Questions tagged [cisco-asa]
Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines
658
questions
0
votes
1
answer
22
views
Unable to configure Site to Site VPN between Cisco Router & Cisco ASA and permit SSH
I am performing configuration on Cisco ASA and Cisco Router from the packet tracer. I am attempting to allow the external network (172.16.22.100 255.255.255.0) to access the internal server which is ...
0
votes
1
answer
37
views
ASA 5555 loses internet connectivity every few days, problem resolves by re-enabling DHCP on wan interface
I'm having a weird problem with my ASA. Every few days the internet connectivity fails (f.e. cannot ping wan ip addresses from the ASA). Problem resolves by forcibly rebinding the DHCP by no ip ...
1
vote
1
answer
71
views
ASA5555-X vlans through port channel not working
I'm havin a problem with my ASA when trying to pass vlans through port channel to a switch. The goal being here that all vlans that we have would go through a single port channel (4 1Gb links for load ...
0
votes
1
answer
66
views
ASA cannot get traffic to pass port forward
I'm not able to get port forwarding to work for some reason on my asa 5555-x.
I have tried the below config:
!
object network SERVER
host 192.168.1.20
!
object service SERVICE_TCP_9982
service tcp ...
0
votes
0
answers
24
views
Need assistance with Cisco Firepower 5516X: Excluding a single IP from a specific Snort rule
I'm currently managing a Cisco Firepower 5516X device and have encountered a false positive for a specific Snort rule. Instead of disabling the rule for all traffic, I would like to selectively ...
- 1
0
votes
0
answers
25
views
2 Cisco ASA Firewalls - TCP SYN FLOOD
Problem
We have 2 firewalls, a DMZ firewall and another firewall named FW1 in a testlab. Both are CISCO ASAs. The shared services and jumphost are behind the FW1 firewall. The 172.28.208.0/24 subnets ...
- 1
0
votes
1
answer
76
views
Testing for 10G throughput
I'm currently facing a throughput limitation in my small core network setup, and I'm seeking advice on how to optimize it for higher speeds. Here's the current setup:
Equipment:
Two small core setups, ...
0
votes
2
answers
156
views
Cisco 5510 between-interface traffic
Let me try rewriting the problem description and see if it helps...
My Cisco 5510 is currently running with the out-of-the-box default access rules
I'm running the ASA's DHCP server to assign ...
- 1
0
votes
1
answer
105
views
Changing Cisco Anyconnect client GUI Text and messages
I tried changing from Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Customization/Localization > GUI Text and Message and also from language localisation..
I ...
0
votes
1
answer
88
views
DH groups support for isakmp policy
When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
- 57
0
votes
1
answer
103
views
DMZ cannot send traffic to INSIDE (Cisco ASA 5505)
Have a nice day, everyone.
I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this:
int vlan 3
no forward interface vlan 1
nameif dmz
...
- 27
0
votes
1
answer
62
views
If asa Cli gets too long, it automatically gets omitted as "$". Is there no way to stop this?
When saving logs in our environment, it is inconvenient to have a CLI omitted as $, so as the title suggests, I would like to prevent $ from being omitted when entering CLI or marking it, is it ...
2
votes
2
answers
316
views
Cisco ASA5505/6 - public key authentication does not work with OpenSSH client
I have been unsuccessful at getting public key authentication to work per Cisco Systems on any of our ASA5505 or ASA5506 routers. Despite my best research and efforts, I still get challenged for a ...
- 171
0
votes
0
answers
28
views
Cisco Firewall 5512 NAT cause IP randomly mapping to the host
I have an ASA 5512 firewall that has configured with 2 public IP addresses.
I use static nat to explosive https service and use PAT to allow my DMZ web server to access the Internet. The CLI are shown ...
- 1
1
vote
2
answers
283
views
ansible addition operation of content from stdout of each hosts
I'm trying to get a VPN count from asa firewall. I'm using
show vpn-sessiondb summary | i *vpn name
and store the result in a file. I have 5 hosts, each host will return a string like below. and I'll ...
- 13
0
votes
1
answer
176
views
configure logging of access successful & failures locally on ASA
Is it possible to configure log-in/access logging (success & fail) locally on ASA?
If it's possible how?
If it's not then should I use asdm or TACACS?
1
vote
1
answer
378
views
Cisco ASA not accepting external traffic without NAT configuration
First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing.
My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
- 121
1
vote
1
answer
43
views
IPS Registering to FMC over VPN
help please.
I have two sites linked by VPN with ASA 5525-X. In Site A we have management network (172.16.30.0/28) where we have management IP of ASA 5525-X IPS (172.16.30.14) and IPS (172.16.30.13). ...
- 11
0
votes
1
answer
546
views
Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes
My end of the tunnel is on an ASAv in AWS. (version 9.14)
show crypto isakmp sa
4 IKE Peer: 212.239.x.y
Type : L2L Role : responder
Rekey : no State : ...
- 213
2
votes
1
answer
519
views
Port forwarding on Cisco ASA 5506X using ADSM
What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX.
So when i configure by referring other video and articles and only change ...
- 23
2
votes
1
answer
601
views
Cisco ASA_Anyconnect clients bandwidth
I just start managing Cisco ASA and this is my first time working with AnyConnect clients, I would like to ask how can i verify the AnyConnect client bandwidth for each user, are we able to limit each ...
- 99
2
votes
1
answer
176
views
Multi-Home BGP on ASA 5500
We have an ASA that has been doing iBGP for hosted networks. These networks include public address spaces that are routed inside our networks.
Recently we have changed providers. The new provider does ...
- 41
2
votes
1
answer
300
views
When in Cisco ASA multiple context mode, does each context have a startup and running config?
When in Cisco ASA multiple context mode, does each context have a startup and running config? After running show context, I would like to understand if I need to run show run and show start, when ...
- 23
1
vote
0
answers
31
views
ASAv VM version
Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version.
...
- 99
1
vote
0
answers
96
views
asa vlan subinterface over s2s ipsec tunnel to IOS router
I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router.
i have the static NAT set up to go from the (wifimain,...
- 11
0
votes
1
answer
95
views
Switching Internet connection on Cisco ASA
I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
- 155
0
votes
1
answer
127
views
Cisco ASDM Remote Code Execution VULN
Our Cisco ASA Devices (ASA 5515 Security Plus)
have been flagged for CVE-2021-1585 bug with high priority. I could not yet find any sources to resolve this issue.
Anyone here know how to fix?
The CVE ...
- 13
1
vote
0
answers
81
views
TACACS Through ASA L2L Tunnel
Hello see below network diagram.
I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
- 171
4
votes
0
answers
440
views
SSH to ASA on Exit Side Of VPN Tunnel
I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram).
HQ-PC2 - 192.168.10.21
HQ-FW1 eth0 - 192.168.20.2 (outside)
HQ-FW1 eth1 - 192.168.10.2 (inside)
Branch-...
- 171
4
votes
2
answers
297
views
TACACS+ AAA over L2L VPN
I have a practice network set up with the relevant topography shown in the below image:
I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
- 171
2
votes
0
answers
238
views
Problem with BGP aggregate-address behavior in IOS when a large number of OSPF routes update all at once
We have a Direct Connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06.
I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
- 123
1
vote
1
answer
661
views
Access TACACS+ Server through ASA
I am trying to set up TACACS+ for a project. The below image shows the layout of the network.
So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
- 171
3
votes
1
answer
429
views
Cisco ASA Clientless SSL VPN Apply Tunnel Group
I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access)
My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
- 171
2
votes
1
answer
431
views
Cisco ASA Clientless SSL VPN Restrict Network Access
I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services.
I have set up a simple clientless SSL VPN which ...
- 171
1
vote
0
answers
95
views
Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]
Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet.
In the logs of our Cisco ASA 5506, i see that the public ...
- 21
1
vote
1
answer
409
views
Cisco ASA syslog messages, reversed source and destination for outbound communication?
I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
- 195
1
vote
1
answer
355
views
NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?
Toplogy:
Tool Used: Cisco Packet Tracer
Scenario:
NAT for hosts in any of the VLANs of Layer3-Switch not working.
Ping requests reaches outside server, but NAT is not working so ISP
Router can't ...
- 121
0
votes
1
answer
1k
views
How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]
Topology:
How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network?
In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
- 121
3
votes
1
answer
270
views
Which command is used in Cisco ASA Firewall to display the whole packet flow?
Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
0
votes
2
answers
163
views
Cisco ASA access-lists and net config
Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0
votes
2
answers
466
views
Error accessing Cisco ASA using ASDM
I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment.
SHOW RUN
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
- 1
4
votes
1
answer
927
views
Cisco IOS -> ASA VTI tunnel not routing traffic
I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
- 193
1
vote
1
answer
317
views
Cisco ASA nat from inside to outside, but network that is routed to inside interface
So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface?
#object network remote_ip_subnet
#subnet 192.168.1.0 ...
- 812
2
votes
2
answers
810
views
Are there any differences in features between Cisco ASA hardware appliance and Cisco ASAv appliance
We are planning to replace our existing hardware firewall with new virtual one.
The feature that we require from the virtual firewall is as below:
HTTPS decryption and logging
IPS/IDS
Gateway ...
- 133
1
vote
0
answers
67
views
DATA & VOICE VLAN ROUTING BETWEEN 2 ROUTERS [closed]
Good Afternoon All-
I would appreciate a little help with a current issue I am facing...
I can ping all Network Segments, all Routers, all Switches, and all Servers on the network.
PROBLEM IS: I CAN'T ...
- 11
0
votes
2
answers
267
views
Concurrent site-to-site VPN tunnels through dual ISPs (with 2 couples of Cisco ASA) between same devices
I currently have a simple site-to-site VPN setup, connecting machines from site 1 to site 2 through 1 ISP, using a set of ASA 5506X. All is good.
I'd like to "double" that setup for ...
- 103
1
vote
0
answers
2k
views
Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]
I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL.
Can ...
- 255
1
vote
0
answers
6k
views
Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]
I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel.
[PA]-----------(internet)-----------[Cisco ASA]
If i ping from Cisco ASA side lan to PA ...
- 4,371
1
vote
1
answer
674
views
VPN with Cisco virtual ASA on Azure not routing correctly
I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ...
- 111
1
vote
0
answers
36
views
Does modifying a ASA tunnel create a downtime?
I inherited a cisco ASA, I never really had to manage one before. But, I need to modify an existing tunnel to add IP addresses to both the local and remote traffic selector, specifically there are ...
- 111