Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
2
votes
2answers
108 views

TACACS+ AAA over L2L VPN

I have a practice network set up with the relevant topography shown in the below image: I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
2
votes
0answers
14 views

Problem with bgp aggregate-address behavior in iOS when a large number of OSPF routes update all at once

We have a direct connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
0
votes
1answer
49 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
2
votes
1answer
44 views

Cisco ASA Clientless SSL VPN Apply Tunnel Group

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access) My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
1
vote
1answer
38 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
1
vote
0answers
29 views

Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]

Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet. In the logs of our Cisco ASA 5506, i see that the public ...
1
vote
1answer
67 views

Cisco ASA syslog messages, reversed source and destination for outbound communication?

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
0
votes
1answer
29 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
0
votes
1answer
47 views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
2
votes
1answer
41 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
0
votes
1answer
64 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0
votes
0answers
29 views

Error accessing Cisco ASA using ASDM

I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment. SHOW RUN =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
0
votes
0answers
17 views

Unable to access Cisco ASA using ASDM [duplicate]

I encounter an error message when attempting to access a Cisco ASA in a test environment. =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:07:17 =~=~=~=~=~=~=~=~=~=~=~= show ver Cisco Adaptive ...
4
votes
1answer
228 views

Cisco IOS -> ASA VTI tunnel not routing traffic

I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
1
vote
1answer
27 views

Cisco ASA nat from inside to outside, but network that is routed to inside interface

So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface? #object network remote_ip_subnet #subnet 192.168.1.0 ...
2
votes
2answers
144 views

Are there any differences in features between Cisco ASA hardware appliance and Cisco ASAv appliance

We are planning to replace our existing hardware firewall with new virtual one. The feature that we require from the virtual firewall is as below: HTTPS decryption and logging IPS/IDS Gateway ...
1
vote
0answers
20 views

DATA & VOICE VLAN ROUTING BETWEEN 2 ROUTERS [closed]

Good Afternoon All- I would appreciate a little help with a current issue I am facing... I can ping all Network Segments, all Routers, all Switches, and all Servers on the network. PROBLEM IS: I CAN'T ...
0
votes
2answers
74 views

Concurrent site-to-site VPN tunnels through dual ISPs (with 2 couples of Cisco ASA) between same devices

I currently have a simple site-to-site VPN setup, connecting machines from site 1 to site 2 through 1 ISP, using a set of ASA 5506X. All is good. I'd like to "double" that setup for ...
1
vote
0answers
369 views

Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can ...
1
vote
0answers
943 views

Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel. [PA]-----------(internet)-----------[Cisco ASA] If i ping from Cisco ASA side lan to PA ...
1
vote
1answer
127 views

VPN with Cisco virtual ASA on Azure not routing correctly

I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ...
1
vote
0answers
26 views

Does modifying a ASA tunnel create a downtime?

I inherited a cisco ASA, I never really had to manage one before. But, I need to modify an existing tunnel to add IP addresses to both the local and remote traffic selector, specifically there are ...
3
votes
1answer
135 views

Can a server on the other end of a site-to-site vpn be exposed (NATd) to a public IP on an ASA

AWS DataCenter ----------- site-to-site VPN ------------ http server <=======================> Cisco ASA public address 10.0.1.59:443 ...
0
votes
0answers
48 views

Cisco FTD DHCP option codes

I have a Cisco ASA 5515-X that is currently running ASA with the FirePOWER module, which cannot sent option code 60 in the DHCP request. My ISP requires me to send this. Does anyone have FTD 6.4 (or ...
2
votes
1answer
68 views

Setup NAT Rule for service group

We have a Cisco ASA 5515 and I am having trouble setting up the proper NAT rule to route a group of services from a public ip (which is already routing some single ports) to an internal ip. I am ...
0
votes
0answers
33 views

How to configure ZPF with Tunnel?

I am trying to configure ZPF in a Cisco 4331 router in Packet Tracer. I have a tunnel interface for GRE tunnel in this router. But I am not being able to assign this tunnel interface to any zone due ...
0
votes
2answers
125 views

Ikev2 ipsec issue between Asa and sonicwall (issue resolved) but need understanding

Really need your help Need help in understanding an issue faced when creating a tunnel between Asa and Sonicwall (Issue got resolved) still need help to understand. SonicWall: Phase 1 Ikev2 Encryption ...
2
votes
0answers
34 views

Single public IP routed to multiple internal IPs by port [closed]

We have a network setup with a Cisco ASA 5515,IPS firewall running ASA 9.8(4)29 and ASDM 7.12(2). I have several rules setup to route public ip addresses and specific ports to specific internal hosts....
0
votes
0answers
75 views

ASA ping outside to inside private ip's?

i am new asa and cisco as well , what i am trying to do to perform this lab , only 1 issue is there , i need help in it, i can ping from pc0 to router0 in other way I can ping inside to outside , but ...
0
votes
1answer
68 views

Cisco ASA 5506-X: clients periodically lose Internet access

Clients periodically lose Internet access, but I can connect to Cisco ASA and manage it. If i am ping sites, it works: Minsk# ping yandex.ru Type escape sequence to abort. Sending 5, 100-byte ICMP ...
0
votes
1answer
143 views

Cisco ASA 5516-X Wont communicate on inside interface at all. No packets

I'm configuring a brand new ASA and the Firewall refuses to communicate on my inside interface. No matter the traffic type, its denied by implicit deny every time. I was hoping to get some feedback/...
1
vote
1answer
54 views

Site to site ASA Routing question

I am doing a lab about DMVPN and Site to Site ASA integration. There is no problem in the DMVPN. However I have problem in establishing route from Site to Site ASA to DMVPN. The router on the left is ...
1
vote
0answers
224 views

Cisco ASA 5585-x Failover Virtual MAC address

I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
1
vote
0answers
32 views

Cisco ASA NSEL Template IDs 256-271: Is there a list of names and functions? [closed]

I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and ...
1
vote
0answers
33 views

Windows L2TP VPN issues when accessing Site to Site VPN on Cisco 5506

We have two Site to Site VPNs and Remote Access VPN configured. Using the builtin IPsec client on OSX all subnets are accessible however when using L2TP built in client on Windows 10 ICMP traffic ...
1
vote
2answers
187 views

Connecting an ASA behind an AT&T router/gateway

I am attempting to setup a temporary network for a company in transition that is moving into a new building. They just bought and had installed an AT&T business internet connection. They have a ...
0
votes
1answer
47 views

Much ARP requests from Cisco ASA 5510

An employee of the ISP writes to me that a lot of ARP requests from us go to them. ISP equipment log: 07:47:27.732242 ARP, Request who-has AAA.BBB.CCC.213 tell AAA.BBB.CCC.53, length 46 07:47:27....
0
votes
1answer
69 views

What is method to switch group-policy on a tunnel-group upon user login?

We have ASA units that have tunnel-groups that have a particular group-policy defined via default-group-policy statement. This initial group-policy ("NOACCESS") is one that prevents any ...
2
votes
3answers
734 views

What is the difference between an ASA firewall and UTM firewall?

How do ASA firewalls and UTM perimeter firewalls differ?
1
vote
0answers
237 views

Cisco ASA 5506: Adding two public IP's that are on the same subnet for the primary and backup interface

Im programming a Cisco ASA 5506. I need to add a primary (public) IP that is x.x.x.82/24 and a backup IP that is x.x.x.81/24. The ASA wont allow me to do this as it gives me an error: "the IP ...
0
votes
1answer
47 views

Cisco ASA: What is the best way to restrict access of nodes in the same network to each other? [closed]

There is a network with five nodes on one interface. These nodes should not be accessible to each other. An option is to use an ACL, but is there another way?
0
votes
3answers
126 views

Static NAT and PAT

I have two private IP addresses, want to make them NAT to 203.0.113.0/2 public IP address. WAY 1 : Static NAT (2 ip addresses NATted to one by manually) WAY 2 : PAT (Router gives port number ...
0
votes
3answers
112 views

Cisco ASA Port Forwarding

I am trying to set up port forwarding on my Cisco ASA security appliance. I have tried several tutorials and can not seem to get it to work. The ASA is set up behind my internet providers gateway. ...
1
vote
1answer
1k views

Cisco anyconnect VPN router specific public IP via tunnel

I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over ...
1
vote
1answer
235 views

VLAN Subinterface Removal - CISCO ASA

The below are the configuration of the subinterfaces in Cisco ASA firewall and currently sub-interface 0/1.1 is only passing traffic and I need to remove 0/1.2 configuration from here as it is unused. ...
2
votes
2answers
2k views

IKEv2 tunnel between ASA and Mikrotik

Trying to move from pfSense to Mikrotik for an office router, and the only stumbling block is maintaining a site-to-site IPSEC tunnel between it and our Cisco ASA. The settings all look correct to me, ...
0
votes
1answer
33 views

Is it possible management IP address of ASA don't move to the new active ASA when failover happen?

I created a failover configuration on two ASA5545s. I set up, for example, 10.10.10.1 on the management interface of the primary ASA and 10.10.10.2 on the secondary ASA. I know when a failoever happen,...
0
votes
0answers
919 views

Cisco ASA and missing logs to syslog server

I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1. When running the following settings I could see a lot of information in the buffer with ...
0
votes
0answers
80 views

Advanced split tunnel question

We are in a work from home state, and I am looking at optimizing VPN without sacrificing security. We are not using split tunnel. We have Direct Access on most clients - it is slow, and have moved ...
2
votes
1answer
142 views

Cisco ASA NAT/PAT Multiple WAN IPs

I'm trying to setup a NAT / PAT in ASA 5520, I'm able to do so very well when the Public IP I want translated to Internal host is configured on the Outside. Question is the ISP provided 1.1.1.1/30 ...

1
2 3 4 5
13