16 votes
Accepted

In IPsec VPN, how is the pre-shared key encrypted?

You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, ...
user avatar
  • 14k
10 votes

How can I reset a VPN tunnel on a Cisco ASA?

I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session. Issue this for example to ...
user avatar
  • 201
8 votes
Accepted

Cisco ASA 9.0(1) - NAT / PAT

Here's an example configuration for what you're looking to accomplish. First create an object for you server: object network SRV1 host 10.203.5.1 Next, create the PAT rule that uses your outside ...
user avatar
8 votes
Accepted

SSH to Cisco ASA 5505

The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears ...
user avatar
8 votes
Accepted

Cisco IOS versions vs Cisco ASA versions?

Cisco has a whole bunch of different operating systems for a variety of products: IOS runs on most Cisco routers and switches. IOS XE is a more modern, modular version of IOS. IOS XR runs on high-end ...
user avatar
  • 1,909
7 votes
Accepted

Dual ASA5510 with dual ISP failover

Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the ...
user avatar
7 votes

Cisco ASA 8.2(5) same security routing issue

Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can ...
user avatar
  • 29.7k
7 votes
Accepted

Correct Cisco ASA CLI Command To Delete Network Objects (force)

Unfortunately, Cisco has not given us a precise, one-line way to remove a single object or object-group. This is something that may come in time as the ASA code continues to mature and the ASA's ...
user avatar
  • 8,258
6 votes
Accepted

Cisco ASA and 3850 routing

Enter the following commands on your 3850: no ip route 0.0.0.0 0.0.0.0 10.128.7.1 ip route 0.0.0.0 0.0.0.0 10.128.17.106 This will direct Internet traffic to your firewall. If you haven't set up ...
user avatar
  • 63k
6 votes

What do the parentheses "()" after objects mean in Cisco ASA ACLs?

Great question! You're right in thinking that it is a function of your object-group. You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-...
user avatar
  • 549
6 votes
Accepted

Multiple VLANs with same subnet behind single ASA

Depending on the ASA and license you have, you could use contexts which create virtual ASAs within the ASA. Each is independent of the other. This would also allow you to test ASA configs before ...
user avatar
6 votes

Switchport BPDUs dropped at ASA firewall

Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
user avatar
  • 311
6 votes
Accepted

Switchport BPDUs dropped at ASA firewall

If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
user avatar
  • 1,470
6 votes

How can i add a host to an already existing object group in ASA

this type of object group is calles Network Object Group , so to create a network group that includes the IP addresses of three administrators for example , enter the following commands: hostname (...
user avatar
  • 3,414
6 votes
Accepted

Cannot get port-forward working on ASA 5505: "Drop-reason: (acl-drop) Flow is denied by configured rule"

access-list outside_acl extended permit tcp interface outside object webserver eq https access-list outside_acl extended permit tcp interface outside object webserver eq www access-list outside_acl ...
user avatar
  • 4,661
6 votes
Accepted

delete object network in cisco ASA with packet tracert

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (...
user avatar
  • 4,661
6 votes
Accepted

Cisco ASA: What is the best way to restrict access of nodes in the same network to each other?

If the hosts are in the same VLAN and the switch they are connected to support it, there's a feature made precisely for this case: private vlan This allow the devices to communicate with remote ...
user avatar
  • 18.4k
5 votes
Accepted

Cisco ASA 5550 stuck on boot from tftp

I found the problem! The firewall has 4 rams (each of 1gb). I started with two rams inserted and changed the configuration and it worked, the firewall did not restart. So there is one failing ram....
user avatar
  • 181
5 votes
Accepted

Unable to save ASA config

First check your current config register value. You can do that using sh ve command. The default value is 0x1. You can find possible values here.
user avatar
  • 66
5 votes

Why is it not possible to do NAT exemption from lower to higher security level on ASA 8.0

NAT Exemption is by definition bi-directional. If I have the following networks, with the following security-levels and IPs: DMZ - Security Level 50 - 10.1.1.0/24 Inside - Security Level 100 - ...
user avatar
  • 14k
5 votes

In IPsec VPN, how is the pre-shared key encrypted?

Your answer is in your question: The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share). See this: https://security.stackexchange.com/...
user avatar
  • 63k
5 votes
Accepted

After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel

Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with. This is done by updating the dynamic map to include new entries with a ...
user avatar
5 votes
Accepted

How should I diagnose why my Cisco ASA denies traffic?

The easiest way to figure out why your ASA drops traffic: If it's a routed ASA firewall, use packet-tracer Both routed and transparent ASA firewalls can use capture [NAME] asp-drop Using packet-...
user avatar
5 votes
Accepted

ASA not routing with IP from ISP dhcp

If the ASA can ping the internet then routing on the firewall is fine. Although I did noticed I can't see a NAT statement to nat your traffic from your inside to the outside address Apply the NAT ...
user avatar
  • 311
5 votes
Accepted

Cisco ASA 5512-X has no VPN capabilities

Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
user avatar
  • 29.7k
5 votes
Accepted

Which security level does a remote site-to-site VPN network have?

See this: What is the ASA packet process order when there is both a VPN and route in place? Documented information: Non-encrypted packets go through the packet process partially quoted at the ...
user avatar
  • 1,125
5 votes
Accepted

Problem with Cisco ASA 5512 NAT Configuration

The IP address of FTP Server you used in packet-tracer input outside tcp 193.252.204.12 12345 10.3.3.128 21 is NOT correct, you should use 62.X.X.226. Therefore, your correct packet-tracer command is ...
user avatar
  • 3,744
5 votes
Accepted

Problem with Cisco ASA 5510 DMZ configuration

In this situation (ASA uses all private IPs), you should avoid doing NAT as much as possible. With your setup, the configuration looks fine and packet-tracer tells you that your static NAT for DMZ ...
user avatar
  • 3,744
5 votes
Accepted

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your ...
user avatar
  • 3,744
5 votes
Accepted

How to keep an ASA tunnel up for lifetime?

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none
user avatar
  • 536

Only top scored, non community-wiki answers of a minimum length are eligible