Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

1
vote
1answer
596 views

Cisco ASA 9 update ACL programatically

I have been collecting different IP address for VoIP attacks in my infrastructure. These attacks happen every day multiple times. I have created a service which generates a notification to a python ...
2
votes
1answer
1k views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
2
votes
2answers
83 views

pinging issue Please help me out on this issue

L3 ESW1 Switch configuration: Building configuration... Current configuration : 2512 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service ...
1
vote
2answers
273 views

Natted client cant ping default gateway

I have a Cisco ASA 5506-x Firewall that I am using to NAT addresses on a machine subnet. These addresses are from a VLAN. When I ping from a 192(Subnet) address to a 177(Vlan)address through the NAT ...
1
vote
1answer
41 views

Catalyst InterVLAN Routing w/ Failover ASAs

I currently have interVLAN routing configured on my Catalyst 3750. My gateway of last resort is my ASA firewall. The switch reaches the firewall through a layer 3 port. The port is configured as ...
1
vote
1answer
86 views

Secure communication between multiple sites over Internet

Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I ...
2
votes
1answer
212 views

ASA 5506-X as NAT only

We have a spare ASA 5506-X that we want to use as a NAT. It will be placed between a VLAN and a machine network. Is it possible to setup the device using only the wizard for this functionality. (I ...
1
vote
1answer
178 views

Route Specific Traffic To Another Firewall

I'm looking for a way to setup a route from my internal LAN to another router. Here's the current situation: I have an ASA5512-X where all servers are connected and all the employees are connected to,...
0
votes
1answer
652 views

Ping from ASA over Site to Site VPN

There are two things I'm trying to solve which are essentially the same problem. Cannot ping from the ASA to remote devices over a site to site VPN terminated on the ASA. ASA AnyConnect LDAP lookups ...
0
votes
2answers
209 views

VPN from azure to internal ASA

My company has created a network topology where we have 2 firewalls. The external one is a DrayTek and the internal one is a Cisco ASA. We also have a dmz connected to the ASA. The DrayTek public IP ...
2
votes
1answer
114 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
0
votes
0answers
842 views

IPsec tunnel getting drop and reconnect itself frequently

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map ...
1
vote
2answers
702 views

Cisco AnyConnect clients connects to Internet via L3 device on inside zone of ASA (default gateway is on the remote network)

I am testing implementation of AnyConnect where AnyConnect client, after establishing IPSec VPN tunnel, must exit to Internet via L3 device that is located on the same network as RA VPN clients, ...
1
vote
1answer
196 views

Site to Site VPN will it conflict with BGP IP address?

I have a site A which consists of the following IP address and subnets: 192.168.10.0/24 (internal) 172.17.0.0/24(DMZ) BGP tunnel tunnel IP with 172.16.0.1 255.255.255.252 Cloud IP address of 10.0.0.0/...
1
vote
1answer
99 views

ASA Ironport WCCP: allow specific host to access only specific url

I need to restrict specific inside host (e.g. 10.0.0.1) to allow accessing only specific URL (e.g. https://www.eestipank.ee/currency/rates/export/csv/custom?imported_at=undefined&chart_start_at=26....
1
vote
1answer
347 views

Cisco ASA not routing without identity NAT?

As I was writing this down I think the solution came to me. As usual. I'll write this down nevertheless to make the world a better place. =D Let's take a look at this beauty of a network ...
2
votes
1answer
2k views

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-...
1
vote
1answer
2k views

What is the need for Reverse Route Injection?

From the definition of Reverse Route Injection, I have understood that it creates static route entries for remote vpn destinations in VPN gateway, so that it can redistribute the routes into into it's ...
2
votes
1answer
779 views

IPsec vpn missing crypto keyring

We have VPN tunnel with our customer and they sent their side VPN config and i am trying to put that config in my Cisco ASA 5585 (9.x) version and it has missing crypto keyring command Customer ...
2
votes
1answer
2k views

ASA anyconnect VPN not able to access remote LAN (inside) network

I have setup ASA5506 for cisco anyconnect VPN and i am able to connect VPN but not able to ping or ssh or anything to any device on remote lan (inside) network 10.0.10.x/24 Here is the network ...
2
votes
2answers
8k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
4
votes
1answer
304 views

Cisco ASA Site to Site VPN

Hoping someone can be of assistance. I am attempting to setup a site to site vpn with two cisco asas. Site A. 192.168.1.0, Static external IP, Cisco ASA 5520 Site B. 10.0.0.0 Dynamic External IP, ...
5
votes
1answer
502 views

Cisco ASA 5505 - Route 2 Public IPs to different VLANs

I am trying to set up a Cisco ASA 5505 firewall on my network, with some important stipulations. I get two usable static IPs from my ISP, one of which I want to use for "home-traffic", and the other ...
1
vote
1answer
743 views

I can't connect to ASDM on my LAN with the enabled inside address shown in CLI

newbie here. Despite the console config here-under, I can't connect to ASA and launch ASDM config from LAN's PC. The latest JAVA is installed, but I get a "This page can't be displayed" message on ...
4
votes
2answers
914 views

Problem with Cisco ASA 5510 DMZ configuration

I need help to resolve this issue. I have a Cisco ASA 5510 and I’m trying access to my webserver from internet but the connection does not work. Please find the network diagram below: I applied this ...
1
vote
1answer
581 views

Cisco IPSec Pass-through on ASA 5505 not working

I have been busting my brain for a few days not and I have so far not been able to figure out what the issue here is. The Problem: I am unable to establish a Client-to-ASA IPSec tunnel from behind ...
1
vote
1answer
230 views

ASA - No internet on NAT'd computers only

ASA5510 without any extra services such as utm and using Comcast business internet. Users stopped getting emails in middle of the night. That was our first indication. After checking things every ...
1
vote
2answers
5k views

Cisco site-to-site vpn multiple subnet route over tunnel

We have a site-to-site VPN tunnel to AWS which was working great until I added another subnet to the ACL list for interesting traffic which was causing a strange issue. It is only allowing me to add a ...
1
vote
2answers
568 views

ASA anyconnect VPN restriction base on group

We have implemented Remote access VPN on ASA and integrate with onelogin cloud base OTP service, where we have LDAP server and onelogin provide RADIUS service to provide LDAP+OTP base authentication. ...
4
votes
3answers
856 views

Cisco ASA Site-to-Site VPN, remote LANs have no Internet

I have a site-to-site VPN from a Cisco ASA 5512 and a Cisco 891. I want all traffic, even Internet access, to come through our ASA. The VPN is established and working. The LANs have connectivity to ...
2
votes
2answers
571 views

ASA traceroute from lower security level to higher security level

In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't ...
2
votes
2answers
8k views

ASA conn flags explain

I have seen following output, but what is the difference between UB vs UIOB vs UIO? I looked at this website, and it has nice explanation, but I am having a hard time to decode it in context: https:/...
2
votes
2answers
2k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...
1
vote
1answer
1k views

How to Multiple Radius server in ASA

We have two RADIUS server for SecureID token auth for VPN and i have configure 10.1.1.1 (primary) but don't know how to configure 10.1.1.2 (backup radius) This is what i have currently aaa-server ...
4
votes
3answers
8k views

Steps to find neighboring device to a Cisco ASA firewalls

What are the right steps to locate a neighboring device adjacent to a Cisco ASA firewall? Can anyone help me with the steps please, one by one?
1
vote
1answer
2k views

How to Cisco Anyconnect increase subscription base license user count

We have Cisco ASA5500 and we purchased L-AC-PLS-LIC= for 25 users for 3 year now if i want to increase users count then how can i increase it to 50? Can i just buy 25 users license and add into or i ...
1
vote
1answer
401 views

Unable to reach public IPs of servers behind ASA 5512

We replaced a Meraki MX with a Cisco ASA, and I'm unable to reach the public IPs of servers behind our firewall now. The server has working Internet access. All packet tracer runs show successful ...
1
vote
1answer
222 views

Unable to properly configure ASA 5512 with WAN IP

I have a /28 block of public IPs from Comcast. I'm trying to put a public IP directly on the ASA outside interface, but when I do I cannot ping 8.8.8.8 or the Comcast modem. Internal communication is ...
0
votes
1answer
47 views

Assign outbound E-mail to specific Ironport server

I'm not a Cisco ASA engineer but wanted to ask if it is possible to create a custom rule to filter a specific outbound email address, like ironportcheck1@contso.com, and assign it to pass thru a ...
1
vote
1answer
2k views

Trouble acl-drop packets on a Cisco asa 5510

I am trying to troubleshoot the cause of "Flow is denied by configured rule (acl-drop)" packets on "show asp drop" on an ASA 8.4 I have done packet captures and packet traces, but I am not able to ...
3
votes
1answer
325 views

Problem with Cisco ASA 5512 NAT Configuration

I need help to resolve this issue. I have a Cisco ASA 5512 and I’m trying to access to my FTP server from external IP but the packets are dropped. Please find the network diagram below: I typed this ...
2
votes
1answer
313 views

ARP flush manual broadcast after IP change

This is strange requirement but thought let me ask if some has good advice, so we have Linux iptables firewall with 3 interface, public, Internal and DMZ now we decided to replace linux firewall with ...
2
votes
1answer
429 views

Cisco ASA Route Outside Track Configuration

I understand route outside (static route) configuration is used to tell the ASA to communicate to the outside world or to traverse internet traffic, but I am confused with this command: route outside ...
2
votes
1answer
2k views

Cisco ASA single isakmp policy for multiple crypto map

We are going to setup multiple site-to-site tunnels to our remote office and every tunnel configuration is identical (same hash,encryption etc). The question is: Do I need to create a separate ...
1
vote
1answer
373 views

Cisco AnyConnect Plus license based on users

Cisco AnyConnect Plus license terms are based on user count and not simultaneous connected sessions. When it said based on users, does that mean the total connected number of users or a total account ...
0
votes
1answer
372 views

ASA Port Exhaustion

Our Branch Offices routes all their traffic to our Headquarter through an MPLS connection, all the traffic then goes through an ASA Firewall to be inspected before being natted to a public address and ...
0
votes
1answer
299 views

PRTG - NetFlow v9 on Cisco ASA 5520 not working [closed]

We have a PRTG Probe 192.168.4.4 in our office's Domain Controller, and we are trying to configure NetFlow on our leased Cisco ASA 5520 ver 8.2(5) We have done the following on the Cisco: conf t ...
1
vote
1answer
1k views

How to configure Cisco ASA to expose SFTP server to external interface?

We recently upgraded from "prosumer" equipment to Cisco ASA routers, and I am trying to learn some basic administration of the devices. The reason this will sound like a newbie question is ... well ......
2
votes
1answer
2k views

ASA Redendent Failover and stateful link issue

We have ASA 5585-X and i create back-to-back (without intermediate switch/hub) two 1G cable between two ASA to create failover + stateful link using g0/6 and g0/7 interface. Interface config ! ...
1
vote
2answers
115 views

Traffic replicated across multiple VLANs - ASA

Have a switch connected to a FW via a trunk. The receiving interface on the FW is a PO with subif's for each VLAN on the trunk. We have a flow we want to track coming in on VLAN 306 / SEC_Data, ...