Questions tagged [cisco-asa]
Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines
668
questions
5
votes
0
answers
587
views
Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached
I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message:
%ASA-4-713239: IP_Address: Tunnel Rejected: ...
- 131
5
votes
0
answers
84
views
Customising Cisco Clientless VPN Password Change Screen ASA5525
I'm working with one of the network engineers to customise our login screens for the Cisco clientless VPN, which, apart form time consuming, has been fine (knowledge gap on both of our parts). As part ...
- 51
5
votes
0
answers
12k
views
Problem ipsec site to site ASA
I am receiving this error when I try to establish an ipsec site to site vpn:
PSEC: Parsing PFKey GETSPI message
IPSEC: Creating IPsec SA
IPSEC: Getting the inbound SPI
IPSEC: New embryonic SA created ...
- 61
4
votes
7
answers
11k
views
Dynamic Routing Protocol (IGP) over IPSec VPN tunnels to branch offices?
What are the best practices for running an IGP to learn networks at HQ from branch offices when those offices connect via IPSec LAN-to-LAN VPN tunnels over the Internet? The branch offices terminate ...
- 7,104
4
votes
2
answers
13k
views
Cisco ASA VPN with split-dns on a Windows VPN client
Split DNS ostensibly allows a remote device accessing a LAN using VPN to direct DNS queries for internal domain names to internal DNS servers while queries for public domain names are directed to ...
- 904
4
votes
2
answers
361
views
TACACS+ AAA over L2L VPN
I have a practice network set up with the relevant topography shown in the below image:
I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
- 171
4
votes
2
answers
4k
views
Cisco ASA 5585X Internal-Data0/1 interface errors
I have noticed on Cisco ASA 5585 (SSP-20) interface error counter going up specially overrun but so far we haven't seen any production impact or issue, error rate is low so its not noticable but would ...
- 4,379
4
votes
2
answers
5k
views
How do I tag traffic with a DSCP value on an ASA?
I have a SIP Server that does not put a DSCP code on it's traffic. This server is behind an ASA, and I want to prioritize its traffic passing through an ASA from the private to public network.
I am ...
- 932
4
votes
2
answers
9k
views
What is the Cisco ASA DHCP Server Address Limit on higher end modles
I know on the Cisco ASA 5505 is limited to only a class C 254 addresses in the DCHPD pool, mainly because of physical resource limitations.
Does this hold true for higher end models likes the 5512-X ...
- 932
4
votes
1
answer
8k
views
Can we change peer IP of IPSec VPN tunnel in one line?
If I have a crypto map with a line as follows:
crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8
Can I change that simply by typing the following in conf t:
# crypto map Outside_map 10 set peer 0....
- 3,310
4
votes
2
answers
3k
views
Cisco ASA Dynamic Routing - Originating a NAT Block
Network guy working on Security problems -- hoping for some guidance!
I have a subnet that I am using as a NAT block for one of my inside subnets.
NAT from inside->outside : Convert source 10.0.0....
- 1,589
4
votes
2
answers
4k
views
Can't Upload New ASA Image (I/O Error)
I'm trying to upgrade the code on a fresh, out of the box Cisco ASA 5510. However, whenever I transfer the code via TFTP I get the following message -
Writing file disk0:asa847-k8.bin...
%Error ...
- 43
4
votes
1
answer
716
views
General issues with access to and from DMZ on Cisco ASA 5520
I just got my software upgraded from v8.2(x) to v.9.1(7), but I have some general issues with access to and from my DMZ:
No internet access from DMZ
No access to web or mail server from outside to ...
4
votes
2
answers
2k
views
Problem with Cisco ASA 5510 DMZ configuration
I need help to resolve this issue. I have a Cisco ASA 5510 and I’m trying access to my webserver from internet but the connection does not work. Please find the network diagram below:
I applied this ...
- 185
4
votes
3
answers
2k
views
Cisco ASA Site-to-Site VPN, remote LANs have no Internet
I have a site-to-site VPN from a Cisco ASA 5512 and a Cisco 891. I want all traffic, even Internet access, to come through our ASA. The VPN is established and working. The LANs have connectivity to ...
- 491
4
votes
1
answer
25k
views
How should I diagnose why my Cisco ASA denies traffic?
I have a Cisco ASA, which is denying traffic from 172.16.1.5 to 4.2.2.2 on tcp/9000
How can I diagnose why this is happening from the Cisco ASA CLI?
- 30k
4
votes
2
answers
9k
views
How to choose Cisco ASA software release
I have some pre-8.3 ASAs that I'm planning to upgrade to standardize on the new NAT semantics. I am aware of the big changes between pre-8.3 and 8.3+ from these two great Q&As.
What is unclear ...
- 904
4
votes
2
answers
6k
views
NAT and ACL order - Cisco ASA, Palo Alto, Checkpoint
I've recently begun working with firewalls (Different brands) and what really confuses me is the order the different firewalls check the ACL and NAT rules.
For instance, allow HTTP traffic from the ...
- 279
4
votes
1
answer
6k
views
Switching to multiple context mode on a Cisco ASA 5585-X; what happens to running config?
I might need to implement a change where an existing in production ASA 5585-X pair (single fail-over) would need to transition to multiple context mode to allow the addition of a new context.
For ...
- 754
4
votes
1
answer
1k
views
Enabled VPN -- Site to site -- Cannot access internet now .. Cisco ASA 5505
I had just enabled site to site VPN access ... I am assuming something got messed up with NAT ... It's the strangest thing .. I cannot find anything wrong through ASDM, or CLI .. Yet, I can ...
- 463
4
votes
1
answer
1k
views
Cisco IOS -> ASA VTI tunnel not routing traffic
I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
- 193
4
votes
2
answers
2k
views
Multiple ISPs failover configuration
I'm going to be more explicit about this and hope you'll get me through
I have two ISPs connected each one to a cisco ASA 5510.the two ASA are connected to a cisco switch 3650 that connects my LAN. I ...
- 41
4
votes
3
answers
27k
views
Load balancing with multiple ISP, two routers and firewall
I have two ISP connections on two Cisco 2901 routers, in front of Cisco ASA-5515 firewall. I need to configure failover load balancing network.
Two Cisco 2901 router with dual (different ISP) ...
- 253
4
votes
1
answer
1k
views
How to use secondary internet exclusively for one host?
I currently have two internet connections coming into my main office. The primary connection is regular static IP cable service and the secondary is a dedicated MPLS Ethernet connection. The primary ...
- 71
4
votes
2
answers
727
views
problem with cisco asa 5505 vpn configuration
I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but:
when i have "use default gateway on remote network" on NIC enabled i have access to ...
- 41
4
votes
1
answer
3k
views
How do you block a specific computer from VPN on a Cisco ASA?
We want to be able to disable a computer in Active Directory and prevent that computer from accessing our VPN.
I have an ASA VPN setup, with Cisco Security Desktop, and a Dynamic Access Policy to ...
- 362
4
votes
1
answer
665
views
Have Cisco ASA 5505 and want it to maintain site-to-site VPN connections
Background: A client has been hitting the host limit for his license on a Cisco ASA 5505. The license has a max of 50 clients that can access the internet, the 51st connection gets dropped. He has ...
- 63
4
votes
1
answer
1k
views
How do you control WAN Download Bandwith on an ASA?
I have a Cisco ASA and cannot seem to control bandwith from the Internet to the device that well. The ASA supports Shaping, but only on outbound traffic which works great. My question is how to ...
- 932
4
votes
1
answer
159
views
Cisco IPS - At what temperature will the IPS halt?
We have an IPS module inside a Cisco ASA. It is an SSM-10. Looking in the show tech of the IPSM I see this line:
Halt Device on Over Temp : 1
I believe that means the system will halt when the ...
- 828
4
votes
1
answer
496
views
Cisco ASA Site to Site VPN
Hoping someone can be of assistance.
I am attempting to setup a site to site vpn with two cisco asas.
Site A. 192.168.1.0, Static external IP, Cisco ASA 5520
Site B. 10.0.0.0 Dynamic External IP, ...
- 41
4
votes
1
answer
2k
views
2-stacked switches with 2 uplinks to each ASA
My current single uplink from 2-stacked switches to ASA is not enough to cater the link utilization (upload traffic from the 2-stacked switches to ASA). So, I have thought of using 2 uplinks. If I use ...
- 927
4
votes
1
answer
949
views
IOS to ASA dynamic and static VPNs - sharing same crypto ACL?
Is it possible to have a dynamic and static VPN between the same IOS router and ASA, sharing same interesting traffic/crypto ACL on the ASA end? The two devices in question:
ASA 9.1 - hub/termination ...
- 123
4
votes
1
answer
7k
views
Cisco ASA 5505 stop passing traffic randomly
I have a very strange issue with Cisco ASA 5505 started about week ago: ASA like a router with outside port to ISP, next port to DMZ and another one to inside network (contains about 50 hosts thru ...
- 71
4
votes
2
answers
17k
views
SIP through ASA without inspection
After talking to a few hosted VoIP providers, they all state that "ALG" or SIP inspection in the case of the Cisco firewall should be disabled. How is SIP not broken after leaving the firewall over ...
- 7,104
4
votes
2
answers
2k
views
Cisco ASA 5512-x, problem with incoming traffic to Exchange server and access to https:/xxx.xxx/owa
Recently I installed a Cisco ASA 5512-X, and have successfully set it up for traffic to the outside, and traffic going out from the Exchange server is fine. But incoming traffic and access to the OWA ...
- 41
4
votes
1
answer
3k
views
Cisco ASA RRI and OSPF redistribution
This is a follow-up question based on this original question.
The following topology is present:
The Cisco ASA is our Internet firewall, as well as VPN gateway, terminating VPN connections. The ASA ...
- 1,071
4
votes
1
answer
3k
views
Limiting VPN traffic with ACL
THIS IS NOT A DUPLICATE POST/SAME QUESTION! PLEASE READ FULLY!!
We're implementing a web-proxy service and in the tunnel config over to their service the provider requested a crypo ACL as follows:
...
- 3,310
4
votes
1
answer
8k
views
Trouble configuring AnyConnect to use a RSA token PIN only for authentication
I have a 5515X 9.1.2 configured with AnyConnect 3.1.04059. I have successfully configured it to accept RSA secureID tokens by means of using the PIN+TokenCode. Now I simply want to enable it so ...
- 828
4
votes
1
answer
692
views
Immediately block a host's traffic
I've got a script set up (triggered by Fail2Ban) to block hosts at the edge of our network. It adds the IP address to a group that's already blocked by an ACL, and then clears the connection out.
...
- 259
4
votes
1
answer
10k
views
ASA VPN works as responder but not as initiator
I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.)
When the pfSense starts the connection, everything works fine. When the ...
- 259
4
votes
1
answer
7k
views
ASA 5510 NAT stops working
I’ve been searching on this issue and can’t seem to find info about it.
I’ve inherited an older ASA5510 (8.2(1)) and unfortunately I’m pretty new to them. I have a set of overloaded NAT statements ...
- 41
4
votes
1
answer
3k
views
Cisco ASA IPsec tunnel QM FSM error
I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company.
we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
- 4,379
4
votes
2
answers
2k
views
L3 core switch and VPN access
At work we have a cisco 3560 L3 core, in which we implement all our L3 VLANs and ACLs controlling inter-vlan routing. As far as client machines are concerned, the L3 switch is the default gateway, ...
- 141
4
votes
1
answer
2k
views
Error Message %ASA-3-210007
I have two ASA 5525-X joined in cluster. Software on both ASAs is 9.7(1)4. I run them in multi-context mode. We will talk about admin context on which I have problem.
When ASA-1 is master and ASA-2 ...
- 812
4
votes
2
answers
1k
views
VPN LAN-to-LAN with Cisco ASA and ISP router
We want to set up a LAN-to-LAN tunnel VPN between our company and a customer, but the connection doesn’t work. Here’s the network diagram:
Below the full Cisco ASA configuration:
: Saved
:
ASA ...
- 185
4
votes
1
answer
821
views
Cisco ASA NAT/ACL issues across EZVPN
I have an EZVPN running between two locations, Location A has a 5520 and is the EZVPN server, Location B has a 5506 and is a EZVPN client. Currently I'm trying to set NAT and ACL(s) so that hosts on ...
- 71
4
votes
1
answer
4k
views
Cisco ASA and BVI interfaces
I'm in the middle of equipment migration and the setup is somewhat similar to Mike's (Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation) but with a difference that I need the ...
- 552
4
votes
1
answer
831
views
Why am I seeing internal traffic on the external interface of my ASA?
I am seeing the following messages in my ASA Log files:
2015-09-10T14:22:07.860487-05:00 natbox %ASA-2-106006: Deny inbound UDP from 172.17.136.168/16403 to 172.17.136.168/16403 on interface ...
- 323
4
votes
1
answer
867
views
ASA 5505 Post-Upgrade One-Way Traffic Flow
I’m hopeful that someone can give us a pointer as we are sure it is a very simple error.
We were recently running an IPSec site-to-site VPN using 2 x Cisco ASA 5505s between a UK and US office. Both ...
- 41
4
votes
1
answer
330
views
Is hairpinning still a problem with multi-context ASA?
I know from previous experience that having servers in DMZ 1 accessing the public NATed IPs of servers in DMZ 2 on the same ASA (aka "hairpinning") is a tricky business in a single-context ASA. But is ...
- 355