Skip to main content
Share Your Experience: Take the 2024 Developer Survey
6 votes

How can i add a host to an already existing object group in ASA

this type of object group is calles Network Object Group , so to create a network group that includes the IP addresses of three administrators for example , enter the following commands: hostname (...
Gadeliow's user avatar
  • 3,444
6 votes
Accepted

Cannot get port-forward working on ASA 5505: "Drop-reason: (acl-drop) Flow is denied by configured rule"

access-list outside_acl extended permit tcp interface outside object webserver eq https access-list outside_acl extended permit tcp interface outside object webserver eq www access-list outside_acl ...
Jesse P.'s user avatar
  • 4,690
6 votes
Accepted

delete object network in cisco ASA with packet tracert

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
Jesse P.'s user avatar
  • 4,690
6 votes
Accepted

Cisco ASA: What is the best way to restrict access of nodes in the same network to each other?

If the hosts are in the same VLAN and the switch they are connected to support it, there's a feature made precisely for this case: private vlan This allow the devices to communicate with remote ...
JFL's user avatar
  • 19.7k
5 votes
Accepted

Problem with Cisco ASA 5512 NAT Configuration

The IP address of FTP Server you used in packet-tracer input outside tcp 193.252.204.12 12345 10.3.3.128 21 is NOT correct, you should use 62.X.X.226. Therefore, your correct packet-tracer command is ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

Problem with Cisco ASA 5510 DMZ configuration

In this situation (ASA uses all private IPs), you should avoid doing NAT as much as possible. With your setup, the configuration looks fine and packet-tracer tells you that your static NAT for DMZ ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

How to keep an ASA tunnel up for lifetime?

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none
A-A-Ron's user avatar
  • 636
5 votes
Accepted

Cisco ASA 9 update ACL programatically

Although one way to do it is with programmatically updating an ACL, you might consider Building a network config and remotely loading it which is programmatically much simpler than trying to edit the ...
jonathanjo's user avatar
  • 16.3k
5 votes

ASA static routes

You probably don’t have a route back. The gateway at 172.16.18.1 doesn’t know how to get back to your internal (192.169.1.0) network. You need a route on that device. If you can’t modify that ...
Ron Trunk's user avatar
  • 67.6k
5 votes
Accepted

Urgent: how to configure different interface using same ip subnet in asa 5506?

The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
Ron Trunk's user avatar
  • 67.6k
5 votes

ASA Denying PAT'd IP

object network DMZ nat (dmz,outside) dynamic interface This statement is part of your problem. You have this "global" NAT that has been given higher priority than: nat (dmz,outside) after-auto ...
Jesse P.'s user avatar
  • 4,690
5 votes
Accepted

General issues with access to and from DMZ on Cisco ASA 5520

Let's clean up your NAT statements a bit before we troubleshoot. Here, we'll temporarily remove your "global" NAT statements object network obj-dmz-subnet no nat (dmz,outside) dynamic ...
Jesse P.'s user avatar
  • 4,690
5 votes

Cisco ASA 5585X Internal-Data0/1 interface errors

From Cisco tech note: The ASA interface error counter "overrun" tracks the number of times that a packet was received on the network interface, but there was no available space in the interface ...
Ron Trunk's user avatar
  • 67.6k
5 votes
Accepted

What is the difference between an ASA firewall and UTM firewall?

An ASA is a layer 3 and layer 4 firewall. UTM stands for Unified Threat Management, meaning it does the basic layer 3 and layer 4 firewalling but also has the capacity (much larger storage, more RAM, ...
Jesse P.'s user avatar
  • 4,690
4 votes
Accepted

Is somebody trying to hack me?

Does this mean that someone is trying to get login over SSH/Telnet to my ASA? Well, yes. But you can expect to see that hundreds or thousands of times a day. Welcome to the Internet. If you ...
Ron Trunk's user avatar
  • 67.6k
4 votes
Accepted

How can i open a group of ports in ASA 5512?

You need to configure Access Rules. Below is an example to get you started. You need to build yours to suit your needs. hostname(config)# access-list outside_access extended permit tcp any object ...
Ronnie Royston's user avatar
4 votes

How can i add a host to an already existing object group in ASA

Your example is adding the host to the object-group. This will not remove any existing entries. To remove hosts you need to do the following: object-group network TEST no network-object <object-...
mike.b93's user avatar
  • 203
4 votes

Packet capture on a Cisco ASA

The packet capture feature stores data in pcap format, which can be read by Wireshark and other analysis tools. So, yes, that would probably be more useful for packet analysis than syslog messages.
Ron Trunk's user avatar
  • 67.6k
4 votes
Accepted

How can I disable temporarily Cisco AnyConnect user from ASDM?

From ASDM: Choose Configuration > Remote Access VPN > AAA/Local Users > Local Users. Select the user you want to configure and click Edit. In the left-hand pane, click VPN Policy. Specify the number ...
hertitu's user avatar
  • 2,658
4 votes
Accepted

ASA5550 manual failover question

How do i check the status of failover to make failover is correctly configure. These commands will give a good indicator of the status and configuration show failover show failover state show ...
TDurden's user avatar
  • 1,241
4 votes
Accepted

Advertise static route via BGP from Cisco ASA 5512-x

I believe the feature you are looking for is "Reverse Route Injection". Reverse route injection (RRI) is the ability for static routes to be automatically inserted into the routing process for ...
TDurden's user avatar
  • 1,241
4 votes
Accepted

Cisco ASA single isakmp policy for multiple crypto map

The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

Cisco ASA Route Outside Track Configuration

In the first example, the 1 sets the administrative distance of the route. By default, the administrative distance of a static route is 1, so normally you wouldn't need to set it. The track feature ...
Ron Trunk's user avatar
  • 67.6k
4 votes
Accepted

Unable to properly configure ASA 5512 with WAN IP

You will never be able to ping from the INSIDE interface IP address of the ASA to any OUTSIDE IP address. The ASA does not allow this. interface GigabitEthernet0/0 description Uplink To ComRTR ...
Kanwar's user avatar
  • 56
4 votes
Accepted

How to Cisco Anyconnect increase subscription base license user count

It is possible for you to buy just another L-AC-PLS-LIC= for additional 25 users, thus you will have licenses for 50 users. Below information is from Cisco AnyConnect Ordering Guide (03/2017): ...
Hung Tran's user avatar
  • 3,754
4 votes

Steps to find neighboring device to a Cisco ASA firewalls

This answer by Cisco that "we don;t support it because it is a security device" is fairly poor. The Device, if it's a good security device, could easily have this implemented as a passive-only ...
Ben Personick's user avatar
4 votes
Accepted

ASA traceroute from lower security level to higher security level

Yes, you need to update your ACL to allow more UDP ports covering the traceroute packets from Unix-like Operating system. According to the Wikipedia Page for Traceroute: On Unix-like Operating ...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

Cisco ASA Site-to-Site VPN, remote LANs have no Internet

1 Your configurations at Cisco ASA and 891 router look fine to me and I was able to apply most of them in the following case and it works properly: Let us say: Your Local LAN network is on R4 ...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

Cannot ping subinterfaces on Cisco ASA 5508

After some research I discovered the ASA does not allow pinging from one interface to another. So this explains why I was able to ping the inside interface when it was setup on the physical port but ...
Racehorse35's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible