July 2011 - Test - lists.nanog.org

RE: Hello List, a easy Cisco question.
by bill＠kruchas.com 11 Jul '11

11 Jul '11

Hello, We have Nat setup on our equipment, just a plain vanilla internet connection. Here is the pertinent section of the runing config. ! interface Ethernet0/2 nameif Etherpoint security-level 0 ip address outside-ip 255.255.255.252 ospf cost 10 ! object-group service terminal-services tcp port-object eq 3389 access-list Inside_access_in extended permit icmp any any access-list Inside_access_in extended permit ip 192.168.125.0 255.255.255.0 any access-list Inside_nat0_outbound extended permit ip 192.168.125.0 255.255.255.0 MobileVPN 255.255.255.0 access-list Inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 MobileVPN 255.255.255.0 inactive access-list Inside_nat0_outbound extended permit ip 192.168.125.0 255.255.255.0 any inactive access-list Inside_nat0_outbound extended permit ip 192.168.125.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list Inside_nat0_outbound extended permit ip 192.168.125.0 255.255.255.0 192.168.14.0 255.255.255.0 access-list Inside_nat0_outbound extended permit ip 192.168.125.0 255.255.255.0 192.168.100.0 255.255.255.0 access-list Inside_nat0_outbound extended permit ip 192.168.125.0 255.255.255.0 192.168.101.0 255.255.255.0 access-list Inside_nat0_outbound extended permit ip 192.168.125.0 255.255.255.0 192.168.253.0 255.255.255.0 access-list Haven_splitTunnelAcl_1 standard permit 192.168.125.0 255.255.255.0 access-list Etherpoint_access_in extended permit tcp host 192.168.125.8 eq 3389 any eq 3389 access-list Etherpoint_access_in extended permit tcp any eq 3389 host 192.168.125.8 eq 3389 access-list Etherpoint_access_in extended permit tcp any host 192.168.125.8 eq 3389 access-list Etherpoint_nat0_outbound extended permit ip host 192.168.125.8 host outside-ip access-list Etherpoint_nat0_outbound extended permit ip host outside-ip host 192.168.125.8 ip local pool HavenVPN 192.168.253.1-192.168.253.254 mask 255.255.255.0 global (Etherpoint) 2 interface nat (Inside) 0 access-list Inside_nat0_outbound nat (Inside) 2 192.168.125.0 255.255.255.0 nat (Etherpoint) 0 access-list Etherpoint_nat0_outbound outside static (Inside,Etherpoint) tcp interface 3389 192.168.125.8 3389 netmask 255.255.255.255 no threat-detection statistics tcp-intercept access-group Inside_access_in in interface Inside access-group Etherpoint_access_in in interface Etherpoint route Etherpoint 0.0.0.0 0.0.0.0 204.186.102.187 1 -------- Original Message -------- Subject: Re: Hello List, a easy Cisco question. From: Dennis <[1]daodennis(a)gmail.com> Date: Mon, July 11, 2011 12:39 pm To: [2]bill(a)kruchas.com On Mon, Jul 11, 2011 at 12:33 PM, <[3]bill(a)kruchas.com> wrote: > Hello, > > I am not a heads down network guy, but I have setup a few > firewalls, and have got them to do what I wanted, "eventually". But > mostly through reading and trial and error. > > I am struggling with this one, but I think I know the answer, but > want to verify it with some experts. > > > > We have a cisco asa 5505, with an internet connection with only one > useable ip address (subnet 255.255.255.252). We/they have had a nat > setup for outgoing connections for some time, but I have been trying to So your provider has your ASA behind a NAT or there is a NAT inside,outside statement on your ASA? Some more pieces of the configuration would be helpful here too. Thanks, Dennis O. References 1. mailto:daodennis@gmail.com 2. mailto:bill@kruchas.com 3. mailto:bill@kruchas.com

2 1

RE: Hello List, a easy Cisco question.
by bill＠kruchas.com 11 Jul '11

11 Jul '11

Thank You all, Here are some of the suggestions so far, all good. And I will followup on them and report back the final solution. Some reading for tonite ( I already had it and skimmed thru, but I'll need to digest it better). I'm hoping that I'm not beating my head against the wall using Nat instead of Pat, and not sure if Pat would be acceptable. Anyway, thanks again. Bill ****************************************************** Hey Bill, I don't think you can do a static NAT translation on a NAT egress IP address. Have you considered using Port Address Translation instead? Cheers, Taylor As per [1]http://www.nanog.org/mailinglist/listfaqs/otherlists.php, since I don't see any responses to the list here, you'll probably get a more comprehensive reply from real Cisco experts at [2]http://puck.nether.net/mailman/listinfo/cisco-nsp I hope you get the problem solved! Whatever happens, do post back a reply to the list saying what solved the problem in the end. Alex -------- Original Message -------- Subject: RE: Hello List, a easy Cisco question. From: "Eric Tykwinski" <[3]eric-list(a)truenet.com> Date: Mon, July 11, 2011 12:47 pm To: <[4]bill(a)kruchas.com> Bill, Sounds like you need to use Port Address Translation (PAT), instead of Network Address Translation (NAT). Here's a Cisco help file for it: [5]http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_ note09186a00804708b4.shtml Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300 F: 610-429-3222 -----Original Message----- From: [6]bill(a)kruchas.com [[7]mailto:bill@kruchas.com] Sent: Monday, July 11, 2011 3:34 PM To: nanog Subject: Hello List, a easy Cisco question. Hello, I am not a heads down network guy, but I have setup a few firewalls, and have got them to do what I wanted, "eventually". But mostly through reading and trial and error. I am struggling with this one, but I think I know the answer, but want to verify it with some experts. We have a cisco asa 5505, with an internet connection with only one useable ip address (subnet 255.255.255.252). We/they have had a nat setup for outgoing connections for some time, but I have been trying to get a new inbound connection going for terminal services to a specific host on tcp port 3389. I'm using "ASDM" but checking the config file and it's building the correct static statement, and access lists (I think anyway). But It doesn't work, and doesn't give a real good definative log message. I was wondering if possibly the fact that nat is using the one ip address, if that precludes the static mapping from working. I've read several step by steps, and again had this working several other places, but always with more ip's. If having just one ip isn't the isssue, is there any other issues I should be looking for. I'd appreciate any insight you might share. Thanks in advance References 1. http://www.nanog.org/mailinglist/listfaqs/otherlists.php 2. http://puck.nether.net/mailman/listinfo/cisco-nsp 3. mailto:eric-list@truenet.com 4. mailto:bill@kruchas.com 5. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note091… 6. mailto:bill@kruchas.com 7. mailto:bill@kruchas.com

1 0

Hello List, a easy Cisco question.
by bill＠kruchas.com 11 Jul '11

11 Jul '11

Hello, I am not a heads down network guy, but I have setup a few firewalls, and have got them to do what I wanted, "eventually". But mostly through reading and trial and error. I am struggling with this one, but I think I know the answer, but want to verify it with some experts. We have a cisco asa 5505, with an internet connection with only one useable ip address (subnet 255.255.255.252). We/they have had a nat setup for outgoing connections for some time, but I have been trying to get a new inbound connection going for terminal services to a specific host on tcp port 3389. I'm using "ASDM" but checking the config file and it's building the correct static statement, and access lists (I think anyway). But It doesn't work, and doesn't give a real good definative log message. I was wondering if possibly the fact that nat is using the one ip address, if that precludes the static mapping from working. I've read several step by steps, and again had this working several other places, but always with more ip's. If having just one ip isn't the isssue, is there any other issues I should be looking for. I'd appreciate any insight you might share. Thanks in advance

2 1

Mediacom Communications Corporation contact available?
by Eric Tykwinski 11 Jul '11

11 Jul '11

Looking for a NOC contact if there are any available. Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300 F: 610-429-3222

1 0

RE: Hello List, a easy Cisco question.
by bill＠kruchas.com 11 Jul '11

11 Jul '11

Hello, I believe I have setup the appropriate access-lists, even have created it both ways in case I have the inside and outside reversed. The packet trace always drops through and hits the implicit rule which is deny everything. No matter how I have the access list setup. I have tried it several ways, and also included the nat exclude statement, but the current config doesn't have that listed anymore as I wanted to try to keep the config as clean as I can, but if the exclude is needed I can certainly add it. But none on the examples used it. -------- Original Message -------- Subject: Re: Hello List, a easy Cisco question. From: James Laszko <[1]jamesl(a)mythostech.com> Date: Mon, July 11, 2011 1:02 pm To: "[2]bill(a)kruchas.com" <[3]bill(a)kruchas.com> Have you setup the appropriate access rule along with the NAT? The packet trace button is useful in testing as well... Regards, James Laszko Mythos Technology Inc [4]Jamesl(a)mythostech.com ----- Original Message ----- From: [5]bill(a)kruchas.com [[6]mailto:bill@kruchas.com] Sent: Monday, July 11, 2011 12:33 PM To: nanog <[7]nanog(a)nanog.org> Subject: Hello List, a easy Cisco question. Hello, I am not a heads down network guy, but I have setup a few firewalls, and have got them to do what I wanted, "eventually". But mostly through reading and trial and error. I am struggling with this one, but I think I know the answer, but want to verify it with some experts. We have a cisco asa 5505, with an internet connection with only one useable ip address (subnet 255.255.255.252). We/they have had a nat setup for outgoing connections for some time, but I have been trying to get a new inbound connection going for terminal services to a specific host on tcp port 3389. I'm using "ASDM" but checking the config file and it's building the correct static statement, and access lists (I think anyway). But It doesn't work, and doesn't give a real good definative log message. I was wondering if possibly the fact that nat is using the one ip address, if that precludes the static mapping from working. I've read several step by steps, and again had this working several other places, but always with more ip's. If having just one ip isn't the isssue, is there any other issues I should be looking for. I'd appreciate any insight you might share. Thanks in advance References 1. mailto:jamesl@mythostech.com 2. mailto:bill@kruchas.com 3. mailto:bill@kruchas.com 4. mailto:Jamesl@mythostech.com 5. mailto:bill@kruchas.com 6. mailto:bill@kruchas.com 7. mailto:nanog@nanog.org

1 0

AOL security contact?
by Chris 11 Jul '11

11 Jul '11

Anyone have an AOL security contact because like I posted yesterday, CNN was hit through a redirect vulnerability in their ad system and now AOL is suffering the same thing by having some scammer serving up "Casey Anthony leaked lawyer video" crap as Facebook spam where unsuspecting lusers are clicking like wild on it -- --C "The dumber people think you are, the more surprised they're going to be when you kill them." - Sir William Clayton

3 3

IMPORTANT ADMINISTRIVIA - NANOG list and website changes over the next week
by Michael K. Smith - Adhost 11 Jul '11

11 Jul '11

Hello Everyone We are going to be moving the NANOG mailing list over to our new service provider beginning this week. There are several changes that will occur over time that will, hopefully, reduce the service impact to users. One key note - the new system doesn't use Mailman, so your filtering rules may need to be changed to accommodate the new system. - July 8th - We will begin the transition of the NANOG website to its new location with our service provider. - There may be service glitches through the weekend on the site, but nothing catastrophic - July 9th - Mailman will be modified to use our service provider's MX for outbound messages. - Hopefully this will be transparent to list participants, but users can add mail.amsl.com to their filters. - July 9th - Subscription changes to the list will be frozen and the list archives will be unavailable. - Administrivia requests will receive a bounce message during this phase. - July 11th - MX records will be updated so all inbound/outbound mail goes through their system. - At this stage, mail.amsl.com will be the only MX for NANOG list services. - July 11th - DNS records will be updated for the website as well. - At this point, all services will have been moved to our provider. If you have any questions or concerns you can send them to me directly. I'd be happy to provide more specifics if people are interested, but I thought a brief and to-the-point message to the list was more appropriate. Regards, Mike -- Michael K. Smith - CISSP, GSEC, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D)

4 3

Re: [NANOG] NANOG TEST
by Joe Sniderman 10 Jul '11

10 Jul '11

On 07/10/2011 10:03 PM, Steve Feldman wrote: > Another test, sorry for the noise. > Steve Well, at least the fears that nanog would be IPv4 only are unfounded.. Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:1112:1::14])... -- Joe Sniderman <joseph.sniderman(a)thoroquel.org>

1 0

Re: CNN security contact?
by Chris 10 Jul '11

10 Jul '11

CNN patched the redirect vulnerability which was making it easier to social engineer Nancy Grace tards who followed the case

1 0

UPDATE: NANOG List Cutover Schedule
by Michael K. Smith - Adhost 10 Jul '11

10 Jul '11

Hello: We have moved the NANOG list back to its original location for the time being. We have a few issues to address before we can cut the system over permanently. I will let everyone know again when we are ready to proceed. Thanks, Mike -- Michael K. Smith - CISSP, GSEC, GISP Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D) > -----Original Message----- > From: Michael K. Smith - Adhost [mailto:mksmith@adhost.com] > Sent: Sunday, July 10, 2011 3:38 PM > To: NANOG list (nanog(a)nanog.org) > Subject: NANOG List Cutover Schedule > > Hello All: > > We are going to cut the mailing list over to the new location at 4:00 PM PDT > (GMT -7). We will be testing the cutover on this list to make sure everything > goes smoothly. Please filter on the subject "NANOG TEST". > > Regards, > > Mike > > -- > Michael K. Smith - CISSP, GSEC, GISP > Chief Technical Officer - Adhost Internet LLC mksmith(a)adhost.com > w: +1 (206) 404-9500 f: +1 (206) 404-9050 > PGP: B49A DDF5 8611 27F3 08B9 84BB E61E 38C0 (Key ID: 0x9A96777D) > >

1 0