Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
0 votes
1 answer
22 views

Unable to configure Site to Site VPN between Cisco Router & Cisco ASA and permit SSH

I am performing configuration on Cisco ASA and Cisco Router from the packet tracer. I am attempting to allow the external network (172.16.22.100 255.255.255.0) to access the internal server which is ...
iloveearth_12345's user avatar
0 votes
1 answer
37 views

ASA 5555 loses internet connectivity every few days, problem resolves by re-enabling DHCP on wan interface

I'm having a weird problem with my ASA. Every few days the internet connectivity fails (f.e. cannot ping wan ip addresses from the ASA). Problem resolves by forcibly rebinding the DHCP by no ip ...
The amateur programmer's user avatar
1 vote
1 answer
71 views

ASA5555-X vlans through port channel not working

I'm havin a problem with my ASA when trying to pass vlans through port channel to a switch. The goal being here that all vlans that we have would go through a single port channel (4 1Gb links for load ...
The amateur programmer's user avatar
0 votes
1 answer
66 views

ASA cannot get traffic to pass port forward

I'm not able to get port forwarding to work for some reason on my asa 5555-x. I have tried the below config: ! object network SERVER host 192.168.1.20 ! object service SERVICE_TCP_9982 service tcp ...
The amateur programmer's user avatar
0 votes
0 answers
24 views

Need assistance with Cisco Firepower 5516X: Excluding a single IP from a specific Snort rule

I'm currently managing a Cisco Firepower 5516X device and have encountered a false positive for a specific Snort rule. Instead of disabling the rule for all traffic, I would like to selectively ...
Hsn Sah's user avatar
0 votes
0 answers
25 views

2 Cisco ASA Firewalls - TCP SYN FLOOD

Problem We have 2 firewalls, a DMZ firewall and another firewall named FW1 in a testlab. Both are CISCO ASAs. The shared services and jumphost are behind the FW1 firewall. The 172.28.208.0/24 subnets ...
Kal's user avatar
  • 1
0 votes
1 answer
76 views

Testing for 10G throughput

I'm currently facing a throughput limitation in my small core network setup, and I'm seeking advice on how to optimize it for higher speeds. Here's the current setup: Equipment: Two small core setups, ...
CyberNun71's user avatar
0 votes
2 answers
156 views

Cisco 5510 between-interface traffic

Let me try rewriting the problem description and see if it helps... My Cisco 5510 is currently running with the out-of-the-box default access rules I'm running the ASA's DHCP server to assign ...
keshlam's user avatar
0 votes
1 answer
105 views

Changing Cisco Anyconnect client GUI Text and messages

I tried changing from Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Customization/Localization > GUI Text and Message and also from language localisation.. I ...
Rokaiya Siddika Orni's user avatar
0 votes
1 answer
88 views

DH groups support for isakmp policy

When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
Blake's user avatar
  • 57
0 votes
1 answer
103 views

DMZ cannot send traffic to INSIDE (Cisco ASA 5505)

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this: int vlan 3 no forward interface vlan 1 nameif dmz ...
Gekko's user avatar
  • 27
0 votes
1 answer
62 views

If asa Cli gets too long, it automatically gets omitted as "$". Is there no way to stop this?

When saving logs in our environment, it is inconvenient to have a CLI omitted as $, so as the title suggests, I would like to prevent $ from being omitted when entering CLI or marking it, is it ...
Myung Seok Kang's user avatar
2 votes
2 answers
316 views

Cisco ASA5505/6 - public key authentication does not work with OpenSSH client

I have been unsuccessful at getting public key authentication to work per Cisco Systems on any of our ASA5505 or ASA5506 routers. Despite my best research and efforts, I still get challenged for a ...
Frobozz's user avatar
  • 171
0 votes
0 answers
28 views

Cisco Firewall 5512 NAT cause IP randomly mapping to the host

I have an ASA 5512 firewall that has configured with 2 public IP addresses. I use static nat to explosive https service and use PAT to allow my DMZ web server to access the Internet. The CLI are shown ...
kswen's user avatar
  • 1
1 vote
2 answers
283 views

ansible addition operation of content from stdout of each hosts

I'm trying to get a VPN count from asa firewall. I'm using show vpn-sessiondb summary | i *vpn name and store the result in a file. I have 5 hosts, each host will return a string like below. and I'll ...
Eniyan's user avatar
  • 13
0 votes
1 answer
176 views

configure logging of access successful & failures locally on ASA

Is it possible to configure log-in/access logging (success & fail) locally on ASA? If it's possible how? If it's not then should I use asdm or TACACS?
Myung Seok Kang's user avatar
1 vote
1 answer
378 views

Cisco ASA not accepting external traffic without NAT configuration

First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing. My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
adrianlzt's user avatar
  • 121
1 vote
1 answer
43 views

IPS Registering to FMC over VPN

help please. I have two sites linked by VPN with ASA 5525-X. In Site A we have management network (172.16.30.0/28) where we have management IP of ASA 5525-X IPS (172.16.30.14) and IPS (172.16.30.13). ...
Papa Seck's user avatar
0 votes
1 answer
546 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
Chris Holt's user avatar
2 votes
1 answer
519 views

Port forwarding on Cisco ASA 5506X using ADSM

What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX. So when i configure by referring other video and articles and only change ...
Alvin's user avatar
  • 23
2 votes
1 answer
601 views

Cisco ASA_Anyconnect clients bandwidth

I just start managing Cisco ASA and this is my first time working with AnyConnect clients, I would like to ask how can i verify the AnyConnect client bandwidth for each user, are we able to limit each ...
RR Cisco's user avatar
2 votes
1 answer
176 views

Multi-Home BGP on ASA 5500

We have an ASA that has been doing iBGP for hosted networks. These networks include public address spaces that are routed inside our networks. Recently we have changed providers. The new provider does ...
Gump's user avatar
  • 41
2 votes
1 answer
300 views

When in Cisco ASA multiple context mode, does each context have a startup and running config?

When in Cisco ASA multiple context mode, does each context have a startup and running config? After running show context, I would like to understand if I need to run show run and show start, when ...
Lizard's user avatar
  • 23
1 vote
0 answers
31 views

ASAv VM version

Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version. ...
RR Cisco's user avatar
1 vote
0 answers
96 views

asa vlan subinterface over s2s ipsec tunnel to IOS router

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router. i have the static NAT set up to go from the (wifimain,...
ptabs's user avatar
  • 11
0 votes
1 answer
95 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
Ruslan's user avatar
  • 155
0 votes
1 answer
127 views

Cisco ASDM Remote Code Execution VULN

Our Cisco ASA Devices (ASA 5515 Security Plus) have been flagged for CVE-2021-1585 bug with high priority. I could not yet find any sources to resolve this issue. Anyone here know how to fix? The CVE ...
John's user avatar
  • 13
1 vote
0 answers
81 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
DavidM's user avatar
  • 171
4 votes
0 answers
440 views

SSH to ASA on Exit Side Of VPN Tunnel

I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram). HQ-PC2 - 192.168.10.21 HQ-FW1 eth0 - 192.168.20.2 (outside) HQ-FW1 eth1 - 192.168.10.2 (inside) Branch-...
DavidM's user avatar
  • 171
4 votes
2 answers
297 views

TACACS+ AAA over L2L VPN

I have a practice network set up with the relevant topography shown in the below image: I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
DavidM's user avatar
  • 171
2 votes
0 answers
238 views

Problem with BGP aggregate-address behavior in IOS when a large number of OSPF routes update all at once

We have a Direct Connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
Appleoddity's user avatar
1 vote
1 answer
661 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
DavidM's user avatar
  • 171
3 votes
1 answer
429 views

Cisco ASA Clientless SSL VPN Apply Tunnel Group

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access) My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
DavidM's user avatar
  • 171
2 votes
1 answer
431 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
DavidM's user avatar
  • 171
1 vote
0 answers
95 views

Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]

Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet. In the logs of our Cisco ASA 5506, i see that the public ...
TechEng's user avatar
  • 21
1 vote
1 answer
409 views

Cisco ASA syslog messages, reversed source and destination for outbound communication?

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
mfloris's user avatar
  • 195
1 vote
1 answer
355 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
Rajan's user avatar
  • 121
0 votes
1 answer
1k views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
Rajan's user avatar
  • 121
3 votes
1 answer
270 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
Alic Antunez Cruz's user avatar
0 votes
2 answers
163 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
David Huang's user avatar
0 votes
2 answers
466 views

Error accessing Cisco ASA using ASDM

I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment. SHOW RUN =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
MMenefee's user avatar
4 votes
1 answer
927 views

Cisco IOS -> ASA VTI tunnel not routing traffic

I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
btongeorge's user avatar
1 vote
1 answer
317 views

Cisco ASA nat from inside to outside, but network that is routed to inside interface

So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface? #object network remote_ip_subnet #subnet 192.168.1.0 ...
John's user avatar
  • 812
2 votes
2 answers
810 views

Are there any differences in features between Cisco ASA hardware appliance and Cisco ASAv appliance

We are planning to replace our existing hardware firewall with new virtual one. The feature that we require from the virtual firewall is as below: HTTPS decryption and logging IPS/IDS Gateway ...
IT researcher's user avatar
1 vote
0 answers
67 views

DATA & VOICE VLAN ROUTING BETWEEN 2 ROUTERS [closed]

Good Afternoon All- I would appreciate a little help with a current issue I am facing... I can ping all Network Segments, all Routers, all Switches, and all Servers on the network. PROBLEM IS: I CAN'T ...
NetAdmin's user avatar
0 votes
2 answers
267 views

Concurrent site-to-site VPN tunnels through dual ISPs (with 2 couples of Cisco ASA) between same devices

I currently have a simple site-to-site VPN setup, connecting machines from site 1 to site 2 through 1 ISP, using a set of ASA 5506X. All is good. I'd like to "double" that setup for ...
Bastien's user avatar
  • 103
1 vote
0 answers
2k views

Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can ...
Vladimir Fomin's user avatar
1 vote
0 answers
6k views

Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel. [PA]-----------(internet)-----------[Cisco ASA] If i ping from Cisco ASA side lan to PA ...
Satish's user avatar
  • 4,371
1 vote
1 answer
674 views

VPN with Cisco virtual ASA on Azure not routing correctly

I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ...
public wireless's user avatar
1 vote
0 answers
36 views

Does modifying a ASA tunnel create a downtime?

I inherited a cisco ASA, I never really had to manage one before. But, I need to modify an existing tunnel to add IP addresses to both the local and remote traffic selector, specifically there are ...
person's user avatar
  • 111

1
2 3 4 5
14