Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
0 votes
1 answer
35 views

Cisco ASA L2TP/IPsec split-tunnel not working for public Internet

I'm testing a setup using ASA to provide VPN over L2TP/IPSec PSK to support native IPSec clients such as iOS, Android, MacOS, Windows, etc. The issue I'm running into is that when connected, the split-...
640KB's user avatar
  • 101
0 votes
1 answer
36 views

ASDM 7.20 doesn't work with script that works with ASDM 7.13

I have a script I wrote for Linux that enables me to use ASDM with Oracle Java 8. One version I know for sure works is 7.13.1 on an ASA 5516, but when I try the same script with 7.20.1 on an FPR 2110 ...
elyograg's user avatar
  • 101
0 votes
0 answers
54 views

Cisco ASA OCSP configuration

Can anyone help me understand how to configure OCSP on my Cisco ASA? I have AnyConnect Over IKEv2 to ASA with AAA and Certificate Authentication. As RootCA server I have OpenSSL. Now I want to ...
John's user avatar
  • 812
0 votes
2 answers
79 views

arp permit-nonconnected Not Working

I have a ASA 5506-X version 9.8(2). The ASA has two interfaces: g1/1 (outside, ip: 209.165.0.2/30), and g1/3 (inside, ip: 209.165.0.5/30). g1/1 is connected to a 881-W router (Router-A), whose ip is ...
user1046658's user avatar
1 vote
0 answers
28 views

Issue with Cisco ASA IPSec VPN clients can't access DMZ network

I have one ASA that is configured for IPSec VPN Cisco client. The VPN allow access to inside network, but trying to get it to my DMZ is a problem. My VPN address pool is defined as 124.140.1.x /24. My ...
Steve's user avatar
  • 11
2 votes
1 answer
70 views

Does Cisco ASA support encrypted logging

Background I am approaching this from a SIEM or Log Collection point of view. Our corporation is thinking about making encrypted logging mandatory Question Cisco ASA default appears to me to be send ...
user3223819's user avatar
0 votes
0 answers
16 views

Cisco ASA 5525x can't limit speed?

There was a need to limit the speed for users on Cisco ASA 5525x but for some reason these commands are simply not available for me: Example: HQFW(config)# access-list POLICE_TRAFFIC_TO_BRANCH permit ...
Глеб Щеголев's user avatar
0 votes
1 answer
137 views

Troubleshooting ipsec ikev2 site to site vpn

I assume, for peer IP we use, is the wan interface of the Cisco ASA and not the gateway of the ISP correct? Also, all routes should go to the same IP of the wan interface correct? So we have two Cisco ...
user1378803's user avatar
0 votes
1 answer
35 views

Unable to configure Site to Site VPN between Cisco Router & Cisco ASA and permit SSH

I am performing configuration on Cisco ASA and Cisco Router from the packet tracer. I am attempting to allow the external network (172.16.22.100 255.255.255.0) to access the internal server which is ...
iloveearth_12345's user avatar
0 votes
1 answer
54 views

ASA 5555 loses internet connectivity every few days, problem resolves by re-enabling DHCP on wan interface

I'm having a weird problem with my ASA. Every few days the internet connectivity fails (f.e. cannot ping wan ip addresses from the ASA). Problem resolves by forcibly rebinding the DHCP by no ip ...
The amateur programmer's user avatar
1 vote
1 answer
104 views

ASA5555-X vlans through port channel not working

I'm havin a problem with my ASA when trying to pass vlans through port channel to a switch. The goal being here that all vlans that we have would go through a single port channel (4 1Gb links for load ...
The amateur programmer's user avatar
0 votes
1 answer
91 views

ASA cannot get traffic to pass port forward

I'm not able to get port forwarding to work for some reason on my asa 5555-x. I have tried the below config: ! object network SERVER host 192.168.1.20 ! object service SERVICE_TCP_9982 service tcp ...
The amateur programmer's user avatar
0 votes
0 answers
38 views

Need assistance with Cisco Firepower 5516X: Excluding a single IP from a specific Snort rule

I'm currently managing a Cisco Firepower 5516X device and have encountered a false positive for a specific Snort rule. Instead of disabling the rule for all traffic, I would like to selectively ...
Hsn Sah's user avatar
0 votes
0 answers
38 views

2 Cisco ASA Firewalls - TCP SYN FLOOD

Problem We have 2 firewalls, a DMZ firewall and another firewall named FW1 in a testlab. Both are CISCO ASAs. The shared services and jumphost are behind the FW1 firewall. The 172.28.208.0/24 subnets ...
Kal's user avatar
  • 1
0 votes
1 answer
103 views

Testing for 10G throughput

I'm currently facing a throughput limitation in my small core network setup, and I'm seeking advice on how to optimize it for higher speeds. Here's the current setup: Equipment: Two small core setups, ...
CyberNun71's user avatar
0 votes
2 answers
165 views

Cisco 5510 between-interface traffic

Let me try rewriting the problem description and see if it helps... My Cisco 5510 is currently running with the out-of-the-box default access rules I'm running the ASA's DHCP server to assign ...
keshlam's user avatar
0 votes
1 answer
199 views

Changing Cisco Anyconnect client GUI Text and messages

I tried changing from Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Customization/Localization > GUI Text and Message and also from language localisation.. I ...
Rokaiya Siddika Orni's user avatar
0 votes
1 answer
194 views

DH groups support for isakmp policy

When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
Blake's user avatar
  • 57
0 votes
1 answer
140 views

DMZ cannot send traffic to INSIDE (Cisco ASA 5505)

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this: int vlan 3 no forward interface vlan 1 nameif dmz ...
Gekko's user avatar
  • 27
0 votes
1 answer
107 views

If asa Cli gets too long, it automatically gets omitted as "$". Is there no way to stop this?

When saving logs in our environment, it is inconvenient to have a CLI omitted as $, so as the title suggests, I would like to prevent $ from being omitted when entering CLI or marking it, is it ...
Myung Seok Kang's user avatar
2 votes
2 answers
462 views

Cisco ASA5505/6 - public key authentication does not work with OpenSSH client

I have been unsuccessful at getting public key authentication to work per Cisco Systems on any of our ASA5505 or ASA5506 routers. Despite my best research and efforts, I still get challenged for a ...
Frobozz's user avatar
  • 171
0 votes
0 answers
29 views

Cisco Firewall 5512 NAT cause IP randomly mapping to the host

I have an ASA 5512 firewall that has configured with 2 public IP addresses. I use static nat to explosive https service and use PAT to allow my DMZ web server to access the Internet. The CLI are shown ...
kswen's user avatar
  • 1
1 vote
2 answers
338 views

ansible addition operation of content from stdout of each hosts

I'm trying to get a VPN count from asa firewall. I'm using show vpn-sessiondb summary | i *vpn name and store the result in a file. I have 5 hosts, each host will return a string like below. and I'll ...
Eniyan's user avatar
  • 13
0 votes
1 answer
309 views

configure logging of access successful & failures locally on ASA

Is it possible to configure log-in/access logging (success & fail) locally on ASA? If it's possible how? If it's not then should I use asdm or TACACS?
Myung Seok Kang's user avatar
1 vote
1 answer
470 views

Cisco ASA not accepting external traffic without NAT configuration

First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing. My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
adrianlzt's user avatar
  • 121
1 vote
1 answer
49 views

IPS Registering to FMC over VPN

help please. I have two sites linked by VPN with ASA 5525-X. In Site A we have management network (172.16.30.0/28) where we have management IP of ASA 5525-X IPS (172.16.30.14) and IPS (172.16.30.13). ...
Papa Seck's user avatar
0 votes
1 answer
660 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
Chris Holt's user avatar
2 votes
1 answer
571 views

Port forwarding on Cisco ASA 5506X using ADSM

What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX. So when i configure by referring other video and articles and only change ...
Alvin's user avatar
  • 23
2 votes
1 answer
741 views

Cisco ASA_Anyconnect clients bandwidth

I just start managing Cisco ASA and this is my first time working with AnyConnect clients, I would like to ask how can i verify the AnyConnect client bandwidth for each user, are we able to limit each ...
RR Cisco's user avatar
2 votes
1 answer
185 views

Multi-Home BGP on ASA 5500

We have an ASA that has been doing iBGP for hosted networks. These networks include public address spaces that are routed inside our networks. Recently we have changed providers. The new provider does ...
Gump's user avatar
  • 41
2 votes
1 answer
320 views

When in Cisco ASA multiple context mode, does each context have a startup and running config?

When in Cisco ASA multiple context mode, does each context have a startup and running config? After running show context, I would like to understand if I need to run show run and show start, when ...
Lizard's user avatar
  • 23
1 vote
0 answers
34 views

ASAv VM version

Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version. ...
RR Cisco's user avatar
1 vote
0 answers
109 views

asa vlan subinterface over s2s ipsec tunnel to IOS router

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router. i have the static NAT set up to go from the (wifimain,...
ptabs's user avatar
  • 11
0 votes
1 answer
112 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
Ruslan's user avatar
  • 155
0 votes
1 answer
142 views

Cisco ASDM Remote Code Execution VULN

Our Cisco ASA Devices (ASA 5515 Security Plus) have been flagged for CVE-2021-1585 bug with high priority. I could not yet find any sources to resolve this issue. Anyone here know how to fix? The CVE ...
John's user avatar
  • 13
1 vote
0 answers
91 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
DavidM's user avatar
  • 171
4 votes
0 answers
496 views

SSH to ASA on Exit Side Of VPN Tunnel

I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram). HQ-PC2 - 192.168.10.21 HQ-FW1 eth0 - 192.168.20.2 (outside) HQ-FW1 eth1 - 192.168.10.2 (inside) Branch-...
DavidM's user avatar
  • 171
4 votes
2 answers
358 views

TACACS+ AAA over L2L VPN

I have a practice network set up with the relevant topography shown in the below image: I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
DavidM's user avatar
  • 171
2 votes
0 answers
277 views

Problem with BGP aggregate-address behavior in IOS when a large number of OSPF routes update all at once

We have a Direct Connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
Appleoddity's user avatar
1 vote
1 answer
743 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
DavidM's user avatar
  • 171
3 votes
1 answer
553 views

Cisco ASA Clientless SSL VPN Apply Tunnel Group

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access) My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
DavidM's user avatar
  • 171
2 votes
1 answer
518 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
DavidM's user avatar
  • 171
1 vote
0 answers
103 views

Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]

Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet. In the logs of our Cisco ASA 5506, i see that the public ...
TechEng's user avatar
  • 21
1 vote
1 answer
464 views

Cisco ASA syslog messages, reversed source and destination for outbound communication?

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
mfloris's user avatar
  • 195
1 vote
1 answer
431 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
Rajan's user avatar
  • 121
0 votes
1 answer
1k views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
Rajan's user avatar
  • 121
3 votes
1 answer
332 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
Alic Antunez Cruz's user avatar
0 votes
2 answers
173 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
David Huang's user avatar
0 votes
2 answers
615 views

Error accessing Cisco ASA using ASDM

I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment. SHOW RUN =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
MMenefee's user avatar
4 votes
1 answer
1k views

Cisco IOS -> ASA VTI tunnel not routing traffic

I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
btongeorge's user avatar

1
2 3 4 5
14