Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 46246

Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines

1
vote
Since the first ACL is named ABC and the second ACL is named DEF, they are obviously used differently in the configuration. Since you don't specify how those two ACLs are applied, we can only guess. …
answered Apr 2 '18 by user3629081
2
votes
This is a really old post, and that's a complex set of requirements. But I'll try to answer this question for anyone else who may be looking to do a similar thing. First, a diagram: Now, some not …
answered Apr 3 '18 by user3629081
1
vote
A few ideas to get you moving forward: Make sure SSH is working on the ASA. Can you SSH to it from your computer? Then, make sure that the ASA allows SSH from the Oxidize server. Do a show run ssh o …
answered May 29 '18 by user3629081
1
vote
DISCLAIMER: This is a really bad idea. The ASA platform is designed to be one system, with hardware redundancy. Therefore, you should ensure that the config always stays in sync, which ensures that …
answered Apr 3 '18 by user3629081
1
vote
When you attempt to connect to the ASA using Clientless VPN, the ASA will test your credentials against whatever is configured in the 'DefaultWEBVPNGroup' tunnel-group. Therefore, you need to add con …
answered Apr 3 '18 by user3629081
1
vote
On an ASA, you can block individual URLs in two different ways. The first way is using FQDN, which basically causes the ASA to resolve the hostname in DNS on a scheduled basis and update the ACL with …
answered Jun 29 '18 by user3629081
1
vote
There are at least three ways I can think of to fix this issue, and I would attempt a solution in the following order: Craft your NAT statements differently (or remove the applicable NAT) so that th …
answered May 10 '18 by user3629081
1
vote
I know this is not the answer that you're hoping to hear, but the answer is to manage your ASA in-band, not out-of-band. The ASA does not have VRF capabilities, meaning that the Man1/1 port (or whate …
answered Apr 4 '18 by user3629081
1
vote
I see that when the traffic goes south, the TSval of the packets rolls over the 2^32 mark and starts again at 0, but the ASA is ACKing back a TSecr of a very high number. It looks like you were hitti …
answered May 10 '18 by user3629081
1
vote
Recap: So, you have two separate firewalls, each with an internet connection. You want users to go to the primary firewall and use the primary ISP unless it's down, in which case you want users to go …
answered Apr 3 '18 by user3629081
1
vote
First, there is no dynamic ACL going on here, and stateful inspection is not a factor, either. (But, read the last paragraph for an explanation of how FTP is special.) The firewall will perform stat …
answered Apr 2 '18 by user3629081
1
vote
It is not supported to have the ASA respond to VPN tunnels on an IP address other than its own IP address. (This is in contrast to Cisco routers where you can do that.) So you would never be able to …
answered May 10 '18 by user3629081
1
vote
When in transparent mode, the ASA performs some layer 2 validation. One thing it validates is that the MAC address and IP address of a packet flying by are correctly correlated. That is to say, tha …
answered Apr 3 '18 by user3629081
4
votes
If I were you, I would not route the traffic through both the ASA and the RV340. Both devices have similar feature sets (in your scenario), and using both would be redundant. Since you already have du …
answered Jul 10 '18 by user3629081
3
votes
When the ASA attempts to send traffic out an interface where a crypto map is applied, it will always process the crypto map from top-down, looking for the first match. Therefore, it will always match …
answered Apr 3 '18 by user3629081