Questions tagged [cisco-asa]

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

Filter by
Sorted by
Tagged with
1 vote
1 answer
70 views

Cisco ASA not accepting external traffic without NAT configuration

First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing. My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
  • 121
0 votes
0 answers
13 views

IPS Registering to FMC over VPN

Help please Hello I have two site linked by VPN with ASA 5525-X.In site A we have management network (172.16.30.0/28) where we have management ip of ASA 5525-X IPS (.172.16.30.14) and IPS (.172.16.30....
0 votes
0 answers
10 views

ASA 5525-X phantom IKEv2 tunnel cant be killed/logged off. Tunnel will only tx/rx one net and tx another

Trying to get a new site up on our network and having trouble with our ASA. I've successfully established a tunnel and am passing traffic on one network but only receiving it on another (sending is ...
  • 1
0 votes
1 answer
73 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
2 votes
1 answer
169 views

Port forwarding on Cisco ASA 5506X using ADSM

What my goal is when enter the public ip address with the specific port number, it will able to show the interface of the PBX. So when i configure by referring other video and articles and only change ...
  • 23
2 votes
1 answer
124 views

Cisco ASA_Anyconnect clients bandwidth

I just start managing Cisco ASA and this is my first time working with AnyConnect clients, I would like to ask how can i verify the AnyConnect client bandwidth for each user, are we able to limit each ...
2 votes
1 answer
68 views

Multi-Home BGP on ASA 5500

We have an ASA that has been doing iBGP for hosted networks. These networks include public address spaces that are routed inside our networks. Recently we have changed providers. The new provider does ...
  • 41
2 votes
1 answer
132 views

When in Cisco ASA multiple context mode, does each context have a startup and running config?

When in Cisco ASA multiple context mode, does each context have a startup and running config? After running show context, I would like to understand if I need to run show run and show start, when ...
  • 23
1 vote
0 answers
19 views

ASAv VM version

Where can I find the VM version for the ASAv or how? I have tried to search it using cli and i couldn't find it as well as I searched on ASDM I was able to find only the resource not the version. ...
1 vote
0 answers
38 views

asa vlan subinterface over s2s ipsec tunnel to IOS router

I am trying to configure wireless traffic that is a separate vlan subinterface on an ASA to travel over a site-to-site vpn to an IOS router. i have the static NAT set up to go from the (wifimain,...
  • 11
0 votes
1 answer
52 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
  • 155
0 votes
1 answer
61 views

Cisco ASDM Remote Code Execution VULN

Our Cisco ASA Devices (ASA 5515 Security Plus) have been flagged for CVE-2021-1585 bug with high priority. I could not yet find any sources to resolve this issue. Anyone here know how to fix? The CVE ...
  • 13
0 votes
0 answers
242 views

Unable to connect to VPN on ASA after software update to 9.12(4)37 due to "vpn-simultaneous-connections"

We have updated our Cisco ASA 5512-X from 9.12(4)7 to 9.12(4)37, which we use as a VPN gateway utilizing SSL VPN via Cisco AnyConnect client. After a routine software update, no user is able to ...
1 vote
0 answers
43 views

TACACS Through ASA L2L Tunnel

Hello see below network diagram. I am trying to configure the Branch Router (10.1.1.1) to use TACACS AAA on the HQ-AAA-Server host (192.168.10.10). TACACS works fine for the Branch-FW1 ASA device ...
  • 161
3 votes
0 answers
187 views

SSH to ASA on Exit Side Of VPN Tunnel

I have a functioning L2L tunnel between two ASA devices (HQ-FW1 and Branch-FW1 on the diagram). HQ-PC2 - 192.168.10.21 HQ-FW1 eth0 - 192.168.20.2 (outside) HQ-FW1 eth1 - 192.168.10.2 (inside) Branch-...
  • 161
4 votes
2 answers
197 views

TACACS+ AAA over L2L VPN

I have a practice network set up with the relevant topography shown in the below image: I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
  • 161
2 votes
0 answers
71 views

Problem with bgp aggregate-address behavior in iOS when a large number of OSPF routes update all at once

We have a direct connect setup to AWS using BGP. We are running a ISR4451 with IOS XE 16.03.06. I have a strange situation where the AWS BGP neighbor drops our connection with the notification: ...
1 vote
1 answer
308 views

Access TACACS+ Server through ASA

I am trying to set up TACACS+ for a project. The below image shows the layout of the network. So far I have the TACACS+ server set up and working (HQ_AAA_SERVER) and it works fine for authentication ...
  • 161
3 votes
1 answer
132 views

Cisco ASA Clientless SSL VPN Apply Tunnel Group

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access) My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow ...
  • 161
2 votes
1 answer
149 views

Cisco ASA Clientless SSL VPN Restrict Network Access

I'm working on a Uni project to set up a secure network. One aspect is to have a VPN for clients of the imaginary company to access web based services. I have set up a simple clientless SSL VPN which ...
  • 161
1 vote
0 answers
34 views

Logs on my Cisco ASA show the public gateway (ISP router) is pinging the internal network, how? [closed]

Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet. In the logs of our Cisco ASA 5506, i see that the public ...
  • 21
1 vote
1 answer
214 views

Cisco ASA syslog messages, reversed source and destination for outbound communication?

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
  • 183
1 vote
1 answer
72 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
  • 121
0 votes
1 answer
489 views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
  • 121
3 votes
1 answer
79 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
0 votes
1 answer
99 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0 votes
0 answers
75 views

Error accessing Cisco ASA using ASDM

I encounter the error message in the picture when attempting to access a Cisco ASA using ASDM in a test environment. SHOW RUN =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.07.03 11:01:46 =~=~=~=~=~=~=~=~=~=~...
4 votes
1 answer
525 views

Cisco IOS -> ASA VTI tunnel not routing traffic

I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
1 vote
1 answer
141 views

Cisco ASA nat from inside to outside, but network that is routed to inside interface

So is it possible to nat from inside to outside interface but not the inside ip subnet, rather the ip subnet that is routed to inside interface? #object network remote_ip_subnet #subnet 192.168.1.0 ...
  • 812
2 votes
2 answers
392 views

Are there any differences in features between Cisco ASA hardware appliance and Cisco ASAv appliance

We are planning to replace our existing hardware firewall with new virtual one. The feature that we require from the virtual firewall is as below: HTTPS decryption and logging IPS/IDS Gateway ...
1 vote
0 answers
41 views

DATA & VOICE VLAN ROUTING BETWEEN 2 ROUTERS [closed]

Good Afternoon All- I would appreciate a little help with a current issue I am facing... I can ping all Network Segments, all Routers, all Switches, and all Servers on the network. PROBLEM IS: I CAN'T ...
0 votes
2 answers
159 views

Concurrent site-to-site VPN tunnels through dual ISPs (with 2 couples of Cisco ASA) between same devices

I currently have a simple site-to-site VPN setup, connecting machines from site 1 to site 2 through 1 ISP, using a set of ASA 5506X. All is good. I'd like to "double" that setup for ...
  • 103
1 vote
0 answers
1k views

Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can ...
1 vote
0 answers
3k views

Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel. [PA]-----------(internet)-----------[Cisco ASA] If i ping from Cisco ASA side lan to PA ...
  • 4,247
1 vote
1 answer
339 views

VPN with Cisco virtual ASA on Azure not routing correctly

I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ...
1 vote
0 answers
30 views

Does modifying a ASA tunnel create a downtime?

I inherited a cisco ASA, I never really had to manage one before. But, I need to modify an existing tunnel to add IP addresses to both the local and remote traffic selector, specifically there are ...
  • 111
3 votes
1 answer
166 views

Can a server on the other end of a site-to-site vpn be exposed (NATd) to a public IP on an ASA

AWS DataCenter ----------- site-to-site VPN ------------ http server <=======================> Cisco ASA public address 10.0.1.59:443 ...
2 votes
1 answer
130 views

Setup NAT Rule for service group

We have a Cisco ASA 5515 and I am having trouble setting up the proper NAT rule to route a group of services from a public ip (which is already routing some single ports) to an internal ip. I am ...
1 vote
2 answers
306 views

Ikev2 ipsec issue between Asa and sonicwall (issue resolved) but need understanding

Really need your help Need help in understanding an issue faced when creating a tunnel between Asa and Sonicwall (Issue got resolved) still need help to understand. SonicWall: Phase 1 Ikev2 Encryption ...
2 votes
0 answers
47 views

Single public IP routed to multiple internal IPs by port [closed]

We have a network setup with a Cisco ASA 5515,IPS firewall running ASA 9.8(4)29 and ASDM 7.12(2). I have several rules setup to route public ip addresses and specific ports to specific internal hosts....
0 votes
0 answers
149 views

ASA ping outside to inside private ip's?

i am new asa and cisco as well , what i am trying to do to perform this lab , only 1 issue is there , i need help in it, i can ping from pc0 to router0 in other way I can ping inside to outside , but ...
0 votes
1 answer
105 views

Cisco ASA 5506-X: clients periodically lose Internet access

Clients periodically lose Internet access, but I can connect to Cisco ASA and manage it. If i am ping sites, it works: Minsk# ping yandex.ru Type escape sequence to abort. Sending 5, 100-byte ICMP ...
  • 155
0 votes
1 answer
217 views

Cisco ASA 5516-X won't communicate on inside interface at all. No packets

I'm configuring a brand new ASA and the Firewall refuses to communicate on my inside interface. No matter the traffic type, its denied by implicit deny every time. I was hoping to get some feedback/...
  • 1
1 vote
1 answer
76 views

Site to site ASA Routing question

I am doing a lab about DMVPN and Site to Site ASA integration. There is no problem in the DMVPN. However I have problem in establishing route from Site to Site ASA to DMVPN. The router on the left is ...
  • 37
1 vote
0 answers
321 views

Cisco ASA 5585-x Failover Virtual MAC address

I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
  • 4,247
1 vote
0 answers
45 views

Cisco ASA NSEL Template IDs 256-271: Is there a list of names and functions? [closed]

I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and ...
1 vote
0 answers
49 views

Windows L2TP VPN issues when accessing Site to Site VPN on Cisco 5506

We have two Site to Site VPNs and Remote Access VPN configured. Using the builtin IPsec client on OSX all subnets are accessible however when using L2TP built in client on Windows 10 ICMP traffic ...
1 vote
2 answers
300 views

Connecting an ASA behind an AT&T router/gateway

I am attempting to setup a temporary network for a company in transition that is moving into a new building. They just bought and had installed an AT&T business internet connection. They have a ...
  • 95
0 votes
1 answer
66 views

Much ARP requests from Cisco ASA 5510

An employee of the ISP writes to me that a lot of ARP requests from us go to them. ISP equipment log: 07:47:27.732242 ARP, Request who-has AAA.BBB.CCC.213 tell AAA.BBB.CCC.53, length 46 07:47:27....
  • 155
0 votes
1 answer
99 views

What is method to switch group-policy on a tunnel-group upon user login?

We have ASA units that have tunnel-groups that have a particular group-policy defined via default-group-policy statement. This initial group-policy ("NOACCESS") is one that prevents any ...

1
2 3 4 5
13