Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

44 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
713 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
4
votes
0answers
920 views

Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?

I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu. I ...
4
votes
0answers
482 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
4
votes
0answers
78 views

Customising Cisco Clientless VPN Password Change Screen ASA5525

I'm working with one of the network engineers to customise our login screens for the Cisco clientless VPN, which, apart form time consuming, has been fine (knowledge gap on both of our parts). As part ...
4
votes
0answers
11k views

Problem ipsec site to site ASA

I am receiving this error when I try to establish an ipsec site to site vpn: PSEC: Parsing PFKey GETSPI message IPSEC: Creating IPsec SA IPSEC: Getting the inbound SPI IPSEC: New embryonic SA created ...
3
votes
0answers
56 views

Cisco ASA 5525-X Input Current

In switches, like Cisco Catalyst 2960X-24TS-L, datasheet mention input power: 100 to 240 VAC, 1A to 0.5A. So, I assume input current = 1A@100VAC and 0.5A@240VAC or Cisco Catalyst 3850 + Power Supply ...
3
votes
0answers
1k views

L2L VPN issues Pix 506e and ASA5520

I have a site-2-site vpn tunnel between a Pix 506e 6.3(3) and an ASA 5510 running 9.0(3)6. I can control both sides of the config. This tunnel worked fine until we did a firmware update on the ASA ...
3
votes
1answer
646 views

ASA 5505 OS 9.0 Port Forwarding

I've been beating my head against this for a while now and I've tried all links I could find that were even the least bit relevant to my situation. Any and all information is greatly appreciated. ...
2
votes
2answers
445 views

IKEv2 tunnel between ASA and Mikrotik

Trying to move from pfSense to Mikrotik for an office router, and the only stumbling block is maintaining a site-to-site IPSEC tunnel between it and our Cisco ASA. The settings all look correct to me, ...
2
votes
0answers
60 views

Cisco ASA static nat one-to-many from interface address to object-group

Syntactically, the following set of statements is valid (at least as of 8.3): interface Ethernet0/0 nameif OUTSIDE ip address 192.0.2.1 255.255.255.0 interface Ethernet0/1 nameif INSIDE ip ...
2
votes
0answers
3k views

Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable

I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured ...
2
votes
0answers
847 views

Problems connecting to clientless vpn portal on a Cisco ASA 5505

Just started a job where they wanted us to re-purpose a local network that wasn't in use and to create a webvpn portal to allow web access to it. We've tried everything and looked every where and ...
2
votes
0answers
424 views

Cisco 5505 PPTP Passthru Config Help

I am new to the 5505 and configuring them. I have several books and the web as research tools however I haven't wrapped my head around the whole thing. I am better at reverse engineering then initial ...
1
vote
0answers
48 views

Cisco ASA 5506: Adding two public IP's that are on the same subnet for the primary and backup interface

Im programming a Cisco ASA 5506. I need to add a primary (public) IP that is x.x.x.82/24 and a backup IP that is x.x.x.81/24. The ASA wont allow me to do this as it gives me an error: "the IP ...
1
vote
1answer
152 views

Arpping responding with Cisco ASA interface mac address and mac address of machine

For some reason our Cisco is responding to arp requests between machines on the same switch. It's not breaking anything but it is slowing initial connections. I've been making a lot of changes on the ...
1
vote
0answers
316 views

Cisco ASA L2TP remote-access VPN with addresses assigned by DHCP

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP. The Cisco Client policy has end-users fetch their ...
1
vote
0answers
90 views

Why can I not see the default gateway when connecting to ASA through AnyConnect?

I've configured an ASA as an AnyConnect server. The IP address pool that'll be assigned to the connecting hosts is from 192.168.10.1-192.168.10.10. Now when I establish a remote access connection to ...
1
vote
0answers
460 views

How can I generate self-signed certificate with hash other then SHA-1 on cisco ASA

I have Cisco ASA 5508-X with IOS 9.6(1), and I have Apex licenses for AnyConnect which support Suite B, NGE. How can I generate self-signed certificate with hash other then default SHA-1. For example ...
1
vote
0answers
27 views

Regarding accessing the MIS server via the public IP from the internal interface

I have port forwarded for my MIS server to be accessed from outside. From inside interface, i use 10.10.2.2:8000 to get access of the MIS. But, what i want right now is to be able to access the MIS ...
1
vote
0answers
570 views

Cisco ASA - multiple context configuration for management interface

I have a pair of Cisco ASAs running in active/standby failover mode which I manage using the management interface. Lately, I frequently have to travel and the VPN to the university's LAN has different ...
1
vote
0answers
1k views

DHCP Relay on Cisco ASA over site-to-site VPN

How do I get the DHCP relay function of a Cisco ASA working over a site-to-site VPN? The ops center is behind a 5510 ASA with a 3560 core switch. The DHCP server is at IP 10.0.10.153. The remote ...
1
vote
0answers
530 views

VPN tunnel with duplicate subnets

I have been tasked to setup a VPN tunnel with an external party's network, but I hit a bit of snag. I am currently running a Cisco ASA 5510 with private subnets of 10.1.2.0/24 on the "inside" network....
1
vote
0answers
69 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
1
vote
0answers
479 views

ASA Site-to-Site VPN Configuration

I have some issues regarding my site-to-site vpn konfiguration between two ASA firewalls.. I have two firewalls FW1 and FW2 where FW1 = 192.168.1.0 and FW2 = 192.168.2.0 I used the following ...
1
vote
0answers
167 views

Accessing inside VLANs from DMZ interface on a Cisco ASA

I have set up a test machine on my dmz2 interface. I need to access the inside VLAN configured on the core L3 which has a route from ASA to core L3. Below is the basic configuration on the ASA : ...
1
vote
0answers
89 views

NAT takes me to a wrong place

We have a 5555-x with multiple interfaces. Our Outside interface and DMZ interfaces have routable IP addresses and DMZ subnet is routed via IP address of the outside interface. Stripped for ...
1
vote
0answers
384 views

ASA not following default route

I have the following network which splits a site into a Corp/DMz style network as best I can with the limitations of the ASA in packer tracer. Both routers have static routes to the 10.100.0.0 and 172....
1
vote
0answers
353 views

ASA cluster with named interface running PPPoE

I am trying to configure an A/S firewall cluster, and I have the interface configured as a PPPoE client. When I try to configure the clustering on ASDM, I get a message saying that high availability ...
1
vote
0answers
2k views

Dual Internet connections in active/standby mode without BGP

hello everyone attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i ...
1
vote
0answers
4k views

VPN tunnel connection issue

My company has 2 ASA firewall with model 5510 & 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago. I checked from log in ASA5512 firewall, it ...
1
vote
0answers
81 views

Cisco ASA Hung - Error: “i82546GB/enadap_get: 2 not null”

We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other ...
1
vote
0answers
4k views

Connection terminated for peer x.x.x.x. Reason: IPSec SA Idle Timeout

I have configured an IPsec Site - site VPN tunnel with Cisco ASA on both sides.there is no issue with the phase 1 of tunnel.but frequently connection towards some IPs become timedout only from some ...
1
vote
0answers
2k views

Problem Site to Site VPN ASA 5512 8.6.1

I try to establish a vpn connection but i get this error IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382 ...
1
vote
1answer
586 views

Cisco ASA context OSPF configuration issue

I've two cisco ASA configured in active/active HA. ASA is connected to switch with port-channel. Switch configuration: interface Port-channel47 description ASA2 switchport mode trunk switchport ...
0
votes
1answer
28 views

Much ARP requests from Cisco ASA 5510

An employee of the ISP writes to me that a lot of ARP requests from us go to them. ISP equipment log: 07:47:27.732242 ARP, Request who-has AAA.BBB.CCC.213 tell AAA.BBB.CCC.53, length 46 07:47:27....
0
votes
0answers
9 views

Site to Site VPN between Cisco ASA and Aruba Virtual Gateway

We have hosted an Aruba Virtual Gateway on AWS. All the configurations are done as per the documentation of Aruba VPNC. Through AWS security policies, UDP 4500 is open on AWS side. We want to ...
0
votes
0answers
20 views

How can I get a CRL automatically on cisco ASA? Do I have to configure OCSP?

I need to get a CRL on cisco ASA without requesting a crl manually. Do I have to configure OSCP, or is there anything else to get a crl automatically?
0
votes
0answers
266 views

Cisco ASA and missing logs to syslog server

I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1. When running the following settings I could see a lot of information in the buffer with ...
0
votes
0answers
41 views

Advanced split tunnel question

We are in a work from home state, and I am looking at optimizing VPN without sacrificing security. We are not using split tunnel. We have Direct Access on most clients - it is slow, and have moved ...
0
votes
0answers
72 views

Cisco ASA Security Warning: Untrusted server cert after asa crash and reload

We have Cisco ASA 5505 working VPN anyconnect and it's been almost 1 year no issue, but last week it got crashed and reboot itself and after that we found it started throwing warning like following: ...
0
votes
0answers
46 views

Anyconnect Cisco 5505 VPN Group cannot Access Inside Network

Below is the Configuration to my Cisco ASA. I can connect to VPN but then trapped and cannot enter the inside network. ASA Version 9.2(4)27 ! hostname AwBTech-ASA domain-name awbtech enable password ...
0
votes
0answers
80 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
0
votes
0answers
652 views

Creating an overlay network using ASA and VXLAN over IP MPLS

I need to extend an existing VLAN from a branch LAN to DC. As a matter of fact I noticed that Cisco ASA 5500X have VXLAN capabilities. I am relatively new to VXLAN and I need some help to find the ...
0
votes
0answers
8k views

Adding a secondary address to an interface on a Cisco ASA

On an ASA5505 version 8.2, I have three internal IP subnets that I want to: Pass traffic between as if they were on the same subnet Share the same gateway Share the same VLAN I've been working to ...