Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Cormac Champion
Online
Stats
Member since
06-18-2016
109
Posts
5
Helpful
3
Solutions
Created by
Cormac Champion
in Firewalls
in Firewalls
09-19-2019
09:11 AM
09-19-2019
09:11 AM
I'm trying to get a Port Translation to work - port 52722 on the outside to port 22 on the inside server. However, I'm getting a Subtype rpf-check DROP
... View more
Created by
Cormac Champion
in Firewalls
in Firewalls
09-12-2019
02:14 PM
09-12-2019
02:14 PM
Hi all, I'm new to ASA's and I have a NATing issue which I'm unable to resolve. I'm trying to allow external access through my ASA to a Web Server. I've used the Packet Tracer in the ASDM and it's recording the following in the Monitoring log Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src MY-ISP:xx.xx.xx.xx/1065 dst INSIDE:10.10.10.101/443 denied due to NAT reverse path failure The NAT Rule I have added is as follows nat (INSIDE,MY-ISP) source static obj-Web_Server interface service any REMOTE-HTTPS Where object network obj-WEB_Server host 10.10.10.101 object service REMOTE-HTTPS service tcp source eq https My ISP Connection is presented as 192.168.1.17. The ISP forwards all ports from their router to mine. I have a 0.0.0.0 0.0.0.0 via 192.168.1.1 for my ISP connection From what I have read, it seems I need to add a NoNat ACL somewhere, but with the ASDM, I'm not sure as to where this should be added, and in what form.
... View more
Labels:
Created by
Cormac Champion
in Firewalls
in Firewalls
09-05-2019
02:24 PM
09-05-2019
02:24 PM
Many thanks for that - that was it exactly. After removing the webvpn command, it just needed a reboot. The "sh asp table socket" command confirmed everything. One more thing - is there a tutorial anywhere I can follow, or can you give me an example for how to configure an inbound connection with port translation. Suppose I wanted to setup Remote Access to HOST_B using an original destination port 8080 translating to the inside HOST_B on port 80. And what about configuring Remote SSH Access to the FW itself, using an original destination port of say 50022 translating to port 22 on the FW
... View more
Created by
Cormac Champion
in Firewalls
in Firewalls
09-05-2019
01:53 PM
09-05-2019
01:53 PM
object service REMOTE-HTTPS service tcp source eq https
... View more
Created by
Cormac Champion
in Firewalls
in Firewalls
09-05-2019
01:10 PM
09-05-2019
01:10 PM
Hi all, I'm trying to get remote access through my 5505 (Security Plus Licence) to my inside Server, and so I have tried to apply the following nat (inside,outside) source static obj-WebServer interface service any REMOTE-HTTPS but as per the subject, I keep getting the message "ERROR: NAT unable to reserve ports." I have successfully applied the same rule two other ports - for REMOTE-RDP and REMOTE-8090. ADSM is configured to run on a port 50443 - so I cannot understand as to why I cannot apply the required config. SPIRIT-FW1# sh xlate 9 in use, 18 most used Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap, s - static, T - twice, N - net-to-net TCP PAT from inside:10.10.5.100 0 to outside:192.168.1.17 3389-3389 flags srT idle 1:00:46 timeout 0:00:00 TCP PAT from outside:0.0.0.0/0 0 to inside:0.0.0.0/0 0 flags srIT idle 1:00:46 timeout 0:00:00 NAT from outside:0.0.0.0/0 to inside:0.0.0.0/0 flags sIT idle 1:00:46 timeout 0:00:00 NAT from outside:0.0.0.0/0 to inside_2:0.0.0.0/0 flags sIT idle 1:00:46 timeout 0:00:00 NAT from outside:0.0.0.0/0 to inside_3:0.0.0.0/0 flags sIT idle 1:00:46 timeout 0:00:00 NAT from outside:0.0.0.0/0 to inside_4:0.0.0.0/0 flags sIT idle 1:00:46 timeout 0:00:00 TCP PAT from outside:10.10.5.100 0 to inside:192.168.1.17 8090-8090 flags srT idle 1:00:46 timeout 0:00:00 TCP PAT from outside:0.0.0.0/0 0 to inside:0.0.0.0/0 0 flags srIT idle 1:00:46 timeout 0:00:00 UDP PAT from outside:147.156.7.18 123-123 to inside:0.0.0.0/0 123-123 flags srT idle 0:36:14 timeout 0:00:00 I would be very grateful for any help or assistance
... View more
Labels:
Created by
Cormac Champion
in Firewalls
in Firewalls
08-25-2019
02:04 PM
08-25-2019
02:04 PM
The petenetlive article is perfect Essentially, it's all about "police output xxxxxxx yyyyyyy" Many thanks
... View more
Created by
Cormac Champion
in Firewalls
in Firewalls
08-25-2019
05:24 AM
08-25-2019
05:24 AM
The users will be LAN Users
... View more
Created by
Cormac Champion
in Firewalls
in Firewalls
08-25-2019
02:33 AM
08-25-2019
02:33 AM
Hi all, On an ASA 5505, is there a way to limit the bandwidth per user unless there is little activity, which would then allow the user more bandwidth. For instance, if I have a 100mb internet link, and give all connections a guaranteed 10mb, could it be configured to allow a user to use most of the 100mb in times of little use ? Thanks in advance
... View more
Labels:
Created by
Cormac Champion
in Routing
in Routing
01-14-2019
07:31 AM
01-14-2019
07:31 AM
Bump - anyone ???
... View more
Created by
Cormac Champion
in Routing
in Routing
01-04-2019
05:00 AM
01-04-2019
05:00 AM
With a 2911 which has an RPS unit connected, is the AC PSU Hot-Swappable ? I believe it is but cannot find written documentation to support it.
The following document specifically mentions that the 2921 and 2951 can be hot-swapped https://fccid.io/ANATEL/00548-10-01086/Manual-parte-3/59E875C8-EF90-46BB-A3D3-5D241A6C4328/PDF (on page 5-27)
... View more
Created by
Cormac Champion
in Wireless and Mobility
in Wireless and Mobility
07-11-2018
03:15 PM
07-11-2018
03:15 PM
Hi all,
Many questions have been asked about HA for 2504's but these were running old 7.x versions and some have also had secondary units with zero licences.
I have 2 x 2504's with 5 licences on each, and running 8.2.141. Can I do the AP SSO HA Option or can I only do N+1 ? It appears to me that the software will allow me to setup a controller as either a Primary or Secondary setup of Redundancy Management interface ip's
... View more
Labels:
Created by
Cormac Champion
in Switching
in Switching
07-03-2018
10:03 AM
07-03-2018
10:03 AM
** Bump **
... View more
Created by
Cormac Champion
in Switching
in Switching
06-29-2018
08:46 AM
06-29-2018
08:46 AM
Thanks Harold Here is a greater selection of output. This is exactly as-is down to the first of the 10.0.0.0 routes NEXUS9K01# sh ip route IP Route Table for VRF "default" '*' denotes best ucast next-hop '**' denotes best mcast next-hop '[x/y]' denotes [preference/metric] '%<string>' in via output denotes VRF <string> 0.0.0.0/0, ubest/mbest: 1/0 *via 10.3.0.9, Vlan5, [170/3072], 7w1d, eigrp-1111, external, tag 5466 1.0.0.0/8, ubest/mbest: 1/0 *via 10.3.0.9, Vlan5, [170/3072], 7w1d, eigrp-1111, external, tag 5466 1.200.16.0/24, ubest/mbest: 1/0 *via 10.3.0.9, Vlan5, [170/3072], 1w0d, eigrp-1111, external, tag 5466 1.253.253.0/24, ubest/mbest: 1/0 *via 10.3.0.9, Vlan5, [170/3072], 7w1d, eigrp-1111, external, tag 5466 1.254.253.0/24, ubest/mbest: 1/0 *via 10.3.0.9, Vlan5, [170/3072], 7w1d, eigrp-1111, external, tag 5466 1.255.4.0/24, ubest/mbest: 2/0 *via 10.53.1.6, Vlan31, [170/29440], 4w2d, eigrp-1111, external, tag 21 *via 10.53.1.7, Vlan31, [170/29440], 4w2d, eigrp-1111, external, tag 21 2.9.95.0/24, ubest/mbest: 1/0 *via 10.3.0.9, Vlan5, [170/3072], 7w1d, eigrp-1111, external, tag 5466 10.0.1.0/24, ubest/mbest: 1/0 *via 10.3.0.9, Vlan5, [170/3072], 7w1d, eigrp-1111, external, tag 5466 NEXUS9K01# sh runn | include IMPORT-FROM-GRT ip prefix-list IMPORT-FROM-GRT seq 10 permit 0.0.0.0/0 ip prefix-list IMPORT-FROM-GRT seq 20 permit 10.0.0.0/8 le 24 ip prefix-list IMPORT-FROM-GRT seq 30 permit 172.16.0.0/12 le 24 ip prefix-list IMPORT-FROM-GRT seq 40 permit 192.168.0.0/16 le 24 ip prefix-list IMPORT-FROM-GRT seq 50 permit 1.0.0.0/8 le 24 ip prefix-list IMPORT-FROM-GRT seq 60 permit 2.0.1.0/24 ip prefix-list IMPORT-FROM-GRT seq 70 permit 2.3.47.0/24 ip prefix-list IMPORT-FROM-GRT seq 80 permit 2.4.11.0/24 ip prefix-list IMPORT-FROM-GRT seq 90 permit 2.5.47.0/24 ip prefix-list IMPORT-FROM-GRT seq 100 permit 2.9.95.0/24 ip prefix-list IMPORT-FROM-GRT seq 110 permit 2.255.255.0/24 NEXUS9K01# sh ip bgp BGP routing table information for VRF default, address family IPv4 Unicast BGP table version is 105015, Local Router ID is 10.73.6.2 Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-injected Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup Network Next Hop Metric LocPrf Weight Path *>r1.0.0.0/8 0.0.0.0 3072 100 32768 ? *>r1.200.16.0/24 0.0.0.0 3072 100 32768 ? *>r1.253.253.0/24 0.0.0.0 3072 100 32768 ? *>r1.254.253.0/24 0.0.0.0 3072 100 32768 ? *>r1.255.4.0/24 0.0.0.0 29440 100 32768 ? *>r2.9.95.0/24 0.0.0.0 3072 100 32768 ? *>r10.0.1.0/24 0.0.0.0 3072 100 32768 ? NEXUS9K01# sh ip route vrf ABC IP Route Table for VRF "ABC" '*' denotes best ucast next-hop '**' denotes best mcast next-hop '[x/y]' denotes [preference/metric] '%<string>' in via output denotes VRF <string> 1.0.0.0/8, ubest/mbest: 1/0 *via 10.3.0.9%default, Vlan5, [20/3072], 7w1d, bgp-100, external, tag 100 1.200.16.0/24, ubest/mbest: 1/0 *via 10.3.0.9%default, Vlan5, [20/3072], 1w0d, bgp-100, external, tag 100 1.253.253.0/24, ubest/mbest: 1/0 *via 10.3.0.9%default, Vlan5, [20/3072], 7w1d, bgp-100, external, tag 100 1.254.253.0/24, ubest/mbest: 1/0 *via 10.3.0.9%default, Vlan5, [20/3072], 7w1d, bgp-100, external, tag 100 1.255.4.0/24, ubest/mbest: 1/0, attached *via 1.255.4.7, Vlan255, [0/0], 19w4d, direct 1.255.4.7/32, ubest/mbest: 1/0, attached *via 1.255.4.7, Vlan255, [0/0], 19w4d, local 1.255.4.11/32, ubest/mbest: 1/0, attached *via 1.255.4.11, Vlan255, [0/0], 19w4d, hsrp 2.9.95.0/24, ubest/mbest: 1/0 *via 10.3.0.9%default, Vlan5, [20/3072], 7w1d, bgp-100, external, tag 100 10.0.1.0/24, ubest/mbest: 1/0 *via 10.3.0.9%default, Vlan5, [20/3072], 7w1d, bgp-100, external, tag 100
... View more
Created by
Cormac Champion
in Switching
in Switching
06-28-2018
01:40 AM
06-28-2018
01:40 AM
Sorry for the delay in following up.
The route is in the Default vrf. In order to leak the route into the ABC vrf, it must go through BGP via the ACL. It's not in BGP and that is the issue - why not ? All of the other routes have been passed but for some reason, the 0.0.0.0 route has not been.
... View more
Created by
Cormac Champion
in Switching
in Switching
06-20-2018
03:24 PM
06-20-2018
03:24 PM
This does not contain a 0.0.0.0 route. It contains many (all) of the 10.0.0.0 /24, 172.16.0.0 and 192.168.0.0 routes.
NEXUS9K01 # sh ip bgp BGP routing table information for VRF default, address family IPv4 Unicast BGP table version is 102173, Local Router ID is 10.73.6.2 Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-injected Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup
Network Next Hop Metric LocPrf Weight Path
*>r10.2.34.0/24 0.0.0.0 3072 100 32768 ?
... View more
Created by
Cormac Champion
in Firewalls
09-19-2019
09-19-2019
I'm trying to get a Port Translation to work - port 52722 on the outside
to port 22 on the inside se...
Created by
Cormac Champion
in Firewalls
09-12-2019
09-12-2019
Hi all, I'm new to ASA's and I have a NATing issue which I'm unable to
resolve. I'm trying to allow ...
Created by
Cormac Champion
in Firewalls
09-05-2019
09-05-2019
Many thanks for that - that was it exactly. After removing the webvpn
command, it just needed a rebo...
Created by
Cormac Champion
in Firewalls
09-05-2019
09-05-2019
object service REMOTE-HTTPSservice tcp source eq https
Created by
Cormac Champion
in Firewalls
09-05-2019
09-05-2019
Hi all, I'm trying to get remote access through my 5505 (Security Plus
Licence) to my inside Server,...
Created by
Cormac Champion
in Firewalls
08-25-2019
08-25-2019
The petenetlive article is perfect Essentially, it's all about "police
output xxxxxxx yyyyyyy" Many ...
08-25-2019
Hi all, On an ASA 5505, is there a way to limit the bandwidth per user
unless there is little activi...
01-09-2019
I would think so. Is that option in there somewhere as a template in
6.3.0 ? I certainly do not see ...
01-09-2019
And to specifically solve my problem - how is the best way to advertise
my inside subnets to my outs...
01-09-2019
I'm on 6.2.2 - ready to upgrade to 6.3.0. However, I have two complete
sets of FTD's and FMC's and B...
01-09-2019
Hi all, I have an FMC managing a HA Pair of FTD2110's. I am using
multiple interfaces on the FTD and...
Created by
Cormac Champion
in Routing
01-04-2019
01-04-2019
With a 2911 which has an RPS unit connected, is the AC PSU Hot-Swappable
? I believe it is but canno...
Created by
Cormac Champion
in FirePOWER
12-21-2018
12-21-2018
Thanks for that. I have already deleted it from the FMC. Should I add it
back in, to then set the De...
Public Statistics
| Date Registered | 06-18-2016 04:35 PM |
| Date Last Visited | 09-19-2019 08:38 AM |
| Total Messages Posted | 109 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "VIP Collaborator"){kind=icon}
