Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

3
votes
1answer
26 views

Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)

So I have given a task to add 1000s of DAP policies after main DAP file crashed and backup is not available due to unfortunate reasons. There is predefined way of doing it through ASDM which is very ...
2
votes
1answer
57 views

Unable to use HTTPS Managment “API” on Cisco ASA 9.12

After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools. Example curl that is functional in prior code (9.8 ...
3
votes
1answer
52 views

Meraki in Passthrough mode behind ASA

I am having trouble getting bidirectional traffic through a Meraki box behind a ASA 5508-X. I can see requests from the client VPN going from a client device to a server on our LAN, the server ...
2
votes
1answer
41 views

Cisco ASA rekeying

Good day I was hoping someone has seen this before, I have a ASA5520 that has a l2l tunnel to a Palo Alto firewall. Every 2 mins the the logs I see a rekey I have check our configuration and we have ...
3
votes
0answers
36 views

Cisco ASA 5525-X Input Current

In switches, like Cisco Catalyst 2960X-24TS-L, datasheet mention input power: 100 to 240 VAC, 1A to 0.5A. So, I assume input current = 1A@100VAC and 0.5A@240VAC or Cisco Catalyst 3850 + Power Supply ...
1
vote
0answers
45 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
0
votes
0answers
22 views

Anyconnect Cisco 5505 VPN Group cannot Access Inside Network

Below is the Configuration to my Cisco ASA. I can connect to VPN but then trapped and cannot enter the inside network. ASA Version 9.2(4)27 ! hostname AwBTech-ASA domain-name awbtech enable password ...
3
votes
1answer
57 views

Cisco ASA 5508x, VLANs can't communicate

We're in the middle of moving to a more secure system, and the first step is to add this security appliance. Currently in place are two small quasi home-grade Cisco routers (rv260W and rv130). This ...
4
votes
2answers
140 views

Cisco ASA 5585X Internal-Data0/1 interface errors

I have noticed on Cisco ASA 5585 (SSP-20) interface error counter going up specially overrun but so far we haven't seen any production impact or issue, error rate is low so its not noticable but would ...
2
votes
1answer
42 views

Cisco ASA 5505- My subnet mask is different from Show Route

While I was troubleshooting a DNS issue on my 10.10.10.0/30 subnet, I noticed the Local (L) and Connected (C) has different values. I configured the 10.10.10.0 network to use 255.255.255.252 has the ...
3
votes
1answer
31 views

ASA 5505 cant access inside network from Anyconnect SSL Connection

So I have a ASA I can connect via SSL perfectly fine receiving internet.My issue is that I cannot ping any device on the network especially the inside network on my router. My topology is a ASA 5505 - ...
1
vote
0answers
29 views

Cisco ASA: Windows DHCP doesn't bind IP address after failover change active [closed]

Equipment and soft: Two Cisco ASA 5540, ASA ver. 9.1(7)32, active/standby failover DHCP server: Windows server 2016 Anyconnect VPN clients get IP addresses from DHCP servers. Everything works ...
3
votes
1answer
65 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
1
vote
1answer
126 views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
1
vote
1answer
55 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
0
votes
0answers
39 views

Cisco ASA L2TP remote-access VPN with addresses assigned by DHCP

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP. The Cisco Client policy has end-users fetch their ...
2
votes
1answer
34 views

How do I find out which NAT is getting hit?

I can see in packet captures that my packet's destination IP is getting translated. How do I find which NAT statement is responsible for the conversion if my device has over 200 NAT rules? I'm using ...
0
votes
0answers
54 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
0
votes
1answer
57 views

ASA access-list to object group

I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain? access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16....
0
votes
1answer
23 views

Issue with Connectivity Over Next Hop Gateway (ASA) to Point to Point

I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. ...
2
votes
1answer
30 views

Subinterface on Cisco ASA 5550 does not work with VLAN on HP ProCurve

I created subinterface on Cisco ASA 5550 (ver. 9.7.1): interface GigabitEthernet1/2.810 vlan 810 nameif dmz810 security-level 50 ip address 172.29.12.33 255.255.255.248 And VLAN 810 on HP ...
1
vote
0answers
24 views

Why can I not see the default gateway when connecting to ASA through AnyConnect?

I've configured an ASA as an AnyConnect server. The IP address pool that'll be assigned to the connecting hosts is from 192.168.10.1-192.168.10.10. Now when I establish a remote access connection to ...
5
votes
1answer
277 views

Cannot get port-forward working on ASA 5505: “Drop-reason: (acl-drop) Flow is denied by configured rule”

Months ago I made this post here on NE, but I still for the life of me just cannot figure our port-forwarding on my ASA 5505. I have since started over and am now trying the DMZ port instead, but ...
1
vote
1answer
103 views

How to view/backup the 'ASA' config from a Firepower device?

We have some Cisco Firepower firewalls which we administer and generally in the past for ASA's we will review the config files locally on our machine, simply because it's easier than viewing it via a ...
0
votes
0answers
41 views

Why can't I ping to the outside interface of my ASA

Below is the output of packet tracer. I have simulated a ping packet from 10.106.51.203 to 10.106.51.200. 'mgmt' is supposed to be the outside interface. Also, why is output-interface in the result ...
3
votes
1answer
73 views

General issues with access to and from DMZ on Cisco ASA 5520

I just got my software upgraded from v8.2(x) to v.9.1(7), but I have some general issues with access to and from my DMZ: No internet access from DMZ No access to web or mail server from outside to ...
3
votes
1answer
177 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
2
votes
1answer
86 views

Restrict VTY SSH access to only MGMT VLAN and loopback

For the sake of the fact that i'm not allowed to share actual configuration, every posted config below is made up or altered. We have more than 250 locations spread over our country. All locations ...
0
votes
0answers
165 views

Creating an overlay network using ASA and VXLAN over IP MPLS

I need to extend an existing VLAN from a branch LAN to DC. As a matter of fact I noticed that Cisco ASA 5500X have VXLAN capabilities. I am relatively new to VXLAN and I need some help to find the ...
2
votes
1answer
62 views

No access to mail server in DMZ [closed]

I have an Cisco asa 5520 8.2(1) firewall that I can't get to give me access to my mail server in DMZ. Here's my configuration: Object groups object-group network WEB_SERVERS network-object host 172....
3
votes
1answer
46 views

ASA Denying PAT'd IP

ASA keeps denying TCP to PAT'd DMZ IP. Could someone have a look at this, i have mostly been using ASDM. same-security-traffic permit intra-interface object network expressway-e host 192.168.5....
5
votes
0answers
284 views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
2
votes
1answer
110 views

Cisco ASA Dial in VPN access Devices on Site-to-Site VPN

Questions 1) What do I need to run to get this to allow the on-site to talk to the dial-in network clients E.G ping from 10.101.1.7 to 10.101.2.1? 2) What do I need to run to get the dial-in network ...
2
votes
1answer
235 views

Urgent: how to configure different interface using same ip subnet in asa 5506?

Scenario is in old asa firewall 5505 I have switch port access vlan command in different interface. Just like below: interface Ethernet0/0 ! interface Ethernet0/1 switchport access vlan 2 ! ...
0
votes
1answer
28 views

Cisco ASA 5506 log collection after power cycle

Today we had to power cycle our Cisco ASA 5506 , since I could not connect to it through any of the connected interfaces. How can I get the logs to see what failed or what was the state of the ASA ...
3
votes
3answers
439 views

Cisco ASA logging to remote syslog question

I have Cisco ASA and i have setup graylog logging server and i am seeing no logs coming on remote syslog so this is what i did.. Current config: asa-fw1-010101-2-7/pri/act(config)# show run logging ...
1
vote
1answer
89 views

Can not access PC(inside) from router(outside) through ASA 5512

I have a serious concern that I can not solve. Thank you for helping me. I have a network with a configuration ASA 5512 (Inside, outside, DMZ) that works well. Now I would like to use the graphical ...
3
votes
1answer
212 views

DHCP OFFER not reaching client through several routers and ASA [closed]

So recently we received notification from one of our remote branches that certain PCs were unable to connect to the internet. We determined that DHCP was the cause. The basic L3 path between the ...
1
vote
2answers
76 views

ASA5520 to 2960X setup

I am setting up a new remote office setup with an ASA5520 to a Cisco 2960X switch. I subinterfaced the the ASA inside to allow the Wired and Wireless subnets. On the 2960 I created a Vlan 100 for the ...
1
vote
1answer
63 views

Cisco anyconnect 4.6 client disable some security feature

Last 3 year we are using cisco anyconnect with client version 4.5 and everything is good but recently i have install client 4.6 which has tons of additional feature which i am not interested and want ...
1
vote
1answer
243 views

Cisco ASA site to site with Forcepoint stonesoft NGFW

I am try to establish a site to site VPN between Cisco ASA and Forcepoint Stonesoft NGFW, i have support that assured everything is set up correct from Forcepoint NGFW side but i have trouble from ...
2
votes
1answer
1k views

Just can't get ASDM to run

I've spent two weekends googling and trying every suggestion I can find, but still, when I try to connect to my ASA, the launcher accepts my credentials, the "updating software" bar goes to 20%, and ...
2
votes
1answer
127 views

Missing crypto options on Cisco 5540 firewall?

ASA 5540 VPN Premium license. Version 9.1(7) asa01(config)# crypto key generate rsa label sslvpnkey ^ ...
1
vote
1answer
337 views

Can ping default gateway, but no internet

I have a Cisco ASA 5506-X with following configuration: ! interface GigabitEthernet1/1 nameif outside security-level 0 ip address *.*.114.179 255.255.255.240 ! interface GigabitEthernet1/2 ...
2
votes
1answer
658 views

Port-forwarding rule on Cisco ASA not working - “Drop-reason: (acl-drop) Flow is denied by configured rule”

New to Cisco, so I hope this question isn't too noobish. I am trying to setup a port-forwarding rule to allow "any" SSL traffic in from "Outside" to the web server on my LAN. The problem is apparently ...
1
vote
1answer
134 views

ASDM access broken on Cisco ASA 5505 - NAT rule gone wrong

I was trying to setup NAT and Access Rules and apparently did something very wrong because now I cannot get into ASDM at all. I've tried multiple machines and all of them time out. Also the landing ...
0
votes
1answer
42 views

Access an ASA via MGMT port

I'm working on an ASA 5520. I have given the MGMT port an IP address, I can ping it ... I have given it the name REMOTE nameif REMOTE and access level 100 ... Then I allowed HTTP server http ...
3
votes
1answer
775 views

Cisco ASA5516 9.8(2) IKEv2 negotiation aborted due unsupported failover version

I have a site to site connection from the ASA to an Azure subscription. The site to site session starts up fine, but after a few minutes (from 3 to 25) the connection fails. If on ASDM I open ...
3
votes
1answer
416 views

ASA5516 9.8(2) IKEv2 (no BGP) site to site connection with Azure fails

I have a Azure subscription, with a virtual network where the gateway subnet is 172.26.0.0/27, and then I have a number of subnets, e.g. 172.26.1.0/24, 172.26.2.0/24, 172.26.3.0/24, .... On the ...
1
vote
0answers
134 views

Cisco ASA 5512 one download blocks all others until download finishes [closed]

My company has a 50 Mbps Down/Up connection. I just migrated from a PIX 515E to an ASA 5512. Previously, one user could download a large file from the internet and block all other users from accessing ...