Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
1
vote
1answer
18 views

Arpping responding with Cisco ASA interface mac address and mac address of machine

For some reason our Cisco is responding to arp requests between machines on the same switch. It's not breaking anything but it is slowing initial connections. I've been making a lot of changes on the ...
1
vote
1answer
28 views

Cisco ASA looping broadcast packet

I have small office where running cisco ASA ASA5506 and version 9.4(1) and it's also configured for IPsec VPN tunnel, My LAN subnet is 10.1.1.0/24 So i have found very interesting things in LAN ...
0
votes
2answers
28 views

Cisco ASA IKE Receiver: Runt ISAKMP packet discarded on Port 500

I have lots of ikev1 tunnel running on our production Cisco ASA5585 and today i have configured ikev2 tunnel for one of our new customer and i have started seeing following error, and not sure what is ...
0
votes
0answers
11 views

Cisco ASA Security Warning: Untrusted server cert after asa crash and reload

We have Cisco ASA 5505 working VPN anyconnect and it's been almost 1 year no issue, but last week it got crashed and reboot itself and after that we found it started throwing warning like following: ...
1
vote
0answers
24 views

Static PAT using Cisco ASA 5506 in cisco packet tracer [closed]

ciscoasa(config)#interface GigabitEthernet 1/3 ciscoasa(config-if)#nameif inside1 INFO: Security level for "inside1" set to 0 by default. ciscoasa(config-if)#security-level 100 ciscoasa(config-if)#no ...
1
vote
1answer
77 views

delete object network in cisco ASA with packet tracert

I used 5506 as firewall and I am trying to delete object network I created and it gives error as ERROR: unable to delete the object configuration. object (inside-net-obj) is being used. commands I ...
0
votes
1answer
32 views

ASA ISP limit of ISP Speed

I've got configured ASA with two ISP. First is main ISP and second for backup. Is possible to set on conf of ASA if the speed of main ISP will be at low bandwith, ASA will active a backup ISP?
4
votes
0answers
29 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
4
votes
2answers
783 views

L3 core switch and VPN access

At work we have a cisco 3560 L3 core, in which we implement all our L3 VLANs and ACLs controlling inter-vlan routing. As far as client machines are concerned, the L3 switch is the default gateway, ...
5
votes
1answer
2k views

Cisco ASA multiple dynamic VPN support (defaultRAGroup-defaultl2lGroup)

Question (short) How to set up 2 totally different dynamic l2l vpn tunnels on an ASA5506 Question (extended) We have a Cisco ASA5506 Security Appliance and we want to set up 2 dynamic VPN setups. ...
1
vote
1answer
54 views

Which interfaces do I need to configure to change MTU of Cisco Site-to-Site VPN

I have a number of Site-to-Site VPN tunnels in my network configurations. They are configured using Cisco ASA devices. To resolve some performance issues I am trying to change the MTU for traffic ...
7
votes
5answers
6k views

Moving interface names on a Cisco ASA while maintaining the rest of the configuration in place

My initial problem: I’ve run out of physical ports on my ASA 5525-X My initial solution: Create sub-interfaces on a port-channel and use a switch to aggregate my VLANs The subsequent issue: How do I ...
5
votes
1answer
485 views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
0
votes
2answers
79 views

Network report integrated with Active Directory or Users

How can i take network report of bandwidth consumption that integrated with AD or users? I have ASA 5506 and configured netflow 9 with PRTG, I can see the source IP and Destination IPs, Is there any ...
4
votes
1answer
791 views

IOS to ASA dynamic and static VPNs - sharing same crypto ACL?

Is it possible to have a dynamic and static VPN between the same IOS router and ASA, sharing same interesting traffic/crypto ACL on the ASA end? The two devices in question: ASA 9.1 - hub/termination ...
1
vote
1answer
70 views

Cisco ASA failover monitor-interface policy

I have Cisco ASA 5585 and it has 10G interface in port channel where i configured multiple vlan sub-interface, is it worth to monitor every single sub-interface for failover policy or just monitor ...
1
vote
1answer
148 views

Cisco ASA 5506: The switching between the two providers by using Route-Map, creation backup channel

We have two providers. I want to make the second provider a backup channel. This configuration is most often offered: object network internal-pat-primary_obj nat (inside,outside1) dynamic interface ...
1
vote
2answers
651 views

ASA Idle Connection Timout 60 Minutes

I have an ASA 5512-X and have the Problem, that when I'm starting an SSH session and leave it running, it cancels the conenction after 60 Minutes. I have two Policy Rules policy-map type inspect ...
2
votes
1answer
165 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
1
vote
0answers
79 views

Unable to Initiate a VPN tunnel using IKEv2

I'm having an issue with a VPN tuunel between my Firewall (ASA 5516-X) and a third party firewall so I can't check the config in the second firewall. So I decide to debug my firewall and I realized ...
3
votes
2answers
261 views

Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)

So I have given a task to add 1000s of DAP policies after main DAP file crashed and backup is not available due to unfortunate reasons. There is predefined way of doing it through ASDM which is very ...
5
votes
3answers
2k views

Unable to connect via VPN to remote network

PROBLEM: I'm unable to connect via VPN to our production network while connected to my home wireless network. SETUP: Internet | ISP router at home | Cisco ASA 5505 firewall | Buffalo wireless ...
3
votes
1answer
99 views

Meraki in Passthrough mode behind ASA

I am having trouble getting bidirectional traffic through a Meraki box behind a ASA 5508-X. I can see requests from the client VPN going from a client device to a server on our LAN, the server ...
2
votes
1answer
203 views

Unable to use HTTPS Managment “API” on Cisco ASA 9.12

After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools. Example curl that is functional in prior code (9.8 ...
2
votes
1answer
57 views

Cisco ASA rekeying

Good day I was hoping someone has seen this before, I have a ASA5520 that has a l2l tunnel to a Palo Alto firewall. Every 2 mins the the logs I see a rekey I have check our configuration and we have ...
2
votes
2answers
10k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
3
votes
2answers
3k views

Migrating from Cisco ASA 5508 to Cisco Meraki Firewall Appliance at small office

At a small remote office my boss decided to buy a Meraki Firewall device with Wireless to replace an old Cisco ASA. The setup looks pretty straight forward. We have 5 public IP addresses for an e-...
3
votes
0answers
45 views

Cisco ASA 5525-X Input Current

In switches, like Cisco Catalyst 2960X-24TS-L, datasheet mention input power: 100 to 240 VAC, 1A to 0.5A. So, I assume input current = 1A@100VAC and 0.5A@240VAC or Cisco Catalyst 3850 + Power Supply ...
0
votes
0answers
27 views

Anyconnect Cisco 5505 VPN Group cannot Access Inside Network

Below is the Configuration to my Cisco ASA. I can connect to VPN but then trapped and cannot enter the inside network. ASA Version 9.2(4)27 ! hostname AwBTech-ASA domain-name awbtech enable password ...
-1
votes
2answers
171 views

dedicate 1 public IP to all devices in a subnet

I have a range of 6 public IP addresses and an ASA5505 I have two subnets and 2 VLANs inside network 10.0.0.0/24 VLAN 1 DMZ subnet 172.25.15.10/24 VLAN 40 all devices in the inside network connect ...
2
votes
1answer
232 views

Event manager applet not getting recognized for Cisco ASA ver8.0

I need help as Event manager applet not getting recognized for Cisco ASA ver8.0. But for cisco ASA ver 9.6 it is working properly. Please advise BnglASA/pri/act(config)#Event manager applet ...
3
votes
1answer
94 views

Cisco ASA 5508x, VLANs can't communicate

We're in the middle of moving to a more secure system, and the first step is to add this security appliance. Currently in place are two small quasi home-grade Cisco routers (rv260W and rv130). This ...
3
votes
1answer
3k views

Cisco ASA SIP/RTP inspection question

I have following scenario: [VoIP phone]--------[ASA 5550]----------[SIP Server] VoIP phone: 10.0.0.10 SIP server: Public Address Question: In above scenario do i need to specify or open RTP ...
1
vote
1answer
283 views

How to view/backup the 'ASA' config from a Firepower device?

We have some Cisco Firepower firewalls which we administer and generally in the past for ASA's we will review the config files locally on our machine, simply because it's easier than viewing it via a ...
1
vote
1answer
112 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
2
votes
1answer
114 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
4
votes
2answers
360 views

Cisco ASA 5585X Internal-Data0/1 interface errors

I have noticed on Cisco ASA 5585 (SSP-20) interface error counter going up specially overrun but so far we haven't seen any production impact or issue, error rate is low so its not noticable but would ...
2
votes
1answer
56 views

Cisco ASA 5505- My subnet mask is different from Show Route

While I was troubleshooting a DNS issue on my 10.10.10.0/30 subnet, I noticed the Local (L) and Connected (C) has different values. I configured the 10.10.10.0 network to use 255.255.255.252 has the ...
3
votes
1answer
44 views

ASA 5505 cant access inside network from Anyconnect SSL Connection

So I have a ASA I can connect via SSL perfectly fine receiving internet.My issue is that I cannot ping any device on the network especially the inside network on my router. My topology is a ASA 5505 - ...
1
vote
0answers
79 views

Cisco ASA: Windows DHCP doesn't bind IP address after failover change active [closed]

Equipment and soft: Two Cisco ASA 5540, ASA ver. 9.1(7)32, active/standby failover DHCP server: Windows server 2016 Anyconnect VPN clients get IP addresses from DHCP servers. Everything works ...
1
vote
1answer
379 views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
3
votes
1answer
89 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
0
votes
0answers
112 views

Cisco ASA L2TP remote-access VPN with addresses assigned by DHCP

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP. The Cisco Client policy has end-users fetch their ...
2
votes
1answer
505 views

ASA stopped working suddenly

My ASA 5516 stopped working all for sudden. There was no In/Outbound traffic anymore, Ping to the inside and outside interface failed. Before the device was running for more then 6 months. At the ...
4
votes
3answers
10k views

Steps to find neighboring device to a Cisco ASA firewalls

What are the right steps to locate a neighboring device adjacent to a Cisco ASA firewall? Can anyone help me with the steps please, one by one?
2
votes
1answer
37 views

How do I find out which NAT is getting hit?

I can see in packet captures that my packet's destination IP is getting translated. How do I find which NAT statement is responsible for the conversion if my device has over 200 NAT rules? I'm using ...
0
votes
0answers
60 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
2
votes
1answer
191 views

Cisco ASA Dial in VPN access Devices on Site-to-Site VPN

Questions 1) What do I need to run to get this to allow the on-site to talk to the dial-in network clients E.G ping from 10.101.1.7 to 10.101.2.1? 2) What do I need to run to get the dial-in network ...
0
votes
1answer
128 views

ASA access-list to object group

I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain? access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16....
5
votes
1answer
476 views

Cannot get port-forward working on ASA 5505: “Drop-reason: (acl-drop) Flow is denied by configured rule”

Months ago I made this post here on NE, but I still for the life of me just cannot figure our port-forwarding on my ASA 5505. I have since started over and am now trying the DMZ port instead, but ...