Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

5
votes
1answer
2k views

Cisco ASA multiple dynamic VPN support (defaultRAGroup-defaultl2lGroup)

Question (short) How to set up 2 totally different dynamic l2l vpn tunnels on an ASA5506 Question (extended) We have a Cisco ASA5506 Security Appliance and we want to set up 2 dynamic VPN setups. ...
3
votes
1answer
531 views

ASA 5505 OS 9.0 Port Forwarding

I've been beating my head against this for a while now and I've tried all links I could find that were even the least bit relevant to my situation. Any and all information is greatly appreciated. ...
1
vote
1answer
349 views

Cisco ASA context OSPF configuration issue

I've two cisco ASA configured in active/active HA. ASA is connected to switch with port-channel. Switch configuration: interface Port-channel47 description ASA2 switchport mode trunk switchport ...
5
votes
0answers
289 views

ASA5515 - QM FSM error / failed to establish L2L SA when transferring large files

I was hoping someone could help me with a problem I’m having - a little clarification or advice would be much appreciated: The Issue: I have set a new backup server and I want to back up data from ...
3
votes
0answers
37 views

Cisco ASA 5525-X Input Current

In switches, like Cisco Catalyst 2960X-24TS-L, datasheet mention input power: 100 to 240 VAC, 1A to 0.5A. So, I assume input current = 1A@100VAC and 0.5A@240VAC or Cisco Catalyst 3850 + Power Supply ...
3
votes
0answers
701 views

Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?

I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu. I ...
3
votes
0answers
397 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
3
votes
0answers
98 views

I want to combine a hub and spoke VPN with a dialup VPN

Can I do this with a Juniper SRX-100? I have a combination of corporate office users and remote work from home users. A total of around 30 users with 10 remote work from home. The remote users run ...
2
votes
0answers
735 views

Problems connecting to clientless vpn portal on a Cisco ASA 5505

Just started a job where they wanted us to re-purpose a local network that wasn't in use and to create a webvpn portal to allow web access to it. We've tried everything and looked every where and ...
2
votes
0answers
68 views

Customising Cisco Clientless VPN Password Change Screen ASA5525

I'm working with one of the network engineers to customise our login screens for the Cisco clientless VPN, which, apart form time consuming, has been fine (knowledge gap on both of our parts). As part ...
2
votes
0answers
10k views

Problem ipsec site to site ASA

I am receiving this error when I try to establish an ipsec site to site vpn: PSEC: Parsing PFKey GETSPI message IPSEC: Creating IPsec SA IPSEC: Getting the inbound SPI IPSEC: New embryonic SA created ...
2
votes
0answers
1k views

L2L VPN issues Pix 506e and ASA5520

I have a site-2-site vpn tunnel between a Pix 506e 6.3(3) and an ASA 5510 running 9.0(3)6. I can control both sides of the config. This tunnel worked fine until we did a firmware update on the ASA ...
2
votes
0answers
406 views

Cisco 5505 PPTP Passthru Config Help

I am new to the 5505 and configuring them. I have several books and the web as research tools however I haven't wrapped my head around the whole thing. I am better at reverse engineering then initial ...
1
vote
0answers
24 views

Why can I not see the default gateway when connecting to ASA through AnyConnect?

I've configured an ASA as an AnyConnect server. The IP address pool that'll be assigned to the connecting hosts is from 192.168.10.1-192.168.10.10. Now when I establish a remote access connection to ...
1
vote
0answers
416 views

How can I generate self-signed certificate with hash other then SHA-1 on cisco ASA

I have Cisco ASA 5508-X with IOS 9.6(1), and I have Apex licenses for AnyConnect which support Suite B, NGE. How can I generate self-signed certificate with hash other then default SHA-1. For example ...
1
vote
0answers
2k views

Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable

I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured ...
1
vote
0answers
23 views

Regarding accessing the MIS server via the public IP from the internal interface

I have port forwarded for my MIS server to be accessed from outside. From inside interface, i use 10.10.2.2:8000 to get access of the MIS. But, what i want right now is to be able to access the MIS ...
1
vote
0answers
495 views

Cisco ASA - multiple context configuration for management interface

I have a pair of Cisco ASAs running in active/standby failover mode which I manage using the management interface. Lately, I frequently have to travel and the VPN to the university's LAN has different ...
1
vote
0answers
1k views

DHCP Relay on Cisco ASA over site-to-site VPN

How do I get the DHCP relay function of a Cisco ASA working over a site-to-site VPN? The ops center is behind a 5510 ASA with a 3560 core switch. The DHCP server is at IP 10.0.10.153. The remote ...
1
vote
0answers
484 views

VPN tunnel with duplicate subnets

I have been tasked to setup a VPN tunnel with an external party's network, but I hit a bit of snag. I am currently running a Cisco ASA 5510 with private subnets of 10.1.2.0/24 on the "inside" network....
1
vote
0answers
64 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
1
vote
0answers
448 views

ASA Site-to-Site VPN Configuration

I have some issues regarding my site-to-site vpn konfiguration between two ASA firewalls.. I have two firewalls FW1 and FW2 where FW1 = 192.168.1.0 and FW2 = 192.168.2.0 I used the following ...
1
vote
0answers
143 views

Accessing inside VLANs from DMZ interface on a Cisco ASA

I have set up a test machine on my dmz2 interface. I need to access the inside VLAN configured on the core L3 which has a route from ASA to core L3. Below is the basic configuration on the ASA : ...
1
vote
0answers
85 views

NAT takes me to a wrong place

We have a 5555-x with multiple interfaces. Our Outside interface and DMZ interfaces have routable IP addresses and DMZ subnet is routed via IP address of the outside interface. Stripped for ...
1
vote
0answers
329 views

ASA not following default route

I have the following network which splits a site into a Corp/DMz style network as best I can with the limitations of the ASA in packer tracer. Both routers have static routes to the 10.100.0.0 and 172....
1
vote
0answers
336 views

ASA cluster with named interface running PPPoE

I am trying to configure an A/S firewall cluster, and I have the interface configured as a PPPoE client. When I try to configure the clustering on ASDM, I get a message saying that high availability ...
1
vote
0answers
2k views

Dual Internet connections in active/standby mode without BGP

hello everyone attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i ...
1
vote
0answers
4k views

VPN tunnel connection issue

My company has 2 ASA firewall with model 5510 & 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago. I checked from log in ASA5512 firewall, it ...
1
vote
0answers
78 views

Cisco ASA Hung - Error: “i82546GB/enadap_get: 2 not null”

We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other ...
1
vote
0answers
4k views

Connection terminated for peer x.x.x.x. Reason: IPSec SA Idle Timeout

I have configured an IPsec Site - site VPN tunnel with Cisco ASA on both sides.there is no issue with the phase 1 of tunnel.but frequently connection towards some IPs become timedout only from some ...
1
vote
0answers
2k views

Problem Site to Site VPN ASA 5512 8.6.1

I try to establish a vpn connection but i get this error IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382 ...
0
votes
0answers
22 views

Anyconnect Cisco 5505 VPN Group cannot Access Inside Network

Below is the Configuration to my Cisco ASA. I can connect to VPN but then trapped and cannot enter the inside network. ASA Version 9.2(4)27 ! hostname AwBTech-ASA domain-name awbtech enable password ...
0
votes
0answers
42 views

Cisco ASA L2TP remote-access VPN with addresses assigned by DHCP

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP. The Cisco Client policy has end-users fetch their ...
0
votes
0answers
54 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
0
votes
0answers
41 views

Why can't I ping to the outside interface of my ASA

Below is the output of packet tracer. I have simulated a ping packet from 10.106.51.203 to 10.106.51.200. 'mgmt' is supposed to be the outside interface. Also, why is output-interface in the result ...
0
votes
0answers
166 views

Creating an overlay network using ASA and VXLAN over IP MPLS

I need to extend an existing VLAN from a branch LAN to DC. As a matter of fact I noticed that Cisco ASA 5500X have VXLAN capabilities. I am relatively new to VXLAN and I need some help to find the ...
0
votes
0answers
855 views

IPsec tunnel getting drop and reconnect itself frequently

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map ...
0
votes
0answers
8k views

Adding a secondary address to an interface on a Cisco ASA

On an ASA5505 version 8.2, I have three internal IP subnets that I want to: Pass traffic between as if they were on the same subnet Share the same gateway Share the same VLAN I've been working to ...