Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

ASA 5525-X phantom IKEv2 tunnel cant be killed/logged off. Tunnel will only tx/rx one net and tx another

Trying to get a new site up on our network and having trouble with our ASA. I've successfully established a tunnel and am passing traffic on one network but only receiving it on another (sending is ...
user avatar
  • 1
0 votes
1 answer
40 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
user avatar
2 votes
1 answer
150 views

Port forwarding on Cisco ASA 5506X using ADSM

What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX. So when i configure by referring other video and articles and only change ...
user avatar
  • 23
2 votes
1 answer
74 views

Cisco ASA_Anyconnect clients bandwidth

I just start managing Cisco ASA and this is my first time working with AnyConnect clients, I would like to ask how can i verify the AnyConnect client bandwidth for each user, are we able to limit each ...
user avatar
2 votes
1 answer
49 views

Multi-Home BGP on ASA 5500

We have an ASA that has been doing iBGP for hosted networks. These networks include public address spaces that are routed inside our networks. Recently we have changed providers. The new provider does ...
user avatar
  • 41
2 votes
1 answer
108 views

When in Cisco ASA multiple context mode, does each context have a startup and running config?

When in Cisco ASA multiple context mode, does each context have a startup and running config? After running show context, I would like to understand if I need to run show run and show start, when ...
user avatar
  • 23
1 vote
0 answers
19 views

ASAv VM version

Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version. ...
user avatar
1 vote
0 answers
34 views

asa vlan subinterface over s2s ipsec tunnel to IOS router

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router. i have the static NAT set up to go from the (wifimain,...
user avatar
  • 11
0 votes
1 answer
41 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
user avatar
  • 155
0 votes
1 answer
53 views

Cisco ASDM Remote Code Execution VULN

Our Cisco ASA Devices (ASA 5515 Security Plus) have been flagged for CVE-2021-1585 bug with high priority. I could not yet find any sources to resolve this issue. Anyone here know how to fix? The CVE ...
user avatar
  • 13
0 votes
0 answers
202 views

Unable to connect to VPN on ASA after software update to 9.12(4)37 due to "vpn-simultaneous-connections"

We have updated our Cisco ASA 5512-X from 9.12(4)7 to 9.12(4)37, which we use as a VPN gateway utilizing SSL VPN via Cisco AnyConnect client. After a routine software update, no user is able to ...
user avatar
1 vote
0 answers
40 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
user avatar
  • 161
3 votes
0 answers
156 views

SSH to ASA on Exit Side Of VPN Tunnel

I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram). HQ-PC2 - 192.168.10.21 HQ-FW1 eth0 - 192.168.20.2 (outside) HQ-FW1 eth1 - 192.168.10.2 (inside) Branch-...
user avatar
  • 161
4 votes
2 answers
185 views

TACACS+ AAA over L2L VPN

I have a practice network set up with the relevant topography shown in the below image: I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
user avatar
  • 161
2 votes
0 answers
61 views

Problem with bgp aggregate-address behavior in iOS when a large number of OSPF routes update all at once

We have a direct connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
user avatar
1 vote
1 answer
244 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
user avatar
  • 161
3 votes
1 answer
114 views

Cisco ASA Clientless SSL VPN Apply Tunnel Group

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access) My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
user avatar
  • 161
2 votes
1 answer
120 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
user avatar
  • 161
1 vote
0 answers
32 views

Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]

Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet. In the logs of our Cisco ASA 5506, i see that the public ...
user avatar
  • 21
1 vote
1 answer
187 views

Cisco ASA syslog messages, reversed source and destination for outbound communication?

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
user avatar
  • 183
1 vote
1 answer
64 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
user avatar
  • 121
0 votes
1 answer
373 views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
user avatar
  • 121
3 votes
1 answer
64 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
user avatar
0 votes
1 answer
91 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
user avatar
0 votes
0 answers
65 views

Error accessing Cisco ASA using ASDM

I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment. SHOW RUN =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
user avatar
4 votes
1 answer
479 views

Cisco IOS -> ASA VTI tunnel not routing traffic

I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
user avatar
1 vote
1 answer
125 views

Cisco ASA nat from inside to outside, but network that is routed to inside interface

So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface? #object network remote_ip_subnet #subnet 192.168.1.0 ...
user avatar
  • 812
2 votes
2 answers
347 views

Are there any differences in features between Cisco ASA hardware appliance and Cisco ASAv appliance

We are planning to replace our existing hardware firewall with new virtual one. The feature that we require from the virtual firewall is as below: HTTPS decryption and logging IPS/IDS Gateway ...
user avatar
1 vote
0 answers
36 views

DATA & VOICE VLAN ROUTING BETWEEN 2 ROUTERS [closed]

Good Afternoon All- I would appreciate a little help with a current issue I am facing... I can ping all Network Segments, all Routers, all Switches, and all Servers on the network. PROBLEM IS: I CAN'T ...
user avatar
0 votes
2 answers
141 views

Concurrent site-to-site VPN tunnels through dual ISPs (with 2 couples of Cisco ASA) between same devices

I currently have a simple site-to-site VPN setup, connecting machines from site 1 to site 2 through 1 ISP, using a set of ASA 5506X. All is good. I'd like to "double" that setup for ...
user avatar
  • 103
1 vote
0 answers
900 views

Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can ...
user avatar
1 vote
0 answers
2k views

Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel. [PA]-----------(internet)-----------[Cisco ASA] If i ping from Cisco ASA side lan to PA ...
user avatar
  • 4,247
1 vote
1 answer
313 views

VPN with Cisco virtual ASA on Azure not routing correctly

I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ...
user avatar
1 vote
0 answers
29 views

Does modifying a ASA tunnel create a downtime?

I inherited a cisco ASA, I never really had to manage one before. But, I need to modify an existing tunnel to add IP addresses to both the local and remote traffic selector, specifically there are ...
user avatar
  • 111
3 votes
1 answer
155 views

Can a server on the other end of a site-to-site vpn be exposed (NATd) to a public IP on an ASA

AWS DataCenter ----------- site-to-site VPN ------------ http server <=======================> Cisco ASA public address 10.0.1.59:443 ...
user avatar
2 votes
1 answer
118 views

Setup NAT Rule for service group

We have a Cisco ASA 5515 and I am having trouble setting up the proper NAT rule to route a group of services from a public ip (which is already routing some single ports) to an internal ip. I am ...
user avatar
1 vote
2 answers
264 views

Ikev2 ipsec issue between Asa and sonicwall (issue resolved) but need understanding

Really need your help Need help in understanding an issue faced when creating a tunnel between Asa and Sonicwall (Issue got resolved) still need help to understand. SonicWall: Phase 1 Ikev2 Encryption ...
user avatar
2 votes
0 answers
40 views

Single public IP routed to multiple internal IPs by port [closed]

We have a network setup with a Cisco ASA 5515,IPS firewall running ASA 9.8(4)29 and ASDM 7.12(2). I have several rules setup to route public ip addresses and specific ports to specific internal hosts....
user avatar
0 votes
0 answers
138 views

ASA ping outside to inside private ip's?

i am new asa and cisco as well , what i am trying to do to perform this lab , only 1 issue is there , i need help in it, i can ping from pc0 to router0 in other way I can ping inside to outside , but ...
user avatar
0 votes
1 answer
96 views

Cisco ASA 5506-X: clients periodically lose Internet access

Clients periodically lose Internet access, but I can connect to Cisco ASA and manage it. If i am ping sites, it works: Minsk# ping yandex.ru Type escape sequence to abort. Sending 5, 100-byte ICMP ...
user avatar
  • 155
0 votes
1 answer
197 views

Cisco ASA 5516-X Wont communicate on inside interface at all. No packets

I'm configuring a brand new ASA and the Firewall refuses to communicate on my inside interface. No matter the traffic type, its denied by implicit deny every time. I was hoping to get some feedback/...
user avatar
  • 1
1 vote
1 answer
71 views

Site to site ASA Routing question

I am doing a lab about DMVPN and Site to Site ASA integration. There is no problem in the DMVPN. However I have problem in establishing route from Site to Site ASA to DMVPN. The router on the left is ...
user avatar
  • 37
1 vote
0 answers
305 views

Cisco ASA 5585-x Failover Virtual MAC address

I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
user avatar
  • 4,247
1 vote
0 answers
42 views

Cisco ASA NSEL Template IDs 256-271: Is there a list of names and functions? [closed]

I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and ...
user avatar
1 vote
0 answers
46 views

Windows L2TP VPN issues when accessing Site to Site VPN on Cisco 5506

We have two Site to Site VPNs and Remote Access VPN configured. Using the builtin IPsec client on OSX all subnets are accessible however when using L2TP built in client on Windows 10 ICMP traffic ...
user avatar
1 vote
2 answers
269 views

Connecting an ASA behind an AT&T router/gateway

I am attempting to setup a temporary network for a company in transition that is moving into a new building. They just bought and had installed an AT&T business internet connection. They have a ...
user avatar
  • 95
0 votes
1 answer
64 views

Much ARP requests from Cisco ASA 5510

An employee of the ISP writes to me that a lot of ARP requests from us go to them. ISP equipment log: 07:47:27.732242 ARP, Request who-has AAA.BBB.CCC.213 tell AAA.BBB.CCC.53, length 46 07:47:27....
user avatar
  • 155
0 votes
1 answer
95 views

What is method to switch group-policy on a tunnel-group upon user login?

We have ASA units that have tunnel-groups that have a particular group-policy defined via default-group-policy statement. This initial group-policy ("NOACCESS") is one that prevents any ...
user avatar
2 votes
3 answers
996 views

What is the difference between an ASA firewall and UTM firewall?

How do ASA firewalls and UTM perimeter firewalls differ?
user avatar
  • 157
1 vote
0 answers
310 views

Cisco ASA 5506: Adding two public IP's that are on the same subnet for the primary and backup interface

Im programming a Cisco ASA 5506. I need to add a primary (public) IP that is x.x.x.82/24 and a backup IP that is x.x.x.81/24. The ASA wont allow me to do this as it gives me an error: "the IP ...
user avatar
  • 21

1
2 3 4 5
13