Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
10
votes
2answers
10k views

In IPsec VPN, how is the pre-shared key encrypted?

I was doing IPsec VPN on ASA 8.0, and I understand a little about that. The initiator starts by sending its ISAKMP policy to the responder, and the responder sends back the matched policy. After that, ...
5
votes
1answer
330 views

Cannot get port-forward working on ASA 5505: “Drop-reason: (acl-drop) Flow is denied by configured rule”

Months ago I made this post here on NE, but I still for the life of me just cannot figure our port-forwarding on my ASA 5505. I have since started over and am now trying the DMZ port instead, but ...
19
votes
2answers
2k views

How do you get an ASA to announce NAT'd 'outside' addresses in to an OSPF zone?

Device arrangement is as follows: BGP Peers + | | +------+-------+ | | | Juniper MX5 | | | +------+-------+ |.254 OSPF | 10.0.1.0/24 ...
7
votes
2answers
13k views

Cannot get Cisco-ASA 5505 properly configured

I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505. I can't get out to the internet (even using ping from the ASA), I can't "see" the ASA on ...
6
votes
4answers
5k views

Moving interface names on a Cisco ASA while maintaining the rest of the configuration in place

My initial problem: I’ve run out of physical ports on my ASA 5525-X My initial solution: Create sub-interfaces on a port-channel and use a switch to aggregate my VLANs The subsequent issue: How do I ...
4
votes
3answers
24k views

Load balancing with multiple ISP, two routers and firewall

I have two ISP connections on two Cisco 2901 routers, in front of Cisco ASA-5515 firewall. I need to configure failover load balancing network. Two Cisco 2901 router with dual (different ISP) ...
4
votes
1answer
2k views

Cisco ASA RRI and OSPF redistribution

This is a follow-up question based on this original question. The following topology is present: The Cisco ASA is our Internet firewall, as well as VPN gateway, terminating VPN connections. The ASA ...
2
votes
1answer
734 views

Port-forwarding rule on Cisco ASA not working - “Drop-reason: (acl-drop) Flow is denied by configured rule”

New to Cisco, so I hope this question isn't too noobish. I am trying to setup a port-forwarding rule to allow "any" SSL traffic in from "Outside" to the web server on my LAN. The problem is apparently ...
7
votes
1answer
25k views

Configuring a Cisco ASA 5505 for routing

I'll start by pointig out that networking issues have always left me scratching my head. There is something about routing especially that I just haven't had that "Oh I get it" moment yet, so it's ...
6
votes
1answer
971 views

Cisco ASA startup-config command ordering for sub-interfaces

In relation to another question on this forum, Moving interface names on a Cisco ASA while maintaining the rest of the configuration in place, I modified the startup-config on my Cisco ASA 5525-X from....
4
votes
3answers
890 views

Cisco ASA Site-to-Site VPN, remote LANs have no Internet

I have a site-to-site VPN from a Cisco ASA 5512 and a Cisco 891. I want all traffic, even Internet access, to come through our ASA. The VPN is established and working. The LANs have connectivity to ...
4
votes
1answer
310 views

Is hairpinning still a problem with multi-context ASA?

I know from previous experience that having servers in DMZ 1 accessing the public NATed IPs of servers in DMZ 2 on the same ASA (aka "hairpinning") is a tricky business in a single-context ASA. But is ...
2
votes
0answers
10k views

Problem ipsec site to site ASA

I am receiving this error when I try to establish an ipsec site to site vpn: PSEC: Parsing PFKey GETSPI message IPSEC: Creating IPsec SA IPSEC: Getting the inbound SPI IPSEC: New embryonic SA created ...
2
votes
1answer
291 views

ipsec vpn with preshared key p

I understood that three session keys are generated by diffi-helmen and nonces, in phase 1 msg 3 and msg 4 both exchanged diffi-helmen public key and generate shared secret key ,and shared secret key ...
2
votes
1answer
1k views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
1
vote
1answer
630 views

Cisco ASA 9 update ACL programatically

I have been collecting different IP address for VoIP attacks in my infrastructure. These attacks happen every day multiple times. I have created a service which generates a notification to a python ...
0
votes
0answers
55 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...