Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
5
votes
2answers
7k views

Why do I get a timeout when I connect via ssh to a Cisco ASA, even though management and ACLs are configured?

I set up a Cisco ASA 5505 8.4(3), and specified ssh version 2 enabled ssh access to the WAN interface via ssh <my network> <mask> <WAN interface> allowed ssh from my network via an ...
8
votes
1answer
2k views

How does group-policy inheritance work for a Cisco ASA?

I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure. What I really want to know is if I pull an attribute from a group-policy will it then be ...
4
votes
7answers
10k views

Dynamic Routing Protocol (IGP) over IPSec VPN tunnels to branch offices?

What are the best practices for running an IGP to learn networks at HQ from branch offices when those offices connect via IPSec LAN-to-LAN VPN tunnels over the Internet? The branch offices terminate ...
2
votes
1answer
397 views

ASA5510 Site-to-site VPN with Bluecoat SSG proxy

I have a scenario whereby we will have over 15 remote IPSEC sites concentrated back to HO where a bluecoat proxy lives; the proxy is in transparent mode. The remote sites will have SRP527W's with an ...
9
votes
3answers
935 views

ASA Netflow support

Cisco ASAs support a version of netflow called NetFlow Secure Event Logging (NSEL). Is special support for the protocol required on the collectors to view the flows? Is the protocol compatible with ...
13
votes
5answers
2k views

ASA 5550 - Reboot Worthwhile?

I've got an ASA 5550 that is performing loads and loads of operations (AnyConnect, NAT, ACL, RADIUS, etc, etc). It isn't particularly overloaded in terms of CPU & Memory, but it has an uptime of ...
10
votes
2answers
386 views

Will ASA 5540 support 3000 simultaneous IPsec connections?

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 ...
15
votes
5answers
168k views

How can I reset a VPN tunnel on a Cisco ASA?

On a site-to-site VPN using a ASA 5520 and 5540, respectively, I noticed that from time to time traffic doesn't pass any more, sometimes just there's even missing traffic just for one specific traffic ...
12
votes
1answer
2k views

ASA5505 and IPv6 over a PPPoE Link

I see a lot of conflicting information about whether or not a Cisco ASA (5505 in this case) can use IPv6 over a PPPoE connection. I see official Cisco documentation making it look easy, but I see ...
5
votes
3answers
2k views

Unable to connect via VPN to remote network

PROBLEM: I'm unable to connect via VPN to our production network while connected to my home wireless network. SETUP: Internet | ISP router at home | Cisco ASA 5505 firewall | Buffalo wireless ...
5
votes
1answer
1k views

How many contexts can be created on a Cisco ASA Active/Standby Pair?

How many contexts can be created on a Cisco ASA Active/Standby pair with base license?
8
votes
4answers
12k views

ASA use of proxy ARP for NAT

I will be performing NAT on the outside interface of an ASA to a web server within a DMZ. I would like to disable proxy-arp on all the interfaces that I can. I know that outside interface will need to ...
11
votes
3answers
2k views

Two Cisco ASA 5525-X as Internet Gateways without Layer 2

Add another reason to hate NAT to the list. I'm bringing up two Internet egress points in our corporate network. The edge devices will be ASA 5525-X firewalls. Traditionally you would put these into ...
13
votes
7answers
3k views

How can I generate traffic on a Cisco ASA?

In a lot of locations, we have only one Cisco ASA 5505 each and one or more WiFi APs, besides the provider router. No servers or PCs, just WiFi service for occasional visitors. I want to remotely ...
21
votes
5answers
27k views

Cisco ASA site-to-site VPN failover

We recently replaced international MPLS with new ASA 5510s and site-to-site VPNs. However, when we deployed this we ran into a problem where each remote location has 2 ISPs for redundancy, but when ...
19
votes
2answers
2k views

How do you get an ASA to announce NAT'd 'outside' addresses in to an OSPF zone?

Device arrangement is as follows: BGP Peers + | | +------+-------+ | | | Juniper MX5 | | | +------+-------+ |.254 OSPF | 10.0.1.0/24 ...
12
votes
3answers
1k views

Migrating pre-8.3 ASA config to 8.3+

What are best practices migrating ASA config to 8.3 and forward? I have manually created a new config file with the following changes: new network objects new NAT statements new access-lists ...