Cisco ASA 5512, IP NVR port forwarding

Hi,
i have Cisco 5512 ASA with version 8.6(1)2. i have one IP NVR for ip cameras.
please help me how to configure port forwarding in cisco asa in CLI?
I have static IP on ASA 94.56.178. 222 and NVR IP 10.192.192.100
thank you so much.

ASA#
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   94.56.178.222   255.255.255.255 identity
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7fffa2969000, priority=0, domain=permit, deny=true
        hits=11524, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=OUTSIDE, output_ifc=any
Result:
input-interface: OUTSIDE
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
please advise 

Similar Messages

  • Cisco ASA 5510 and Spiceworks port forward

    So you want to set up a static NAT from 207.123.123.123:9876 to 192.168.0.11:9876. (I assume you're keeping the same port on the public interface.)
    Here's a link to a how-to for setting it up. (I'm headed out the door for the weekend. Sorry!) Hope this helps.
    http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/na..
    Skip down to the section "Configuring Static NAT or Static NAT-with-Port-Translation"

    I know this topic has been beaten to death, but I'm rather green with firewalls and would like some guidance with why my config is not working. I'm using ASDM 6.4.
    My public address is 207.123.123.123 (simplified for this example)
    My Spiceworks server is 192.168.0.11 (SpiceServer)
    My SpiceServer SSL port for SW is 9876
    I've created a NAT for SpiceServer to Any Outside connection. I've created an access rule for Outside where Any is destined for SpiceServer and I created a Service Group for TCP-UDP for Port 9876.
    Where am I going wrong (besides everywhere)??
    This topic first appeared in the Spiceworks Community

  • Cisco ASA 5512 two interfaces

    i have an Cisco ASA 5512 working as Firewall
    We configure one ASA interface connecting to Cisco router 1700 with leasd line internet service without any problem.
    Now we have an extra internet connection ADSL 2MB connected to another ASA interface  
    I configure the ASA like this :
    1-    Enable interface 2 on ASA and connect it to ADSL router (interface ip 192.168.1.100 from the same ADSL router {192.168.1.1}range ) 
    2-    Create Access rule say source (My computer ip) destination  ADSL network range action accept
    3-    Create Nat Rule say source interface inside source ip (my ip) destination interface ADSL ip 192.168.1.100 destination source router ip 192.168.1.1
    4-    Add static route say ADSL interface source ip my ip gateway ADSL router
    This steps what I do but it doesn't work.
    Thanks in advance

    FYI for internet access I doubt this will work because if you configure two default route then ASA won't distribute traffic across two interface, first default route will be the one where ASA will send traffic. However from your description it is not very clear which IP address you are trying to ping and how exactly rules you have configured.
    Either attach your config or paste the relevant config in post.

  • How to Configure Cisco ASA 5512 for multiple public IP interfaces

    Hi
    I have a new ASA 5512 that I would like to configure for multiple public IP support.  My problem may be basic but I am an occasional router admin and don't touch this stuff enough to retain everything I have learned.
    Here is my concept.    We have a very basic network setup using three different ISPs that are currently running with cheap routers for internet access.  We use these networks to open up access for Sales to demo different products that use a lot of bandwidth (why we have three)
    I wanted to use the 5512 to consolidate the ISPs so we are using one router to manage the connections.  I have installed an add on license that allows multiple outside interfaces along with a number of other features.
    Outside Networks (I've changed the IPs for security purposes)
    Outside1 E 0/0 : 74.55.55.210  255.255.255.240 gateway 74.55.55.222
    Outside2 E 0/2: 50.241.134.220 255.255.248 gateway 50.241.134.222
    Inside1 : E 0/1 192.168.255.1 255.255.248.0
    Inside2 : E 0/3 172.16.255.1 255.255.248.0
    My goal is to have Inside 1 route all internet traffic using Outside1 and Inside 2 to use Outside2.    The problem is I can't seem to do this. I can get inside 1 to use outside 1 but Inside2 uses Outside 1 as well.
    I tried adding static routes on Outside2 to have all 172.16.248.0/21 traffic use gateway 50.241.134.222 but that doesn't seem to work.   
    I can post my config up as needed.  I am not well versed in Cisco CLI, I've been using the ASDM 7.1 app.  My ASA 5512 is at 9.1.   
    Thanks in advance for the suggestions/help

    I have been away for a while and am just getting caught up on some posts. so my apology for a delayed response.
    I find the response very puzzling. It begins by proclaiming that to achieve the objective we must use Policy Based Routing. But then in the suggested configuration there is no PBR. What it gives us is two OSPF processes using one process for each of the public address ranges and with some strange distribute list which uses a route map. I am not clear what exactly it is that this should accomplish and do not see how it contributes to having one group of users use one specific ISP and the other group of users use the other ISP>
    To the original poster
    It seems to me that you have chosen the wrong device to implement the edge function of your network. The ASA is a good firewall and it does some routing things. But fundamentally it is not a router. And to achieve what you want were a group of users will use a specified ISP and the other group of users will use the other ISP you really need a router. You want to control outbound traffic based on the source of the traffic, and that is a classic situation where PBR is the ideal solution. But the ASA does not do PBR.
    HTH
    Rick

  • Cisco ASA, skipping real source port number with PAT.

    Hi Experts,
    Cisco ASA configuration guide says:
    "PAT translates multiple real addresses to a single mapped IP address by translating the real address and source port to the mapped address and a unique port. If available, the real source port number is used for the mapped port. "
    Is it possible to skip this ? I do not want to use real source port number. The issue is, when I have a PAT entry with real source port (port 5060), - SIP session doesn't work. With all the other ports numbers,- everything works.

    Hi,
    Notice that the configuration you try does not modify the real source port at all.
    Since you are using the same "object" for the real/mapped service then the configuration above matches traffic where the connections destination is "any" and the destination is "udp 6000 65535" and only when the source is "udp sip" and in that event it keeps the exact same "udp sip" source port as you are using the same "object".
    I am not sure if its a software or configuration related issue but I have not gotten this to work reliably on my ASA. I might have to try some other software level.
    I guess you would want to match the SIP source port in the Dynamic PAT and avoid using the SIP port as the mapped port?. With that in mind I was thinking something like this
    object service UDP-SIP
     service udp source eq sip
    object service UDP-SIP-MAPPED
     service udp source range 30000 31000
    nat (VoiP,outside) source dynamic <source network object> interface service UDP-SIP UDP-SIP-MAPPED
    Though it seems the above configuration seems to be bypassed by the ASA completely and it seems to use the identical source port as the mapped port even though it matches the configuration.
    If I were to change the above configuration from "dynamic" to "static" then the configuration matches but it uses only the first mapped "source" port of "30000". I guess it would only use a different mapped port if you used multiple real source ports also instead of the current single source port "sip".
    nat (VoiP,outside) source static <source network object> interface service UDP-SIP UDP-SIP-MAPPED unidirectional
    Example from my own ASA.
    DYNAMIC
    - Matches the configuration but doesnt map the port at all
    Phase: 5
    Type: NAT
    Subtype:
    Result: ALLOW
    Config:
    nat (LAN,WAN) source dynamic LAN-NETWORK interface service SIP SIP-MAPPED
    Additional Information:
    Dynamic translate 10.0.0.123/5060 to <my pat ip>/5060
    STATIC
    - Matches the configuration and maps the source port but only uses the first mapped port from the range
    Phase: 4
    Type: NAT
    Subtype:
    Result: ALLOW
    Config:
    nat (LAN,WAN) source static LAN-NETWORK interface service SIP SIP-MAPPED unidirectional
    Additional Information:
    Static translate 10.0.0.123/5060 to <my pat ip>/30000
    I am not really sure if this configuration is reliable at all but its the only thing I can think of at the moment.
    Hope this helps :)
    - Jouni

  • Block / Deny ICMP Traffic cisco asa 5512-x

    hi expert
    I have cisco asa 5512x for configure as firewall and sslvpn.
    my customer want block/Deny icmp traffic from interface outside without block anything.
    i've configure form cli :
    icmp deny any outside
    but from outside can't open sslvpn url and asdm.

    Hi,
    Access for the Anyconnect/ASDM does not depend on the ICMP permit/deny commands on the ASA device.
    If you want to block the Pings to the ASA interface use the command:-
    icmp deny any outside etc.
    What do you mean by "i can ping from outside." Plzz explain.
    Thanks and Regards,
    Vibhor Amrodia

  • Need help with ASA 5512 and SQL port between DMZ and inside

    Hello everyone,
    Inside is on gigabitEthernet0/1 ip 192.9.200.254
    I have a dmz on gigabitEthernet2 ip 192.168.100.254
    I need to pass port 443 from outside to dmz ip 192.168.100.80 and open port 1433 from 192.168.100.80 to the inside network. 
    I believe this will work for port 443:
    object network dmz
    subnet 192.168.100.0 255.255.255.0
    object network webserver
    host 192.168.100.80
    object network webserver
    nat (dmz,outside) static interface service tcp 443 443
    access-list Outside_access_in extended permit tcp any object webserver eq 443
    access-group Outside_access_in in interface Outside
    However...How would I open only port 1433 from dmz to inside?
    At the bottom of this message is my config if it helps.
    Thanks,
    John Clausen
    Config:
    : Saved
    ASA Version 9.1(2) 
    hostname ciscoasa-gcs
    domain-name router.local
    enable password f4yhsdf.4sadf977 encrypted
    passwd f4yhsdf.4sadf977 encrypted
    names
    ip local pool vpnpool 192.168.201.10-192.168.201.50
    interface GigabitEthernet0/0
     nameif outside
     security-level 0
     ip address 123.222.222.212 255.255.255.224 
    interface GigabitEthernet0/1
     nameif inside
     security-level 100
     ip address 192.9.200.254 255.255.255.0 
    interface GigabitEthernet0/2
     nameif dmz
     security-level 100
     ip address 192.168.100.254 255.255.255.0 
    interface GigabitEthernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet0/4
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet0/5
     shutdown
     no nameif
     no security-level
     no ip address
    interface Management0/0
     management-only
     nameif management
     security-level 100
     ip address 192.168.1.1 255.255.255.0 
    ftp mode passive
    dns server-group DefaultDNS
     domain-name router.local
    object network inside-subnet
     subnet 192.9.200.0 255.255.255.0
    object network netmotion
     host 192.9.200.6
    object network inside-network
     subnet 192.9.200.0 255.255.255.0
    object network vpnpool
     subnet 192.168.201.0 255.255.255.192
    object network NETWORK_OBJ_192.168.201.0_26
     subnet 192.168.201.0 255.255.255.192
    object network NETWORK_OBJ_192.9.200.0_24
     subnet 192.9.200.0 255.255.255.0
    access-list outside_access_in extended permit icmp any4 any4 log disable 
    access-list Outside_access_in extended permit udp any object netmotion eq 5020 
    access-list split standard permit 192.9.200.0 255.255.255.0 
    access-list VPNT_splitTunnelAcl standard permit 192.9.200.0 255.255.255.0 
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    mtu dmz 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static inside-network inside-network destination static vpnpool vpnpool
    nat (inside,outside) source static NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24 destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
    object network netmotion
     nat (inside,outside) static interface service udp 5020 5020 
    nat (inside,outside) after-auto source dynamic any interface
    access-group Outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 123.222.222.1 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.9.200.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac 
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev1 enable outside
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400
    telnet 192.9.200.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes128-sha1 3des-sha1
    webvpn
     enable outside
     anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 2 regex "Windows NT"
     anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 3 regex "Intel Mac OS X"
     anyconnect enable
     tunnel-group-list enable
    group-policy SSLVPN internal
    group-policy SSLVPN attributes
     dns-server value 192.9.200.13
     vpn-tunnel-protocol ssl-client 
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value split
     default-domain value router.local
    group-policy VPNT internal
    group-policy VPNT attributes
     dns-server value 192.9.200.13
     vpn-tunnel-protocol ikev1 l2tp-ipsec 
     split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPNT_splitTunnelAcl
     default-domain value router.local
    username grimesvpn password 7.wersfhyt encrypted
    username grimesvpn attributes
     service-type remote-access
    tunnel-group SSLVPN type remote-access
    tunnel-group SSLVPN general-attributes
     address-pool vpnpool
     default-group-policy SSLVPN
    tunnel-group SSLVPN webvpn-attributes
     group-alias SSLVPN enable
    tunnel-group VPNT type remote-access
    tunnel-group VPNT general-attributes
     address-pool vpnpool
     default-group-policy VPNT
    tunnel-group VPNT ipsec-attributes
     ikev1 pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map 
      inspect ftp 
      inspect h323 h225 
      inspect h323 ras 
      inspect rsh 
      inspect rtsp 
      inspect esmtp 
      inspect sqlnet 
      inspect skinny  
      inspect sunrpc 
      inspect xdmcp 
      inspect sip  
      inspect netbios 
      inspect tftp 
      inspect ip-options 
      inspect icmp 
    service-policy global_policy global
    prompt hostname context 
    no call-home reporting anonymous
    Cryptochecksum:36271b5a1b9382621e14c3aa635e2fbb
    : end

    Hi Vibor. Apologies if my comment was misunderstood.  What I meant to say was that the security level of the dmz interface should probably be less than 100. 
    And therefore traffic could be controlled between DMZ and inside networks. 
    As per thr security level on the DMZ interface. ....... that command is correct. :-)

  • Cisco ASA 5512 Transparent mode

                       Hi all - hope this is the right place to ask this question-
    I'm having trouble understanding how to configure an ASA 5512X in what should be a really easy way -
    I simply want the ASA to be a transparent Layer 2 "bump" in a routed link between two networks, and then I'll use the Management interface to actually see the firewall ASDM,Syslog, configure, etc.
    I have the interfaces set up thusly:
    interface GigabitEthernet0/0
    nameif UnTrustedNetwork
    security-level 0
    interface GigabitEthernet0/1
    nameif TrustedNetwork
    security-level 100
    interface Management0/0
    nameif ManagementAccess
    security-level 100
    ip address 192.168.X.Y 255.255.255.0
    management-only
    I cannot figure out how to install a default route so that interface Management0/0 with it's IP of 192.168.X.Y can be reached from
    other networks, like 10.6.X.Y, etc.
    I thought the point of a Management interface was that you could set things up in such a way that the Management interface
    was the only way you could access the firewall, and you did not have to have IP addresses on the Gig interfaces,
    (at least not in transparent mode, for NAT you obviously would have to)
    I tried to add a static route entry to 10.6.X.Y , but
    when I typed "route.." my only available destination interfaces were either TrustedNetwork or UnTrustedNetwork ??
    How do I configure the Management interface for non-local subnets to be reachable on the firewall in transparent mode?

    transparent firewall is configured differently from routed mode.
    here's a basic config required:
    firewall transparent               (erases the current config; does not require a reboot)
    interface BVI1
    ip address 192.168.10.10 255.255.255.0
    interface GigabitEthernet0
    nameif outside
    bridge-group 1
    security-level 0
    interface GigabitEthernet1
    nameif inside
    bridge-group 1
    security-level 100
    route outside 0.0.0.0 0.0.0.0 192.168.10.254
    route inside 10.0.0.0 255.0.0.0 192.168.10.100
    I think that you need a BVI interface with an IP address before the ASA starts forwarding traffic
    The old syntax (pre 8.3 or 8.2 not sure) forces only 2 interfaces and no BVI was configured... the IP was assigned in global config.
    Hope that helps,
    Patrick

  • Is there a statement from Cisco on the lack of port forwarding thru DNS?

    or instructions on how to do this?

    Hi, we tried re-simulating the process as indicated in the link provided to you by one of our moderators and has found an additional step you need to take to accomplish to fix the @NO_SCREENNAME@ issue.
    Can you please revisit the link and re-try the procedure?
    Heres the link: http://homecommunity.cisco.com/t5/Wireless-Routers/How-to-fix-NO-SCREENNAME-username/td-p/565100
    By the way, can you also PM us the case number provided by support so we can check and follow up on your concern?
    The Search Function is your friend.... and Google too.
    How to Secure your Network
    How to Upgrade Routers Firmware
    Setting-Up a Router with DSL Internet Service
    Setting-Up a Router with Cable Internet Service
    How to Hard Reset or 30/30/30 your Router

  • Cisco ASA 5512-X slow upload speeds

    drop rate on the internet link.... you sure the ISPs router is set to auto/auto on the duplex/speed?
    you might need to force the duplex/speed at both ends

    On my Internet link I get the following:Interface GigabitEthernet0/3 "INTERNET_LINK", is up, line protocol is up Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec Full-Duplex(Full-duplex), 1000 Mbps(1000 Mbps) Input flow control is unsupported, output flow control is off MAC address 54a2.7459.d17c, MTU 1500 IP address 10.6.72.146, subnet mask 255.255.255.248 625090952 packets input, 238504080257 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 pause input, 0 resume input 0 L2 decode drops 873663838 packets output, 1085237392896 bytes, 0 underruns 0 pause output, 0 resume output 0 output errors, 0 collisions, 5 interface resets 0 late collisions, 0 deferred 0 input reset drops, 30 output reset drops input queue (blocks free curr/low): hardware (472/427) output...

  • Configuring "Guest Wi-Fi" VLAN on ASA 5512

    I'm attempting to setup a new vlan on my Cisco ASA 5512 running version 8.6(1)2.  This vlan will provide access for wireless "guest" AP's in my network.  I have the guest vlan setup through to my switches, I'm able to dedicate a switch port to VLAN 40 and aquire an IP address in the 10.40.10.0/24 network.  Below is excerpt of what I think is the relevent config information.  I'm trying to route guest traffic out my "outside" interface.
    Obvious to me I'm missing another command in here.  Any help would be greatling appreciated. If more the running-config is needed please advise.  Thanks in advance!
    interface GigabitEthernet0/1.40
    description Guest Wireless Network
    vlan 40
    nameif guestwireless
    security-level 50
    ip address 10.40.10.5 255.255.255.0
    route outside 0.0.0.0 0.0.0.0 X.X.X.X 1  (public IP at X.X.X.X)
    access-list guestwireless_access_in extended permit ip 10.40.10.0 255.255.255.0 interface outside
    mtu guestwireless 1500
    access-group guestwireless_access_in in interface guestwireless
    dhcpd address 10.40.10.50-10.40.10.250 guestwireless
    dhcpd dns 8.8.8.8 interface guestwireless
    dhcpd enable guestwireless

    Stripped out some config pertaining to crypto and credentials
    --------------Config Below-----------------------------------
    : Saved
    ASA Version 8.6(1)2
    hostname ASA
    domain-name company.local
    names
    interface GigabitEthernet0/0
    description ISP Interface
    nameif outside
    security-level 100
    ip address ##.##.###.### 255.255.255.248
    interface GigabitEthernet0/1
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/1.40
    description Guest Wireless Network
    vlan 40
    nameif guestwireless
    security-level 50
    ip address 10.40.10.5 255.255.255.0
    interface GigabitEthernet0/2
    nameif inside-tempnet
    security-level 0
    ip address 172.29.0.252 255.255.255.0
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    shutdown
    nameif management
    security-level 100
    no ip address
    management-only
    boot system disk0:/asa861-2-smp-k8.bin
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns server-group DefaultDNS
    domain-name company.local
    same-security-traffic permit inter-interface
    object network NETWORK_OBJ_10.100.10.0_24
    subnet 10.100.10.0 255.255.255.0
    access-list outside_access_in extended permit ip object NETWORK_OBJ_10.100.10.0_24 any
    access-list inside-tempnet_access_in extended permit ip 172.29.0.0 255.255.255.0 object NETWORK_OBJ_10.100.10.0_24
    access-list Split_Tunnel_List standard permit 172.29.0.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu guestwireless 1500
    mtu inside-tempnet 1500
    mtu management 1500
    ip local pool ClientVPN-DHCP-Pool 10.100.10.50-10.100.10.250 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-66114.bin
    asdm history enable
    arp timeout 14400
    nat (inside-tempnet,outside) source static any any destination static NETWORK_OBJ_10.100.10.0_24 NETWORK_OBJ_10.100.10.0_24 no-proxy-arp route-lookup
    nat (guestwireless,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    access-group inside-tempnet_access_in in interface inside-tempnet
    route outside 0.0.0.0 0.0.0.0 ##.##.###.### 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    http server enable
    http 0.0.0.0 0.0.0.0 inside-tempnet
    http 172.29.0.0 255.255.255.0 inside-tempnet
    http redirect inside-tempnet 80
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    dhcpd address 10.40.10.50-10.40.10.250 guestwireless
    dhcpd dns 8.8.8.8 interface guestwireless
    dhcpd enable guestwireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes256-sha1 aes128-sha1 3des-sha1
    ssl trust-point ASDM_TrustPoint0 outside
    ssl trust-point ASDM_TrustPoint0 inside-tempnet
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2
    anyconnect profiles VPNConnect disk0:/vpnconnect.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy "GroupPolicy_VPN Connect" internal
    group-policy "GroupPolicy_VPN Connect" attributes
    wins-server none
    dns-server value #.#.#.#
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Split_Tunnel_List
    default-domain value company.local
    webvpn
      anyconnect profiles value VPNConnect type user
    tunnel-group "VPN Connect" type remote-access
    tunnel-group "VPN Connect" general-attributes
    address-pool ClientVPN-DHCP-Pool
    authentication-server-group compnay.LOCAL LOCAL
    default-group-policy "GroupPolicy_VPN Connect"
    tunnel-group "VPN Connect" webvpn-attributes
    group-alias "VPN Connect" enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    : end

  • ASA 5512-X an out of date ASDM-IDM?

    The cisco ASA 5512-X we have recently purchased comes with an out of date ASDM-IDM. It comes with version 6.6(1) which is not compatible with the asa version 9.1 is this normal?

    I haven't opened a new one in the past couple of months but ASDM 6.6(1) is compatible with ASA software 8.6(1). That was the version most units were shipping with for a while as it was the initial release that introduced support for the 5500- X series.
    If the box shipped new with 9.1 ASA software then the ASDM should be at least 7.1(1) - and the recommended version is 7.2(1). Reference.
    It's easy enough to upgrade ASDM - just copy the file over and change the "asdm image" command to point to it.
    (By the way, you'd get better visibility of a question like this in the Security - Firewalling forum.)

  • ASA 5512-X numerous issues

    Hello,
    We have recently implemented a new Cisco ASA 5512-X firewall replacing and old Cisco ASA 5505 Firewall.
    We have a number of issues which we are encountering and have so far been unable to rectify. The config was copied visually across to the new firewall from the old so the majority of the config matches the old firewall. I have attached the config.
    1. VOIP Phones not conencting to ntp uk.pool.ntp.org - Our VOIP network is on its own vlan inside the network. The phones were able  to conenct to the ntp externally before the new firewall was inplace. I have tested numerous access rules but with no luck.
    2. VPN - We have setup a site to site VPN between the new Firewall and a SonicWall. The SonicWALL is showing the following errors from our firewall
    07/10/2013 12:38:24.192
    Info
    VPN IKE
    Received IKE SA delete request
    77.107.90.203, 500
    164.40.213.246, 500
    VPN Policy: New_VPN
    6
    07/10/2013 12:38:24.192
    Warning
    VPN IKE
    Received notify. NO_PROPOSAL_CHOSEN
    77.107.90.203, 500
    164.40.213.246, 500
    7
    07/10/2013 12:38:24.160
    Info
    VPN IKE
    IKE Initiator: Start Quick Mode (Phase 2).
    164.40.213.246, 500
    77.107.90.203, 500
    VPN Policy: New_VPN
    3. Firewall rules for outside coming in do not allow pointing to the NAT object of a device we have to use the internal network object instead.
    Any help would be much appreciated.
    Many Thanks
    James

    No, there is no web filtering feature build in to ASA5512-X, however you can configure ASA5512-X to send web traffic towards cloud based (Cisco ScanSafe) web filtering solution. You would need to purchase ScanSafe user base license.

  • BREAKING NEWS FOR PORT FORWARDING ISSUES - WHO IN ...

    Hi there,
    I'm Cisco engineer who can't port forward! No matter what I try. I've never had this prolem before. I read today that BT are puttnig users on a NAT trial. I really suspect I and others are on this trial. The fact that even in a DMZ I can not see any ports open, suggests to me that I am on this trial.
    http://www.thinkbroadband.com/news/5818-bt-retail-in-carrier-grade-nat-pilot.html
    Now I have tried calling BT. Oh god how I have tried but for the sake of my health and sanity, I can't subject myself to it anymore. 
    Any wiser? How do I get BT to remove me from this trial? 
    Solved!
    Go to Solution.

    If you were on the trial the IP your router reports would be different to the one that you see if you go to, for example, www.ipchicken.com
    Is this the case?
    If not then you are probably doing something wrong, Cisco engineer or not
    Tom - Mouselike

  • CISCO ASA WITH FORTIMAIL

    Hi
    Recently we want to replace the CSC for a Fortimail, my quetion is how I redirect the smtp trafic to the Fortimail Appliance from the ASA because the ASA received the traffic SMTP.

    You don't redirect the traffic from the ASA to the Fortimail. That's (to my knowledge) not a possible design. You have probably two ways to deploy the Fortimail in your environment:
    Gateway mode
    For that you configure your internal mail-server with the Fortimail as a smarthost. On the ASA you change the port-forwarding which is configured to your internal Mailserver to the Fortigate.
    Transparent mode
    Here you place the FortiMail inline between your Mail-Server and the ASA.
    For the rest it is probably better to ask in a Fortinet-support-forum.

Maybe you are looking for