Inactive firewall access rule can still work?

Hi all,
I have a asa firewall which has a inactive access rule whose enabled checkbox is not checked. However it seem that this access rule can still work.
Hence i would like to know what is the difference in having the access rule's enabled checkbox check or uncheck. Pls advise, thks in advance.

I'm assuming by rule you mean an inactive access-list entry? If so, did you try clearing the translations (clear xlate) after disabling it?
Try running packet-tracer to determine if that is the rule that the traffic is hitting.

Similar Messages

Firewall Access Rules do not work on One to One NAT (RV042G Router)

I have two unique IP addresses, two servers, and one RV042G router.
What I would like to do is have each IP address go to it's own respective server. To do that, I've set the settings on One-to-One NAT to make this happen. Now IP address 1 points to server A and IP address 2 points to server B.
However, I only want port 80 to be open to each server. I've tried setting the Firewall access rules to accommodate this but it doesn't appear to block anything. All ports on the servers are exposed despite the firewall rules.
Here's what I have in the router configuration:
Under One-to-One NAT:
{internal IP address 1} => {external IP address 1}
{internal IP address 2} => {external IP address 2}
Under Firewall Access Rules:
Action | Service | Source Interface | Source | Destination | Time
Allow | HTTP Secondary 80 | WAN1 | Any | {internal IP address 1} | Always
Deny | All Traffic | WAN1 | Any | Any | Always
Is there a proper way to accomplish what I want?

Thanks for replying.
Turns out I had to add new access rules to specifically deny all traffic to the internal addresses, in addition to the rule allowing the specified ports through.
So, with the IP addresses still defined the same way in the One-to-One NAT section, I now have the following rules defined in the firewall section:
Under Firewall Access Rules:
Priority | Action | Service | Source Interface | Source | Destination | Time
[1] | Allow | HTTP Secondary 80 | ANY | Any | {internal IP address 1} | Always
[2] Deny | All Traffic | WAN1 | Any | { internal IP address 1 } | Always <== the new one I ended up adding
(default) | Deny | All Traffic | WAN1 | Any | Any | Always <== built in default rule in router
I originally did not add the second rule because I had assumed that the default deny rule would block all traffic to all internal IP addresses anyway. Perhaps someone can correct me if I'm wrong but I am now assuming that the default deny rule applies to the router only and not to any other defined One-to-One NAT entries. In which case, I had to add another rule that duplicates the default deny rule but for each 1:1 NAT entry.
If this was already in the manual, I probably missed it so that would be my own mistake. Still, I wish this was more apparent in the web GUI as it didn't really specify that I had to do this.
In any case, I hope my solution helps anyone else in the future having this similar issue.

RV180W - Access Rules Don't Work

Hi,
We have a RV180W and the Access Rules will not work. I'm trying to block HTTP and HTTPS services for a specific workstation on our LAN, but the access rules don't seem to be working. I've also tried blocking different services as well as ANY service, but it's not working. I've tried rebooting the router after adjusting settings; I've tried adjusting services from the Port Forwarding menu first; and a couple weeks ago, I upgraded the firmware to version 1.0.2.6 and repeated all the previous steps. Nothing seems to be working. So far the only solution I could come up with is to block the workstation's MAC address altogether, but I don't want that because I still need it to hit the internet for other services.
Thank you,
Ryan

These are the Access Rules I've tried (firmware v1.0.2.6):
Outbound:
Inbound along with the auto added Port Forwarding setting:

RV016 Protocol Binding & Access Rules do not work on PPTP

Hi
I am Enabled PPTP Server and connection success, but can’t block the internet service by Protocol Binding and Access Rules for PPTP client.
The PPTP Server:
192.168.1.150~160
Protocol Binding:
HTTP [TCP/80~80] -> 192.168.1.150~160(0.0.0.0~0.0.0.0)
Access Rules:
1; Enable; Deny; HTTP [80]; LAN; 192.168.1.150~160; Any; Always
Firmware Version: 3.0.0.19-tm
I tried to test the setting by local PC connect the router directly. The rule is running.
But by PPTP, it can go to internet. And confirmed the VPN IP is 192.168.1.150

st1\:*{behavior:url(#ieooui) }
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:表格內文;
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";
mso-ansi-language:#0400;
mso-fareast-language:#0400;
mso-bidi-language:#0400;}
HI Mr Krastew.
Thank you for your reply.
But i am not looking stop internet web service on my client side only.
May be I explain more here.
The client PC is running on intranet, that mean client network stopped all service [1~65535: TCP/UDP] pass through WAN. At this moment, the client network allows the PPTP Port 1723 pass through it only. And the Client PC is running on manual configure No DNS.
And the client requests that client PC NO intranet service when PPTP VPN connected. So I can't Disable Using Remote Network Default Gateway on TCP/IP Configure.
And Server (RV016), half of pc allow connect to internet.
The Local PC in server LAN can control by ACL.
The client connected by PPTP and the IP still within the ACL. But it can access internet all service. (e.g. FTP, HTTP).
So I want to know it is my configure problem? Or the router own problem? Or my design problem?
Now, I key in wrong DNS on client PC to Cheat the user for temporary.
Best regards,
Joe Wong

Can a Transparent mode firewall use /30 and still work.

Here is my question, I have a ASA 5510 that is connected to my ISP and the inside interface that is connected to my router. I have a /30 and need to determine if the configuration of x.x.x.121/30 which is my ISP and also the BVI address on the ASA. The inside router address is x.x.x.122/30 same subnet as my ISP will allow me to pass traffic. Management interface works using a different ip address but not able to get the traffic to pass traffic out to the internet thru the ASA
ISP-------->ASA-------->Router
Bottom Line is that I only have one usable address that is being used by the router and the ISP and ASA are using the other. Will this work?

Transparent firewall needs a management ip address in the same subnet as the passing traffic. Also please check the vlans of the switch port (if any) of the outside and inside interfaces. The vlans needs to be different for both interfaces.
Posted by WebUser Fawad Khan from Cisco Support Community App

Names for Firewall Access Rules on RV42G!

In the very old version of this router (Linksys RV042 Firmware Version: 1.3.12.19-tm ) the Acces Rules have a "Policy Name", which is very useful to remember that function meets every rule created.
In the "new" version of this router (RV042 and RV042G from Cisco) the firewall rules have no way of identifying simple manner ; you can not put them name.
Please consider adding a "name" for each rule , thus it is easier to manage the router when you have many (in my case more than 25 ) different rules.

You don't need to permit anything else beside the interesting traffic that is to be encrypted unless:
- The ASA terminating the tunnel is sitting behind another ASA/FW/Router. If that is the case then you will need to create some "permit" entries on that device
- You can an ACL attached on the "outside" that is only allowing the "outside" IP to communicate with a specific list of other public IPs
I hope this helps!
Thank you for rating helpful posts!

RV082 Access Rules

Good Day To All,
We recently purchased a RV082 Firewall Router and I am having the headache of a lifetime with the access rules and port forwarding. I have read EVERY post possible and still cannot come to a conclusion of what I am doing wrong...
First Question is the MAIL SERVER.. I could not get our email server to talk when setting this device to DMZ so for the time being I put it on LAN2 and attempted to set up an access rule Port 25 to the IP of the mail server. NO GO.. I had to port forward or it would not work.
Now I want to deny access on port 25 over WAN1 201.X.X.108 but allow access over port 25 on WAN2 201.X.X.109 and this is where it's a NO GO. It doesnt matter what order I put the rules in, its still a no go. Furthermore if I take out the port forward 25 and put in the rules to allow ANY source to reach 25 on the mail server it ALSO does not work...
This is what I have now and I can still access the email server on EITHER WAN address. I have tried to specifically DENY WAN1 but still no luck.
FORWARD:
PORT 25 to 192.168.0.221 is ENABLED
ACCESS RULES: (in this order)
ACTION: ALLOW
SERVICE: SMTP:25
SOURCE INTERFACE: WAN2
SOURCE: ANY
DESTINATION: 192.168.0.221
TIME: ALWAYS
ACTION: ALLOW
SERVICE: SMTP:25
SOURCE INTERFACE: LAN
SOURCE: 192.168.0.221
DESTINATION: ANY
TIME: ALWAYS
ACTION: DENY
SERVICE: SMTP:25
SOURCE INTERFACE: ANY
SOURCE: ANY
DESTINATION: ANY
TIME: ALWAYS
Now Second Question is pretty much the same but with SSH on port 22. I did this as a test and enabled SSH to the mail server.
FORWARD:
NOTHING SET
ACTION: ALLOW
SERVICE: SSH:22
SOURCE INTERFACE: ANY
SOURCE: ANY
DESTINATION: 192.168.0.221
TIME: ALWAYS
Why would this not work? The ONLY was I can get an SSH:22 to work is if I port forward it and then the access rule when set to DENY ALL it still allows it on both WAN1 and WAN2...
CONFUSED!
HELP!
PLEASE!
The Screen shot was my last attempt at making SSH work...

Esentially what I am trying to accomplish is to NOT have the port forward set. But in every case so far it seems as if the access rules DO NOT WORK at all.
Even if I set SSH:22 to port forward and set a firewall rule to DENY ANY ANY ANY to ANY I can still SSH to the box

RV042 Dual WAN access rules

New RV042 router with latest Firmware update installed.
Two restaurants on the same LAN subnet, one POS terminal PC at each restaurant for on-line resrvation system.
LAN connection allows each restaurant to view reservations for the other.
Comcast ISP with Static IPs and Comcast/SMC gateway in bridge mode (Comcast Gateway WAN IP = 50.###.###.134, LAN IP = 192.168.10.1).
LAN port 1 on Comcast Gateway connected to WAN1 on RV042 (WAN1 IP = 50.###.###.133).
LAN port 2 on Comcast Gateway connected to WAN2 on RV042 (WAN2 IP = 50.###.###.132).
RV042 LAN IP = 10.1.10.1.
Restaurant A POS PC IP - 10.1.10.201 (static).
Restaurant B POS PC IP - 10.1.10.202 (static).
OpenTable online reservation system needs 5 inbound port ranges forwarded to each terminal PC for the OpenTable interface.
For Restaurant A OpenTable sends to 50.###.###.133.
For Restaurant B OpenTable sends to 50.###.###.132.
We setup RV042 Firewall "Access Rules" specifying the appropriate source interface (WAN1/WAN2) with source set to ANY and the appropriate destination (10.1.10.201/10.1.10.202) for the 5 port ranges (so 10 rules in all, 5 per restaurant)
However this is not working for either restaurant.
OpenTable cannot interface with the termianl PCs on the specified ports.
If we add the port range forwarding under the "Forwarding" section of the RV042 setup (which limits us to seting it up for only one of the restaurants) the OpenTable interface works for the one restaurant.
What are we missing????

David,
I pretty sure on this model router we can't specify the inbound port address to be forwarded from specified WAN port (it's catch all). It doesn't give us the ability to choose this in port forwarding or Upnp forward. Now if you can separate the ranges that needs to be forward to each server say SERVER 1 1000-1005 and ports 1006-1010 to SERVER 2.
if you are needed to specify which wan port on your fowarding then you'll need to move up to a different router.
SA520,SA520W or SA540
Jasbryan

ASDM not showing access rules for interfaces

Strangest thing. I have applied the access lists and can see that in CLI, but ASDM isnt displaying them.
in CLI:
access-group inside_access_in in interface inside
But ASDM doesnt display the interface under "Firewall - Access Rules"
Cisco Adaptive Security Appliance Software Version 8.4(5)6
Device Manager Version 7.1(4)
Anyone else seeing this?
I configured this firewall a few months ago and havent touched it since. I have updated Java and suspect that it may have something to do with it.
Java version 7 Update 45

Hi there
I am sorry for any delay.
Please check this out:
ASDM 7.0 Edit Bookmark Window empty.
Symptom:
In the Edit Bookmark Window all fields are empty.
Conditions:
ASDM 7.0
Workaround:
If running any ASA code before 9.0 downgrade to ASDM 6.4.
If running ASA 9.0, there is no workaround.
Fixed-In
7.1(1.2)
You may try with the latest version available Release 7.1.1
HTH.
Please rate any helpful posts

HT4648 So if you import a numbers document from a mac to iPad which has a conditional format rule such as a cell with a score between 1-10 fills with the colour black will still work on the iPad? Not being able to edit it just means you can't change this

I want to use numbers on my iPad mini for a team I coach. I have a spreadsheet on my mac I want to import onto the iPad mini for players to enter in wellness ratings. On this spreadsheet (on the mac) I have a conditioning formatting rule that when a player enters in their numbers the cells fill with black so others can't see their entries (to maintain privacy). Will this function import across onto iPad numbers? From the discussion I saw on this site it only partly answers my question stating "it cannot be edited" does this mean the conditional formatting rule cannot be changed and therefore will still work or the whole spreadsheet can't be edited and you can only view the spreadsheet and make no new entries to it?

Yes, I have posted this thread to different forums after I realized that Lenovo "customer care" is not likely to help me out and even wirelessforums.org members couldn't come up with any ideas for days, that's why. I have already written that helper applications like SMAC (or etherchange or macshift) don't work, because they do the same thing in the system as I change it in the driver panel, so they use the same method which simply does not work.
Locked? Definitely not. If yes, why can I change the MAC of my adapter under Ubuntu Linux using b43 open-source driver if it's really locked? Or you mean it's locked from software, because Lenovo or Broadcom didn't want their users to change their MACs or they just forgot to release a fully-functional driver? Well, then I would like to have a driver in which it's not locked, because this is a basic feature of my adapter of which the hardware is capable.
I have already contacted Broadcom, see their (automatically-generated) answer in my initial post, but I will try to do that again with more foresight.

I uninstalled Norton 360 under windows xp and now I'm getting this problem that firefox will no longer load pages. IE and Outlook still work and I can access the internet with them, I can ping any website I like successfully but Firefox won't load any pa

I uninstalled Norton 360 under windows xp and now I'm getting this problem that firefox will no longer load pages. IE and Outlook still work and I can access the internet with them, I can ping any website I like successfully but Firefox won't load any pages ... N
== This happened ==
Every time Firefox opened
== I uninstalled Norton 360 ==
== User Agent ==
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

I found a fix for this, not only firefox but several other networking programs were broken as well (Outlook and IE were ok for some reason) so I reasoned that the Norton uninstall was incomplete somehow - I had done it from the add/remove programs in the control panel. Sure enough that's not enough to release Norton's tentacles in your system, there's an uninstall tool on their website (a whole set of them actually) that managed to carve it out completely and after a restart everything was back to normal. My machines will definitely be Norton-free from now on ... N

Since downloading maverick, finder is not responsive; a safe restart did not help; dock still works; programs can be accessed

since downloading maverick, finder is not responsive; a safe restart did not help; dock still works; programs can be accessed

The startup disk may need repairing ...
Launch Disk Utility located in HD > Applications > Utillities
Select the startup disk on the left then select the First Aid tab.
Click: Verify Disk (not Verify Disk Permissions)
If DU reports errors, restart your Mac while holding down the Command + R keys. From there you should be able to acces the built in utilities in OS X Recovery
Make sure to back up all important files first before using OS X Recovery.
OS X Recover does require a broadband high speed internet connection.

Source IP Address Access Rule Not Working

I'm trying to create and access rule that denies certain source IP addresses
from making SMTP connections to my email server. I create the access rule
and put it at the top of the list but the connections are still happening.
It's a deny rule to block Port, Service: SMTP, Origin Server Port 25, TCP &
UDP, Specified 'ip addresses', Destination 'any'. Granted I have my email
NATed through a secondary IP address to the email server. Any ideas why this
isn't working? Thanks.

It's a GWIA.
>>> On 11/22/2006 at 11:27 AM, in message
<bw19h.1043$[email protected]>, Jim
Michael<[email protected]> wrote:
> Adrian van Ravesteyn wrote:
>> OK, that makes sense. Is there a way I can limit access for certain ip
>> addresses on this NATed interface?
>
> Giving access to "all but a few" is a problem, but limiting access to
> "all but a few" is relatively easy (you just create the exceptions you
> need, with the allowed source IPs). You're better off blocking specific
> IPs at your SMTP server. Is your mail server a GroupWise GWIA, or
> something else?

I have Itunes on my PC. For some reason, I now have only one song in my library. I can still access my songs through my hard drive but they don't show up on Itunes anymore. Any idea how I can fix this?

I have a lot of songs in my Itunes library. However, for some reason, they have disappeared and I only have one song left. When I check under My Music, I can see all the songs but can't access them through Itunes. Any idea why this happended and how I can fix it?

I think I fixed this problem a few years ago by literally copying and pasting all my audio content into the iTunes library folder. I can't remember what is called of the top of my head and I don't know if this will still work.

Can't open Gmail with Windows 8.1 (still works with I.E., and this wasn't a problem on Windows XP)

Hi! I've switched from Windows XP to 8.1. I've installed Firefox, but when I try to access gmail, I get a message that says gmail can't be opened because I need to disable cookies. I don't want to disable cookies, and this was never a problem before. Gmail still works through Internet Explorer, which is not as good a browser. How do I get gmail and firefox to play nicely together in the sandbox and still share cookies? Thanks!

You can try these steps in case of issues with web pages:
You can reload web page(s) and bypass the cache to refresh possibly outdated or corrupted files.
*Hold down the Shift key and left-click the Reload button
*Press "Ctrl + F5" or press "Ctrl + Shift + R" (Windows,Linux)
*Press "Command + Shift + R" (Mac)
Clear the cache and cookies only from websites that cause problems.
"Clear the Cache":
*[[Image:new fx menu]] > Options/Preferences> Advanced > Network > Cached Web Content: "Clear Now"
"Remove Cookies" from sites causing problems:
*[[Image:new fx menu]] > Options/Preferences > Privacy > "Use custom settings for history" > Cookies: "Show Cookies"

Inactive firewall access rule can still work?

Similar Messages

Maybe you are looking for