Skip to main content

Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Network Socket Address format used in Cisco ASA syslogs

I'm getting syslog logs from CISCO ASA where the ip addresses are coming in what I would call a non-standard format: The IP with port is being logged as 'd.d.d.d/port' (e.g. 10.0.1.2/63313') so it ...
Neil Walker's user avatar
0 votes
0 answers
86 views

What is mean final version firmware ASA 5525-x

Please advise, when reading the “Release Notes for the Cisco ASA Series, 9.17(x) ” I saw the following: ASA 9.14(x) was the final version for the ASA 5525-X" But the current version of our Cisco ...
Глеб Щеголев's user avatar
0 votes
2 answers
43 views

ASA - Redundancy ISP in Multiple contexts

At the moment I am interested in the fault tolerance of the route to providers in Cisco ASA in multiple contexts. As I know, in one context you cannot track the route and change it, but the task is to ...
Глеб Щеголев's user avatar
0 votes
1 answer
46 views

Cisco ASA L2TP/IPsec split-tunnel not working for public Internet

I'm testing a setup using ASA to provide VPN over L2TP/IPSec PSK to support native IPSec clients such as iOS, Android, MacOS, Windows, etc. The issue I'm running into is that when connected, the split-...
640KB's user avatar
  • 101
0 votes
1 answer
141 views

ASDM 7.20 doesn't work with script that works with ASDM 7.13

I have a script I wrote for Linux that enables me to use ASDM with Oracle Java 8. One version I know for sure works is 7.13.1 on an ASA 5516, but when I try the same script with 7.20.1 on an FPR 2110 ...
elyograg's user avatar
  • 101
0 votes
0 answers
66 views

Cisco ASA OCSP configuration

Can anyone help me understand how to configure OCSP on my Cisco ASA? I have AnyConnect Over IKEv2 to ASA with AAA and Certificate Authentication. As RootCA server I have OpenSSL. Now I want to ...
John's user avatar
  • 812
0 votes
2 answers
130 views

arp permit-nonconnected Not Working

I have a ASA 5506-X version 9.8(2). The ASA has two interfaces: g1/1 (outside, ip: 209.165.0.2/30), and g1/3 (inside, ip: 209.165.0.5/30). g1/1 is connected to a 881-W router (Router-A), whose ip is ...
paperangel220's user avatar
1 vote
0 answers
45 views

Issue with Cisco ASA IPSec VPN clients can't access DMZ network

I have one ASA that is configured for IPSec VPN Cisco client. The VPN allow access to inside network, but trying to get it to my DMZ is a problem. My VPN address pool is defined as 124.140.1.x /24. My ...
Steve's user avatar
  • 11
2 votes
1 answer
102 views

Does Cisco ASA support encrypted logging

Background I am approaching this from a SIEM or Log Collection point of view. Our corporation is thinking about making encrypted logging mandatory Question Cisco ASA default appears to me to be send ...
user3223819's user avatar
0 votes
0 answers
19 views

Cisco ASA 5525x can't limit speed?

There was a need to limit the speed for users on Cisco ASA 5525x but for some reason these commands are simply not available for me: Example: HQFW(config)# access-list POLICE_TRAFFIC_TO_BRANCH permit ...
Глеб Щеголев's user avatar
0 votes
1 answer
196 views

Troubleshooting ipsec ikev2 site to site vpn

I assume, for peer IP we use, is the wan interface of the Cisco ASA and not the gateway of the ISP correct? Also, all routes should go to the same IP of the wan interface correct? So we have two Cisco ...
user1378803's user avatar
0 votes
1 answer
37 views

Unable to configure Site to Site VPN between Cisco Router & Cisco ASA and permit SSH

I am performing configuration on Cisco ASA and Cisco Router from the packet tracer. I am attempting to allow the external network (172.16.22.100 255.255.255.0) to access the internal server which is ...
iloveearth_12345's user avatar
0 votes
1 answer
70 views

ASA 5555 loses internet connectivity every few days, problem resolves by re-enabling DHCP on wan interface

I'm having a weird problem with my ASA. Every few days the internet connectivity fails (f.e. cannot ping wan ip addresses from the ASA). Problem resolves by forcibly rebinding the DHCP by no ip ...
The amateur programmer's user avatar
1 vote
1 answer
130 views

ASA5555-X vlans through port channel not working

I'm havin a problem with my ASA when trying to pass vlans through port channel to a switch. The goal being here that all vlans that we have would go through a single port channel (4 1Gb links for load ...
The amateur programmer's user avatar
0 votes
1 answer
109 views

ASA cannot get traffic to pass port forward

I'm not able to get port forwarding to work for some reason on my asa 5555-x. I have tried the below config: ! object network SERVER host 192.168.1.20 ! object service SERVICE_TCP_9982 service tcp ...
The amateur programmer's user avatar
0 votes
0 answers
42 views

Need assistance with Cisco Firepower 5516X: Excluding a single IP from a specific Snort rule

I'm currently managing a Cisco Firepower 5516X device and have encountered a false positive for a specific Snort rule. Instead of disabling the rule for all traffic, I would like to selectively ...
Hsn Sah's user avatar
0 votes
0 answers
40 views

2 Cisco ASA Firewalls - TCP SYN FLOOD

Problem We have 2 firewalls, a DMZ firewall and another firewall named FW1 in a testlab. Both are CISCO ASAs. The shared services and jumphost are behind the FW1 firewall. The 172.28.208.0/24 subnets ...
Kal's user avatar
  • 1
0 votes
1 answer
112 views

Testing for 10G throughput

I'm currently facing a throughput limitation in my small core network setup, and I'm seeking advice on how to optimize it for higher speeds. Here's the current setup: Equipment: Two small core setups, ...
CyberNun71's user avatar
0 votes
2 answers
174 views

Cisco 5510 between-interface traffic

Let me try rewriting the problem description and see if it helps... My Cisco 5510 is currently running with the out-of-the-box default access rules I'm running the ASA's DHCP server to assign ...
keshlam's user avatar
0 votes
1 answer
247 views

Changing Cisco Anyconnect client GUI Text and messages

I tried changing from Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Customization/Localization > GUI Text and Message and also from language localisation.. I ...
Rokaiya Siddika Orni's user avatar
0 votes
1 answer
267 views

DH groups support for isakmp policy

When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
Blake's user avatar
  • 57
0 votes
1 answer
165 views

DMZ cannot send traffic to INSIDE (Cisco ASA 5505)

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this: int vlan 3 no forward interface vlan 1 nameif dmz ...
Penguin's user avatar
  • 27
0 votes
1 answer
149 views

If asa Cli gets too long, it automatically gets omitted as "$". Is there no way to stop this?

When saving logs in our environment, it is inconvenient to have a CLI omitted as $, so as the title suggests, I would like to prevent $ from being omitted when entering CLI or marking it, is it ...
Myung Seok Kang's user avatar
2 votes
2 answers
547 views

Cisco ASA5505/6 - public key authentication does not work with OpenSSH client

I have been unsuccessful at getting public key authentication to work per Cisco Systems on any of our ASA5505 or ASA5506 routers. Despite my best research and efforts, I still get challenged for a ...
Frobozz's user avatar
  • 171
0 votes
0 answers
29 views

Cisco Firewall 5512 NAT cause IP randomly mapping to the host

I have an ASA 5512 firewall that has configured with 2 public IP addresses. I use static nat to explosive https service and use PAT to allow my DMZ web server to access the Internet. The CLI are shown ...
kswen's user avatar
  • 1
1 vote
2 answers
360 views

ansible addition operation of content from stdout of each hosts

I'm trying to get a VPN count from asa firewall. I'm using show vpn-sessiondb summary | i *vpn name and store the result in a file. I have 5 hosts, each host will return a string like below. and I'll ...
Eniyan's user avatar
  • 13
0 votes
1 answer
456 views

configure logging of access successful & failures locally on ASA

Is it possible to configure log-in/access logging (success & fail) locally on ASA? If it's possible how? If it's not then should I use asdm or TACACS?
Myung Seok Kang's user avatar
1 vote
1 answer
543 views

Cisco ASA not accepting external traffic without NAT configuration

First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing. My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
adrianlzt's user avatar
  • 121
1 vote
1 answer
50 views

IPS Registering to FMC over VPN

help please. I have two sites linked by VPN with ASA 5525-X. In Site A we have management network (172.16.30.0/28) where we have management IP of ASA 5525-X IPS (172.16.30.14) and IPS (172.16.30.13). ...
Papa Seck's user avatar
0 votes
1 answer
748 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
Chris Holt's user avatar
2 votes
1 answer
609 views

Port forwarding on Cisco ASA 5506X using ADSM

What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX. So when i configure by referring other video and articles and only change ...
Alvin's user avatar
  • 23
2 votes
1 answer
798 views

Cisco ASA_Anyconnect clients bandwidth

I just start managing Cisco ASA and this is my first time working with AnyConnect clients, I would like to ask how can i verify the AnyConnect client bandwidth for each user, are we able to limit each ...
RR Cisco's user avatar
2 votes
1 answer
195 views

Multi-Home BGP on ASA 5500

We have an ASA that has been doing iBGP for hosted networks. These networks include public address spaces that are routed inside our networks. Recently we have changed providers. The new provider does ...
Gump's user avatar
  • 41
2 votes
1 answer
339 views

When in Cisco ASA multiple context mode, does each context have a startup and running config?

When in Cisco ASA multiple context mode, does each context have a startup and running config? After running show context, I would like to understand if I need to run show run and show start, when ...
Lizard's user avatar
  • 23
1 vote
0 answers
36 views

ASAv VM version

Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version. ...
RR Cisco's user avatar
1 vote
0 answers
117 views

asa vlan subinterface over s2s ipsec tunnel to IOS router

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router. i have the static NAT set up to go from the (wifimain,...
ptabs's user avatar
  • 11
0 votes
1 answer
114 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
Ruslan's user avatar
  • 155
0 votes
1 answer
154 views

Cisco ASDM Remote Code Execution VULN

Our Cisco ASA Devices (ASA 5515 Security Plus) have been flagged for CVE-2021-1585 bug with high priority. I could not yet find any sources to resolve this issue. Anyone here know how to fix? The CVE ...
John's user avatar
  • 13
1 vote
0 answers
95 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
DavidM's user avatar
  • 171
4 votes
0 answers
509 views

SSH to ASA on Exit Side Of VPN Tunnel

I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram). HQ-PC2 - 192.168.10.21 HQ-FW1 eth0 - 192.168.20.2 (outside) HQ-FW1 eth1 - 192.168.10.2 (inside) Branch-...
DavidM's user avatar
  • 171
4 votes
2 answers
386 views

TACACS+ AAA over L2L VPN

I have a practice network set up with the relevant topography shown in the below image: I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
DavidM's user avatar
  • 171
2 votes
0 answers
296 views

Problem with BGP aggregate-address behavior in IOS when a large number of OSPF routes update all at once

We have a Direct Connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
Appleoddity's user avatar
1 vote
1 answer
794 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
DavidM's user avatar
  • 171
3 votes
1 answer
659 views

Cisco ASA Clientless SSL VPN Apply Tunnel Group

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access) My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
DavidM's user avatar
  • 171
2 votes
1 answer
560 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
DavidM's user avatar
  • 171
1 vote
0 answers
111 views

Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]

Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet. In the logs of our Cisco ASA 5506, i see that the public ...
TechEng's user avatar
  • 21
1 vote
1 answer
494 views

Cisco ASA syslog messages, reversed source and destination for outbound communication?

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
mfloris's user avatar
  • 195
1 vote
1 answer
457 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
Rajan's user avatar
  • 121
0 votes
1 answer
2k views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
Rajan's user avatar
  • 121
3 votes
1 answer
358 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
Alic Antunez Cruz's user avatar

1
2 3 4 5
14