Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

53 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
0 answers
1k views

Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?

I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu. I ...
Chris Holt's user avatar
5 votes
0 answers
587 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
Ottootto's user avatar
  • 131
5 votes
0 answers
84 views

Customising Cisco Clientless VPN Password Change Screen ASA5525

I'm working with one of the network engineers to customise our login screens for the Cisco clientless VPN, which, apart form time consuming, has been fine (knowledge gap on both of our parts). As part ...
grunt121's user avatar
5 votes
0 answers
12k views

Problem ipsec site to site ASA

I am receiving this error when I try to establish an ipsec site to site vpn: PSEC: Parsing PFKey GETSPI message IPSEC: Creating IPsec SA IPSEC: Getting the inbound SPI IPSEC: New embryonic SA created ...
Tapha Gaye's user avatar
4 votes
0 answers
497 views

SSH to ASA on Exit Side Of VPN Tunnel

I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram). HQ-PC2 - 192.168.10.21 HQ-FW1 eth0 - 192.168.20.2 (outside) HQ-FW1 eth1 - 192.168.10.2 (inside) Branch-...
DavidM's user avatar
  • 171
4 votes
0 answers
66 views

Cisco ASA 5525-X Input Current

In switches, like Cisco Catalyst 2960X-24TS-L, datasheet mention input power: 100 to 240 VAC, 1A to 0.5A. So, I assume input current = 1A@100VAC and 0.5A@240VAC or Cisco Catalyst 3850 + Power Supply ...
Mohamed Allam's user avatar
3 votes
0 answers
1k views

L2L VPN issues Pix 506e and ASA5520

I have a site-2-site vpn tunnel between a Pix 506e 6.3(3) and an ASA 5510 running 9.0(3)6. I can control both sides of the config. This tunnel worked fine until we did a firmware update on the ASA ...
ATX_Admin's user avatar
3 votes
1 answer
451 views

Cisco 5505 PPTP Passthru Config Help

I am new to the 5505 and configuring them. I have several books and the web as research tools however I haven't wrapped my head around the whole thing. I am better at reverse engineering then initial ...
SRH's user avatar
  • 31
3 votes
1 answer
784 views

ASA 5505 OS 9.0 Port Forwarding

I've been beating my head against this for a while now and I've tried all links I could find that were even the least bit relevant to my situation. Any and all information is greatly appreciated. ...
rb88's user avatar
  • 31
2 votes
0 answers
278 views

Problem with BGP aggregate-address behavior in IOS when a large number of OSPF routes update all at once

We have a Direct Connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
Appleoddity's user avatar
2 votes
2 answers
318 views

Static NAT and PAT

I have two private IP addresses, want to make them NAT to 203.0.113.0/2 public IP address. WAY 1 : Static NAT (2 ip addresses NATted to one by manually) WAY 2 : PAT (Router gives port number ...
CoderBoy's user avatar
2 votes
1 answer
515 views

Cisco ASA static nat one-to-many from interface address to object-group

Syntactically, the following set of statements is valid (at least as of 8.3): interface Ethernet0/0 nameif OUTSIDE ip address 192.0.2.1 255.255.255.0 interface Ethernet0/1 nameif INSIDE ip ...
jimbobmcgee's user avatar
2 votes
0 answers
1k views

Problems connecting to clientless vpn portal on a Cisco ASA 5505

Just started a job where they wanted us to re-purpose a local network that wasn't in use and to create a webvpn portal to allow web access to it. We've tried everything and looked every where and ...
Sam B's user avatar
  • 21
2 votes
1 answer
136 views

NAT takes me to a wrong place

We have a 5555-x with multiple interfaces. Our Outside interface and DMZ interfaces have routable IP addresses and DMZ subnet is routed via IP address of the outside interface. Stripped for ...
solefald's user avatar
  • 131
1 vote
0 answers
30 views

Issue with Cisco ASA IPSec VPN clients can't access DMZ network

I have one ASA that is configured for IPSec VPN Cisco client. The VPN allow access to inside network, but trying to get it to my DMZ is a problem. My VPN address pool is defined as 124.140.1.x /24. My ...
Steve's user avatar
  • 11
1 vote
0 answers
34 views

ASAv VM version

Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version. ...
RR Cisco's user avatar
1 vote
0 answers
109 views

asa vlan subinterface over s2s ipsec tunnel to IOS router

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router. i have the static NAT set up to go from the (wifimain,...
ptabs's user avatar
  • 11
1 vote
0 answers
91 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
DavidM's user avatar
  • 171
1 vote
0 answers
36 views

Does modifying a ASA tunnel create a downtime?

I inherited a cisco ASA, I never really had to manage one before. But, I need to modify an existing tunnel to add IP addresses to both the local and remote traffic selector, specifically there are ...
person's user avatar
  • 111
1 vote
0 answers
483 views

Cisco ASA 5585-x Failover Virtual MAC address

I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
Satish's user avatar
  • 4,379
1 vote
0 answers
81 views

Windows L2TP VPN issues when accessing Site to Site VPN on Cisco 5506

We have two Site to Site VPNs and Remote Access VPN configured. Using the builtin IPsec client on OSX all subnets are accessible however when using L2TP built in client on Windows 10 ICMP traffic ...
memory24's user avatar
1 vote
0 answers
490 views

Cisco ASA 5506: Adding two public IP's that are on the same subnet for the primary and backup interface

Im programming a Cisco ASA 5506. I need to add a primary (public) IP that is x.x.x.82/24 and a backup IP that is x.x.x.81/24. The ASA wont allow me to do this as it gives me an error: "the IP ...
TechEng's user avatar
  • 21
1 vote
0 answers
481 views

Cisco ASA L2TP remote-access VPN with addresses assigned by DHCP

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP. The Cisco Client policy has end-users fetch their ...
jimbobmcgee's user avatar
1 vote
0 answers
182 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
BillyCee's user avatar
1 vote
0 answers
363 views

Why can I not see the default gateway when connecting to ASA through AnyConnect?

I've configured an ASA as an AnyConnect server. The IP address pool that'll be assigned to the connecting hosts is from 192.168.10.1-192.168.10.10. Now when I establish a remote access connection to ...
P_K's user avatar
  • 55
1 vote
0 answers
681 views

How can I generate a self-signed certificate with a hash other than SHA-1 on cisco ASA?

I have a Cisco ASA 5508-X with IOS 9.6(1), and I have Apex licenses for AnyConnect which support Suite B, NGE. How can I generate a self-signed certificate with a hash other than default SHA-1. For ...
John's user avatar
  • 812
1 vote
0 answers
29 views

Regarding accessing the MIS server via the public IP from the internal interface

I have port forwarded for my MIS server to be accessed from outside. From inside interface, i use 10.10.2.2:8000 to get access of the MIS. But, what i want right now is to be able to access the MIS ...
de.walkar's user avatar
  • 433
1 vote
2 answers
685 views

Cisco ASA - multiple context configuration for management interface

I have a pair of Cisco ASAs running in active/standby failover mode which I manage using the management interface. Lately, I frequently have to travel and the VPN to the university's LAN has different ...
Ron Vince's user avatar
  • 927
1 vote
0 answers
2k views

DHCP Relay on Cisco ASA over site-to-site VPN

How do I get the DHCP relay function of a Cisco ASA working over a site-to-site VPN? The ops center is behind a 5510 ASA with a 3560 core switch. The DHCP server is at IP 10.0.10.153. The remote ...
paulmanac's user avatar
1 vote
0 answers
634 views

VPN tunnel with duplicate subnets

I have been tasked to setup a VPN tunnel with an external party's network, but I hit a bit of snag. I am currently running a Cisco ASA 5510 with private subnets of 10.1.2.0/24 on the "inside" network....
jaglin84's user avatar
1 vote
1 answer
118 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
PM99's user avatar
  • 11
1 vote
0 answers
489 views

ASA Site-to-Site VPN Configuration

I have some issues regarding my site-to-site vpn konfiguration between two ASA firewalls.. I have two firewalls FW1 and FW2 where FW1 = 192.168.1.0 and FW2 = 192.168.2.0 I used the following ...
user19366's user avatar
1 vote
0 answers
501 views

ASA not following default route

I have the following network which splits a site into a Corp/DMz style network as best I can with the limitations of the ASA in packer tracer. Both routers have static routes to the 10.100.0.0 and 172....
Matthew Williams's user avatar
1 vote
0 answers
416 views

ASA cluster with named interface running PPPoE

I am trying to configure an A/S firewall cluster, and I have the interface configured as a PPPoE client. When I try to configure the clustering on ASDM, I get a message saying that high availability ...
Mr.lock's user avatar
  • 1,723
1 vote
0 answers
3k views

Dual Internet connections in active/standby mode without BGP

hello everyone attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i ...
Networker's user avatar
1 vote
0 answers
6k views

VPN tunnel connection issue

My company has 2 ASA firewall with model 5510 & 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago. I checked from log in ASA5512 firewall, it ...
Man Timothy's user avatar
1 vote
0 answers
88 views

Cisco ASA Hung - Error: "i82546GB/enadap_get: 2 not null"

We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other ...
Maaraa's user avatar
  • 11
1 vote
0 answers
5k views

Connection terminated for peer x.x.x.x. Reason: IPSec SA Idle Timeout

I have configured an IPsec Site - site VPN tunnel with Cisco ASA on both sides.there is no issue with the phase 1 of tunnel.but frequently connection towards some IPs become timedout only from some ...
sunnychen's user avatar
1 vote
0 answers
3k views

Problem Site to Site VPN ASA 5512 8.6.1

I try to establish a vpn connection but i get this error IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382 ...
Tapha Gaye's user avatar
1 vote
1 answer
126 views

Site to site ASA Routing question

I am doing a lab about DMVPN and Site to Site ASA integration. There is no problem in the DMVPN. However I have problem in establishing route from Site to Site ASA to DMVPN. The router on the left is ...
chiajw1's user avatar
  • 37
0 votes
0 answers
55 views

Cisco ASA OCSP configuration

Can anyone help me understand how to configure OCSP on my Cisco ASA? I have AnyConnect Over IKEv2 to ASA with AAA and Certificate Authentication. As RootCA server I have OpenSSL. Now I want to ...
John's user avatar
  • 812
0 votes
0 answers
16 views

Cisco ASA 5525x can't limit speed?

There was a need to limit the speed for users on Cisco ASA 5525x but for some reason these commands are simply not available for me: Example: HQFW(config)# access-list POLICE_TRAFFIC_TO_BRANCH permit ...
Глеб Щеголев's user avatar
0 votes
1 answer
140 views

Troubleshooting ipsec ikev2 site to site vpn

I assume, for peer IP we use, is the wan interface of the Cisco ASA and not the gateway of the ISP correct? Also, all routes should go to the same IP of the wan interface correct? So we have two Cisco ...
user1378803's user avatar
0 votes
0 answers
38 views

Need assistance with Cisco Firepower 5516X: Excluding a single IP from a specific Snort rule

I'm currently managing a Cisco Firepower 5516X device and have encountered a false positive for a specific Snort rule. Instead of disabling the rule for all traffic, I would like to selectively ...
Hsn Sah's user avatar
0 votes
0 answers
38 views

2 Cisco ASA Firewalls - TCP SYN FLOOD

Problem We have 2 firewalls, a DMZ firewall and another firewall named FW1 in a testlab. Both are CISCO ASAs. The shared services and jumphost are behind the FW1 firewall. The 172.28.208.0/24 subnets ...
Kal's user avatar
  • 1
0 votes
1 answer
143 views

DMZ cannot send traffic to INSIDE (Cisco ASA 5505)

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this: int vlan 3 no forward interface vlan 1 nameif dmz ...
Gekko's user avatar
  • 27
0 votes
0 answers
29 views

Cisco Firewall 5512 NAT cause IP randomly mapping to the host

I have an ASA 5512 firewall that has configured with 2 public IP addresses. I use static nat to explosive https service and use PAT to allow my DMZ web server to access the Internet. The CLI are shown ...
kswen's user avatar
  • 1
0 votes
2 answers
173 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
David Huang's user avatar
0 votes
2 answers
620 views

Error accessing Cisco ASA using ASDM

I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment. SHOW RUN =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
MMenefee's user avatar
0 votes
0 answers
2k views

Cisco ASA and missing logs to syslog server

I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1. When running the following settings I could see a lot of information in the buffer with ...
Muffe's user avatar
  • 23