service timestamps log datetime service password-encryption service sequence-numbers ! ! boot-start-marker boot-end-marker ! ! ! aaa new-model ! ! aaa authentication login default local ! ! ! ! ! ! aaa session-id common clock timezone WST 8 0 clock summer-time GMT recurring last Sun Mar 1:00 last Sun Oct 2:00 system mtu routing 1500 ip routing ! ! ! ip dhcp snooping vlan 522 ip dhcp snooping ! ! ! ! ! ! ! ! errdisable recovery cause udld errdisable recovery cause bpduguard errdisable recovery cause security-violation errdisable recovery cause channel-misconfig (STP) errdisable recovery cause pagp-flap errdisable recovery cause dtp-flap errdisable recovery cause link-flap errdisable recovery cause sfp-config-mismatch errdisable recovery cause gbic-invalid errdisable recovery cause l2ptguard errdisable recovery cause psecure-violation errdisable recovery cause dhcp-rate-limit errdisable recovery cause vmps errdisable recovery cause storm-control errdisable recovery cause arp-inspection errdisable recovery cause loopback ! spanning-tree mode pvst spanning-tree extend system-id spanning-tree vlan 1-999 priority 24576 ! vlan internal allocation policy ascending ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address 3.3.3.3 255.255.255.255 ! interface Port-channel1 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/1 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/2 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/3 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/4 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/5 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/6 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/7 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/8 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/9 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/10 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/11 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/12 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/13 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/14 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/15 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/16 switchport access vlan 522 switchport mode access ! interface GigabitEthernet0/17 switchport access vlan 523 ! interface GigabitEthernet0/18 description trunk to bm-sg-sw3 in other server room switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/19 description link to 3com switch for 10.40.12.x network switchport access vlan 512 ip dhcp snooping trust ! interface GigabitEthernet0/20 description link to drac card on xen server switchport access vlan 523 switchport mode access mls qos trust cos ! interface GigabitEthernet0/21 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/22 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/23 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/24 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/25 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/26 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/27 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/28 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/29 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/30 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/31 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/32 switchport access vlan 512 switchport mode access ip dhcp snooping trust ! interface GigabitEthernet0/33 description servers in engineering room switchport access vlan 523 mls qos trust cos ! interface GigabitEthernet0/34 description link to rack for engineering network switchport access vlan 523 mls qos trust cos ! interface GigabitEthernet0/35 description C1841-F0/1 switchport access vlan 600 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/36 description ASA5510-F0/1 switchport access vlan 600 switchport mode access mls qos trust cos spanning-tree portfast ! interface GigabitEthernet0/37 description C2811-F0/0 switchport access vlan 600 switchport mode access mls qos trust cos spanning-tree portfast ! interface GigabitEthernet0/38 description vmserver1 switchport access vlan 512 ip dhcp snooping trust ! interface GigabitEthernet0/39 switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/40 description build server nas switchport access vlan 512 switchport mode access ! interface GigabitEthernet0/41 description server farm b switchport access vlan 522 ! interface GigabitEthernet0/42 switchport access vlan 523 switchport mode access mls qos trust cos ! interface GigabitEthernet0/43 description hub for engineering server farm switchport access vlan 522 ! interface GigabitEthernet0/44 description connection for voip 2851 no switchport ip address 10.40.40.1 255.255.255.0 ! interface GigabitEthernet0/45 no switchport no ip address ! interface GigabitEthernet0/46 description connection to ASA inside no switchport ip address 10.40.250.2 255.255.255.0 duplex full ! interface GigabitEthernet0/47 description span port ! interface GigabitEthernet0/48 ! interface GigabitEthernet0/49 description trunk to 3560-POE switch 2 switchport trunk encapsulation dot1q switchport mode trunk channel-group 1 mode desirable ! interface GigabitEthernet0/50 ! interface GigabitEthernet0/51 ! interface GigabitEthernet0/52 ! interface Vlan1 ip address 10.10.100.1 255.255.255.0 ! interface Vlan10 ip address 10.40.10.3 255.255.255.0 ! interface Vlan300 ip address 10.40.255.1 255.255.255.248 ! interface Vlan512 description corp_serv ip address 10.40.12.1 255.255.255.0 ! interface Vlan520 description corp_con ip address 10.40.200.1 255.255.254.0 ! interface Vlan522 description workstations ip address 10.40.224.1 255.255.254.0 secondary ip address 10.40.220.1 255.255.254.0 ip helper-address 10.40.12.253 ip helper-address 10.40.12.252 ! interface Vlan523 description office_lab ip address 10.40.230.1 255.255.254.0 ip access-group vlan523_access_in in no ip unreachables ! ! router eigrp 321 network 3.0.0.0 network 10.0.0.0 eigrp stub connected summary ! ip http server ip http authentication local ip http secure-server ! ! ip route 0.0.0.0 0.0.0.0 10.40.250.1 ip route 10.1.0.0 255.255.0.0 10.40.10.254 ip route 10.1.1.0 255.255.255.0 10.40.250.1 ip route 10.40.240.0 255.255.254.0 10.40.40.2 ip route 202.56.195.121 255.255.255.255 10.40.10.254 ip route 202.152.162.174 255.255.255.255 10.40.10.254 ip route 202.152.162.177 255.255.255.255 10.40.10.254 ip route 203.145.131.152 255.255.255.255 10.40.10.254 ip route 203.196.249.7 255.255.255.255 10.40.10.254 ! ip access-list extended search_for_192.168 permit ip any host 216.246.60.14 log-input ip access-list extended vlan523_access_in remark permit any tcp connection into this vlan to return permit tcp any any established remark allow DNS query permit udp any host 10.40.12.253 eq domain remark http access to fumes permit tcp any host 10.26.156.51 eq www permit tcp any host 10.26.156.51 eq 443 remark http access to 3.0 build machine permit tcp any host 10.26.156.30 eq www permit tcp any host 10.26.156.30 eq 443 remark allow communication between 10.40.231.205 and cisco cme permit ip host 10.40.231.205 host 10.40.240.1 permit ip host 10.40.231.205 host 10.40.40.2 remark Allow IANA ephemeral port permit udp any any range 49152 65535 permit udp any any range 25000 35000 permit udp any any range 40001 45000 remark permit connection to SingNet Proxy permit tcp any host 220.255.4.9 eq 8080 remark http and NFS access to filesvr permit tcp any host 10.40.12.248 eq www permit tcp any host 10.40.12.248 eq 443 permit tcp any host 10.40.12.248 eq sunrpc permit udp any host 10.40.12.248 eq sunrpc permit tcp any host 10.40.12.248 eq 2049 permit udp any host 10.40.12.248 eq 2049 permit tcp any host 10.40.12.248 range 4000 4002 permit udp any host 10.40.12.248 range 4000 4002 remark permit sip traffic permit tcp any any range 5060 5063 permit udp any any range 5060 5063 permit udp any any range 5000 5003 permit udp any any range 5010 5013 permit udp any any range 16384 32767 remark permit access to ldap server permit tcp any host 10.40.12.247 eq 389 deny icmp any any redirect deny icmp any any mask-request permit icmp any any permit ip 0.0.0.0 255.255.254.0 0.0.0.0 255.255.254.0 permit tcp 0.0.0.0 255.255.254.0 0.0.0.0 255.255.254.0 permit ip any any permit tcp any any ! logging trap warnings logging facility syslog logging source-interface Loopback0 logging host 10.40.12.210 ! ! ! ! ! line con 0 logging synchronous line vty 0 4 privilege level 15 password 7 120F0B0F1F08545D79 transport preferred none transport input telnet transport output none line vty 5 15 privilege level 15 password 7 120F0B0F1F08545D79 transport preferred none transport input telnet transport output none ! ! monitor session 1 source vlan 1 - 4094 monitor session 1 destination interface Gi0/47 ntp server 10.40.12.253 prefer end </code>
... View more
Labels:
11-04-2013
Fixed it.Problem was somehow the configurations went missing.I added
following conf and it is workin...
11-03-2013
I added another ASA device and have to assign 10.40.250.1 to that
device.So i assigned 10.40.251.1 t...
11-03-2013
I have one ASA which is for client VPN connections and site-to-site
VPNsI changed its IP address, no...
11-03-2013
HiI'm new to firewalls, so apologies if i'm wrong anhywhere.Here is my
setup.I have a cisco C3560 sw...
Public Statistics
| Date Registered | 11-03-2013 02:34 AM |
| Date Last Visited | 08-18-2017 04:27 AM |
| Total Messages Posted | 11 |
