Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
1
vote
1answer
24 views

Cisco 5505 ASA firewall Ipsec vpn- Can connect two outside different public ip to two different local subnets

I only get one IPSEC vpn connection up but not the other. Link to access configs on Google: https://drive.google.com/open?id=1yB_yIWvJ51A0UeNbkAEiTH9YMIEipqy_ profile1- outside interface - 66.x.x.x ...
0
votes
1answer
50 views

Cisco ASA and a Router?

I'm trying to understand networking and when looking at the different routers, firewalls and switches, I came across Cisco ASA. I've read that these can be used as firewalls and routers but others say ...
2
votes
3answers
208 views

Cisco ASA 5512X does not allow connections across VLANs to internet

First time doing a network, I'm a software guy normally. I am setting up a network to share and internet connections to multiple properties. The goal is to segment each property onto its own VLAN. I ...
2
votes
1answer
39 views

Can I set the AnyConnect group policy from users source IP?

Is it possible to configure a Group Policy to be used based on the source IP of the AnyConnect user? I want users connecting from a specific location (IP address) to get a specific Group policy. ...
1
vote
1answer
50 views

DNS expire-entry-timer has negative affect on ASA using FQDN ACL

I have a Cisco ASA using FQDN egress ACLs for a host that changes IP addresses every 10 mins (Apple APNS IP address pool). As soon as the TTL expires for the addresses, my internal server requests a ...
1
vote
1answer
40 views

Arpping responding with Cisco ASA interface mac address and mac address of machine

For some reason our Cisco is responding to arp requests between machines on the same switch. It's not breaking anything but it is slowing initial connections. I've been making a lot of changes on the ...
0
votes
2answers
59 views

Cisco ASA IKE Receiver: Runt ISAKMP packet discarded on Port 500

I have lots of ikev1 tunnel running on our production Cisco ASA5585 and today i have configured ikev2 tunnel for one of our new customer and i have started seeing following error, and not sure what is ...
0
votes
0answers
15 views

Cisco ASA Security Warning: Untrusted server cert after asa crash and reload

We have Cisco ASA 5505 working VPN anyconnect and it's been almost 1 year no issue, but last week it got crashed and reboot itself and after that we found it started throwing warning like following: ...
1
vote
1answer
49 views

Cisco ASA looping broadcast packet

I have small office where running cisco ASA ASA5506 and version 9.4(1) and it's also configured for IPsec VPN tunnel, My LAN subnet is 10.1.1.0/24 So i have found very interesting things in LAN ...
1
vote
0answers
48 views

Static PAT using Cisco ASA 5506 in cisco packet tracer [closed]

ciscoasa(config)#interface GigabitEthernet 1/3 ciscoasa(config-if)#nameif inside1 INFO: Security level for "inside1" set to 0 by default. ciscoasa(config-if)#security-level 100 ciscoasa(config-if)#no ...
1
vote
1answer
101 views

delete object network in cisco ASA with packet tracert

I used 5506 as firewall and I am trying to delete object network I created and it gives error as ERROR: unable to delete the object configuration. object (inside-net-obj) is being used. commands I ...
0
votes
1answer
39 views

ASA ISP limit of ISP Speed

I've got configured ASA with two ISP. First is main ISP and second for backup. Is possible to set on conf of ASA if the speed of main ISP will be at low bandwith, ASA will active a backup ISP?
4
votes
0answers
76 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
1
vote
1answer
78 views

Which interfaces do I need to configure to change MTU of Cisco Site-to-Site VPN

I have a number of Site-to-Site VPN tunnels in my network configurations. They are configured using Cisco ASA devices. To resolve some performance issues I am trying to change the MTU for traffic ...
1
vote
1answer
125 views

Cisco ASA failover monitor-interface policy

I have Cisco ASA 5585 and it has 10G interface in port channel where i configured multiple vlan sub-interface, is it worth to monitor every single sub-interface for failover policy or just monitor ...
1
vote
1answer
150 views

Cisco ASA 5506: The switching between the two providers by using Route-Map, creation backup channel

We have two providers. I want to make the second provider a backup channel. This configuration is most often offered: object network internal-pat-primary_obj nat (inside,outside1) dynamic interface ...
1
vote
0answers
97 views

Unable to Initiate a VPN tunnel using IKEv2

I'm having an issue with a VPN tuunel between my Firewall (ASA 5516-X) and a third party firewall so I can't check the config in the second firewall. So I decide to debug my firewall and I realized ...
3
votes
2answers
401 views

Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)

So I have given a task to add 1000s of DAP policies after main DAP file crashed and backup is not available due to unfortunate reasons. There is predefined way of doing it through ASDM which is very ...
2
votes
1answer
248 views

Unable to use HTTPS Managment “API” on Cisco ASA 9.12

After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools. Example curl that is functional in prior code (9.8 ...
3
votes
1answer
140 views

Meraki in Passthrough mode behind ASA

I am having trouble getting bidirectional traffic through a Meraki box behind a ASA 5508-X. I can see requests from the client VPN going from a client device to a server on our LAN, the server ...
2
votes
1answer
63 views

Cisco ASA rekeying

Good day I was hoping someone has seen this before, I have a ASA5520 that has a l2l tunnel to a Palo Alto firewall. Every 2 mins the the logs I see a rekey I have check our configuration and we have ...
3
votes
0answers
48 views

Cisco ASA 5525-X Input Current

In switches, like Cisco Catalyst 2960X-24TS-L, datasheet mention input power: 100 to 240 VAC, 1A to 0.5A. So, I assume input current = 1A@100VAC and 0.5A@240VAC or Cisco Catalyst 3850 + Power Supply ...
2
votes
1answer
244 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
0
votes
0answers
27 views

Anyconnect Cisco 5505 VPN Group cannot Access Inside Network

Below is the Configuration to my Cisco ASA. I can connect to VPN but then trapped and cannot enter the inside network. ASA Version 9.2(4)27 ! hostname AwBTech-ASA domain-name awbtech enable password ...
3
votes
1answer
129 views

Cisco ASA 5508x, VLANs can't communicate

We're in the middle of moving to a more secure system, and the first step is to add this security appliance. Currently in place are two small quasi home-grade Cisco routers (rv260W and rv130). This ...
4
votes
2answers
460 views

Cisco ASA 5585X Internal-Data0/1 interface errors

I have noticed on Cisco ASA 5585 (SSP-20) interface error counter going up specially overrun but so far we haven't seen any production impact or issue, error rate is low so its not noticable but would ...
2
votes
1answer
63 views

Cisco ASA 5505- My subnet mask is different from Show Route

While I was troubleshooting a DNS issue on my 10.10.10.0/30 subnet, I noticed the Local (L) and Connected (C) has different values. I configured the 10.10.10.0 network to use 255.255.255.252 has the ...
3
votes
1answer
52 views

ASA 5505 cant access inside network from Anyconnect SSL Connection

So I have a ASA I can connect via SSL perfectly fine receiving internet.My issue is that I cannot ping any device on the network especially the inside network on my router. My topology is a ASA 5505 - ...
1
vote
0answers
96 views

Cisco ASA: Windows DHCP doesn't bind IP address after failover change active [closed]

Equipment and soft: Two Cisco ASA 5540, ASA ver. 9.1(7)32, active/standby failover DHCP server: Windows server 2016 Anyconnect VPN clients get IP addresses from DHCP servers. Everything works ...
3
votes
1answer
107 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
1
vote
1answer
491 views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
1
vote
1answer
126 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
1
vote
0answers
143 views

Cisco ASA L2TP remote-access VPN with addresses assigned by DHCP

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP. The Cisco Client policy has end-users fetch their ...
2
votes
1answer
39 views

How do I find out which NAT is getting hit?

I can see in packet captures that my packet's destination IP is getting translated. How do I find which NAT statement is responsible for the conversion if my device has over 200 NAT rules? I'm using ...
0
votes
0answers
61 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
1
vote
1answer
158 views

ASA access-list to object group

I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain? access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16....
0
votes
1answer
24 views

Issue with Connectivity Over Next Hop Gateway (ASA) to Point to Point

I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. ...
2
votes
1answer
46 views

Subinterface on Cisco ASA 5550 does not work with VLAN on HP ProCurve

I created subinterface on Cisco ASA 5550 (ver. 9.7.1): interface GigabitEthernet1/2.810 vlan 810 nameif dmz810 security-level 50 ip address 172.29.12.33 255.255.255.248 And VLAN 810 on HP ...
1
vote
0answers
37 views

Why can I not see the default gateway when connecting to ASA through AnyConnect?

I've configured an ASA as an AnyConnect server. The IP address pool that'll be assigned to the connecting hosts is from 192.168.10.1-192.168.10.10. Now when I establish a remote access connection to ...
5
votes
1answer
541 views

Cannot get port-forward working on ASA 5505: “Drop-reason: (acl-drop) Flow is denied by configured rule”

Months ago I made this post here on NE, but I still for the life of me just cannot figure our port-forwarding on my ASA 5505. I have since started over and am now trying the DMZ port instead, but ...
1
vote
1answer
361 views

How to view/backup the 'ASA' config from a Firepower device?

We have some Cisco Firepower firewalls which we administer and generally in the past for ASA's we will review the config files locally on our machine, simply because it's easier than viewing it via a ...
0
votes
0answers
129 views

Why can't I ping to the outside interface of my ASA

Below is the output of packet tracer. I have simulated a ping packet from 10.106.51.203 to 10.106.51.200. 'mgmt' is supposed to be the outside interface. Also, why is output-interface in the result ...
4
votes
1answer
136 views

General issues with access to and from DMZ on Cisco ASA 5520

I just got my software upgraded from v8.2(x) to v.9.1(7), but I have some general issues with access to and from my DMZ: No internet access from DMZ No access to web or mail server from outside to ...
3
votes
1answer
240 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
2
votes
1answer
223 views

Restrict VTY SSH access to only MGMT VLAN and loopback

For the sake of the fact that i'm not allowed to share actual configuration, every posted config below is made up or altered. We have more than 250 locations spread over our country. All locations ...
0
votes
0answers
338 views

Creating an overlay network using ASA and VXLAN over IP MPLS

I need to extend an existing VLAN from a branch LAN to DC. As a matter of fact I noticed that Cisco ASA 5500X have VXLAN capabilities. I am relatively new to VXLAN and I need some help to find the ...
3
votes
1answer
86 views

ASA Denying PAT'd IP

ASA keeps denying TCP to PAT'd DMZ IP. Could someone have a look at this, i have mostly been using ASDM. same-security-traffic permit intra-interface object network expressway-e host 192.168.5....
5
votes
1answer
556 views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
2
votes
1answer
215 views

Cisco ASA Dial in VPN access Devices on Site-to-Site VPN

Questions 1) What do I need to run to get this to allow the on-site to talk to the dial-in network clients E.G ping from 10.101.1.7 to 10.101.2.1? 2) What do I need to run to get the dial-in network ...
2
votes
1answer
398 views

Urgent: how to configure different interface using same ip subnet in asa 5506?

Scenario is in old asa firewall 5505 I have switch port access vlan command in different interface. Just like below: interface Ethernet0/0 ! interface Ethernet0/1 switchport access vlan 2 ! ...