Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
3
votes
1answer
841 views

Cisco ASA5516 9.8(2) IKEv2 negotiation aborted due unsupported failover version

I have a site to site connection from the ASA to an Azure subscription. The site to site session starts up fine, but after a few minutes (from 3 to 25) the connection fails. If on ASDM I open ...
3
votes
1answer
446 views

ASA5516 9.8(2) IKEv2 (no BGP) site to site connection with Azure fails

I have a Azure subscription, with a virtual network where the gateway subnet is 172.26.0.0/27, and then I have a number of subnets, e.g. 172.26.1.0/24, 172.26.2.0/24, 172.26.3.0/24, .... On the ...
1
vote
0answers
137 views

Cisco ASA 5512 one download blocks all others until download finishes [closed]

My company has a 50 Mbps Down/Up connection. I just migrated from a PIX 515E to an ASA 5512. Previously, one user could download a large file from the internet and block all other users from accessing ...
0
votes
2answers
384 views

Problem with downloading pcap capture from Cisco ASA

There is a problem with downloading pcap capture from Cisco ASA 5520 from https://<ip_of_asa>/admin/capture/<capture_name>/pcap - an empty file with size 24 bytes is downloaded while https:...
1
vote
1answer
88 views

Outbound NAT for single host behind an ASA located over an IPSEC tunnel [closed]

I have these two nets connected over the public internet with ASA 5510s. 192.168.0.0 < -- ASA1 ---> Internet <--- ASA2 --> 192.168.5.0 Each net does either a simple dynamic or static nat ...
1
vote
1answer
303 views

No access to internet from DMZ Cisco ASA 5512

Glad to join the forum. I hope to get help too and help as much as I can. Currently I have a big problem. I am using Cisco ASA 5512. I defined 3 interfaces on the firewall: inside (192.168.0.0), ...
1
vote
1answer
109 views

Cisco ASA access list on interface on which cryptomap is applied [closed]

I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering. Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some ...
1
vote
1answer
384 views

Cisco ASA - security levels vs. implicit global access rule

I try to understand how to combinate implicit global ACL witch security level. 1) In documentation there are: Traffic from Higher Security Level to Lower Security Level: Allow ALL traffic originating ...
1
vote
1answer
361 views

Cisco ASA context OSPF configuration issue

I've two cisco ASA configured in active/active HA. ASA is connected to switch with port-channel. Switch configuration: interface Port-channel47 description ASA2 switchport mode trunk switchport ...
1
vote
1answer
242 views

URL Filtering on ASA5506

I need some help. I need to allow a single network (for example only 10.10.10.0/24) access to 10 url (.norton.com.symantec.com etc...). Everything else has to be deny.I don't know what i have to do to ...
1
vote
1answer
127 views

ASA static routes

I have an Interface (IF1) with 172.16.18.254 255.255.255.0 security Level 0. This one connects to a Firwall where the network 172.16.18.0 255.255.255.0 is located and the gateway to this is 172.16....
3
votes
2answers
542 views

load balancing with multiple ISP, one router and asa 5520

I connected different two ISPs to the RV340 with dual WAN support. I want to connect the ISP - Router - ASA in the normal way, and connect the L2 Switch after the ASA. I need to know how to do DHCP ...
0
votes
1answer
371 views

Configuring IPsec VPN and TTL

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel. The Question: If each of the two sites have different ...
2
votes
1answer
429 views

ASA stopped working suddenly

My ASA 5516 stopped working all for sudden. There was no In/Outbound traffic anymore, Ping to the inside and outside interface failed. Before the device was running for more then 6 months. At the ...
2
votes
1answer
87 views

Asa5508 NAT two internal IPs

Hello I have a Cisco asa5508 and I want to NAT 2 internal IP's to 2 public IP's that I have.Each IP on its own. Currently I have NatPool and it's working either with the one IP or with the other. Is ...
-1
votes
2answers
166 views

dedicate 1 public IP to all devices in a subnet

I have a range of 6 public IP addresses and an ASA5505 I have two subnets and 2 VLANs inside network 10.0.0.0/24 VLAN 1 DMZ subnet 172.25.15.10/24 VLAN 40 all devices in the inside network connect ...
1
vote
1answer
465 views

ASA VPN Tunnel NAT Issues

I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What ...
0
votes
1answer
169 views

AWS direct connect with Cisco ASA redendency

We have following scenario currently and BLUE link is active and running, now i am going to get second link for redendency which is right side of diagram. As you can see currently i have VLAN 9 (...
1
vote
1answer
277 views

Oxidized Unable to Pull Cisco ASA Config

I am trying to configure an ASA with Oxidized but the log file keeps telling me "status no_connection" and goes through it's attempts. I have tried many different configurations with no success. I ...
2
votes
1answer
184 views

Event manager applet not getting recognized for Cisco ASA ver8.0

I need help as Event manager applet not getting recognized for Cisco ASA ver8.0. But for cisco ASA ver 9.6 it is working properly. Please advise BnglASA/pri/act(config)#Event manager applet ...
6
votes
3answers
273 views

Cisco ASA 5510 - ACL Config Question

My company's email server is under attack from the following IP address blocks 92.63.193.0 5.188.9.0 Here are the corresponding WHOIS records for each network % This is the RIPE Database query ...
2
votes
1answer
87 views

Cisco ASA 5525 VPN authentication with gmail account

I'm wondering if it's possible to setup a VPN authentication to Cisco asa firewall by using gmail account? Each time me or any of my users want to use VPN we could use our gmail credentials and it ...
3
votes
2answers
923 views

Cisco ASA 5510 implicit deny dropping traffic despite permit any ACL

I'm trying to allow VPN access through a specific public IP address on our company ASA. The ASA is currently configured with a /29 public IP address as follows: Interface Ethernet0/0 "outside" IP ...
1
vote
1answer
202 views

ASA packet routing problem after upgrade, wrong output next-hop due to vpn route?

We just replaced an ASA5510 with a new ASA5516x. Everything worked smoothly except for traffic between our network and traffic on the customer end of a site-to-site VPN tunnel. Old system: ASA5510 ...
1
vote
1answer
101 views

Cisco ASA: virtual Pool IP not filtered via ACL

One of our Customers has a corporate network at three different locations. Let's assume: location A: 192.168.1.0/24 location B: 192.168.2.0/24 and location C: 192.168.3.0/24 At each location a Cisco ...
3
votes
1answer
168 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
1
vote
1answer
213 views

How would you map a network at layer 2 without CDP or LLDP?

I'm on an ASA right now and can path my directly connected next hop devices via IP address, but I want to make sure there isn't a switch in between. Another related question, when I "show arp" it ...
2
votes
1answer
400 views

Cisco ASA IP object vs TCP/UDP object wrt VPN Filters

When it comes to managing access rules in Cisco ASAs I always use ASDM because it's easier for me to visualize, troubleshoot and manage. I recently created a VPN filter for a S2S IPsec VPN and ...
1
vote
1answer
463 views

Understanding how Cisco ASA with FirePOWER Services works

We recently installed a Cisco ASA 5508-x with FirePOWER Services. I am now getting around to setting FP up. I would like to understand how FP works before configuration. In terms of exposure, how ...
2
votes
1answer
311 views

Trunk on the outside ASA interface

I have a topology as in the picture. It is designed to be a factory network. 2 ASAs in a failover cluster border the whole LAN. And it is pretty much clear how to configure them: outside interface to ...
1
vote
1answer
452 views

Pix 6.3 to ASA 9.2 migration

I inherited a production Cisco Pix 6.3 firewall and an unconfigured ASA 5512 9.2. I'm reading up on converting the existing Pix config to an ASA-compatible config and there's mention of a migration ...
1
vote
1answer
412 views

ASA Inspection clarity

i want to make sure i get this because it's driving me a bit mad. class-map ftp match port tcp eq 21 class-map http match port tcp eq 21 [it should be 80] policy-map test class ftp ...
4
votes
1answer
666 views

L3 core switch and VPN access

At work we have a cisco 3560 L3 core, in which we implement all our L3 VLANs and ACLs controlling inter-vlan routing. As far as client machines are concerned, the L3 switch is the default gateway, ...
1
vote
2answers
3k views

Cisco ASA MTU vs TCP MSS

I am trying to set jumbo MTU for Cisco ASA 5585 and I did following: asa1/pri/act(config)# mtu inside 9000 INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU Use '...
2
votes
2answers
438 views

ASA cannot ping outside through NAT on border router

I have the following topology below, in GNS3. Basically, the cloud NAT-1 is the Internet, R1 is my border router with NAT and FWASAv-1 was supposed to be able to access the Internet, but can't. I ...
2
votes
2answers
464 views

Cisco ASA - LDAP Authentication issue

I've configured the ASA for LDAP authentication and successfully tested with the "Test aaa-server" command. However when I attempt to connect via Clientless VPN, I am unable to log in. Local users are ...
2
votes
2answers
1k views

Cisco failover interface in waiting

I have following scenario, where i am getting 1G copper Cat6 cable from ISP and directly terminated on my Cisco ASA firewall on Gi0/8 interface and i have configured failover now my in failover output ...
4
votes
2answers
810 views

Multiple ISPs failover configuration

I'm going to be more explicit about this and hope you'll get me through I have two ISPs connected each one to a cisco ASA 5510.the two ASA are connected to a cisco switch 3650 that connects my LAN. I ...
2
votes
2answers
2k views

Cisco ASA vPC configuration issue

I have this scenario and trying to configure vPC for Cisco ASA 5585 (Active-Standby) Nexus vPC config: interface port-channel1 switchport mode trunk switchport trunk allowed vlan 10 speed ...
3
votes
1answer
202 views

ASA as a local DNS resolver

I have an site to site VPN access configured by ASAs. My remote site needs to connect to the domain through the tunnel which will required DNS located on the main site. I would like to use DNS server ...
2
votes
1answer
204 views

Cisco ASA 5525 Access Rule is not used

I'm having some trouble with Access Rules on a Cisco ASA 5525. The rule I want the ASA to use is the following: access-list global_access line 1 extended permit ip range 192.168.1.3 192.168.1.233 ...
1
vote
1answer
455 views

CISCO ASA 5512-X internet traffic drops intermittently for a few seconds on the WAN after adding VLANs to the network

we recently separated our internal network into VLANs for better manageablility over WiFi. All the VLANs were created as sub-interfaces of GE1. The previously connected GE2 and GE3 were disconnected ...
2
votes
1answer
571 views

Cisco ASA Management and Routing Help

Hoping somebody can help me understand what I'm doing wrong here. Here is the diagram: [![enter image description here][1]][1] We have an ASA sitting at the edge. The FirePower module is connected ...
2
votes
1answer
341 views

VPN S2S/L2L between 2 ASA 5506-X

I have a problem to create a VPN L2L between 2 ASA 5506-X (see the pictures bellow). I configure my 2 firewall inspired by the majority of tutorials found on the NET. I correctly place client PCs in ...
3
votes
1answer
2k views

IPsec Tunnel is showing decrypt packets counter but 0 encryption packets: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides. However,When I checked the "Show cyrpto ipsec sa" ,I ...
2
votes
2answers
491 views

How to assign a second available Public ip for NAT (Dynamic PAT) to Inside Network Cisco ASA 5516-X

I have a x.x.x.200/29 subnet of Public IPs. Router Interface: x.x.x.206 255.255.255.248 ASA 5516-x outside: x.x.x.201 255.255.255.248 ASA 5516-x Inside: 10.111.22.254 255.255.255.0 I want to nat ...
1
vote
1answer
258 views

SSL VPN certificate issue

We have situation for SSL VPN (CISCO ASA anyconnect ) VPN gateway- XXX.cap.org - wild card certificate (*.cap.org) is expiring on next month. Anyconnect client is getting authenticated with AD not ...
1
vote
1answer
141 views

Why is it necessary to upgrade to ASA 8.4 on the way to 9.2?

According to Cisco, if you are upgrading from Cisco ASA 8.2 to Cisco ASA 9.2 you need to perform an interim upgrade to Cisco ASA 8.4 before you continue to Cisco 9.2. Cisco says this is because there ...
1
vote
1answer
796 views

Cisco ASA DH group and Lifetime of Phase 2

Not very good with ASAs so please have that in mind. I need to replace an ASA but can't seem to get some info on Phase 1 and Phase 2. I can get everything from Phase 1 except the DH group (got PFS ...
1
vote
2answers
368 views

SIte-to-Site VPN between ASAv8 and ASAv9: NAT issue

I'm setting up a site-to-site via ASDM. Initially I configured both devices correctly, matching policies, crypto, etc and set both inside networks as "NAT exempt". Problem is, when I apply changes on ...