8
votes
Accepted
Cisco IOS versions vs Cisco ASA versions?
Cisco has a whole bunch of different operating systems for a variety of products:
IOS runs on most Cisco routers and switches.
IOS XE is a more modern, modular version of IOS.
IOS XR runs on high-end ...
- 1,949
6
votes
How can i add a host to an already existing object group in ASA
this type of object group is calles Network Object Group ,
so to create a network group that includes the IP addresses of three administrators for example , enter the following commands:
hostname (...
- 3,444
6
votes
Accepted
Cannot get port-forward working on ASA 5505: "Drop-reason: (acl-drop) Flow is denied by configured rule"
access-list outside_acl extended permit tcp interface outside object webserver eq https
access-list outside_acl extended permit tcp interface outside object webserver eq www
access-list outside_acl ...
- 4,690
6
votes
Accepted
delete object network in cisco ASA with packet tracert
It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
- 4,690
6
votes
Accepted
Cisco ASA: What is the best way to restrict access of nodes in the same network to each other?
If the hosts are in the same VLAN and the switch they are connected to support it, there's a feature made precisely for this case: private vlan
This allow the devices to communicate with remote ...
- 19.5k
5
votes
Accepted
Which security level does a remote site-to-site VPN network have?
See this: What is the ASA packet process order when there is both a VPN and route in place?
Documented information:
Non-encrypted packets go through the packet process partially quoted at the ...
- 1,135
5
votes
Accepted
Problem with Cisco ASA 5512 NAT Configuration
The IP address of FTP Server you used in packet-tracer input outside tcp 193.252.204.12 12345 10.3.3.128 21 is NOT correct, you should use 62.X.X.226.
Therefore, your correct packet-tracer command is ...
- 3,754
5
votes
Accepted
Problem with Cisco ASA 5510 DMZ configuration
In this situation (ASA uses all private IPs), you should avoid doing NAT as much as possible.
With your setup, the configuration looks fine and packet-tracer tells you that your static NAT for DMZ ...
- 3,754
5
votes
Accepted
Site-to-Site IPsec VPN tunnel with an additional remote network/subnet
1
What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:
At your ...
- 3,754
5
votes
Accepted
How to keep an ASA tunnel up for lifetime?
You should be able to disable this in the group policy attributes.
group-policy "policy_name" attributes
vpn-idle-timeout none
- 536
5
votes
Accepted
Cisco ASA 9 update ACL programatically
Although one way to do it is with programmatically updating an ACL, you might consider
Building a network config and remotely loading it which is programmatically much simpler than trying to edit the ...
- 16.2k
5
votes
ASA static routes
You probably don’t have a route back. The gateway at 172.16.18.1 doesn’t know how to get back to your internal (192.169.1.0) network.
You need a route on that device.
If you can’t modify that ...
- 67.1k
5
votes
Accepted
Urgent: how to configure different interface using same ip subnet in asa 5506?
The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
- 67.1k
5
votes
ASA Denying PAT'd IP
object network DMZ
nat (dmz,outside) dynamic interface
This statement is part of your problem. You have this "global" NAT that has been given higher priority than:
nat (dmz,outside) after-auto ...
- 4,690
5
votes
Accepted
General issues with access to and from DMZ on Cisco ASA 5520
Let's clean up your NAT statements a bit before we troubleshoot.
Here, we'll temporarily remove your "global" NAT statements
object network obj-dmz-subnet
no nat (dmz,outside) dynamic ...
- 4,690
5
votes
Cisco ASA 5585X Internal-Data0/1 interface errors
From Cisco tech note:
The ASA interface error counter "overrun" tracks the number of times
that a packet was received on the network interface, but there was no
available space in the interface ...
- 67.1k
5
votes
Accepted
What is the difference between an ASA firewall and UTM firewall?
An ASA is a layer 3 and layer 4 firewall. UTM stands for Unified Threat Management, meaning it does the basic layer 3 and layer 4 firewalling but also has the capacity (much larger storage, more RAM, ...
- 4,690
4
votes
Accepted
High number of "pkts replay failed" on Cisco ASA
This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing.
Anti-Replay
The goal of Anti-...
- 15k
4
votes
Accepted
Remove ASDM from ASA
You did uninstall it... from the ASA. All that's on the ASA is installer packages. Once you've used ASDM from the firewall (https... Install ASDM Launcher), then you have ASDM on your PC; it doesn't ...
- 31.8k
4
votes
ASA NAT & ACL question
Since ASA 8.3 code, the interface ACLs expect the real-ip in each statement.
In your example, your real-ip is 10.15.x.x.
As such, your ACL entry will have to look like this:
access-list ...
- 15k
4
votes
Accepted
Is somebody trying to hack me?
Does this mean that someone is trying to get login over SSH/Telnet to
my ASA?
Well, yes. But you can expect to see that hundreds or thousands of times a day. Welcome to the Internet. If you ...
- 67.1k
4
votes
Accepted
How can i open a group of ports in ASA 5512?
You need to configure Access Rules. Below is an example to get you started. You need to build yours to suit your needs.
hostname(config)# access-list outside_access extended permit tcp any object ...
- 4,399
4
votes
How can i add a host to an already existing object group in ASA
Your example is adding the host to the object-group. This will not remove any existing entries.
To remove hosts you need to do the following:
object-group network TEST
no network-object <object-...
- 203
4
votes
Packet capture on a Cisco ASA
The packet capture feature stores data in pcap format, which can be read by Wireshark and other analysis tools. So, yes, that would probably be more useful for packet analysis than syslog messages.
- 67.1k
4
votes
Accepted
How can I disable temporarily Cisco AnyConnect user from ASDM?
From ASDM:
Choose Configuration > Remote Access VPN > AAA/Local Users > Local Users.
Select the user you want to configure and click Edit.
In the left-hand pane, click VPN Policy.
Specify the number ...
- 2,638
4
votes
Accepted
ASA5550 manual failover question
How do i check the status of failover to make failover is correctly
configure.
These commands will give a good indicator of the status and configuration
show failover
show failover state
show ...
- 1,241
4
votes
Accepted
Advertise static route via BGP from Cisco ASA 5512-x
I believe the feature you are looking for is "Reverse Route Injection".
Reverse route injection (RRI) is the ability for static routes to be
automatically inserted into the routing process for ...
- 1,241
4
votes
Accepted
Cisco ASA single isakmp policy for multiple crypto map
The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
- 3,754
4
votes
Accepted
Cisco ASA Route Outside Track Configuration
In the first example, the 1 sets the administrative distance of the route.
By default, the administrative distance of a static route is 1, so normally you wouldn't need to set it.
The track feature ...
- 67.1k
4
votes
Accepted
Unable to properly configure ASA 5512 with WAN IP
You will never be able to ping from the INSIDE interface IP address of the ASA to any OUTSIDE IP address. The ASA does not allow this.
interface GigabitEthernet0/0
description Uplink To ComRTR
...
- 56
Only top scored, non community-wiki answers of a minimum length are eligible