Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
21
votes
5answers
27k views

Cisco ASA site-to-site VPN failover

We recently replaced international MPLS with new ASA 5510s and site-to-site VPNs. However, when we deployed this we ran into a problem where each remote location has 2 ISPs for redundancy, but when ...
19
votes
2answers
2k views

How do you get an ASA to announce NAT'd 'outside' addresses in to an OSPF zone?

Device arrangement is as follows: BGP Peers + | | +------+-------+ | | | Juniper MX5 | | | +------+-------+ |.254 OSPF | 10.0.1.0/24 ...
19
votes
1answer
3k views

Finding transparent firewall packet loss

We use the Cisco ASA 5585 in a layer2 transparent mode. The configuration is just two 10GE links between our business partner dmz and our inside network. A simple map looks like this. 10.4.2.9/30 ...
15
votes
5answers
167k views

How can I reset a VPN tunnel on a Cisco ASA?

On a site-to-site VPN using a ASA 5520 and 5540, respectively, I noticed that from time to time traffic doesn't pass any more, sometimes just there's even missing traffic just for one specific traffic ...
13
votes
7answers
3k views

How can I generate traffic on a Cisco ASA?

In a lot of locations, we have only one Cisco ASA 5505 each and one or more WiFi APs, besides the provider router. No servers or PCs, just WiFi service for occasional visitors. I want to remotely ...
13
votes
5answers
2k views

ASA 5550 - Reboot Worthwhile?

I've got an ASA 5550 that is performing loads and loads of operations (AnyConnect, NAT, ACL, RADIUS, etc, etc). It isn't particularly overloaded in terms of CPU & Memory, but it has an uptime of ...
13
votes
3answers
12k views

How do you block bit torrent traffic with a Cisco ASA?

I have referenced an old external Cisco article on how to block Bit torrent traffic referenced on-line Here This procedure I have found only works 50% of the time. I find blocking bit torrent ...
12
votes
3answers
1k views

Migrating pre-8.3 ASA config to 8.3+

What are best practices migrating ASA config to 8.3 and forward? I have manually created a new config file with the following changes: new network objects new NAT statements new access-lists ...
12
votes
1answer
15k views

Site-to-Site VPN Tunnel Up Not Passing Traffic

I have a site-to-site VPN that seems to be dropping traffic from a particular subnet when a lot of data is being pushed through the tunnel. I have to run clear ipsec sa to get it going again. I ...
12
votes
1answer
2k views

ASA5505 and IPv6 over a PPPoE Link

I see a lot of conflicting information about whether or not a Cisco ASA (5505 in this case) can use IPv6 over a PPPoE connection. I see official Cisco documentation making it look easy, but I see ...
12
votes
1answer
578 views

Cisco ASA: What is the “tx hangs” counter on show interface?

Consider the following output from show interface: Interface GigabitEthernet0/1 "inside", is up, line protocol is up Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec Full-Duplex(Full-...
11
votes
3answers
2k views

Two Cisco ASA 5525-X as Internet Gateways without Layer 2

Add another reason to hate NAT to the list. I'm bringing up two Internet egress points in our corporate network. The edge devices will be ASA 5525-X firewalls. Traditionally you would put these into ...
11
votes
2answers
5k views

Cisco ASA double NAT with DNS translation

I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion. I got double NAT working correctly, such that I have a server in ...
10
votes
2answers
11k views

In IPsec VPN, how is the pre-shared key encrypted?

I was doing IPsec VPN on ASA 8.0, and I understand a little about that. The initiator starts by sending its ISAKMP policy to the responder, and the responder sends back the matched policy. After that, ...
10
votes
2answers
11k views

How do you throttle Dropbox Traffic?

It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
10
votes
1answer
469 views

Does L-ASA-SC-10= require a reboot?

We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
10
votes
2answers
386 views

Will ASA 5540 support 3000 simultaneous IPsec connections?

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 ...
10
votes
1answer
1k views

Firewall Replication

If I have two datacenter sites that are considered redundant to each other. Is it possible to sync firewall configuration from the primary to the backup? What is the best way to keep both firewalls ...
10
votes
4answers
5k views

ASA 5505 remote access VPN - Connection established, but no internet/access to internal subnet

Update Finally got upgraded to 9.1.4. I got everything configured, reenabled VPN, and was still having the same problem. So, I cleared all VPN config information and started from scratch. Below is my ...
9
votes
3answers
935 views

ASA Netflow support

Cisco ASAs support a version of netflow called NetFlow Secure Event Logging (NSEL). Is special support for the protocol required on the collectors to view the flows? Is the protocol compatible with ...
9
votes
1answer
727 views

What do the parentheses “()” after objects mean in Cisco ASA ACLs?

I have encountered something I'm not familiar with in a customer's configuration, I know that the "(hitcnt=324165)" at the end of every rule in "show access-list" points to rule usage, hit count. But ...
9
votes
4answers
2k views

ASA FTP Special Character in password issue

I am trying to copy a show tech from an ASA to a remote server via FTP. My issue is that the password I am providing has a '@' and it is being interpreted incorrectly by the CLI. I have tried putting ...
8
votes
2answers
9k views

Cisco ASA Routing Issue

I am working on a lab right now and am having some issues with ASA routing. Here is the current network topology: Currently if I login to the console on the ASA or Router I can get outside to the ...
8
votes
1answer
11k views

Cisco ASA - Delete or rename “names”

I had a bad experience with Cisco ASA when changing/renaming "nameif" interface attributes. I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to ...
8
votes
1answer
1k views

ASA5550 Error: assertion “_vf_mode_init” failed: file “vf_api.c”, line 99

I pulled an old ASA5550 off the shelf, which had 8.4(2) loaded on it. When I tried to boot it, I got the following error... ----------------------------------------------- Traceback output aborted. ...
8
votes
2answers
3k views

ASA in multiple context: save config

I have an ASA running 9.0(1) with four security contexts. When we modify a context, our standard procedure is to do a "write mem" inside that context. But sometimes we have to modify all the ...
8
votes
2answers
6k views

How to host server in DMZ zone of an ASA

I have an ASA5525-X with 9.1.2. On it are several interfaces, but primarily I'm looking at: (fake subnets) inside 10.0.0.0/24, security level 100 outside 10.0.200.0/24, security level 0 DMZ 10.0.100....
8
votes
3answers
772 views

Placement of firewall for VPN RA and L2L tunnels

For Remote Access (RA) and LAN-to-LAN (L2L) VPN, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX ...
8
votes
4answers
12k views

ASA use of proxy ARP for NAT

I will be performing NAT on the outside interface of an ASA to a web server within a DMZ. I would like to disable proxy-arp on all the interfaces that I can. I know that outside interface will need to ...
8
votes
1answer
2k views

How does group-policy inheritance work for a Cisco ASA?

I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure. What I really want to know is if I pull an attribute from a group-policy will it then be ...
8
votes
1answer
961 views

FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA

Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
8
votes
2answers
7k views

NAT with VPN Site to Site and Remote LANs with same IP address

I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...). For every remote LAN, I ...
7
votes
2answers
18k views

Cisco ASA 8.4(3); NAT multiple ports on public IP to private IP

I have the following configuration on an ASA running 8.4 already; object network SERVER-01 host 192.168.0.1 ! object network SERVER-01 nat (Inside,Outside) static interface service tcp 3389 5001 I ...
7
votes
1answer
25k views

Configuring a Cisco ASA 5505 for routing

I'll start by pointig out that networking issues have always left me scratching my head. There is something about routing especially that I just haven't had that "Oh I get it" moment yet, so it's ...
7
votes
1answer
635 views

Cisco Feature Navigator equivalent for ASA's?

I've recently been using the Cisco Feature Navigator to assess whether or not to upgrade IOS images (and compare them), but it doesn't support ASA software. Is there an easy way to compare images for ...
7
votes
4answers
9k views

TCP Handshake fails on Cisco ASA

I am using a Traffic Generator for setting up a TCP connection that should pass a Cisco ASA firewall. My topology looks like this: +------------------+ ...
7
votes
1answer
3k views

Upgrading ASA and ASDM on a ASA5510

I have a single Cisco ASA 5510 in production. It has: ASA version 8.0(2) ASDM version 6.0(2) 1GB RAM (upgraded recently from 256MB) 64MB Flash I have backed up the flash and the configuration. We ...
7
votes
2answers
13k views

Cannot get Cisco-ASA 5505 properly configured

I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505. I can't get out to the internet (even using ping from the ASA), I can't "see" the ASA on ...
7
votes
1answer
13k views

Timeouts for ASA VPN peers

I have configured a remote site with two IP addresses for data centre VPN peers - one primary (1.1.1.1), one backup (2.2.2.2). When the primary peer fails, the remote site detects the failure using ...
7
votes
2answers
11k views

ASA IPS issue: routing and management interface

We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
7
votes
2answers
3k views

Cisco ASA: Why does static NAT block access through VPN? [closed]

TL/DR I set up a static nat rule, so that I can use my public internet IP address to directly ssh into a dedicated machine on the inside network. As a result I cannot ssh into the dedicated machine ...
7
votes
5answers
5k views

Moving interface names on a Cisco ASA while maintaining the rest of the configuration in place

My initial problem: I’ve run out of physical ports on my ASA 5525-X My initial solution: Create sub-interfaces on a port-channel and use a switch to aggregate my VLANs The subsequent issue: How do I ...
7
votes
2answers
608 views

OSPF on ASA 8.2 not advertising /32

We have set up OSPF between our 2 ASA 5540 running in Active/Passive and our Internet provider's Juniper routers. We would like to advertise routes based on the content of an ACL through a route-map : ...
7
votes
3answers
4k views

Problem with remote access, fixed L2L and dynamic L2L IPSEC working together on ASA 5540 8.2

I have an issue with a mixture of remote access, L2L and dynamic L2L tunnels on an ASA5540 running 8.2 Here is a snip of the relevant config:- crypto dynamic-map outside-crypto-dynamic-map 10 match ...
6
votes
2answers
3k views

Switchport BPDUs dropped at ASA firewall

I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with capture voip type asp-drop l2_acl after seeing the l2_acl counter incrementing in show asp ...
6
votes
2answers
867 views

SPAN impact on ASA performance

I am planning to mirror some traffic on an ASA 5510 running version 9.1. this traffic is mostly internet data which cannot exceed 30 Mbps. what impact could this SPAN operation cost me on performance ...
6
votes
1answer
7k views

Cisco ASA 9.0(1) - NAT / PAT

I'm trying to open some ports in my ASA 5505 Firewall with the 9.0(1) software. I've being using another ASA with a lower software version. As you can imagine I'm quite confused and have been reading ...
6
votes
1answer
493 views

What does the RTTSum and RTTSum2 represent in a ASA SLA monitor?

I have enabled the SLA monitor on an ASA, and I was wondering what the RTTSum and RTTSum2 Metric Represents? RTT stands for "Rout Trip Time" I am having trouble figuring what the RTTSum actually ...
6
votes
4answers
5k views

Cisco ASA 5505 Remote Users Cannot Access site-to-site tunnel

I've (finally) got a VPN tunnel to an AWS VPC up and running. I'm not a network engineer. It works fine from the office to the VPC, but remote users cannot access anything through this site-to-site ...
6
votes
3answers
281 views

Cisco ASA 5510 - ACL Config Question

My company's email server is under attack from the following IP address blocks 92.63.193.0 5.188.9.0 Here are the corresponding WHOIS records for each network % This is the RIPE Database query ...