8
votes
Accepted
Cisco IOS versions vs Cisco ASA versions?
Cisco has a whole bunch of different operating systems for a variety of products:
IOS runs on most Cisco routers and switches.
IOS XE is a more modern, modular version of IOS.
IOS XR runs on high-end ...
- 1,949
7
votes
Accepted
Correct Cisco ASA CLI Command To Delete Network Objects (force)
Unfortunately, Cisco has not given us a precise, one-line way to remove a single object or object-group. This is something that may come in time as the ASA code continues to mature and the ASA's ...
- 8,288
6
votes
Accepted
Switchport BPDUs dropped at ASA firewall
If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
- 1,470
6
votes
Switchport BPDUs dropped at ASA firewall
Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's
Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
- 311
6
votes
How can i add a host to an already existing object group in ASA
this type of object group is calles Network Object Group ,
so to create a network group that includes the IP addresses of three administrators for example , enter the following commands:
hostname (...
- 3,434
6
votes
Accepted
Cannot get port-forward working on ASA 5505: "Drop-reason: (acl-drop) Flow is denied by configured rule"
access-list outside_acl extended permit tcp interface outside object webserver eq https
access-list outside_acl extended permit tcp interface outside object webserver eq www
access-list outside_acl ...
- 4,670
6
votes
Accepted
delete object network in cisco ASA with packet tracert
It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
- 4,670
6
votes
Accepted
Cisco ASA: What is the best way to restrict access of nodes in the same network to each other?
If the hosts are in the same VLAN and the switch they are connected to support it, there's a feature made precisely for this case: private vlan
This allow the devices to communicate with remote ...
- 19.3k
5
votes
Accepted
ASA not routing with IP from ISP dhcp
If the ASA can ping the internet then routing on the firewall is fine.
Although I did noticed I can't see a NAT statement to nat your traffic from your inside to the outside address
Apply the NAT ...
- 311
5
votes
Accepted
Cisco ASA 5512-X has no VPN capabilities
Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
- 31.1k
5
votes
Accepted
Which security level does a remote site-to-site VPN network have?
See this: What is the ASA packet process order when there is both a VPN and route in place?
Documented information:
Non-encrypted packets go through the packet process partially quoted at the ...
- 1,135
5
votes
Accepted
Problem with Cisco ASA 5512 NAT Configuration
The IP address of FTP Server you used in packet-tracer input outside tcp 193.252.204.12 12345 10.3.3.128 21 is NOT correct, you should use 62.X.X.226.
Therefore, your correct packet-tracer command is ...
- 3,754
5
votes
Accepted
Problem with Cisco ASA 5510 DMZ configuration
In this situation (ASA uses all private IPs), you should avoid doing NAT as much as possible.
With your setup, the configuration looks fine and packet-tracer tells you that your static NAT for DMZ ...
- 3,754
5
votes
Accepted
Site-to-Site IPsec VPN tunnel with an additional remote network/subnet
1
What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:
At your ...
- 3,754
5
votes
Accepted
How to keep an ASA tunnel up for lifetime?
You should be able to disable this in the group policy attributes.
group-policy "policy_name" attributes
vpn-idle-timeout none
- 536
5
votes
Accepted
Cisco ASA 9 update ACL programatically
Although one way to do it is with programmatically updating an ACL, you might consider
Building a network config and remotely loading it which is programmatically much simpler than trying to edit the ...
- 16.1k
5
votes
ASA static routes
You probably don’t have a route back. The gateway at 172.16.18.1 doesn’t know how to get back to your internal (192.169.1.0) network.
You need a route on that device.
If you can’t modify that ...
- 66.1k
5
votes
Accepted
Urgent: how to configure different interface using same ip subnet in asa 5506?
The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
- 66.1k
5
votes
ASA Denying PAT'd IP
object network DMZ
nat (dmz,outside) dynamic interface
This statement is part of your problem. You have this "global" NAT that has been given higher priority than:
nat (dmz,outside) after-auto ...
- 4,670
5
votes
Accepted
General issues with access to and from DMZ on Cisco ASA 5520
Let's clean up your NAT statements a bit before we troubleshoot.
Here, we'll temporarily remove your "global" NAT statements
object network obj-dmz-subnet
no nat (dmz,outside) dynamic ...
- 4,670
5
votes
Cisco ASA 5585X Internal-Data0/1 interface errors
From Cisco tech note:
The ASA interface error counter "overrun" tracks the number of times
that a packet was received on the network interface, but there was no
available space in the interface ...
- 66.1k
5
votes
Accepted
What is the difference between an ASA firewall and UTM firewall?
An ASA is a layer 3 and layer 4 firewall. UTM stands for Unified Threat Management, meaning it does the basic layer 3 and layer 4 firewalling but also has the capacity (much larger storage, more RAM, ...
- 4,670
4
votes
How to use secondary internet exclusively for one host?
ip policy route-map
that command permit to create differentiate policy to the routing table:
http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/
create an acl to define the ...
- 344
4
votes
Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?
If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.
- 14.5k
4
votes
Accepted
Changing the IP address of a Cisco ASA 5505 Remotely
I am posting this on stack exchange as I was unable to find an answer on the 'net:
Where the new subnet is:
A.B.C.0 (gateway=A.B.C.1, host ip=A.B.C.2)
and the old subnet is:
P.Q.R.0 (gateway=P.Q....
- 191
4
votes
Is there a checklist for replacing failed ASA hardware?
One thing to add to the things collected is the licensed features (show activation-key detail)
This all depends on the asa model and running version. Some parts will be in the config, others in flash ...
- 31.1k
4
votes
Accepted
Is there a checklist for replacing failed ASA hardware?
I opted to use the Cisco support methods of swapping out my ASA. You might also consider Ricky Beam's suggestion to swap CF cards which is unsupported by Cisco
I just finished the swap and ...
- 904
4
votes
Accepted
High number of "pkts replay failed" on Cisco ASA
This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing.
Anti-Replay
The goal of Anti-...
- 14.5k
4
votes
Accepted
Remove ASDM from ASA
You did uninstall it... from the ASA. All that's on the ASA is installer packages. Once you've used ASDM from the firewall (https... Install ASDM Launcher), then you have ASDM on your PC; it doesn't ...
- 31.1k
4
votes
ASA NAT & ACL question
Since ASA 8.3 code, the interface ACLs expect the real-ip in each statement.
In your example, your real-ip is 10.15.x.x.
As such, your ACL entry will have to look like this:
access-list ...
- 14.5k
Only top scored, non community-wiki answers of a minimum length are eligible