Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

1
vote
1answer
430 views

Block private addresses for Egress traffic passing through an ASA firewall performing NAT translation

I am completing a lab and have been told I should ALWAYS block Egress traffic from private address ranges. The ASA performs NAT translation of private IPs to the public IP address assigned to the '...
0
votes
1answer
67 views

Network report integrated with Active Directory or Users

How can i take network report of bandwidth consumption that integrated with AD or users? I have ASA 5506 and configured netflow 9 with PRTG, I can see the source IP and Destination IPs, Is there any ...
1
vote
2answers
551 views

ASA's traffic policy(QoS) for ipsec VPN tunnels

i have ipsec l2l VPN over internet, I wander if there is default policy in ASA for making ipsec traffic with higher priority? My question basically is, if one of packet from two packets must be ...
1
vote
1answer
251 views

No traffic over ASA 5505 site to site tunnel

I'm not seeing traffic in either direction on a new site-to-site VPN. (Two others are fine) I can't see what is wrong. : ASA Version 9.2(4)13 ! hostname wss domain-name xxxxxxxxxxxx.com enable ...
2
votes
2answers
744 views

allowing udp/443 on top of tcp/443 on ASA-5505

I have ASA-5505 with public IP facing interface with port forwarding https/443 to a Barracuda SSL VPN appliance. (Barracuda has private ip only). Running in L2 mode where remote hosts feel like they ...
2
votes
3answers
6k views

IKEv2 Site to Site from Cisco ASA 5506 to Azure “RouteBased” VPN

I am having a little bit of a problem setting up a IKEv2 site to site to Azure cloud. I am using the IPSec permaeters from this document. Phase1 is established, but I cant figure out Phase2, here is ...
1
vote
1answer
271 views

ASA5505 - no outside access

This should be simple but I'm missing something. Setting up an ASA 5505 to replace an old Netgear router. Same external IP address and gateway. I'm not getting access to the internet from the inside. ...
1
vote
2answers
553 views

Branch Office Config with ASA and L3 Switch

We have a number of branch offices consisting of one or more 2960 series switches and a 55xx series firewall. The switches are usually stacked, and have at least IP Base feature sets. In most offices,...
1
vote
1answer
467 views

ASA wont pass all traffic

I have an ASA I set up for a non profit org which is not passing traffic. Packet tracer gives me mixed results depending on where the traffic is coming from, the two results are that the traffic is ...
1
vote
1answer
95 views

Outbound VPN connection from DMZ, without using jumpserver

Im using a Cisco Asa 5505 but I don't think it has anything to do with the my issue. I have 2 VLAN:s on my ASA Inside(192.168.1.) and DMZ(10.10.0.). In my DMZ I have one host that is used as a PPTP/...
1
vote
1answer
750 views

Configuring redundancy Site to Site VPNs with different ISPs

I'm trying to configure two Site to Site VPNs from one Cisco ASA 5585x to two separate FWs with different ISPs. I found that multiple peer IP addresses can be configured under ASDM, Configuration > ...
1
vote
1answer
1k views

Internet access through ASA firewall

I am new to ASA firewall. I have ASA 5520 firewall (hardware) I want my clients in my Local network to gain internet access through the firewall. So it should be like this: ISP to Billion modem to ...
1
vote
1answer
251 views

Cisco ASA web portal clientless VPN login issues via RSA token authentication

Heyho, I got a problem after ASA Update to 9.1 with the authentication on the ASA web portal with RSA Token. Before the we were on ASA 8.4 and everything was fine. A new token was assigned to a co-...
2
votes
1answer
3k views

How can I disable temporarily Cisco AnyConnect user from ASDM?

I created user under local users. Now I need to disable the user connecting through VPN for a while only. Platform is ASA 5512 with ASDM 7.6.
0
votes
1answer
111 views

How to monitor “Web Activity” of standalone users/clients on WiFi/LAN without restricting them?

kindly help me How can I monitor "Web Activity" of standalone users/clients on WiFi/LAN without restricting them? => Requirements:- (1) Just want to monitor "The visited websites, HTTP, HTTPs, FTP,...
1
vote
1answer
1k views

Ping LAN via Anyconnect VPN

I'm trying to configure the VPN on a Cisco ASA 5510. I can connect to it without any problem and I can ping my switch (172.16.1.2/24) but I can't ping the gateway (172.16.1.1/24) nor the Google public ...
1
vote
1answer
2k views

Cannot ping LAN via VPN

I'm configuring a Cisco ASA 5505. I try to configure a AnyConnect VPN. It works for the outside GAN. I have access to that, I can ping it also, but I cannot ping/access anything that is in my LAN. Can ...
2
votes
1answer
438 views

Problem with trunk between Cisco ASA 5505 and Catalyst 3750G

I'm trying to make a trunk between a Cisco ASA 5505 with the IP Service licence and a Cisco Catalyst 3750G. Here are my current config's: ASA: interface Ethernet0/1 switchport trunk allowed vlan ...
1
vote
0answers
2k views

Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable

I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured ...
2
votes
1answer
610 views

Cisco ASA allow no-nat public subnets

Testing in a lab...I have a VLAN directly attached to a Cisco ASA 5520 that contains host machines who use IPs from a public address space, 11.11.11.0/26 for example. The ASA has two interfaces this ...
2
votes
2answers
166 views

Cisco ASA 5505 ver 8.2 Firewall

I am working on a project to allow ICMP through the firewall from the outside interface to an inside interface. I have configured the firewall to inspect icmp and allowed icmp through access-list ...
1
vote
2answers
961 views

Cisco ASA-5505 - Can ping the Internet from LAN connected devices, however I cannot ping from the LAN interface to the Internet

I am new to Cisco ASA and ASDM. Struggling with difference from IOS devices. Network layout is as follows: AWS VPC -- IPsec tunnel -- ASA-5505 -- LAN Currently: IPsec tunnel is up. AWS can reach ...
2
votes
2answers
723 views

can a cisco ASA be configured as a DHCP server for a VLAN on a subinterface? and route packets between VLANs?

We are in the process of planning to phase out a Sonicwall tz205 in our office. i am hoping to replace it with a CISCO ASA 5516 specifically. We have three networks in house the main production ...
0
votes
1answer
739 views

How to configure port to port forwarding on ASA 5512-X?

Below is the config. The port redirection is working, but the range of the ports and other ports permitted in the access-list are not opening: object network TEST_PUBLIC_IP host 10.10.10.10 object-...
1
vote
2answers
886 views

Packets are not being de-capsulated on the ASA end of a VPN

I have an ASA that I take care of remotely. On this device, there are about 6 IPSec tunnels. All of them work as expected. Recently I had to create one for the new office. I am having problems with ...
2
votes
2answers
338 views

Packet capture on a Cisco ASA

how is packet capturing on the ASA firewall different or similar to setting up a syslog server for the capture. I want to capture interesting traffic on the FW and store them for analysis during ...
0
votes
1answer
36 views

Cisco gateway and firewall changing addresses?

We have a Honeywell control board that has an Ethernet controller. We have assigned a static IP address as such: IP: 10.2.112.12 Mask: 255.255.254.0 GW: 10.2.112.2 The gateway is a Cisco router. ...
2
votes
2answers
365 views

Cisco Network ACL on ASA

We have the following access list on our router: access-list 101 permit ip 10.16.43.0 0.0.0.255 172.50.0.0 0.0.127.255 Traffic from our router flows through our Cisco ASA. I have been told that I ...
1
vote
2answers
5k views

Source and Destination NAT in cisco ASA

Really confused regarding source NAT and Destination NAT in Cisco ASA. I have a NVR in IP 10.10.20.20 and locally it is opened via http://10.10.20.20. Remotely, i want this to be accessed via my ...
-1
votes
1answer
141 views

Viewing Geo-Map in Cisco SourceFire FireSight Defense Center

Is there a way to view a geographical representation, specifically a map of network malware and intrusion events, within Defense Center?
5
votes
4answers
6k views

How can i add a host to an already existing object group in ASA

How can i add a host to an already existing object group in ASA, without over-writing the already existing members ? Please suggest For Example: Object group TEST has 2 members, and i want to add ...
1
vote
2answers
167 views

PC IP address through internet to ping VPN host

I have made a network and i posted the topology below, i need to ping through the internet to a host inside the network. which will essentially be a VPN and i need help on giving the network "VPN" ...
1
vote
2answers
598 views

Inside to outside firewall ping

Hi guys I am trying to get ping from a inside host to outside host, i have posted my topology below, can someone please provide the correct configuration so i can do this? thank you.
1
vote
1answer
120 views

Trying to go from inside to outside

Trying to go from inside network to outside network, I have a 3560 switch connecting to a 2960 switch which connects to 5520 ASA firewall. I have a Single 3560 switch for my outside network connecting ...
2
votes
1answer
1k views

How can i open a group of ports in ASA 5512?

Am dealing ASA first time. I want to install aplplication in my server and it needs some ports to be open in firewall. so i need to open tcp,udp,http,https,ssl ports. How can i configure this on ...
2
votes
2answers
9k views

debug crypto ipsec via ssh

How to debug IP Sec VPN on ASA using SSH? I try debug crypto ipsec terminal monitor logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC ...
0
votes
2answers
681 views

Can I connect the two routers back to back to use HSRP? Please suggest

Current network is like - MSP network--> Cisco 4431--> ASA--> N7k--> LAN. I'm adding one more router and one more ASA in the network, Do I really need to add L2 switch to connect routers LAN side and ...
2
votes
2answers
2k views

Regarding the Manual NAT in Cisco ASA

I have cisco ASA 5515-x running version 9.2. I want to port forward the request on 80 to 9006 which is of my DVR. I did this : object network obj-10.10.26.6 host 10.10.26.6 object network obj-203....
3
votes
1answer
12k views

ASA tunnel up but not passing traffic

I have two offices (Victoria at IP 1.2.3.4 and Toronto at IP 5.6.7.8) each with pfSense running Strongswan, and each with an IKEv2 IPSec tunnel back to a Cisco ASA 5512 at IP 9.8.7.6. I recently ...
1
vote
1answer
2k views

Anyconnect doesn't tunnel internet

I have set up the ASA as VPN Server (SSL). Everything works great. I can reach every office network and also the Internet. Now I noticed that on our old network, the configuration was different. When ...
1
vote
1answer
1k views

Cisco ASA syslog filtering

I've got a Cisco ASA forwarding syslog messages to a remote server (which is working great). However, after reviewing the logs, I've noticed a lot of 302013 and 302014 events with one particular ...
1
vote
2answers
624 views

Problem with DHCP for wired guest clients - Cisco WLC

I am very new to Cisco wireless. The most important settings on Cisco WLCs 5508 were done by external engineer. I have got an issue with wired guest network, my DHCP server (Cisco ASA Firewall) is not ...
1
vote
4answers
940 views

Cisco ASA5505 configure web server

I'm sure there's answers to this all over the internet but I've tried for days and days and I just can't get it. Maybe I'm cisco dyslexic. I have a simple home connection and lets say my external web ...
2
votes
1answer
169 views

Cisco ASA network object host changes with NAT

How do I take this: object network obj-nat_DNS1 host 10.128.33.11 object network obj-nat_DNS2 host 10.128.33.12 And change the hosts to different IPs? I'm not trying to delete the network objects,...
1
vote
1answer
683 views

Real IP phone in GNS3 Problem

I am trying to link this configuration to a real SPA 303 IP phone but I do not know where to begin with this. I have the physical IP Phone, but I want to run it through the simulated environment that ...
2
votes
2answers
2k views

Cisco ASAv not building up child SA

Background information I have a Cisco 2911 router and a Cisco ASAv connected using a IKEv2 based IPSec tunnel. The tunnel initially comes up fine as soon as there is some traffic from the routers end....
2
votes
2answers
499 views

Logging hit count ACEs that are used in NAT rules on email

Can anyone tell me all the commands that I need to enable logging on my email, hit count on access control entries that I use in static NAT with port translation, on my ASA 5525-X? I tried with: ...
3
votes
1answer
4k views

Apple devices causing “Land Attack” on Cisco ASA

Recently migrated to a Cisco ASA/Sourcefire implementation in our enviroment and have been going through the logs on the ASA. Looking over the logs I noticed multiple critical errors that kept coming ...
3
votes
1answer
557 views

AWS VPC and Cisco ASA

I am trying to setup a VPN connection using AWS VPC. I have generated the VPN configuration files and have sent to the client. However the client is asking for the Blue highlighted info in the ...
2
votes
0answers
731 views

Problems connecting to clientless vpn portal on a Cisco ASA 5505

Just started a job where they wanted us to re-purpose a local network that wasn't in use and to create a webvpn portal to allow web access to it. We've tried everything and looked every where and ...