Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Gizmo37QC
Stats
Member since
01-20-2010
11
Posts
0
Helpful
0
Solutions
05-03-2010
12:24 PM
Hi all, did someone successfully applied ACL for MS-RPC service in an ASA or a FWSM ? There is a lot of example but it seem to be generic parameter. We are requested to do as some other manufacturer does, by specifying RPC access based on UUID . (ie, specify the RPC service authorized to pass through the firewall : Only Ms-Exchange Directory Service for exemple). When i look to the last FWSM or ASA software guide, nowhere it is specified we can add or specify UUID. I also look at optionnal info in ASDM dce inspection protocol and nothing about UUID. If someone have implemented it, is it possible to get additional documentation ? Thanks, Gizmo
... View more
Labels:
01-26-2010
06:48 PM
Hi all, i tried to add route in a VRF to go toward the global router in a 6513 with sup720. For exemple i have an svi on global router with ip 192.168.1.1 ; this svi links to a wan and there is some entries in the routing table i have two svi mapped in a vrf with 172.16.1.1 and 172.16.2.1 i also have other vrf. In each VRF, i want to point default to 192.168.1.1 in the global router. i tried the global parameter at the end of the ip route command (ip route vrf xyz 0.0.0.0 0.0.0.0 192.168.1.1 global but the ios return an error saying that the gateway is this router. I know i could leak route between VRF and using BGP (i tried it) , but i only want each VRF know some route with GRT and vice-versa, so im looking a simple manner to add some route to GRT. Thanks.
... View more
Labels:
01-25-2010
07:26 AM
Hi there, i had to modify MAC Adress on a VRF SVI in order to bridge my vlan to another one in the global router (bridge with FWSM). It resolved the issue i had (thanks to people here). On another setup, i also had to modify mac adress in two pair of Cisco ASA 5550 running each multiple context in failover. On th VRF mapped svi, i only modify a digit of the mac adress (replacing the first 0 with a 1....) In the ASA, we made an internal definition mac Structure (relative to context id, context vlan etc etc). My question is : Is there a range of usable MAC adress we can use for this kind of purpose ? Or a convention for modifying it relative to the kind of equipment ? Thanks !
... View more
Labels:
01-22-2010
10:25 AM
yep, basic communication is working after i modify mac on the vrf-svi. Do you know if there is any 'rule' for mac we can use when we do this ? i only replace the first digit from 0 to 1 for now. Next week we will go with more communication with servers and host, also exchange route between the vrf and the global router. Thanks a lot again.
... View more
01-22-2010
08:42 AM
Hi, with the help of a couple user here (thanks a lot again), we set up a FWSM in a 6513 chassis . we have set an admin context in routed mode and working. Now we have set a context in transparent mode. Interface A is linked to a svi on the global router. Interface B is linked to a svi mapped in a VRF Before the assignement of vlan-group, svi A dont see svi B in the VRF. Now The vlan are assigned and the bvi is set. there is a rule who permit icmp on both interface. When we are in CLI in the context, we can ping SVI A at the global router. We can ping SVI B at the VRF. The VRF can ping the bvi . The global router can ping the bvi also. BUT, the VRF can NOT ping the global router nor the global router can ping the VRF svi and dont see anything in the log monitor. We permit ip any any on both interface We permit any ethertype rule also. Is there something to do in the global router or the FWSM to allow these 2 SVI to exchange communication ? Thanks !
... View more
Labels:
01-21-2010
07:08 PM
Hi All, we have a few problem relative to FWSM integration in a 6513 cluster (VSS). All IOS are up to date. We suspect the <default>configuration running int the FWSM doesnt permit communication with anything, so we are unable to check connectivity with VRF and Global router. What i want to be sure, its about access list in the context. i created an access list named PermitAll and applied it on both interface. The permit all access list is permit ip any any. So here is a sample of the setup : On the 6500 : vlan 192 vlan 196 int vlan192 ip 10.65.192.1 /24 int vlan196 vrf forwarding TEST int vlan 196ip 10.65.196.1 /24 firewall vlan-group 1 192-196 firewall sw 1 slot 6 vlan-group 1 Both interface are up after been assigned to fwsm ************** In the FW system : int vlan 192 and 196 are visible and no shut (UP) both int are allocated in context admin in context admin int vlan192 ip is 10.65.192.2 /24 with security level 100 int vlan 196 ip is 10.65.196.2 /24 with security level 50 telnet and ssh 10.65.192.0 255.255.255.0 both interface are up ************************************************************* at this point if we are in the context admin, we are unable to ping the svi on vlan 192 (10.65.192.1) but of course we ping local interface sucessfully. same problem on int 196. we put access list permit ip any any in on both interface but this not resolve. when on MSFC, we ping local but we dont ping fwsm int192 on the same vlan. strangely, the sh arp command show the ip of the FWSM in router and same command show svi ip in the FWSM. Also, we are unable to telnet from 10.65.192.x to the FWSM. Do we need something else to permit these elementary things ? we dont set up any nat command at this point. We also suspect problem communication between the FWSM module and the switch, but if it would be the case, i dont think we would see other module MAC adresse in the arp table. Any tips would be appreciated
... View more
Labels:
01-21-2010
06:10 PM
Giuseppe, thanks again... we verify and we have good version. We rebuild the setup of the FWSM (clear all configuration). And we have the same results, either in Transparent or Routed Mode. The fact is it look like the FWSM doesnt contact MSFC at Layer 3, as we cant ping anyting (ex. we dont ping int inside from MSFC to FWSM or FWSM to MSFC) we cant telnet the FWSM nor contact http server (ASDM). Weird, the sh arp command return the mac and ip of those interface (so the ARP Works) . all firewall Interface have same MAC. All svi have also have a unique MAC We checked Firewall vlan group on the switch and the 2 Vlan used are assigned on group 1, and the group 1 is assigned to the switch module. We really dont understand, we also compare a lot of sample FW config and nothing seems to be wrong. How can be sure communication pass on the port Channel between the chassis and the fwsm for the specified vlan ? How can be sure it is not the Firewall itself who drop connection ? Would it be better for me to start in another thread with these question ?
... View more
01-21-2010
09:34 AM
Giuseppe, is GRT SVI able to communicate with VRF mapped SVI? The answer is NO. Now i tried to put my admin context in routed mode instead. When all will be working, i will create other context in transparent mode. But guess what ? i have the same problem !!! i created GRT SVI vlan 10 (svi 10.1.1.1) i created VRF SVI vlan 11 (svi 10.1.2.1) i created vlan 10 and 11 in FWSM system, i see int vlan 10 and 11 in admin context int vlan 10 ip 10.1.1.2 int vlan 11 ip 10.1.2.2 when im in context, i ping 10.1.1.2 and 10.1.2.2. but never ping both SVI. (timeout). i put an acl ip any any on both interface. ip ut an acl icmp any any on both interface also. i set up telnet access on int vlan 10 (GRT side) but cannot telnet the FWSM (10.1.1.2) from the switch if i show arp i see ip of SVI (both) So, in transparent mode or routed mode, i miss something in order IP in module can talk to IP in the switch (GRT or VRF). ^$%^$#%@! Im using the switch in VSS Mode. The FWSM module in the other chassis is not configured yet.
... View more
01-21-2010
06:15 AM
Good morning Giuseppe ! It is exactly what we did for now, trying to establish a transparent FW, with one int on a SVI Global a one Interface on a SVI VRF, all this bridge on a BVI. We manage via a session to the module. We can't access (ping, telnet....) BVI from either of interface (from global router or from VRF) and when in the context, we cannot reach any of two side (svi global ou svi VRF). We can ping the BVI ip when we are in the context. Is there something else (not mentionned in the config sample) that could be mandatory for basic setup ? Is something required in the routing table (dont think so as it is on the same subnet).
... View more
01-20-2010
02:02 PM
Giuseppe, it helped a lot ! i understand it is possible ... i tried it a couple of time and im unable to reach ip except the bridge (bvi) ip. On the FWSM, in the context admin, im able to ping the bvi but im not able to ping router on each end of Vlan. Of course, i cant telnet the management FWSM via telnet from the msfc I put a test access list to permit any any tcp and icmp on both interface (in and out). In the url i mentionned above, there is sample configuration. In the admin context, the add a ARP entry. The same ARP are not in other context. Is there any reason for these entry to be there ? and why only in admin context ? in admin context : arp outside 10.1.1.2 0009.7cbe.2100
arp inside 10.1.1.3 0009.7cbe.1000
Not sure if it can be the reason why i dont access anything from the admin ctx. Thanks again.
... View more
01-20-2010
10:24 AM
Hi all, i did a lot of search about the following case and it is not clear to me what are the facts. I need to bind about 10 VRF to the central router (MSFC) in a 6513 with 720G sup. The objectives is to do as illustrate in the Figure B 5 Example 5 of this Cisco Document : http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/exampl_f.html#wp1047426 The doc is not specifiying bottom router are physical. So we would like to to the same thing but with VRF for each customer. The question is 'How establish the connectivity between a VRF and the router (MSFC), in order to place a transparent FW context (in FWSM in the same chassis) between the VRF and the MSFC. We need transparent because behind some customer VRF there will be a WAN with dynamic routing (which is not supported in routed Firewall in multi-context mode). Any tips would be appreciated. Probably we could plug a wire in the switch and 'connect' the VRF and a routed port but it is not very attractive ! I understand i can do Route Leaking between VRF with BGP, but this way we couldn't place transparent FW.... Thanks.
... View more
Labels:
05-03-2010
Hi all, did someone successfully applied ACL for MS-RPC service in an
ASA or a FWSM ? There is a lot...
01-26-2010
Hi all, i tried to add route in a VRF to go toward the global router in
a 6513 with sup720.For exemp...
01-25-2010
Hi there, i had to modify MAC Adress on a VRF SVI in order to bridge my
vlan to another one in the g...
01-21-2010
Hi All, we have a few problem relative to FWSM integration in a 6513
cluster (VSS). All IOS are up t...
01-21-2010
Giuseppe, thanks again... we verify and we have good version. We rebuild
the setup of the FWSM (clea...
01-21-2010
Giuseppe,is GRT SVI able to communicate with VRF mapped SVI? The answer
is NO.Now i tried to put my ...
01-21-2010
Good morning Giuseppe !It is exactly what we did for now, trying to
establish a transparent FW, with...
01-20-2010
Giuseppe, it helped a lot ! i understand it is possible ... i tried it a
couple of time and im unabl...
Public Statistics
| Date Registered | 01-20-2010 10:10 AM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 11 |
.jpg "Hall of Fame Expert"){kind=icon}
