Becky's questions

this was just a thought and I wondered if anyone else had managed to do it or thought about it.

We use Google apps for Business and to avoid any issues, we have whitelisted all of Google's IP ranges on our Cisco Ironport. However, some of our users abuse this and spend all day in their own Google mail account. Is it possible to block non corporate Gmail URL's to prevent them from logging in to their own accounts?

I would really like to hear if anyone else has managed to do this or given it any thought. Merry Christmas!

I am attempting to setup a Cisco 887VA to connect out to the internet via a basic ADSL connection. I have configured it to the best of my ability but its the first one I've ever done and I think I may have overlooked something silly. I have triple checked everything and all but the ADSL username/password being incorrect, I cannot see what else it could be.

Could anyone take a look over my config and see if anything stands out please?

Using 3473 out of 262136 bytes
!
! Last configuration change at 08:22:49 UTC Tue May 24 2016 by administrator
!
version 15.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
no service timestamps debug uptime
no service timestamps log uptime
service password-encryption
no service dhcp
!
hostname rtr-h003103
!
boot-start-marker
boot system tftp c880data-universalk9-mz.154-3.M5.bin 255.255.255.255
boot system flash:c880data-universalk9-mz.154-3.M5.bin
boot-end-marker
!
!
no logging buffered
no logging console
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication enable default enable
aaa authentication ppp default local
aaa authorization exec default local
!
!
!
!
!
aaa session-id common
memory-size iomem 10
!
crypto pki trustpoint TP-self-signed-1297352779
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1297352779
 revocation-check none
 rsakeypair TP-self-signed-1297352779
!
!
crypto pki certificate chain TP-self-signed-1297352779
 certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
!
!
!
!
!
!
!
!
!
!
!
!
!
ip domain name mydomain.local
ip cef
no ipv6 cef
!
!
cts logging verbose
license udi pid CISCO887VA-K9 sn FCZ1524C3GC
!
!
archive
 log config
  hidekeys
username administrator privilege 15 secret 5 $1$vd2f$WpvhuZd3aufh0bd0SPUhQ/
username ccpuser privilege 15 secret 5 $1$vqGL$stHJZv4odwJC5LOCvhVpr.
!
!
!
!
!
controller VDSL 0
no cdp run
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0
 description ADSL LAN Interface
 ip address 192.168.2.100 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly in
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
 pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
 no ip address
!
interface FastEthernet1
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface Vlan1
 description 192.168.1.0 LAN (Connected to CCTV Feed)
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
interface Dialer0
 description Test (ADSL)
 ip address 81.136.61.19 255.255.255.254
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname [email protected]
 ppp chap password 7 07072055420C0002051D1E1C55
 ppp pap sent-username [email protected] password 7 030C5A120A0A384B5C060C1546
 ppp ipcp dns request
 ppp ipcp route default
 no cdp enable
!
interface Dialer1
 no ip address
 no cdp enable
!
ip forward-protocol nd
no ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip ftp username root
ip ftp password 7 0201545F06090B240D
ip nat inside source list 10 interface Dialer0 overload
ip nat inside source list natin interface Dialer0 overload
ip nat inside source static 192.168.1.250 81.149.241.71
ip route 0.0.0.0 0.0.0.0 Dialer0
ip ssh version 1
ip ssh pubkey-chain
  username administrator
!
ip access-list standard natin
 permit 192.168.1.0 0.0.0.255
!
dialer-list 1 protocol ip permit
!
access-list 10 permit 192.168.2.0 0.0.0.255
!
!
!
!
line con 0
 privilege level 15
 no modem enable
line aux 0
line vty 0 4
 privilege level 15
 transport input telnet ssh
line vty 5 15
 exec-timeout 0 0
 privilege level 15
 transport input none
!
!
end

Thank you in advance.

I am looking for some advise on how to connect some of our locations together, using a site-to-site VPN on our Cisco ASA 5515-X. At the moment we have a 5515-X at our head office and a Cisco 887A router at each location that we want to connect to the ASA and establish the VPN.

I see the connection profiles on the ASA whilst viewing the settings through the Cisco ASDM GUI and it looks quite straight forward, I think I can work this part out but can anyone tell me if the 887A routers are capable of doing this as I cannot put an ASA in each location.

Also, to start my testing I was hoping to connect my home network to the VPN but I am using a Virgin Media Super Hub. I have read that all I need to do is enable IPSec, PPTP and Multicast pass through but where do I enter the reverse VPN settings? If this is not possible on a Super Hub, then there is a possibility of placing a 887A router on the inside of my LAN.

I have been looking around and trying to find ideas on how to isolate a test lab from our main network whilst still allowing the test lab access out to the internet.

At the moment, our main network is on a 10.11.23.x subnet. To this we have added a Cisco Catalyst WS2960 on 10.11.23.245. I have created vlan23 on this switch, 10.11.23.245 and vlan192, 192.168.0.252.

Physically plugged into vlan23 of this switch is eth0 of a a HP desktop server running CentOS. Plugged into vlan192 of the switch is eth1 of the same HP machine.

So the switch config shows:

interface Vlan23
 ip address 10.11.23.245 255.255.255.0
!
interface Vlan192
 ip address 192.168.0.252 255.255.255.0

And the CentOS box shows:

eth0      Link encap:Ethernet  HWaddr A0:48:1C:D6:8D:78  
          inet addr:10.11.23.212  Bcast:10.11.23.255  Mask:255.255.255.0
          inet6 addr: fe80::a248:1cff:fed6:8d78/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4463062082 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4058451942 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1677558138503 (1.5 TiB)  TX bytes:1109258225607 (1.0 TiB)
          Interrupt:17 

eth1      Link encap:Ethernet  HWaddr A0:48:1C:D6:8D:79  
          inet addr:192.168.0.100  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::a248:1cff:fed6:8d79/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2983685 errors:1 dropped:0 overruns:0 frame:2
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:231387664 (220.6 MiB)  TX bytes:522 (522.0 b)
          Interrupt:18 

From the CentOS box I can ping anything on vlan23 but nothing on the private test LAN, vlan192. Same goes for the switch, it can't even ping eth1 on the CentOS box which is physically plugged into one of its own ports.

We want vlan192 to remain invisible from vlan23 as we are setting up a test domain controller and want to be sure that its not interfering in any way however, the gateway out to the internet is 10.11.23.254. Can this be done?

Thanks in advance for any suggestions.

I am new to the forums and really hope someone can help me. I am pulling my hair out! I have posted on both the Cisco forums and Windows forums in hopes anyone can suggest something but no one has even viewed my questions. I really hope this forum is a lot more active!

I am trying to allow a 3rd party to RDP to two of our servers using custom ports (3390 & 3391). I have set up two access rules on our ASA 5515-X using the ASDM (I cannot do CLI).

Rules are as follows:

Source Criteria - Permit - Any Destination Criteria - internal.server.local - (Service) RDP

Then I have applied a NAT rule as follows:

Match Source Interface - Internet - Source Address - Any Destination Interface - LAN - Destination Address - 1.2.3.4 (Our public IP) - Service - 3390 (Custom RDP)

Action Source NAT Type - Static - Source Address - Original - Destination Address - internal.server.local - Service - RDP

And again for the other server using a NAT rule using 3391 for the custom port.

This rule seems to be working and the logs show that the connection attempt is made but then it looks like the Windows server on the other end is refusing the connection.

6   Dec 22 2015 08:18:43    302014  213.205.x.x 49639   10.11.200.55    3389    Teardown TCP connection 20423786 for BTnet:213.205.x.x/49639 to LAN:10.11.200.55/3389 duration 0:00:30 bytes 0 SYN Timeout

I have double checked the server, firewall is off and there is also an exception rule in place to allow RDP connections anyway, plus RDP is enabled.

This morning I have also noticed the following error after performing a trace:

5   Dec 22 2015 07:34:08    305013  213.205.x.x 49345   10.11.200.55    3389    Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src BTnet:213.205.x.x/49345 dst LAN:10.11.200.55/3389 denied due to NAT reverse path failure

Could this be the actual reason its failing? I would be eternally grateful for any suggestions.