Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Maddhattr
Stats
Member since
06-25-2018
5
Posts
0
Helpful
0
Solutions
Created by
Maddhattr
in Network Security
in Network Security
10-31-2018
09:53 AM
10-31-2018
09:53 AM
I just removed the Proxy ID's and made the tunnel to allow ANY. After about 5 minutes ping started to happen. The only problem is now I can ping anything on the ASA. LOL I will attempt to limit this traffic with access rules. My prference would be for the tunnel to have limited traffic on it still. It also take a long time for traffic to be established.
The other issue I will run into is that I need to have more than one tunnel as multiple locations will be access the data that the ASA is connected to. I am not sure how to set up routes or NAT rules to make this work.
Any suggestions are welcome.
Thanks!
... View more
10-31-2018
09:27 AM
I am still leaning the cisco ASA and need some help with my tunnels. I was able to stand up and connect a VPN tunnel to my site successfully. The tunnel connects without issue and seem to be reliable in that it stays connected. One end is a Palo Alto firewall (which I am very familiar with) and the other is the ASA.
However I seem to have issues passing traffic reliably. I can get one range connected and working sometimes. Any of the other subnets I need to connect will not do so. I can even see the ping / rdp traffic hitting the ASA and the connections being created. Yet the traffic does not reach it destination or is not returned.
Attached is the config. Let me know if there is something else I should pull or look at.
... View more
Created by
Maddhattr
in Network Security
in Network Security
10-26-2018
03:51 PM
10-26-2018
03:51 PM
I have updated the configs for the switch ports. They no longer have spanning tree portfast disable on them. This seems to have solved the issue of ping and interface traffic. I discovered this when going through the questions you asked and checking my connections. I removed the cable to FW1 P3 and had ping all of a sudden.
interface GigabitEthernet1/0/23 description "FW1 P3" switchport trunk native vlan 888 switchport trunk allowed vlan 413-417,904 switchport mode trunk ! interface GigabitEthernet1/0/24 description "FW2 P3" switchport trunk native vlan 888 switchport trunk allowed vlan 413-417,904 switchport mode trunk
Originally I had planned to set the interfaces as an Etherchannel but could not get that to work and figured redundant ports would be easier to configure. I left some settings on SW01 from when I had been configuring that. Now I just have to figure out how to set up a tunnel and VPN! And make some static routes. Can you point me a any good resources for that.
For example does my route for external look correct? Ignoring the fact that the address of 40.1 is a private ip. This system is currently sitting behind another firewall.
route ISP01 0.0.0.0 0.0.0.0 192.168.40.1 1
Then I guess I have to work on NAT's.
... View more
Created by
Maddhattr
in Network Security
in Network Security
10-26-2018
02:53 PM
10-26-2018
02:53 PM
Here are the interface ports on the switch that is connected to the FW:
interface GigabitEthernet1/0/3 description FEP1 N1 switchport trunk native vlan 888 switchport trunk allowed vlan 413-415,417 switchport mode trunk spanning-tree portfast disable ! interface GigabitEthernet1/0/4 description FEP1 N2 switchport trunk native vlan 888 switchport trunk allowed vlan 413-415,417 switchport mode trunk spanning-tree portfast disable ! interface GigabitEthernet1/0/5 description FEP2 N1 switchport trunk native vlan 888 switchport trunk allowed vlan 413-415,417 switchport mode trunk spanning-tree portfast disable ! interface GigabitEthernet1/0/6 description FEP2 N2 switchport trunk native vlan 888 switchport trunk allowed vlan 413-415,417 switchport mode trunk spanning-tree portfast disable ! interface GigabitEthernet1/0/23 description "FW1 P3" switchport trunk allowed vlan 413-417,904 switchport mode dot1q-tunnel no cdp enable spanning-tree portfast disable ! interface GigabitEthernet1/0/24 description "FW2 P3" switchport trunk allowed vlan 413-417,904 switchport mode trunk spanning-tree portfast disable
Here is the ASA settings:
ASA Version 9.8(2) ! hostname FW01
! interface GigabitEthernet0/0 description Interface for external ISP 1 nameif ISP01 security-level 0 zone-member Z0-Public ip address 192.168.40.33 255.255.254.0 ! interface GigabitEthernet0/0.904 description MGMT vlan 904 nameif MGMT security-level 100 no ip address ! interface GigabitEthernet0/1 description Interface for external ISP 2 shutdown nameif ISP02 security-level 0 zone-member Z0-Public no ip address ! interface Redundant4 member-interface GigabitEthernet0/2 member-interface GigabitEthernet0/3 nameif REDUNDANT security-level 0 no ip address ! interface Redundant4.413 vlan 413 nameif HM-PHYS security-level 60 ip address 192.168.13.1 255.255.255.0 ! interface Redundant4.414 vlan 414 nameif HM-AD security-level 70 ip address 192.168.14.1 255.255.255.0 ! interface Redundant4.415 vlan 415 nameif HM-DMZ security-level 50 ip address 192.168.15.1 255.255.255.0 ! interface Redundant4.416 vlan 416 nameif HM-PLNT security-level 20 ip address 192.168.16.1 255.255.255.0 ! interface Redundant4.417 vlan 417 nameif HM-FEP security-level 80 ip address 192.168.17.1 255.255.255.0 ! object network FEPA host 192.168.17.21 description FEPA object network FEPA-NAT host 10.116.251.93 description NAT for PLNT acccess by the FEP object network FEPB-NAT host 10.116.251.94 description NAT for PLNT access from FEPB object network FEPB host 192.168.17.22 description FEPB object network HERMDC1 host 192.168.14.15 description DC1 object network HERMDC2 host 192.168.14.16 description DC2 object network HMPHFEPA host 192.168.13.21 description Physical FEP server A object network HMPHFEPB host 192.168.13.22 description Physical FEP server B object network HM-EMS-SW01 host 192.168.104.201 object network HM-EMS-SW02 host 192.168.104.202 object network HERM-FW02 host 192.168.104.102 object network HERM-FW01 host 192.168.104.101 object network HM-ISP-SW01 host 192.168.104.205 object network HM-ISP-SW02 host 192.168.104.206 object network PHYS-GW host 192.168.13.1 object network AD-GW host 192.168.14.1 object-group network DM_INLINE_NETWORK_1 network-object object HMPHFEPA network-object object HMPHFEPB object-group network DM_INLINE_NETWORK_2 network-object object HERMDC1 network-object object HERMDC2 object-group network DM_INLINE_NETWORK_3 network-object object FEPA network-object object FEPB object-group network DM_INLINE_NETWORK_4 network-object object HERMDC1 network-object object HERMDC2 object-group network DM_INLINE_NETWORK_5 network-object object HMPHFEPA network-object object HMPHFEPB object-group network DM_INLINE_NETWORK_6 network-object object HERMDC1 network-object object HERMDC2 object-group network DM_INLINE_NETWORK_7 network-object object HMPHFEPA network-object object HMPHFEPB object-group network DM_INLINE_NETWORK_8 network-object object HERMDC1 network-object object HERMDC2 object-group network DM_INLINE_NETWORK_9 network-object object HMPHFEPA network-object object HMPHFEPB access-list PLNT_access_in_1 remark Allows communication from FEPA to the PLNT network access-list PLNT_access_in_1 extended permit ip object FEPA 192.168.251.64 255.255.255.224 access-list PLNT_access_in_1 remark Allows communication from FEPB to the PLNT network access-list PLNT_access_in_1 extended permit ip object FEPB 192.168.251.64 255.255.255.224 access-list PHYS_access_out extended permit ip object-group DM_INLINE_NETWORK_5 192.168.14.0 255.255.255.0 access-list PHYS_access_out extended permit ip any any access-list HERM-AD-SVR_access_in extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_INLINE_NETWORK_2 access-list HERM-AD-SVR_access_in extended permit ip object-group DM_INLINE_NETWORK_3 object-group DM_INLINE_NETWORK_4 access-list HERM-AD-SVR_access_out extended permit ip object-group DM_INLINE_NETWORK_6 object-group DM_INLINE_NETWORK_7 access-list PHYS_access_in extended permit ip object-group DM_INLINE_NETWORK_8 object-group DM_INLINE_NETWORK_9 access-list PHYS_access_in extended permit ip any any access-list AD_access_out extended permit ip 192.168.14.0 255.255.255.0 192.168.13.0 255.255.255.0 access-list AD_access_out extended permit ip any any access-list AD_access_in extended permit ip any any access-list HERM-PHYS_access_out extended permit ip any any access-list HERM-PHYS_access_in extended permit ip any any
... View more
Created by
Maddhattr
in Network Security
in Network Security
10-26-2018
08:41 AM
10-26-2018
08:41 AM
I am working on configuring a pair of cisco ASA 5525 and I am running into some trouble. I have done the basic configuration and have a management interface and HA setup without issue. Now I am trying to configure some vlan sub-interfaces but cannot get them to pass traffic. I am familiar with cisco switches and Palo Alto firewalls and watchguard firewalls.
Basic setup is two cisco switches for redundancy connected to the ASA on interface 2 and 3 set as a redundant interface. The switch connections to the ASA are set a trunk interfaces with the proper vlans allowed. Similar to how I have set up other networks.
The ASA has the sub-interfaces configured with the correct vlans and show a status of UP in the home section of the ASDM. I however cannot ping the interface IP address nor can I pass traffic to another VLAN interface. I also cannot pass any external traffic. I am sure it is something simple that I am missing.
Any help or advice would be great! I can post a copy of the ASA config if needed. Thanks
... View more
10-31-2018
I just removed the Proxy ID's and made the tunnel to allow ANY. After
about 5 minutes ping started t...
10-31-2018
I am still leaning the cisco ASA and need some help with my tunnels. I
was able to stand up and conn...
10-26-2018
I have updated the configs for the switch ports. They no longer have
spanning tree portfast disable ...
10-26-2018
Here are the interface ports on the switch that is connected to the FW:
interface GigabitEthernet1/0...
Public Statistics
| Date Registered | 06-25-2018 04:15 PM |
| Date Last Visited | 11-05-2018 08:56 PM |
| Total Messages Posted | 5 |
