Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

3
votes
1answer
50 views

Meraki in Passthrough mode behind ASA

I am having trouble getting bidirectional traffic through a Meraki box behind a ASA 5508-X. I can see requests from the client VPN going from a client device to a server on our LAN, the server ...
2
votes
1answer
54 views

Unable to use HTTPS Managment “API” on Cisco ASA 9.12

After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools. Example curl that is functional in prior code (9.8 ...
2
votes
1answer
41 views

Cisco ASA rekeying

Good day I was hoping someone has seen this before, I have a ASA5520 that has a l2l tunnel to a Palo Alto firewall. Every 2 mins the the logs I see a rekey I have check our configuration and we have ...
2
votes
2answers
8k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
1
vote
0answers
45 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
2answers
2k views

Migrating from Cisco ASA 5508 to Cisco Meraki Firewall Appliance at small office

At a small remote office my boss decided to buy a Meraki Firewall device with Wireless to replace an old Cisco ASA. The setup looks pretty straight forward. We have 5 public IP addresses for an e-...
3
votes
0answers
36 views

Cisco ASA 5525-X Input Current

In switches, like Cisco Catalyst 2960X-24TS-L, datasheet mention input power: 100 to 240 VAC, 1A to 0.5A. So, I assume input current = 1A@100VAC and 0.5A@240VAC or Cisco Catalyst 3850 + Power Supply ...
0
votes
0answers
22 views

Anyconnect Cisco 5505 VPN Group cannot Access Inside Network

Below is the Configuration to my Cisco ASA. I can connect to VPN but then trapped and cannot enter the inside network. ASA Version 9.2(4)27 ! hostname AwBTech-ASA domain-name awbtech enable password ...
-1
votes
2answers
165 views

dedicate 1 public IP to all devices in a subnet

I have a range of 6 public IP addresses and an ASA5505 I have two subnets and 2 VLANs inside network 10.0.0.0/24 VLAN 1 DMZ subnet 172.25.15.10/24 VLAN 40 all devices in the inside network connect ...
5
votes
1answer
2k views

Cisco ASA multiple dynamic VPN support (defaultRAGroup-defaultl2lGroup)

Question (short) How to set up 2 totally different dynamic l2l vpn tunnels on an ASA5506 Question (extended) We have a Cisco ASA5506 Security Appliance and we want to set up 2 dynamic VPN setups. ...
2
votes
1answer
171 views

Event manager applet not getting recognized for Cisco ASA ver8.0

I need help as Event manager applet not getting recognized for Cisco ASA ver8.0. But for cisco ASA ver 9.6 it is working properly. Please advise BnglASA/pri/act(config)#Event manager applet ...
3
votes
1answer
57 views

Cisco ASA 5508x, VLANs can't communicate

We're in the middle of moving to a more secure system, and the first step is to add this security appliance. Currently in place are two small quasi home-grade Cisco routers (rv260W and rv130). This ...
3
votes
1answer
3k views

Cisco ASA SIP/RTP inspection question

I have following scenario: [VoIP phone]--------[ASA 5550]----------[SIP Server] VoIP phone: 10.0.0.10 SIP server: Public Address Question: In above scenario do i need to specify or open RTP ...
1
vote
1answer
101 views

How to view/backup the 'ASA' config from a Firepower device?

We have some Cisco Firepower firewalls which we administer and generally in the past for ASA's we will review the config files locally on our machine, simply because it's easier than viewing it via a ...
1
vote
1answer
55 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
2
votes
1answer
114 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
4
votes
2answers
140 views

Cisco ASA 5585X Internal-Data0/1 interface errors

I have noticed on Cisco ASA 5585 (SSP-20) interface error counter going up specially overrun but so far we haven't seen any production impact or issue, error rate is low so its not noticable but would ...
2
votes
1answer
42 views

Cisco ASA 5505- My subnet mask is different from Show Route

While I was troubleshooting a DNS issue on my 10.10.10.0/30 subnet, I noticed the Local (L) and Connected (C) has different values. I configured the 10.10.10.0 network to use 255.255.255.252 has the ...
3
votes
1answer
31 views

ASA 5505 cant access inside network from Anyconnect SSL Connection

So I have a ASA I can connect via SSL perfectly fine receiving internet.My issue is that I cannot ping any device on the network especially the inside network on my router. My topology is a ASA 5505 - ...
1
vote
0answers
29 views

Cisco ASA: Windows DHCP doesn't bind IP address after failover change active [closed]

Equipment and soft: Two Cisco ASA 5540, ASA ver. 9.1(7)32, active/standby failover DHCP server: Windows server 2016 Anyconnect VPN clients get IP addresses from DHCP servers. Everything works ...
1
vote
1answer
125 views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
3
votes
1answer
64 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
0
votes
0answers
39 views

Cisco ASA L2TP remote-access VPN with addresses assigned by DHCP

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP. The Cisco Client policy has end-users fetch their ...
2
votes
1answer
397 views

ASA stopped working suddenly

My ASA 5516 stopped working all for sudden. There was no In/Outbound traffic anymore, Ping to the inside and outside interface failed. Before the device was running for more then 6 months. At the ...
4
votes
3answers
8k views

Steps to find neighboring device to a Cisco ASA firewalls

What are the right steps to locate a neighboring device adjacent to a Cisco ASA firewall? Can anyone help me with the steps please, one by one?
2
votes
1answer
34 views

How do I find out which NAT is getting hit?

I can see in packet captures that my packet's destination IP is getting translated. How do I find which NAT statement is responsible for the conversion if my device has over 200 NAT rules? I'm using ...
0
votes
0answers
54 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
2
votes
1answer
110 views

Cisco ASA Dial in VPN access Devices on Site-to-Site VPN

Questions 1) What do I need to run to get this to allow the on-site to talk to the dial-in network clients E.G ping from 10.101.1.7 to 10.101.2.1? 2) What do I need to run to get the dial-in network ...
0
votes
1answer
56 views

ASA access-list to object group

I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain? access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16....
5
votes
1answer
275 views

Cannot get port-forward working on ASA 5505: “Drop-reason: (acl-drop) Flow is denied by configured rule”

Months ago I made this post here on NE, but I still for the life of me just cannot figure our port-forwarding on my ASA 5505. I have since started over and am now trying the DMZ port instead, but ...
2
votes
1answer
652 views

Port-forwarding rule on Cisco ASA not working - “Drop-reason: (acl-drop) Flow is denied by configured rule”

New to Cisco, so I hope this question isn't too noobish. I am trying to setup a port-forwarding rule to allow "any" SSL traffic in from "Outside" to the web server on my LAN. The problem is apparently ...
0
votes
1answer
23 views

Issue with Connectivity Over Next Hop Gateway (ASA) to Point to Point

I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. ...
1
vote
0answers
24 views

Why can I not see the default gateway when connecting to ASA through AnyConnect?

I've configured an ASA as an AnyConnect server. The IP address pool that'll be assigned to the connecting hosts is from 192.168.10.1-192.168.10.10. Now when I establish a remote access connection to ...
2
votes
1answer
30 views

Subinterface on Cisco ASA 5550 does not work with VLAN on HP ProCurve

I created subinterface on Cisco ASA 5550 (ver. 9.7.1): interface GigabitEthernet1/2.810 vlan 810 nameif dmz810 security-level 50 ip address 172.29.12.33 255.255.255.248 And VLAN 810 on HP ...
0
votes
0answers
40 views

Why can't I ping to the outside interface of my ASA

Below is the output of packet tracer. I have simulated a ping packet from 10.106.51.203 to 10.106.51.200. 'mgmt' is supposed to be the outside interface. Also, why is output-interface in the result ...
1
vote
1answer
486 views

VPN: IPsec tunnel between Private IP ASA & Public IP ASA

We have a user that moved recently to an incubator, in order to secure his traffic between his computer and the office we purchased an ASA 5505 to connect to his desktop, and hoped we could configure ...
3
votes
1answer
176 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
3
votes
1answer
73 views

General issues with access to and from DMZ on Cisco ASA 5520

I just got my software upgraded from v8.2(x) to v.9.1(7), but I have some general issues with access to and from my DMZ: No internet access from DMZ No access to web or mail server from outside to ...
2
votes
1answer
61 views

No access to mail server in DMZ [closed]

I have an Cisco asa 5520 8.2(1) firewall that I can't get to give me access to my mail server in DMZ. Here's my configuration: Object groups object-group network WEB_SERVERS network-object host 172....
2
votes
1answer
85 views

Restrict VTY SSH access to only MGMT VLAN and loopback

For the sake of the fact that i'm not allowed to share actual configuration, every posted config below is made up or altered. We have more than 250 locations spread over our country. All locations ...
0
votes
0answers
163 views

Creating an overlay network using ASA and VXLAN over IP MPLS

I need to extend an existing VLAN from a branch LAN to DC. As a matter of fact I noticed that Cisco ASA 5500X have VXLAN capabilities. I am relatively new to VXLAN and I need some help to find the ...
3
votes
1answer
45 views

ASA Denying PAT'd IP

ASA keeps denying TCP to PAT'd DMZ IP. Could someone have a look at this, i have mostly been using ASDM. same-security-traffic permit intra-interface object network expressway-e host 192.168.5....
5
votes
0answers
276 views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
2
votes
2answers
1k views

VyOS / Cisco ASA 5520 site-to-site VPN traffic drops after ~10 minutes

I am trying to setup a site-to-site VPN to a large telco. We are running VyOS 1.1.7 in AWS; they are using a Cisco ASA 5520. Since the telco is large, and we are small, they have dictated all the ...
1
vote
2answers
628 views

VLANs: No Internet Access

I've set up a new VLAN (VLAN 11) to service subnet 10.0.11.0\24. It's primarily for wired PCs. I have DHCP working. I can browse all of my network, file shares, ping interfaces etc. I can't get my new ...
2
votes
1answer
64 views

NAT test environments

I need to create 4x test environments, each environment contains 3x servers within a 192.168.215.0/24 subnet. Each test environment does NOT need to be aware of the other test environments. The ...
2
votes
1answer
234 views

Urgent: how to configure different interface using same ip subnet in asa 5506?

Scenario is in old asa firewall 5505 I have switch port access vlan command in different interface. Just like below: interface Ethernet0/0 ! interface Ethernet0/1 switchport access vlan 2 ! ...
0
votes
2answers
317 views

Problem with downloading pcap capture from Cisco ASA

There is a problem with downloading pcap capture from Cisco ASA 5520 from https://<ip_of_asa>/admin/capture/<capture_name>/pcap - an empty file with size 24 bytes is downloaded while https:...
1
vote
2answers
263 views

Branch office network

We going to open branch office. In Head office we have 2 ASA firewalls (active-standby) and 2960 switches on each floor. How can i connect branch office to the main office ? I have 2901 Router and HP ...
2
votes
1answer
318 views

Unbalanced port-channel utilization

I have below setup: +------------------+ vPC +------------------+ | | | | | NX5K-SW01 +-----------------------+ ...