Multiple Public IP Addresses To Be Used For DMZ - ASA 5505 - IOS 8.4(2)

I'm trying to figure out how to forward an IP address to my DMZ servers allowing me to use the ACL to control access to the servers within my DMZ interface (LAN). I can't figure out if the ASA handles that automatically when a NAT rule is created, or maybe when an ACL is created, or do I need to add it when configuring the interface (outside)? Ex: IP Address: 1.1.1.1, 2.2.2.2, 3.3.3.3
Notes:
- I'm using the ASDM but can use CLI if needed.
- All IP address are fictitious of course.
- I currently have a public IP address of 1.1.1.1 that is used for all traffic coming from the ASA (including my NATed inside traffic).
- My local LAN subnet is 10.10.10.0/24.
- My DMZ subnet for my servers is 10.10.20.0/24.
- I have an IP address I want to use (public) of 2.2.2.2 that would be forwarded to my DMZed server of 10.10.20.2.
- I have an IP address I want to use (public) of 3.3.3.3 that would be forwarded to my DMZed server of 10.10.20.3.

Hi,
I am not sure if I understood you correctly.
Are you just asking how to configure Static NAT for your DMZ servers and allow traffic to them?
If so the basic NAT configuration format would be
object network SERVER-1
host 10.10.20.2
nat (DMZ,outside) static 2.2.2.2 dns
object network SERVER-2
host 10.10.20.3
nat (DMZ,outside) static 3.3.3.3 dns
The above 2 "object network" create the Static NAT between the internal private and external public IP addresses.
access-list OUTSIDE-IN remark Allow traffic to DMZ servers
access-list OUTSIDE-IN permit tcp any object SERVER-1 eq www
access-list OUTSIDE-IN permit tcp any object SERVER-2 eq ftp
access-group OUTSIDE-IN in interface outside
The above creates an ACL which allows for example HTTP traffic to SERVER-1 and FTP traffic to SERVER-2. Finally the last command attaches the ACL to the "outside" interface. If you already have an ACL attached to the "outside" interface then you naturally use that one.
Those are just simple examples.
Please let me know if I understood you incorrectly if I missed something
- Jouni

Similar Messages

Email address cannot be used for iMessage

Just set up an icloud email address for my daughter. I want her to be able to use that icloud email address to send iMessages to me or her mother using our iPads and iPhones.
I set up the icloud email address for her with no problem and am able to e-mail her with it and she is able to send emails back to me with it.
Went into Settings>Messages>Add Another Email. I typed in the icloud email address I set up for her and received the following error message:
"This email address cannot be used for iMessage."
I do not know why I received this error message. The icloud email account was set up.
I also went into the Messages app on my phone and sent a iMessage to the iCloud e-mail account and received a response that the message was delivered and Read!
If anyone has dealt with this issue before, please let me know what you think. Thank you!
Joe

So if I'm reading this right, you cannot assign multiple Apple IDs to iMessage on the same device? You have to log out of the first in order to use the second?
If this is true, does this work device to device? In other words, if she has access to an iPad and an iPhone, could you allow the iPhone to message and FaceTime through my daugther's new icloud email while the iPhone is still assigned to her mother's e-mail?
Or, is there a way to allow multiple apple IDs to iMessage and FaceTime on a sinle device WITHOUT having to disable one?
Thanks for the previous fast response and the future help.
Joe

HT1933 I have old email address's I used for iTune music purchases and cannot change password on several old accounts. Now some of the music I purchased I can not download and authorize it on my device. What can I do password security does not match my bi

I have old email address's I used for iTune music purchases and cannot change password on several old accounts. Now some of the music I purchased I can not download and authorize it on my device. What can I do password security does not match my birthdate on two of the accounts. Apple can not send me email with a password authorization on several current accounts that I have with them. How can I contact Apple with this annoying problem I can not fix.

settings - app/iTunes store - sign out and sign back in with your new id.
Note - if your older apps needs an update it will use your old apple id and password, as Apps are tied to the apple id that was used to purchase it.
You can't merge apple id.

HT4897 Can I have multiple icloud email addresses. i.e. one for me one for my wife?

Can I have multiple icloud email addresses. i.e. one for me one for my wife?

You can if you create two iCloud accounts. Each iCloud account is only given a single email account. (You can have additional email alias addresses, but they will still deliver incoming email to the same email account and inbox.)

I want to change the email address that I use for my apple ID.....how do I do that!!!!

I want to change the email address that I use for my apple ID.....how do I do that!!!!

Hello Embark2013 - Thanks for the help! If possible, could you or somebody in Apple-land explain to Apple that their system is IDIOTIC?! Changing an email address should be the simplest thing imaginable. Nobody should EVER have to consult a discussion group to learn how to do such a thing.

HT5312 Whose email address do you use for your rescue email?

Whose email address do you use for your rescue email?

My own.
That is the point of the rescue e-mail

Which protocol we should use for file transfer in ios ?

which protocol we should use for file transfer in ios ?

My friend that's definitively a Lotus Domino question, you'll probably ask in the Domino's forums if it generates wsdl, or simple http services you're ready to consume those services in Flex.

MULTIPLE PUBLIC IP ADDRESSES ON OUTSIDE INTERFACE

Hi All,
We are configuring an ASA 5510 for remote VPN users using Any Connect.
Our question is:
We have a /29 block of public IP addresses and we want to configure 5 public IP addresses on the Outside interface so that VPN users can use different DDNS logins that terminate on one of the 5 addresses. 1 of the 6 hosts in the subnet is the gateway address to the ISP router.
Any suggestions on how to best achieve this requirement.
Regards,

What are the different groups used for? Are that different companies or just different departments of one company?
There are so many ways to achieve different VPN-Settings for the users and all of them only work with the one public IP-address your ASA has on the outside interface.
One "typical" way to configure different VPN-settings for different users is the following:
You configure one tunnel-group with the needed authentication-settings. The assigned group-policy only has the needed tunnel-protocol configured like sssl-client.
For each department you configure one group-policy with all needed parameters like split tunnel, VPN-filter, banner, DNS/WINS-servers domain and so on.
Your users get one of these group-policies assigned. That can be done with local authentication in the user-acount, or more scalable through a central RADIUS-server which can be the Windows NPS to authenticate the domain-users.

Multiple public IP addresses

ASA newb here. This question has been asked before but the configurations seem to be different so they don't really answer my question. I think mine is pretty simple but I can't find a clear "this is what you do" answer. I've been reading the Cisco doc's trying to figure it out but they have so many different scenarios and examples that its a little overwhelming. Plus none of the seem to match mine 100%.
ASA 8.4
I have 6 public ip addresses and want to use 2 of them. I have two servers running an application that needs port 1234 accesable externally for updates. Can't change port numbers and obviously can't route 1234 two different places.
Say my range is 4.4.4.4 to 4.4.4.10. I want to use 4.4.4.4 and 4.4.4.5. My network currently looks like so:
4.4.4.4 <--> ASA <--> 192.168.0.0/24
I want:
4.4.4.4,4.4.4.5 <--> ASA <--> 192.168.0.0/24
Any ideas?

none taken.
Let me make sure i've got this right. I'll describe what i see in ASDM.
Line 1: Source Intf - inside, Dest Inft - Outside, Source - server2, Destination - any, Service - tcp/1234, Source - server2-outside, Destination - --Orginal--, Service --Original--
Line 2: Source Intf - outside, Dest Intf - inside, Source - any, Destination - server2-outside, Service - tcp/1234, Source --Original--(S), Destination - server 2, Service --Original--
I'm not entering your server1 info because I already have that setup and working.
ACL: Source - any, Destination - 192.168.1.5, Service - tcp/1234, Action - permit
Server2 = 192.168.1.5
Server2-Outside = 4.4.4.6 (my other external address)

Multiple public IP Addresses on ASA 5505?

Hi
Is it possible to two or more public IP Addresses bound to a Cisco ASA 5505 running 8.4(2). If so, how?
Thanks in advance for your help with my request.
d

Hello Douglas,
you don't need to assign multiple IP-addresses - the trick is the MASK besides that you tell ASA where to find the default gateway.
The rest is icing on a cake, and you achive this with the help of NAT.
Lets say you're provided a network with a mask of 255.255.255.248, then nets, or subnets, jump on the number 8.
1. net: X.X.X.0, with 7 being the broadcast, 1 the first usable (usually the DFGW) leaving you 5 addresses
2. net: X.X.X.8, with 15 being the broadcast, 9 the first usable leaving you 5 addresses
3. net: X.X.X.16, with 23 being the broadcast, 17 the first usable, leaving you 5 adresses
and so forth
Lets take the 3rd example here, and configure the outside interface with a mask of 255.255.255.248 and the address of X.X.X.18 (the first usable besides the DFGW), or X.X.X.22 (the last usable if 17 was taken by the DFGW) - we stick with 18.
If you want your mail to be available through X.X.X.19 create a NAT-rule where you reference from the inside (IP of your server etc.) to the outside with the address X.X.X.19 (create a object like "WAN-ADDRESS-19" and give it the address X.X.X.19, and don't forget the ACLs!).
If you want your webservices to be available through X.X.X.20 create a NAT-rule where you reference from the inside (IP of your server etc.) to the outside with the address X.X.X.20 (create a object like "WAN-ADDRESS-20" and give it the address X.X.X.20, and don't forget the ACLs!).
That all works through 1 cable, 1 interface assigned with the right MASK
Hope that clears the skys?
Pls, rate right answers!

(ASA 5510) How do assign multiple public IP addresses to outside interface?

Hi,
I'm currently replacing my ASA 5505 with a 5510. I have a range of public IP addresses, one has been assigned to the outside interface by the setup wizard (e.g. 123.123.123.124 ) and another I would like to NAT to an internal server (e.g 192.168.0.3 > 123.123.123.125). On my asa 5505 this seemed fairly straigh forward, i.e. create an incoming access rule that allowed SMTP to 123.123.123.125 and then create a static nat to translate 192.168.0.3 to 123.123.123.125. Since I've tried to do the same on the 5510 traffic is not passing through so I'm assuming that the use of additional public IP addresses is not handled in the same way as the 5505? I also see that by default on the 5505, 2 VLANs are created, one for the inside and one for the outside, where as this is not the case on the 5510. Is the problem that VLANs or sub-interfaces need to be created first? Please bare in mind I'm doing the config via ASDM.
PS. everything else seems to OK i.e. access to ASDM via 123.123.123.124, outbound PAT and the site-to-site VPN.
Any help much appreciated as I really need to get this sorted by Sunday night!
Jan

ASA 5505 is slighly different to ASA 5510. ASA 5505 has switchport, while ASA 5510 has all routed ports, hence there is no need for VLAN assignment, unless you are creating a trunk port with sub interfaces.
In regards to static NAT, which version of ASA are you running?
For ASA version 8.2 and earlier (assuming that you name your inside interface: inside, and outside interface: outside):
static (inside,outside) 123.123.123.125 192.168.0.3 netmask 255.255.255.255
For ASA version 8.3 and above:
object network obj-192.168.0.3
host 192.168.0.3
nat (inside,outside) static 123.123.123.125
Also, with your inbound ACL, the behaviour also changes from ASA 8.2 and earlier compared to ASA 8.3 and above.
For ASA 8.3 and above, you would need to configure ACL with the destination of the real IP (192.168.0.3), not the NATed IP (123.123.123.125).
For ASA 8.2 and below, it is normally ACL with destination of NATed IP (123.123.123.125) for inbound ACL on the outside interface.
Hope that helps.

Multiple recipient email addresses is not working for xsl & PDF Attachment

multiple recipient email addresses is not working properly when
to list has some external email address and sending xls and PDF file as an attachment.
Test Scenario:
(A) Create mail target activity
1)To email : use the multiple email id with some external domain (ex.
[email protected] ,[email protected], [email protected])
2)File attachment with .xls file and this file is sending to mail target as an inputstream(at runtime)
3)Use all other valid parameter in activity.
(B) Create a process flow File source to mail target
Execute the process flow.
Actual Result: Mail is received by every email account. Only external email account get correct file but other email account(as ([email protected])) attachment files
displaying message
�abc.xls� can not be accessed. The file may be read-only, Or you may be
trying to access a read only location. Or, the server the document is stored on
may not be responding.�
When i trying to open xls and PDF file
Expected Result:
All type of file attachments should be supported with all valid email address
(servers).
Pls help me about this senario:
What is problem in this case:
I am sending code
Session session =getSession(host,port,secure);
session.setDebug(this._debug);
               Transport trans = connect(host,port,session,userID,password);
               Message message = new MimeMessage(session);
               InternetAddress[] iAddr = null;
               message.setFrom(new InternetAddress(fromName));
               iAddr = InternetAddress.parse(toUserName, true);
               message.setRecipients(Message.RecipientType.TO, iAddr);
               message.setSubject(subject);
               //BodyPart messageBodyPart = new MimeBodyPart();
               Multipart multipart = new MimeMultipart();
               MimeBodyPart messageBodyPart=null;
if(dataLocation!=null && dataLocation.equalsIgnoreCase("ATTACHMENT")){
                    String tmpName=fileName;
                    if( inputstream != null)
                              tmpName = makeAttachment(fileName,inputstream);
                    messageBodyPart = new MimeBodyPart();
                    DataSource source = new FileDataSource(tmpName);
                    messageBodyPart.setDataHandler(new DataHandler(source));
                    fileName = fileName.replace('\\', '/');
                    fileName = fileName.substring(fileName.lastIndexOf('/') + 1,
                              fileName.length());
                    messageBodyPart.setFileName(fileName);
                    multipart.addBodyPart(messageBodyPart);

First, when sending your message, the filename should be a simple
filename, not containing any directory names.
It sounds like your mail server might be doing some special
processing of attachments, perhaps to prevent viruses.

Address already in use for oc4j-instance: unable to run a form

Hi,
I've an error starting the oc4j-instance of forms.
it says: address already in use JVM-bind.
i changed the port number to 8888 (it was 8889) in the devsuit/config/default-web-site.xml.
running for the first time a form JInitiator was installed, applictaion server installation succesfull, but i see only a grey screen (in stead of my form).
i changed the prot number to 8889 again.
how to solve?
by the way, how to combine all oc4j instances into one?
(I have one for forms, one for reports, one for mapviewer and one for BIPublisher)
Leo

Thank you so much for your help.
It works when I remove the http://%%20" from address in Internet Explorer. But it doesn't work in preference->runtime. No matter what address I typed, FormBuilder added http://%%20" in front of the address automatically. I don't know what else I need to change to avoid this problem.
Thank you.

Port Forwarding for Cisco ASA 5505 VPN

This is the Network
Linksys E2500 ---> Cisco ASA 5505 ---> Server
I beleive I need to forward some ports to the asa to use the IPsec VPN I just setup. I had the SSL VPN working but only needed to forward 443 for that....I assume that IPsec tunnel is a specific port.
Thank You

For IPSec VPN, you need to port forward UDP/500 and UDP/4500, and remember to enable NAT-T on the ASA.
Command to enable NAT-T on ASA:
crypto isakmp nat-traversal 30

What is the Sucessor for the ASA 5505 Appliance

Hello,
we are looking for a small Firewall Appliance for branch offices which are connected via MPLS and Internet VPNs in the best case.
We need a small low-priced appliance with the specs of a 5505.
Sometimes the appliances are not Rackmounted but placed inside of small offices, so they need to be silent.
We only need basic Firewalling and IPSec VPN capabilities. No Cloud / Application / Fill-In-Buzzword-here Stuff.
An Hardware Updated 5505 would be ideal.
Is there any real sucessor for the 5505? What would you use for this (other vendors may also apply).
Regards
Sebastian

Up to now, there is no successor for the 5505. Many people expect that something will come soon, I do that for much over a year now ... ;-)
For your needs, a Cisco 880 could be a good buy. Not as fast as the 5505 but much more features for your VPN-deployment.

Multiple Public IP Addresses To Be Used For DMZ - ASA 5505 - IOS 8.4(2)

Similar Messages

Maybe you are looking for