As of May 31, 2023, we have updated our Code of Conduct.
8 votes
Accepted

Cisco IOS versions vs Cisco ASA versions?

Cisco has a whole bunch of different operating systems for a variety of products: IOS runs on most Cisco routers and switches. IOS XE is a more modern, modular version of IOS. IOS XR runs on high-end ...
RobinG's user avatar
  • 1,949
7 votes
Accepted

Correct Cisco ASA CLI Command To Delete Network Objects (force)

Unfortunately, Cisco has not given us a precise, one-line way to remove a single object or object-group. This is something that may come in time as the ASA code continues to mature and the ASA's ...
Brett Lykins's user avatar
  • 8,288
6 votes
Accepted

Switchport BPDUs dropped at ASA firewall

If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
cpt_fink's user avatar
  • 1,470
6 votes

Switchport BPDUs dropped at ASA firewall

Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
Smithy2k3's user avatar
  • 311
6 votes

How can i add a host to an already existing object group in ASA

this type of object group is calles Network Object Group , so to create a network group that includes the IP addresses of three administrators for example , enter the following commands: hostname (...
Gadeliow's user avatar
  • 3,434
6 votes
Accepted

Cannot get port-forward working on ASA 5505: "Drop-reason: (acl-drop) Flow is denied by configured rule"

access-list outside_acl extended permit tcp interface outside object webserver eq https access-list outside_acl extended permit tcp interface outside object webserver eq www access-list outside_acl ...
Jesse P.'s user avatar
  • 4,670
6 votes
Accepted

delete object network in cisco ASA with packet tracert

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
Jesse P.'s user avatar
  • 4,670
6 votes
Accepted

Cisco ASA: What is the best way to restrict access of nodes in the same network to each other?

If the hosts are in the same VLAN and the switch they are connected to support it, there's a feature made precisely for this case: private vlan This allow the devices to communicate with remote ...
JFL's user avatar
  • 19.3k
5 votes
Accepted

ASA not routing with IP from ISP dhcp

If the ASA can ping the internet then routing on the firewall is fine. Although I did noticed I can't see a NAT statement to nat your traffic from your inside to the outside address Apply the NAT ...
Smithy2k3's user avatar
  • 311
5 votes
Accepted

Cisco ASA 5512-X has no VPN capabilities

Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
Ricky's user avatar
  • 31.1k
5 votes
Accepted

Which security level does a remote site-to-site VPN network have?

See this: What is the ASA packet process order when there is both a VPN and route in place? Documented information: Non-encrypted packets go through the packet process partially quoted at the ...
Todd Wilcox's user avatar
  • 1,135
5 votes
Accepted

Problem with Cisco ASA 5512 NAT Configuration

The IP address of FTP Server you used in packet-tracer input outside tcp 193.252.204.12 12345 10.3.3.128 21 is NOT correct, you should use 62.X.X.226. Therefore, your correct packet-tracer command is ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

Problem with Cisco ASA 5510 DMZ configuration

In this situation (ASA uses all private IPs), you should avoid doing NAT as much as possible. With your setup, the configuration looks fine and packet-tracer tells you that your static NAT for DMZ ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

How to keep an ASA tunnel up for lifetime?

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none
A-A-Ron's user avatar
  • 536
5 votes
Accepted

Cisco ASA 9 update ACL programatically

Although one way to do it is with programmatically updating an ACL, you might consider Building a network config and remotely loading it which is programmatically much simpler than trying to edit the ...
jonathanjo's user avatar
  • 16.1k
5 votes

ASA static routes

You probably don’t have a route back. The gateway at 172.16.18.1 doesn’t know how to get back to your internal (192.169.1.0) network. You need a route on that device. If you can’t modify that ...
Ron Trunk's user avatar
  • 66.1k
5 votes
Accepted

Urgent: how to configure different interface using same ip subnet in asa 5506?

The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
Ron Trunk's user avatar
  • 66.1k
5 votes

ASA Denying PAT'd IP

object network DMZ nat (dmz,outside) dynamic interface This statement is part of your problem. You have this "global" NAT that has been given higher priority than: nat (dmz,outside) after-auto ...
Jesse P.'s user avatar
  • 4,670
5 votes
Accepted

General issues with access to and from DMZ on Cisco ASA 5520

Let's clean up your NAT statements a bit before we troubleshoot. Here, we'll temporarily remove your "global" NAT statements object network obj-dmz-subnet no nat (dmz,outside) dynamic ...
Jesse P.'s user avatar
  • 4,670
5 votes

Cisco ASA 5585X Internal-Data0/1 interface errors

From Cisco tech note: The ASA interface error counter "overrun" tracks the number of times that a packet was received on the network interface, but there was no available space in the interface ...
Ron Trunk's user avatar
  • 66.1k
5 votes
Accepted

What is the difference between an ASA firewall and UTM firewall?

An ASA is a layer 3 and layer 4 firewall. UTM stands for Unified Threat Management, meaning it does the basic layer 3 and layer 4 firewalling but also has the capacity (much larger storage, more RAM, ...
Jesse P.'s user avatar
  • 4,670
4 votes

How to use secondary internet exclusively for one host?

ip policy route-map that command permit to create differentiate policy to the routing table: http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/ create an acl to define the ...
feligiotti's user avatar
4 votes

Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?

If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.
Eddie's user avatar
  • 14.5k
4 votes
Accepted

Changing the IP address of a Cisco ASA 5505 Remotely

I am posting this on stack exchange as I was unable to find an answer on the 'net: Where the new subnet is: A.B.C.0 (gateway=A.B.C.1, host ip=A.B.C.2) and the old subnet is: P.Q.R.0 (gateway=P.Q....
xirt's user avatar
  • 191
4 votes

Is there a checklist for replacing failed ASA hardware?

One thing to add to the things collected is the licensed features (show activation-key detail) This all depends on the asa model and running version. Some parts will be in the config, others in flash ...
Ricky's user avatar
  • 31.1k
4 votes
Accepted

Is there a checklist for replacing failed ASA hardware?

I opted to use the Cisco support methods of swapping out my ASA. You might also consider Ricky Beam's suggestion to swap CF cards which is unsupported by Cisco I just finished the swap and ...
alx9r's user avatar
  • 904
4 votes
Accepted

High number of "pkts replay failed" on Cisco ASA

This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing. Anti-Replay The goal of Anti-...
Eddie's user avatar
  • 14.5k
4 votes
Accepted

Remove ASDM from ASA

You did uninstall it... from the ASA. All that's on the ASA is installer packages. Once you've used ASDM from the firewall (https... Install ASDM Launcher), then you have ASDM on your PC; it doesn't ...
Ricky's user avatar
  • 31.1k
4 votes

ASA NAT & ACL question

Since ASA 8.3 code, the interface ACLs expect the real-ip in each statement. In your example, your real-ip is 10.15.x.x. As such, your ACL entry will have to look like this: access-list ...
Eddie's user avatar
  • 14.5k

Only top scored, non community-wiki answers of a minimum length are eligible