Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
-1
votes
0answers
13 views

Cisco ASA Routing Issue with load balancing [closed]

Existing config no issues have 40 sites already adding 1 more site Any help any command you need run just ask I'm kind of screwed here. Load balancer when traffic is passed to the load balancer for ...
3
votes
3answers
924 views

can a cisco ASA be configured as a DHCP server for a VLAN on a subinterface? and route packets between VLANs?

We are in the process of planning to phase out a Sonicwall tz205 in our office. i am hoping to replace it with a CISCO ASA 5516 specifically. We have three networks in house the main production ...
0
votes
0answers
11 views

Ikev2 ipsec issue between Asa and sonicwall (issue resolved) but need understanding

Really need your help Need help in understanding an issue faced when creating a tunnel between Asa and Sonicwall (Issue got resolved) still need help to understand. SonicWall: Phase 1 Ikev2 Encryption ...
0
votes
1answer
36 views

Cisco ASA 5516-X Wont communicate on inside interface at all. No packets

I'm configuring a brand new ASA and the Firewall refuses to communicate on my inside interface. No matter the traffic type, its denied by implicit deny every time. I was hoping to get some feedback/...
2
votes
2answers
127 views

connecting two ISPs to my network

Hi My network has the following resources: 3 ASA-5505 w/site-to-site VPN's newly acquired c801F-K9 router Exchange Server 3 ISP's (soon to be 2) A t-1, DSL, Satellite. VOIP Cisco Cme My goal is to ...
2
votes
3answers
2k views

How can I find which natted private IP address is communicating on Cisco ASA 5508

Normally we are facing abnormal traffic targeting specific servers. My question is How can I know which private IP address is targeted since we are using Dynamic NAT on Cisco ASA 5508 Firewall? ...
2
votes
0answers
29 views

Single public IP routed to multiple internal IPs by port [closed]

We have a network setup with a Cisco ASA 5515,IPS firewall running ASA 9.8(4)29 and ASDM 7.12(2). I have several rules setup to route public ip addresses and specific ports to specific internal hosts....
0
votes
2answers
184 views

Cisco ASA and a Router?

I'm trying to understand networking and when looking at the different routers, firewalls and switches, I came across Cisco ASA which many use for firewall and routing abilities, so if you use an ASA ...
2
votes
4answers
6k views

Subinterfaces on ASA5506-X doesn't communicate with the switch or computer

We are upgrading from ASA5505 to ASA5506-X, but unlike the ASA5505, the new firewall ASA5506-X doesn't have switch ports and does not support vlans on physical interfaces. So, I'm creating vlans on ...
2
votes
2answers
558 views

Options for setting up a DMZ and internal network with an ASA 5505 and a single switch

This is an attempt to clarify my original post which was too long. My task is to add a DMZ to our network. Currently, the internal network is connected to one ASA interface. I have been able to set ...
0
votes
0answers
20 views

ASA ping outside to inside private ip's?

i am new asa and cisco as well , what i am trying to do to perform this lab , only 1 issue is there , i need help in it, i can ping from pc0 to router0 in other way I can ping inside to outside , but ...
1
vote
2answers
2k views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
2
votes
2answers
2k views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
0
votes
0answers
46 views

Users after login are redirected to the ASA AnyConnect download page rather than connecting to the VPN

Several users after logging in are redirected to the ASA AnyConnect download section instead of connecting to the VPN. We try to log in via Web or AnyConnect application by using SAML Identity ...
1
vote
1answer
192 views

Arpping responding with Cisco ASA interface mac address and mac address of machine

For some reason our Cisco is responding to arp requests between machines on the same switch. It's not breaking anything but it is slowing initial connections. I've been making a lot of changes on the ...
0
votes
1answer
31 views

Cisco ASA 5506-X: clients periodically lose Internet access

Clients periodically lose Internet access, but I can connect to Cisco ASA and manage it. If i am ping sites, it works: Minsk# ping yandex.ru Type escape sequence to abort. Sending 5, 100-byte ICMP ...
14
votes
4answers
12k views

How do you block bit torrent traffic with a Cisco ASA?

I have referenced an old external Cisco article on how to block Bit torrent traffic referenced on-line Here This procedure I have found only works 50% of the time. I find blocking bit torrent ...
2
votes
2answers
880 views

IKEv2 tunnel between ASA and Mikrotik

Trying to move from pfSense to Mikrotik for an office router, and the only stumbling block is maintaining a site-to-site IPSEC tunnel between it and our Cisco ASA. The settings all look correct to me, ...
1
vote
1answer
36 views

Site to site ASA Routing question

I am doing a lab about DMVPN and Site to Site ASA integration. There is no problem in the DMVPN. However I have problem in establishing route from Site to Site ASA to DMVPN. The router on the left is ...
5
votes
2answers
8k views

Why do I get a timeout when I connect via ssh to a Cisco ASA, even though management and ACLs are configured?

I set up a Cisco ASA 5505 8.4(3), and specified ssh version 2 enabled ssh access to the WAN interface via ssh <my network> <mask> <WAN interface> allowed ssh from my network via an ...
1
vote
0answers
65 views

Cisco ASA 5585-x Failover Virtual MAC address

I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
1
vote
0answers
21 views

Windows L2TP VPN issues when accessing Site to Site VPN on Cisco 5506

We have two Site to Site VPNs and Remote Access VPN configured. Using the builtin IPsec client on OSX all subnets are accessible however when using L2TP built in client on Windows 10 ICMP traffic ...
1
vote
0answers
21 views

Cisco ASA NSEL Template IDs 256-271: Is there a list of names and functions? [closed]

I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and ...
1
vote
2answers
53 views

Connecting an ASA behind an AT&T router/gateway

I am attempting to setup a temporary network for a company in transition that is moving into a new building. They just bought and had installed an AT&T business internet connection. They have a ...
2
votes
3answers
413 views

What is the difference between an ASA firewall and UTM firewall?

How do ASA firewalls and UTM perimeter firewalls differ?
0
votes
1answer
31 views

What is method to switch group-policy on a tunnel-group upon user login?

We have ASA units that have tunnel-groups that have a particular group-policy defined via default-group-policy statement. This initial group-policy ("NOACCESS") is one that prevents any ...
0
votes
1answer
37 views

Much ARP requests from Cisco ASA 5510

An employee of the ISP writes to me that a lot of ARP requests from us go to them. ISP equipment log: 07:47:27.732242 ARP, Request who-has AAA.BBB.CCC.213 tell AAA.BBB.CCC.53, length 46 07:47:27....
0
votes
0answers
18 views

Site to Site VPN between Cisco ASA and Aruba Virtual Gateway

We have hosted an Aruba Virtual Gateway on AWS. All the configurations are done as per the documentation of Aruba VPNC. Through AWS security policies, UDP 4500 is open on AWS side. We want to ...
7
votes
4answers
11k views

TCP Handshake fails on Cisco ASA

I am using a Traffic Generator for setting up a TCP connection that should pass a Cisco ASA firewall. My topology looks like this: +------------------+ ...
2
votes
2answers
17k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
1
vote
0answers
88 views

Cisco ASA 5506: Adding two public IP's that are on the same subnet for the primary and backup interface

Im programming a Cisco ASA 5506. I need to add a primary (public) IP that is x.x.x.82/24 and a backup IP that is x.x.x.81/24. The ASA wont allow me to do this as it gives me an error: "the IP ...
1
vote
3answers
77 views

Static NAT and PAT

I have two private IP addresses, want to make them NAT to 203.0.113.0/2 public IP address. WAY 1 : Static NAT (2 ip addresses NATted to one by manually) WAY 2 : PAT (Router gives port number ...
4
votes
1answer
2k views

2-stacked switches with 2 uplinks to each ASA

My current single uplink from 2-stacked switches to ASA is not enough to cater the link utilization (upload traffic from the 2-stacked switches to ASA). So, I have thought of using 2 uplinks. If I use ...
1
vote
1answer
2k views

Ping LAN via Anyconnect VPN

I'm trying to configure the VPN on a Cisco ASA 5510. I can connect to it without any problem and I can ping my switch (172.16.1.2/24) but I can't ping the gateway (172.16.1.1/24) nor the Google public ...
3
votes
2answers
3k views

Manage Cisco ASA Firepower ASDM

Cisco recently made available Firepower management via ASDM along with Firesight VM. I am using ASDM to manage and I am unable to see "Create new policy" under Configuration->Asa Firepower ...
0
votes
1answer
28 views

Cisco ASA: What is the best way to restrict access of nodes in the same network to each other? [closed]

There is a network with five nodes on one interface. These nodes should not be accessible to each other. An option is to use an ACL, but is there another way?
4
votes
0answers
965 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
6
votes
3answers
2k views

Block usage of proxy server

I am network administrator in a small company. Until recently i used the Cisco ASA to prevent the employees from surfing facebook, youtube... But now they are using proxy server to overcome this. Any ...
0
votes
3answers
58 views

Cisco ASA Port Forwarding

I am trying to set up port forwarding on my Cisco ASA security appliance. I have tried several tutorials and can not seem to get it to work. The ASA is set up behind my internet providers gateway. ...
2
votes
1answer
409 views

Cisco anyconnect VPN router specific public IP via tunnel

I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over ...
1
vote
1answer
81 views

VLAN Subinterface Removal - CISCO ASA

The below are the configuration of the subinterfaces in Cisco ASA firewall and currently sub-interface 0/1.1 is only passing traffic and I need to remove 0/1.2 configuration from here as it is unused. ...
1
vote
1answer
52 views

Port Forwarding on Cisco ASA 5510

I have an EDI server behind a Cisco ASA 5510 version 8.2(1). Currently our EDI server sends over documents to our trading partners and they will look for our URL in this format http://1.1.1.1:1000. ...
0
votes
1answer
172 views

IKEV2 between ASA and Router problem

I am trying to configure a ikev2 vpn between asa and router using tunnel interface. I have encountered the problem of it not even establishing the connection. There is no problem in the connectivity ...
4
votes
0answers
78 views

Customising Cisco Clientless VPN Password Change Screen ASA5525

I'm working with one of the network engineers to customise our login screens for the Cisco clientless VPN, which, apart form time consuming, has been fine (knowledge gap on both of our parts). As part ...
0
votes
0answers
26 views

How can I get a CRL automatically on cisco ASA? Do I have to configure OCSP?

I need to get a CRL on cisco ASA without requesting a crl manually. Do I have to configure OSCP, or is there anything else to get a crl automatically?
0
votes
1answer
28 views

Is it possible management IP address of ASA don't move to the new active ASA when failover happen?

I created a failover configuration on two ASA5545s. I set up, for example, 10.10.10.1 on the management interface of the primary ASA and 10.10.10.2 on the secondary ASA. I know when a failoever happen,...
0
votes
0answers
432 views

Cisco ASA and missing logs to syslog server

I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1. When running the following settings I could see a lot of information in the buffer with ...
0
votes
0answers
57 views

Advanced split tunnel question

We are in a work from home state, and I am looking at optimizing VPN without sacrificing security. We are not using split tunnel. We have Direct Access on most clients - it is slow, and have moved ...
2
votes
1answer
39 views

Cisco ASA NAT/PAT Multiple WAN IPs

I'm trying to setup a NAT / PAT in ASA 5520, I'm able to do so very well when the Public IP I want translated to Internal host is configured on the Outside. Question is the ISP provided 1.1.1.1/30 ...
0
votes
1answer
280 views

Cisco ASA IPSec Site-to-Site VPN Rx Bytes not increasing

I have IPsec Site-to-Site VPN from my ASA to customer. After customer complain about VPN down, I reset the tunnel now I can see Login time duration 12h:34m Byte TX is 543240 and Byte Rx is 0. What ...

1
2 3 4 5
13