Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco SA520 IP Alias port forward issue

Hi,

I have a SA520 and have setup our ip aliases for the WAN interface but when i set the firewall rule to allow traffic and forward it to an internal LAN address it does not work, The logs show that it is still dropping the packets.

I have rechecked the settings a few times and even tried wiht all the attack security switched off but it still does not work.

We are running firmware 1.1.42,

Is it possible it needs a hardware restart? i have rebooted it using the interface and there is still no joy.

Regards,

Alllan

  • Small Business Security
Everyone's tags (1)
10 REPLIES
New Member

Re: Cisco SA520 IP Alias port forward issue

Update,

I have upgraded to the new RC2 firmware in the hope that that may shead some light on the issue, now there is nothing showing up in the firewall logs when i try and connect to the ipalias and the connection is still not succeeding.

I'm trying a soft-reboot to see if it needed that after the firmware update in additon to the automatic reboot.

I'll keep updating as i find more out.

Allan

Edited, Well the reboot did not change anything the firewall rules do not work and the logs still are showing my connects since updating the firmware.

On a side note should i be able to telnet to the firewall? i know its wishful thinking but i was hopeing it might run IOS.

Also forgot to say i'll be onsite tomorrow so will try a hard reboot then. (clutching at straws now).

New Member

Re: Cisco SA520 IP Alias port forward issue

Well I have realized that the logging has decided not to pog or at least show denied packets, not sure how this changed (must be linked to the install of the firmware),

So still as a bit of a loss.

New Member

Re: Cisco SA520 IP Alias port forward issue

Hi Allan,

We are not seeing this issue that you are reporting but would like to replicate what you are seeing. If you send us your configuration file, I will load it and try it out locally. Please change any password sensitive information from the configuration. Also if you are not comfortable posting it on support community, you can send us through private message.

Thanks,

Nitin

New Member

Re: Cisco SA520 IP Alias port forward issue

Allan,


Can you post a scree shot of your IPv4 Firewall Rules?

New Member

Re: Cisco SA520 IP Alias port forward issue

Hi,

I have removed the external ip but it is correct (the first alias) the service RDP is port 3389 (It works on the WAN1 rule). The only difference is that the second rule has a defind external ip from the alias list but all the packets are dropped for this connection when i see them hitting the firewall.

Regards,

Allan

New Member

Re: Cisco SA520 IP Alias port forward issue

Well i have checked by using logging software and the packets are still hitting the firewall just getting declined.

I have double checked that all outbound traffic is allowed and the inbound rules are correct so i'm still none the wiser.

New Member

Re: Cisco SA520 IP Alias port forward issue

Hi,

Thanks for you reply, i'll send you a pm now.

Regards,

Allan

New Member

Re: Cisco SA520 IP Alias port forward issue

Hi Allan,

I am not able to access the link. Can you check on the privileges that you have assigned to me or you can send it to nmanglik@cisco.com.

Thanks,

Nitin.

New Member

Re: Cisco SA520 IP Alias port forward issue

Hi,

You should have recieved a email from me with the attachment.

Thanks,

Allan

3474
Views
0
Helpful
10
Replies