Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Need assistance with Cisco Firepower 5516X: Excluding a single IP from a specific Snort rule

I'm currently managing a Cisco Firepower 5516X device and have encountered a false positive for a specific Snort rule. Instead of disabling the rule for all traffic, I would like to selectively ...
Hsn Sah's user avatar
0 votes
0 answers
22 views

2 Cisco ASA Firewalls - TCP SYN FLOOD

Problem We have 2 firewalls, a DMZ firewall and another firewall named FW1 in a testlab. Both are CISCO ASAs. The shared services and jumphost are behind the FW1 firewall. The 172.28.208.0/24 subnets ...
Kal's user avatar
  • 1
0 votes
1 answer
59 views

Testing for 10G throughput

I'm currently facing a throughput limitation in my small core network setup, and I'm seeking advice on how to optimize it for higher speeds. Here's the current setup: Equipment: Two small core setups, ...
CyberNun71's user avatar
0 votes
2 answers
150 views

Cisco 5510 between-interface traffic

Let me try rewriting the problem description and see if it helps... My Cisco 5510 is currently running with the out-of-the-box default access rules I'm running the ASA's DHCP server to assign ...
keshlam's user avatar
0 votes
1 answer
56 views

Changing Cisco Anyconnect client GUI Text and messages

I tried changing from Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Customization/Localization > GUI Text and Message and also from language localisation.. I ...
Rokaiya Siddika Orni's user avatar
0 votes
1 answer
51 views

DH groups support for isakmp policy

When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
Blake's user avatar
  • 57
0 votes
1 answer
55 views

DMZ cannot send traffic to INSIDE (Cisco ASA 5505)

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this: int vlan 3 no forward interface vlan 1 nameif dmz ...
Gekko's user avatar
  • 27
0 votes
1 answer
40 views

If asa Cli gets too long, it automatically gets omitted as "$". Is there no way to stop this?

When saving logs in our environment, it is inconvenient to have a CLI omitted as $, so as the title suggests, I would like to prevent $ from being omitted when entering CLI or marking it, is it ...
Myung Seok Kang's user avatar
2 votes
2 answers
250 views

Cisco ASA5505/6 - public key authentication does not work with OpenSSH client

I have been unsuccessful at getting public key authentication to work per Cisco Systems on any of our ASA5505 or ASA5506 routers. Despite my best research and efforts, I still get challenged for a ...
Frobozz's user avatar
  • 161
0 votes
0 answers
28 views

Cisco Firewall 5512 NAT cause IP randomly mapping to the host

I have an ASA 5512 firewall that has configured with 2 public IP addresses. I use static nat to explosive https service and use PAT to allow my DMZ web server to access the Internet. The CLI are shown ...
kswen's user avatar
  • 1
1 vote
2 answers
242 views

ansible addition operation of content from stdout of each hosts

I'm trying to get a VPN count from asa firewall. I'm using show vpn-sessiondb summary | i *vpn name and store the result in a file. I have 5 hosts, each host will return a string like below. and I'll ...
Eniyan's user avatar
  • 13
0 votes
1 answer
147 views

configure logging of access successful & failures locally on ASA

Is it possible to configure log-in/access logging (success & fail) locally on ASA? If it's possible how? If it's not then should I use asdm or TACACS?
Myung Seok Kang's user avatar
1 vote
1 answer
307 views

Cisco ASA not accepting external traffic without NAT configuration

First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing. My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
adrianlzt's user avatar
  • 121
1 vote
1 answer
40 views

IPS Registering to FMC over VPN

help please. I have two sites linked by VPN with ASA 5525-X. In Site A we have management network (172.16.30.0/28) where we have management IP of ASA 5525-X IPS (172.16.30.14) and IPS (172.16.30.13). ...
Papa Seck's user avatar
0 votes
1 answer
482 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
Chris Holt's user avatar
2 votes
1 answer
477 views

Port forwarding on Cisco ASA 5506X using ADSM

What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX. So when i configure by referring other video and articles and only change ...
Alvin's user avatar
  • 23
2 votes
1 answer
526 views

Cisco ASA_Anyconnect clients bandwidth

I just start managing Cisco ASA and this is my first time working with AnyConnect clients, I would like to ask how can i verify the AnyConnect client bandwidth for each user, are we able to limit each ...
RR Cisco's user avatar
2 votes
1 answer
172 views

Multi-Home BGP on ASA 5500

We have an ASA that has been doing iBGP for hosted networks. These networks include public address spaces that are routed inside our networks. Recently we have changed providers. The new provider does ...
Gump's user avatar
  • 41
2 votes
1 answer
286 views

When in Cisco ASA multiple context mode, does each context have a startup and running config?

When in Cisco ASA multiple context mode, does each context have a startup and running config? After running show context, I would like to understand if I need to run show run and show start, when ...
Lizard's user avatar
  • 23
1 vote
0 answers
31 views

ASAv VM version

Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version. ...
RR Cisco's user avatar
1 vote
0 answers
85 views

asa vlan subinterface over s2s ipsec tunnel to IOS router

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router. i have the static NAT set up to go from the (wifimain,...
ptabs's user avatar
  • 11
0 votes
1 answer
88 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
Ruslan's user avatar
  • 155
0 votes
1 answer
117 views

Cisco ASDM Remote Code Execution VULN

Our Cisco ASA Devices (ASA 5515 Security Plus) have been flagged for CVE-2021-1585 bug with high priority. I could not yet find any sources to resolve this issue. Anyone here know how to fix? The CVE ...
John's user avatar
  • 13
1 vote
0 answers
79 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
DavidM's user avatar
  • 171
4 votes
0 answers
403 views

SSH to ASA on Exit Side Of VPN Tunnel

I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram). HQ-PC2 - 192.168.10.21 HQ-FW1 eth0 - 192.168.20.2 (outside) HQ-FW1 eth1 - 192.168.10.2 (inside) Branch-...
DavidM's user avatar
  • 171
4 votes
2 answers
274 views

TACACS+ AAA over L2L VPN

I have a practice network set up with the relevant topography shown in the below image: I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
DavidM's user avatar
  • 171
2 votes
0 answers
206 views

Problem with BGP aggregate-address behavior in IOS when a large number of OSPF routes update all at once

We have a Direct Connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
Appleoddity's user avatar
1 vote
1 answer
602 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
DavidM's user avatar
  • 171
3 votes
1 answer
365 views

Cisco ASA Clientless SSL VPN Apply Tunnel Group

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access) My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
DavidM's user avatar
  • 171
2 votes
1 answer
392 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
DavidM's user avatar
  • 171
1 vote
0 answers
88 views

Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]

Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet. In the logs of our Cisco ASA 5506, i see that the public ...
TechEng's user avatar
  • 21
1 vote
1 answer
381 views

Cisco ASA syslog messages, reversed source and destination for outbound communication?

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
mfloris's user avatar
  • 195
1 vote
1 answer
321 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
Rajan's user avatar
  • 121
0 votes
1 answer
1k views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
Rajan's user avatar
  • 121
3 votes
1 answer
239 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
Alic Antunez Cruz's user avatar
0 votes
2 answers
157 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
David Huang's user avatar
0 votes
2 answers
384 views

Error accessing Cisco ASA using ASDM

I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment. SHOW RUN =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
MMenefee's user avatar
4 votes
1 answer
872 views

Cisco IOS -> ASA VTI tunnel not routing traffic

I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
btongeorge's user avatar
1 vote
1 answer
289 views

Cisco ASA nat from inside to outside, but network that is routed to inside interface

So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface? #object network remote_ip_subnet #subnet 192.168.1.0 ...
John's user avatar
  • 812
2 votes
2 answers
730 views

Are there any differences in features between Cisco ASA hardware appliance and Cisco ASAv appliance

We are planning to replace our existing hardware firewall with new virtual one. The feature that we require from the virtual firewall is as below: HTTPS decryption and logging IPS/IDS Gateway ...
IT researcher's user avatar
1 vote
0 answers
67 views

DATA & VOICE VLAN ROUTING BETWEEN 2 ROUTERS [closed]

Good Afternoon All- I would appreciate a little help with a current issue I am facing... I can ping all Network Segments, all Routers, all Switches, and all Servers on the network. PROBLEM IS: I CAN'T ...
NetAdmin's user avatar
0 votes
2 answers
245 views

Concurrent site-to-site VPN tunnels through dual ISPs (with 2 couples of Cisco ASA) between same devices

I currently have a simple site-to-site VPN setup, connecting machines from site 1 to site 2 through 1 ISP, using a set of ASA 5506X. All is good. I'd like to "double" that setup for ...
Bastien's user avatar
  • 103
1 vote
0 answers
2k views

Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can ...
Vladimir Fomin's user avatar
1 vote
0 answers
5k views

Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel. [PA]-----------(internet)-----------[Cisco ASA] If i ping from Cisco ASA side lan to PA ...
Satish's user avatar
  • 4,361
1 vote
1 answer
606 views

VPN with Cisco virtual ASA on Azure not routing correctly

I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ...
public wireless's user avatar
1 vote
0 answers
34 views

Does modifying a ASA tunnel create a downtime?

I inherited a cisco ASA, I never really had to manage one before. But, I need to modify an existing tunnel to add IP addresses to both the local and remote traffic selector, specifically there are ...
person's user avatar
  • 111
3 votes
1 answer
248 views

Can a server on the other end of a site-to-site vpn be exposed (NATd) to a public IP on an ASA

AWS DataCenter ----------- site-to-site VPN ------------ http server <=======================> Cisco ASA public address 10.0.1.59:443 ...
Chris Holt's user avatar
2 votes
1 answer
238 views

Setup NAT Rule for service group

We have a Cisco ASA 5515 and I am having trouble setting up the proper NAT rule to route a group of services from a public ip (which is already routing some single ports) to an internal ip. I am ...
Jerry Welliver's user avatar
1 vote
2 answers
561 views

Ikev2 ipsec issue between Asa and sonicwall (issue resolved) but need understanding

Really need your help Need help in understanding an issue faced when creating a tunnel between Asa and Sonicwall (Issue got resolved) still need help to understand. SonicWall: Phase 1 Ikev2 Encryption ...
Sajesh Achari's user avatar
2 votes
0 answers
90 views

Single public IP routed to multiple internal IPs by port [closed]

We have a network setup with a Cisco ASA 5515,IPS firewall running ASA 9.8(4)29 and ASDM 7.12(2). I have several rules setup to route public ip addresses and specific ports to specific internal hosts....
Jerry Welliver's user avatar

1
2 3 4 5
14