Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

1
vote
2answers
115 views

Traffic replicated across multiple VLANs - ASA

Have a switch connected to a FW via a trunk. The receiving interface on the FW is a PO with subif's for each VLAN on the trunk. We have a flow we want to track coming in on VLAN 306 / SEC_Data, ...
2
votes
1answer
524 views

Implement ospf routing

My topology is ---rtr1-.1---192.168.10.0/24....2.asa1-.2---1.1.1.0/24----.1-asa2-.1---192.168.20.0/24---.2-rtr2 My goal is rtr2 can reach rtr1 via OSPF routing and vice versa my problem is on ASA, I ...
1
vote
1answer
439 views

Deactivate Security plus licence on ASA 5585

We activate Cisco licence L-ASA5585-SEC-PL (Security Plus) to enable 10G ports and everything working but now i want to deactivate that licence but i am getting this error ciscoasa(config)# ...
2
votes
3answers
4k views

Subinterfaces on ASA5506-X doesn't communicate with the switch or computer

We are upgrading from ASA5505 to ASA5506-X, but unlike the ASA5505, the new firewall ASA5506-X doesn't have switch ports and does not support vlans on physical interfaces. So, I'm creating vlans on ...
3
votes
2answers
2k views

Cisco ASA Port Forward using a custom RDP Port

I am having trouble setting up RDP access from outside the network using a custom port. I would like for port 5000 to be translated externally to 3389 internally. I have set it up with the commands ...
1
vote
1answer
193 views

ASA 5585 Error ASA-MPC module found in wrong slot

We have following ASA 5585-x with two SSP-10 module and i am seeing following error when i plug my console on top (SSP-10) module. **************************************************************** ****...
3
votes
1answer
529 views

ASA 5505 OS 9.0 Port Forwarding

I've been beating my head against this for a while now and I've tried all links I could find that were even the least bit relevant to my situation. Any and all information is greatly appreciated. ...
1
vote
1answer
276 views

ASA Update OpenConnect Fatal SSL error

I've upgraded my ASA 5512-X from ASA 9.6(2) to ASA 9.8.1. After the upgrade Openconnect fails with following Error SSL connection failure: A TLS fatal alert has been received I didn't change any ...
1
vote
1answer
275 views

ASA 5585-X with SSP-10 License

We are planning to buy ASA 5585-X SSP-10 so have question related licensing, what comes with base model? we need following feature does base model cover that without any extra license? VLAN (number ...
2
votes
1answer
772 views

Can a Cisco ASA firewall do force remote VPN?

Right now I have Remote Access VPN configured to use fulltunnel. Right now when I am off the VPN I can still browse external sites (google, yahoo, etc) which is using my local ISP. If I want to VPN ...
0
votes
1answer
109 views

Pass traffic to ASA from Spokes via Hub

Good afternoon, The network will be MPLS in the future and I am thinking about new design for it. We will have hub router with ASA behind and couple spokes without the need for IPsec (at least for ...
1
vote
1answer
1k views

Going from Split-tunnel to Full-tunnel VPN on ASA Firewall

I have seen some posts regarding this but I am still a little hazy on the topic. I have a task to take our VPN solution which is split-tunnel and go full-tunnel with it. I am looking at my config ...
1
vote
1answer
258 views

What is the hex number at the end of a Cisco access-list?

This is the output of show access-list aclOUT command in Cisco ASA firewall access-list aclOUT line 15 extended permit icmp any host 10.255.255.1 echo-reply (hitcnt=2) 0x2ae70942 My questions is ...
0
votes
1answer
2k views

ASA 5510 Enable traffic between two or more hosts connected to the same interface

I have three hosts connected to my ASA; two security cameras and one server running the security software. All ports belong to one interface, all on the same VLAN. The cameras and server can ...
1
vote
1answer
534 views

VPN hairpin and port forwarding on ASA 5506x

I have a Cisco ASA5506x on which I want VPN hairpin so that all VPN traffic goes through the ASA A port forwarding for RDP (3389) to my RDP server I can get them to work separately depending on ...
0
votes
1answer
1k views

External DNS intermittent issue on anyconnect remote vpn

I have a anyconnect remote vpn profile where I am having the problem with intermittent issue with external dns. I can not open any external weblink and cant ping it with name but accessing them with ...
1
vote
1answer
99 views

Trouble routing between subnets

Here’s my scenario. I have 2 offices and a remote worker. Office 1: 192.168.11.0/24 – Cisco ASA 5505, ASA 8.2(5) Office 2: 192.168.12.0/24 – Cisco ASA 5505, ASA 8.2(5) Office 2 printer: 192.168.12....
0
votes
1answer
86 views

Exporting cisco ASA configuration into HP aruba?

I wanted to export the configurations from cisco asa firewall into HP aruba ,is there anyway we can make it happen. My company just installed the HP and replaced it with cisco arube, and we have a lot ...
2
votes
2answers
394 views

ASA not passing traffic

I hate posting things like this, but we're backed into a corner here. We recently had a new client ask us to set up an ASA for their branch office 800 miles away. A colleague and I spent last night ...
1
vote
1answer
487 views

VPN: IPsec tunnel between Private IP ASA & Public IP ASA

We have a user that moved recently to an incubator, in order to secure his traffic between his computer and the office we purchased an ASA 5505 to connect to his desktop, and hoped we could configure ...
4
votes
1answer
628 views

Error Message %ASA-3-210007

I have two ASA 5525-X joined in cluster. Software on both ASAs is 9.7(1)4. I run them in multi-context mode. We will talk about admin context on which I have problem. When ASA-1 is master and ASA-2 ...
2
votes
1answer
3k views

Cisco ASA - My NAT is forcing traffic out the wrong interface!

Cisco ASA 5508, 9.6.3 code. I have 2 outside interfaces BACKUP and PRIMARY and a INSIDE interface. For some reason the NAT sends traffic out the BACKUP interface even when BACKUP is down! [Edit I ...
1
vote
2answers
487 views

Global IP sourced on my INSIDE interface to another global IP on OUTSIDE interface

I have a Cisco ASA that gives me some sylogs that I do not understand. My INSIDE interface is where all my private IP addresses reside for the enterprise i work for. My OUTSIDE interface is what has ...
1
vote
1answer
450 views

Options for setting up a DMZ and internal network with an ASA 5505 and a single switch

This is an attempt to clarify my original post which was too long. My task is to add a DMZ to our network. Currently, the internal network is connected to one ASA interface. I have been able to set ...
0
votes
2answers
65 views

Cisco ASA 5510 - re-route to an alternative destination if server down

I work in a very small software development team where we (just about) manage a couple of Cisco ASAs (model 5510, version 8.4). None of us are Cisco experts. We are attempting to increase our ...
1
vote
1answer
247 views

Extended Traceroute on ASA 5550

My co-worker and I are curious if you can use the traceroute [IP Address] source [interface name] successfully on the Cisco ASA 55** series. We are running on 8.4(2). Thanks
2
votes
1answer
2k views

Access list with SNMP v3 Cisco

I was wondering if someone could help me with something. I am trying to set up SNMP v3 but with access control. Now, I have made the user and group. That's all fine, but I can't seem to get the access ...
2
votes
2answers
392 views

Can Cisco ASA be a firewall for another public IP?

New to Cisco here, and wanting to know if an idea is possible with my ASA 5506-X (version 9.5). The ASA has a public/external IP that (for example) is z.z.z.3. Currently, it is performing SNAT for ...
2
votes
2answers
5k views

How to Upgrade Cisco AnyConnect?

So I am in the process of upgrading our Cisco AnyConnect client on our ASA from 3.1 to 4.4 for an upcoming ISE upgrade. I've transferred the files to the ASA's flash, and we are ready to change the "...
1
vote
1answer
508 views

ASA Idle Connection Timout 60 Minutes

I have an ASA 5512-X and have the Problem, that when I'm starting an SSH session and leave it running, it cancels the conenction after 60 Minutes. I have two Policy Rules policy-map type inspect ...
3
votes
1answer
428 views

Cisco ASA, redirect Anyconnect SSL VPN to new address/url

We have changed our ASA's DNS name from vpn-1.old-domain.com to vpn-1.new-domain.com. A connection profile in a user PC contains the old one VPN host: vpn-1.old-domain.com. So, due to connection there ...
5
votes
2answers
282 views

Issue configuring multiple ISPs under subinterfaces

Background: 2 Cisco 2911 for two ISPs -> two physical ports on a Cisco 2960 switch -> a single port on ASA5520 I am running out of ports on a the ASA so I am thinking if i could do this the ...
3
votes
0answers
696 views

Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?

I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu. I ...
2
votes
2answers
258 views

Increasing output drops on a 2960 switch

Total output drops are still increasing on a Cisco 2960 switch trunk interface that is connected to ASA interface. What causes these drops?
1
vote
2answers
264 views

Branch office network

We going to open branch office. In Head office we have 2 ASA firewalls (active-standby) and 2960 switches on each floor. How can i connect branch office to the main office ? I have 2901 Router and HP ...
1
vote
0answers
415 views

How can I generate self-signed certificate with hash other then SHA-1 on cisco ASA

I have Cisco ASA 5508-X with IOS 9.6(1), and I have Apex licenses for AnyConnect which support Suite B, NGE. How can I generate self-signed certificate with hash other then default SHA-1. For example ...
2
votes
1answer
318 views

Unbalanced port-channel utilization

I have below setup: +------------------+ vPC +------------------+ | | | | | NX5K-SW01 +-----------------------+ ...
5
votes
1answer
1k views

Advertise static route via BGP from Cisco ASA 5512-x

I'm currently using a Cisco ASA 5512-X to establish an IKEv1 VPN with an Amazon Web Services VPC. I'm using BGP to advertise the route as per this example. So far everything is working great, my local ...
2
votes
1answer
64 views

NAT test environments

I need to create 4x test environments, each environment contains 3x servers within a 192.168.215.0/24 subnet. Each test environment does NOT need to be aware of the other test environments. The ...
3
votes
1answer
3k views

Cisco ASA SIP/RTP inspection question

I have following scenario: [VoIP phone]--------[ASA 5550]----------[SIP Server] VoIP phone: 10.0.0.10 SIP server: Public Address Question: In above scenario do i need to specify or open RTP ...
2
votes
3answers
592 views

Cisco ASA 5510 IP Hairpin NAT

I’ve been going round in circles for the last few days trying to accomplish this: I’ve not had much experience with cisco routers, this is a ASA 5510 running 8.2 (old command structure). In a ...
1
vote
3answers
6k views

NAT-T Traversal on a Cisco ASA

I'm trying to set up a IPSec VPN connection between a Cisco ASA and a Mikrotik router (which is behind a Fritzbox in DMZ mode). I think everything is set up correctly except for that NAT-T is missing ...
2
votes
1answer
100 views

connecting two isp's to my network

Hi My network has the following resources: 3 ASA-5505 w/site-to-site VPN's newly acquired c801F-K9 router Exchange Server 3 ISP's (soon to be 2) A t-1, DSL, Satellite. VOIP Cisco Cme My goal is to ...
1
vote
2answers
104 views

Does a cold spare Cisco ASA we need a separate license to keep it up to date?

We have 2 ASA 5505's. The one that is in production does have a current contract on it, but the second one is a spare so we did not renew it since it was replaced with a 5512 at another location. ...
2
votes
1answer
2k views

ASA5550 manual failover question

We have two ASA5550 primary & secondary and they are pretty old running from since last couple year and we never bother to touch but recently we are doing some maintenance and found we need to ...
7
votes
2answers
2k views

Cisco ASA: Why does static NAT block access through VPN? [closed]

TL/DR I set up a static nat rule, so that I can use my public internet IP address to directly ssh into a dedicated machine on the inside network. As a result I cannot ssh into the dedicated machine ...
2
votes
1answer
746 views

Cisco ASA Site to Site Ikev2 certificate authentication without Certificate authority

Is is possible to setup site to site ipsec tunnel on two ASA with certificate authentication without available certificate authority for both ASA. As per guide from: Cisco site Certificate authority ...
0
votes
2answers
515 views

Remote access vpn to connect company provided laptop only

I have a request from business where they need to have this feature which only allows users to connect to remote vpn only if they are using company provided laptop and restrict them if they use their ...
1
vote
1answer
355 views

ASA 5506W AP the wrong image upload

I tried upgrading ASA 5506W AP and upload the wrong image k9w8- full lightweight instead k9w7- autonomus. How to fix it
-1
votes
1answer
253 views

Can't Configure CISCO ASA 5505 firewall

HELP ME..!!!! I want to Design my Network as like as Below. I tried several times but Failed (Failed to ping Web server from my Local LAN and also from LAN). My configuration is: interface Vlan1 ...