16
votes
Accepted
In IPsec VPN, how is the pre-shared key encrypted?
You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, ...
- 13.9k
10
votes
How can I reset a VPN tunnel on a Cisco ASA?
I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session.
Issue this for example to ...
- 201
8
votes
Accepted
Cisco ASA 9.0(1) - NAT / PAT
Here's an example configuration for what you're looking to accomplish.
First create an object for you server:
object network SRV1
host 10.203.5.1
Next, create the PAT rule that uses your outside ...
- 746
8
votes
Accepted
SSH to Cisco ASA 5505
The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears ...
- 7,009
8
votes
Accepted
Cisco IOS versions vs Cisco ASA versions?
Cisco has a whole bunch of different operating systems for a variety of products:
IOS runs on most Cisco routers and switches.
IOS XE is a more modern, modular version of IOS.
IOS XR runs on high-end ...
- 1,899
7
votes
Accepted
Dual ASA5510 with dual ISP failover
Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the ...
- 7,009
7
votes
Cisco ASA 8.2(5) same security routing issue
Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can ...
- 29.6k
7
votes
Accepted
Correct Cisco ASA CLI Command To Delete Network Objects (force)
Unfortunately, Cisco has not given us a precise, one-line way to remove a single object or object-group. This is something that may come in time as the ASA code continues to mature and the ASA's ...
- 8,258
6
votes
Accepted
Can we change peer IP of IPSec VPN tunnel in one line?
Can I change that simply by typing the following in conf t:
In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for ...
- 1,626
6
votes
Accepted
Cisco ASA and 3850 routing
Enter the following commands on your 3850:
no ip route 0.0.0.0 0.0.0.0 10.128.7.1
ip route 0.0.0.0 0.0.0.0 10.128.17.106
This will direct Internet traffic to your firewall. If you haven't set up ...
- 62.5k
6
votes
What do the parentheses "()" after objects mean in Cisco ASA ACLs?
Great question! You're right in thinking that it is a function of your object-group.
You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-...
- 549
6
votes
Accepted
Multiple VLANs with same subnet behind single ASA
Depending on the ASA and license you have, you could use contexts which create virtual ASAs within the ASA. Each is independent of the other. This would also allow you to test ASA configs before ...
- 3,032
6
votes
Switchport BPDUs dropped at ASA firewall
Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's
Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
- 311
6
votes
Accepted
Switchport BPDUs dropped at ASA firewall
If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
- 1,470
6
votes
How can i add a host to an already existing object group in ASA
this type of object group is calles Network Object Group ,
so to create a network group that includes the IP addresses of three administrators for example , enter the following commands:
hostname (...
- 3,404
6
votes
Accepted
Cannot get port-forward working on ASA 5505: "Drop-reason: (acl-drop) Flow is denied by configured rule"
access-list outside_acl extended permit tcp interface outside object webserver eq https
access-list outside_acl extended permit tcp interface outside object webserver eq www
access-list outside_acl ...
- 4,481
6
votes
Accepted
delete object network in cisco ASA with packet tracert
It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
- 4,481
6
votes
Accepted
Cisco ASA: What is the best way to restrict access of nodes in the same network to each other?
If the hosts are in the same VLAN and the switch they are connected to support it, there's a feature made precisely for this case: private vlan
This allow the devices to communicate with remote ...
- 18.4k
5
votes
Accepted
Cisco ASA 5550 stuck on boot from tftp
I found the problem!
The firewall has 4 rams (each of 1gb).
I started with two rams inserted and changed the configuration and it worked, the firewall did not restart.
So there is one failing ram....
- 181
5
votes
Accepted
Cisco ASA Dynamic Routing - Originating a NAT Block
Creating a static route for "10.100.00.0/23" and redistributing it to EIGRP should do the trick.
The static route would lift it into the routing table and the redistribution of static routs will ...
- 351
5
votes
Accepted
Unable to save ASA config
First check your current config register value. You can do that using sh ve command.
The default value is 0x1.
You can find possible values here.
- 66
5
votes
Why is it not possible to do NAT exemption from lower to higher security level on ASA 8.0
NAT Exemption is by definition bi-directional. If I have the following networks, with the following security-levels and IPs:
DMZ - Security Level 50 - 10.1.1.0/24
Inside - Security Level 100 - ...
- 13.9k
5
votes
In IPsec VPN, how is the pre-shared key encrypted?
Your answer is in your question: The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share).
See this: https://security.stackexchange.com/...
- 62.5k
5
votes
Accepted
After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel
Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with.
This is done by updating the dynamic map to include new entries with a ...
- 615
5
votes
Accepted
How should I diagnose why my Cisco ASA denies traffic?
The easiest way to figure out why your ASA drops traffic:
If it's a routed ASA firewall, use packet-tracer
Both routed and transparent ASA firewalls can use capture [NAME] asp-drop
Using packet-...
- 29.6k
5
votes
Accepted
ASA not routing with IP from ISP dhcp
If the ASA can ping the internet then routing on the firewall is fine.
Although I did noticed I can't see a NAT statement to nat your traffic from your inside to the outside address
Apply the NAT ...
- 311
5
votes
Accepted
Cisco ASA 5512-X has no VPN capabilities
Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
- 29.6k
5
votes
Accepted
Which security level does a remote site-to-site VPN network have?
See this: What is the ASA packet process order when there is both a VPN and route in place?
Documented information:
Non-encrypted packets go through the packet process partially quoted at the ...
- 1,125
5
votes
Accepted
Problem with Cisco ASA 5512 NAT Configuration
The IP address of FTP Server you used in packet-tracer input outside tcp 193.252.204.12 12345 10.3.3.128 21 is NOT correct, you should use 62.X.X.226.
Therefore, your correct packet-tracer command is ...
- 3,744
5
votes
Accepted
Problem with Cisco ASA 5510 DMZ configuration
In this situation (ASA uses all private IPs), you should avoid doing NAT as much as possible.
With your setup, the configuration looks fine and packet-tracer tells you that your static NAT for DMZ ...
- 3,744
Only top scored, non community-wiki answers of a minimum length are eligible