Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
1
vote
1answer
846 views

Cisco ASA DH group and Lifetime of Phase 2

Not very good with ASAs so please have that in mind. I need to replace an ASA but can't seem to get some info on Phase 1 and Phase 2. I can get everything from Phase 1 except the DH group (got PFS ...
1
vote
2answers
390 views

SIte-to-Site VPN between ASAv8 and ASAv9: NAT issue

I'm setting up a site-to-site via ASDM. Initially I configured both devices correctly, matching policies, crypto, etc and set both inside networks as "NAT exempt". Problem is, when I apply changes on ...
3
votes
2answers
2k views

Cannot ping subinterfaces on Cisco ASA 5508

I am not able to ping the inside subinterface on my ASA 5508-x. When setup this way, I am able to ping the interface: interface GigabitEthernet1/3 nameif inside security-level 100 ip address X.X....
1
vote
1answer
564 views

Cisco 5506-x dynamic site to site tunnel doesn't works

I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
1
vote
2answers
90 views

Separate a network within the enterprise environment

What will be the best solution, to securely separate a network and have internet connectivity. In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate ...
4
votes
1answer
201 views

Immediately block a host's traffic

I've got a script set up (triggered by Fail2Ban) to block hosts at the edge of our network. It adds the IP address to a group that's already blocked by an ACL, and then clears the connection out. ...
1
vote
1answer
683 views

Cisco ASA 9 update ACL programatically

I have been collecting different IP address for VoIP attacks in my infrastructure. These attacks happen every day multiple times. I have created a service which generates a notification to a python ...
2
votes
1answer
1k views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
2
votes
2answers
84 views

pinging issue Please help me out on this issue

L3 ESW1 Switch configuration: Building configuration... Current configuration : 2512 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service ...
1
vote
2answers
302 views

Natted client cant ping default gateway

I have a Cisco ASA 5506-x Firewall that I am using to NAT addresses on a machine subnet. These addresses are from a VLAN. When I ping from a 192(Subnet) address to a 177(Vlan)address through the NAT ...
1
vote
1answer
46 views

Catalyst InterVLAN Routing w/ Failover ASAs

I currently have interVLAN routing configured on my Catalyst 3750. My gateway of last resort is my ASA firewall. The switch reaches the firewall through a layer 3 port. The port is configured as ...
1
vote
1answer
94 views

Secure communication between multiple sites over Internet

Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I ...
2
votes
1answer
235 views

ASA 5506-X as NAT only

We have a spare ASA 5506-X that we want to use as a NAT. It will be placed between a VLAN and a machine network. Is it possible to setup the device using only the wizard for this functionality. (I ...
1
vote
1answer
208 views

Route Specific Traffic To Another Firewall

I'm looking for a way to setup a route from my internal LAN to another router. Here's the current situation: I have an ASA5512-X where all servers are connected and all the employees are connected to,...
0
votes
1answer
798 views

Ping from ASA over Site to Site VPN

There are two things I'm trying to solve which are essentially the same problem. Cannot ping from the ASA to remote devices over a site to site VPN terminated on the ASA. ASA AnyConnect LDAP lookups ...
0
votes
2answers
215 views

VPN from azure to internal ASA

My company has created a network topology where we have 2 firewalls. The external one is a DrayTek and the internal one is a Cisco ASA. We also have a dmz connected to the ASA. The DrayTek public IP ...
2
votes
1answer
114 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
0
votes
0answers
934 views

IPsec tunnel getting drop and reconnect itself frequently

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map ...
1
vote
2answers
856 views

Cisco AnyConnect clients connects to Internet via L3 device on inside zone of ASA (default gateway is on the remote network)

I am testing implementation of AnyConnect where AnyConnect client, after establishing IPSec VPN tunnel, must exit to Internet via L3 device that is located on the same network as RA VPN clients, ...
1
vote
1answer
212 views

Site to Site VPN will it conflict with BGP IP address?

I have a site A which consists of the following IP address and subnets: 192.168.10.0/24 (internal) 172.17.0.0/24(DMZ) BGP tunnel tunnel IP with 172.16.0.1 255.255.255.252 Cloud IP address of 10.0.0.0/...
1
vote
1answer
104 views

ASA Ironport WCCP: allow specific host to access only specific url

I need to restrict specific inside host (e.g. 10.0.0.1) to allow accessing only specific URL (e.g. https://www.eestipank.ee/currency/rates/export/csv/custom?imported_at=undefined&chart_start_at=26....
1
vote
1answer
408 views

Cisco ASA not routing without identity NAT?

As I was writing this down I think the solution came to me. As usual. I'll write this down nevertheless to make the world a better place. =D Let's take a look at this beauty of a network ...
2
votes
1answer
2k views

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-...
1
vote
1answer
2k views

What is the need for Reverse Route Injection?

From the definition of Reverse Route Injection, I have understood that it creates static route entries for remote vpn destinations in VPN gateway, so that it can redistribute the routes into into it's ...
2
votes
1answer
931 views

IPsec vpn missing crypto keyring

We have VPN tunnel with our customer and they sent their side VPN config and i am trying to put that config in my Cisco ASA 5585 (9.x) version and it has missing crypto keyring command Customer ...
2
votes
1answer
3k views

ASA anyconnect VPN not able to access remote LAN (inside) network

I have setup ASA5506 for cisco anyconnect VPN and i am able to connect VPN but not able to ping or ssh or anything to any device on remote lan (inside) network 10.0.10.x/24 Here is the network ...
2
votes
2answers
10k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
4
votes
1answer
313 views

Cisco ASA Site to Site VPN

Hoping someone can be of assistance. I am attempting to setup a site to site vpn with two cisco asas. Site A. 192.168.1.0, Static external IP, Cisco ASA 5520 Site B. 10.0.0.0 Dynamic External IP, ...
5
votes
1answer
550 views

Cisco ASA 5505 - Route 2 Public IPs to different VLANs

I am trying to set up a Cisco ASA 5505 firewall on my network, with some important stipulations. I get two usable static IPs from my ISP, one of which I want to use for "home-traffic", and the other ...
1
vote
1answer
853 views

I can't connect to ASDM on my LAN with the enabled inside address shown in CLI

newbie here. Despite the console config here-under, I can't connect to ASA and launch ASDM config from LAN's PC. The latest JAVA is installed, but I get a "This page can't be displayed" message on ...
4
votes
2answers
976 views

Problem with Cisco ASA 5510 DMZ configuration

I need help to resolve this issue. I have a Cisco ASA 5510 and I’m trying access to my webserver from internet but the connection does not work. Please find the network diagram below: I applied this ...
1
vote
1answer
645 views

Cisco IPSec Pass-through on ASA 5505 not working

I have been busting my brain for a few days not and I have so far not been able to figure out what the issue here is. The Problem: I am unable to establish a Client-to-ASA IPSec tunnel from behind ...
1
vote
1answer
238 views

ASA - No internet on NAT'd computers only

ASA5510 without any extra services such as utm and using Comcast business internet. Users stopped getting emails in middle of the night. That was our first indication. After checking things every ...
1
vote
2answers
5k views

Cisco site-to-site vpn multiple subnet route over tunnel

We have a site-to-site VPN tunnel to AWS which was working great until I added another subnet to the ACL list for interesting traffic which was causing a strange issue. It is only allowing me to add a ...
1
vote
2answers
668 views

ASA anyconnect VPN restriction base on group

We have implemented Remote access VPN on ASA and integrate with onelogin cloud base OTP service, where we have LDAP server and onelogin provide RADIUS service to provide LDAP+OTP base authentication. ...
4
votes
3answers
970 views

Cisco ASA Site-to-Site VPN, remote LANs have no Internet

I have a site-to-site VPN from a Cisco ASA 5512 and a Cisco 891. I want all traffic, even Internet access, to come through our ASA. The VPN is established and working. The LANs have connectivity to ...
2
votes
2answers
619 views

ASA traceroute from lower security level to higher security level

In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't ...
2
votes
2answers
10k views

ASA conn flags explain

I have seen following output, but what is the difference between UB vs UIOB vs UIO? I looked at this website, and it has nice explanation, but I am having a hard time to decode it in context: https:/...
2
votes
2answers
2k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...
1
vote
1answer
2k views

How to Multiple Radius server in ASA

We have two RADIUS server for SecureID token auth for VPN and i have configure 10.1.1.1 (primary) but don't know how to configure 10.1.1.2 (backup radius) This is what i have currently aaa-server ...
4
votes
3answers
9k views

Steps to find neighboring device to a Cisco ASA firewalls

What are the right steps to locate a neighboring device adjacent to a Cisco ASA firewall? Can anyone help me with the steps please, one by one?
1
vote
1answer
2k views

How to Cisco Anyconnect increase subscription base license user count

We have Cisco ASA5500 and we purchased L-AC-PLS-LIC= for 25 users for 3 year now if i want to increase users count then how can i increase it to 50? Can i just buy 25 users license and add into or i ...
1
vote
1answer
474 views

Unable to reach public IPs of servers behind ASA 5512

We replaced a Meraki MX with a Cisco ASA, and I'm unable to reach the public IPs of servers behind our firewall now. The server has working Internet access. All packet tracer runs show successful ...
1
vote
1answer
279 views

Unable to properly configure ASA 5512 with WAN IP

I have a /28 block of public IPs from Comcast. I'm trying to put a public IP directly on the ASA outside interface, but when I do I cannot ping 8.8.8.8 or the Comcast modem. Internal communication is ...
0
votes
1answer
47 views

Assign outbound E-mail to specific Ironport server

I'm not a Cisco ASA engineer but wanted to ask if it is possible to create a custom rule to filter a specific outbound email address, like ironportcheck1@contso.com, and assign it to pass thru a ...
1
vote
1answer
2k views

Trouble acl-drop packets on a Cisco asa 5510

I am trying to troubleshoot the cause of "Flow is denied by configured rule (acl-drop)" packets on "show asp drop" on an ASA 8.4 I have done packet captures and packet traces, but I am not able to ...
3
votes
1answer
351 views

Problem with Cisco ASA 5512 NAT Configuration

I need help to resolve this issue. I have a Cisco ASA 5512 and I’m trying to access to my FTP server from external IP but the packets are dropped. Please find the network diagram below: I typed this ...
2
votes
1answer
351 views

ARP flush manual broadcast after IP change

This is strange requirement but thought let me ask if some has good advice, so we have Linux iptables firewall with 3 interface, public, Internal and DMZ now we decided to replace linux firewall with ...
2
votes
1answer
506 views

Cisco ASA Route Outside Track Configuration

I understand route outside (static route) configuration is used to tell the ASA to communicate to the outside world or to traverse internet traffic, but I am confused with this command: route outside ...
2
votes
1answer
2k views

Cisco ASA single isakmp policy for multiple crypto map

We are going to setup multiple site-to-site tunnels to our remote office and every tunnel configuration is identical (same hash,encryption etc). The question is: Do I need to create a separate ...