16

You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, I am going to assume you are interested in IKEv1. Things change a little for IKEv2 (well, a lot), but I did want to mention the answer below only correlates to ...


10

I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session. Issue this for example to get a list of site to site vpn tunnels that are up. show vpn-sessiondb l2l output example: Connection : 192.168.1.1 Index : 330 ...


8

Answering my own question to help future googlers. I spent about 3 hours on the phone with TAC; we finally got to the root cause of the issue. The solution is to add a special NAT entry, which matches the IP address in the DNS A-Record when it arrives on the INSIDE interface. object network DNS_NAT_masd1 description xlate A-Record DMZ src 1.195.18.182 to ...


8

Here's an example configuration for what you're looking to accomplish. First create an object for you server: object network SRV1 host 10.203.5.1 Next, create the PAT rule that uses your outside interface IP: object network SRV1 nat (inside,outside) static interface service tcp 3389 10001 The packet processing order of operations on 8.2 code and below ...


8

The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears down. After ensuring vlan 100 is up/up, you'll need both a crypto key for SSH and a statement like ssh 192.168.0.0 255.255.255.0 inside to permit all inside ...


8

Cisco has a whole bunch of different operating systems for a variety of products: IOS runs on most Cisco routers and switches. IOS XE is a more modern, modular version of IOS. IOS XR runs on high-end routers. NX-OS runs on the Nexus line of datacenter switches. ASA OS runs on Cisco ASA devices. AireOS runs on Access Points. And I'm probably forgetting a lot ...


7

You are correct, if all the ASA sees is an HTTPS request, then the TCP payload is encrypted, which prevents the ASA's URL filtering (or any other TCP payload inspection). Typically, url filtering is done by an http reverse-proxy or load-balancer (like Cisco's ACE/CSM, F5 LTM, or Citrix Netscaler to name a few). The devices I mentioned can also offload SSL ...


7

OK, after looking at your configuration, you are missing one statement: route outside 0.0.0.0 0.0.0.0 125.x.x.9 This tells the firewall to forward all Internet traffic to the ISP's router at 125.x.x.9


7

Experiment There is a lot of conflicting information about what actually happens on a Windows client when using split-dns. So much that I decided to gather some evidence and see where it points. I set up a simultaneous packet capture on both the VPN-connected Windows client and the ASA to which that client is connected. Here is a diagram of the test setup:...


7

Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the hack is to not have both subinterfaces active at the same time on a single ASA. On the ASA on the left assuming it's active, the first subint would be alive and ...


7

Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can override that basic function. Once inter-interface/intra-interface is enabled -- thus allowing traffic at all -- ACLs will apply. (You could set interfaces to ...


7

Unfortunately, Cisco has not given us a precise, one-line way to remove a single object or object-group. This is something that may come in time as the ASA code continues to mature and the ASA's themselves get more CPU resources. The original ASA line was pathetically underpowered in the CPU department. Your 5505, for example, was first released in 2006 ...


6

If you are using a Cisco PIX 6.2(2) and later or ASA 7.0 and later as your firewall you can do the following: Create an object-group service, but don't specify tcp-udp after you name it. Once you hit enter you will be able to use the service-object command to define what udp, tcp, or tcp-udp ports you want, as well as if it is a source or destination ...


6

How can I measure how this latency is divided between outbound and inbound leg? You can find the congested ping direction with hping on linux / cygwin. If it turns out to be generated equally or mostly on inbound traffic, can I affect that (i.e. ingress throttling) or do I have to contact my ISP? You can do it either way, but the ISP method is better ...


6

You can do a static PAT (Port Address Translation) to forward specific ports for an IP (including the ASA's interface IP) to different internal devices. You can do this for any port, but each port can only be forwarded to one internal device using a static PAT statement. For example, assuming you have something like: interface Ethernet0/2 nameif dmz ip ...


6

The ACL associated with a point to point VPN should always contain both source and destination information. To classify "interesting traffic", that is the traffic to be protected and then sent to a remote endpoint, Cisco devices (routers and L3 swithces and ASAs oh my) will look at both source and destination addresses. If you would like a singular host to ...


6

It is recommended you upgrade the flash to at least the current shipping default of 256mb in the fine print (number 11) of the 8.3 memory upgrade guide. (http://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/guide/asa_hw/overview.html#pgfId-1054519). The same would apply for 9.1. The concern would come with loading the ASA code it self, along with ...


6

Can I change that simply by typing the following in conf t: In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for Outside_map's sequence number 10. The peer list can hold up to ten addresses. ASA3(config)# show run crypto | i peer crypto map Outside_map 10 set peer 1.2.3.4 5.6....


6

Enter the following commands on your 3850: no ip route 0.0.0.0 0.0.0.0 10.128.7.1 ip route 0.0.0.0 0.0.0.0 10.128.17.106 This will direct Internet traffic to your firewall. If you haven't set up NAT on your firewall yet, post a copy of your firewall config and we can modify that for you too.


6

Great question! You're right in thinking that it is a function of your object-group. You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-control . ACL optimisation collapses all the possible ACE combinations for source/destination addresses and ports back into your original objects. The numbers in ...


6

Depending on the ASA and license you have, you could use contexts which create virtual ASAs within the ASA. Each is independent of the other. This would also allow you to test ASA configs before putting them on production. Each vlan interface is assigned to a context. Packets coming in are classified (in your situation, via MAC of the vlan interface) and ...


6

Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN.. because the 5505 has L2 switch ports rather than "L3 Routed Ports" If you want to protect somebody plugging into your switch interface and obtaining root-...


6

If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. This does not provide any loop protection, but the ASA (non-5505 as indicated) is incapable of creating a L2 loop and your stated goal is to remove BPDU's from ...


6

this type of object group is calles Network Object Group , so to create a network group that includes the IP addresses of three administrators for example , enter the following commands: hostname (config)# object-group network admins hostname (config-protocol)# description Administrator Addresses hostname (config-protocol)# network-object host 10.1.1.4 ...


6

access-list outside_acl extended permit tcp interface outside object webserver eq https access-list outside_acl extended permit tcp interface outside object webserver eq www access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq www access-list outside_acl extended permit tcp host 172.16.0.2 host 0.0.0.0 eq https You need to remove ...


6

It's giving you that/those error(s) because removing that object would leave the access-list empty but still existing, which is not possible or allowed, and you can't delete an access-list like that (by just saying "no" on its only line). What you need to do is: clear config access-list out2in This will disassociate the access-list with the interface and ...


6

If the hosts are in the same VLAN and the switch they are connected to support it, there's a feature made precisely for this case: private vlan This allow the devices to communicate with remote networks but not with each other. As explained in the linked article private VLAN is the name of the feature in Cisco world. Some other vendors have the same feature ...


5

My understanding is that when using the SDI protocol for RSA integration, you cannot pass group/class info. However, if you reach the RSA server using RADIUS, then the RSA server can be configured to return a RADIUS Class attribute of the format "OU=group-policy-name;" which is then used to match a group-policy name in the ASA config. I've done it this way ...


5

From the ASA Config Guide For all ASA models, the maximum number of DHCP client addresses varies depending on the license: •If the limit is 10 hosts, the maximum available DHCP pool is 32 addresses. •If the limit is 50 hosts, the maximum available DHCP pool is 128 addresses. •If the number of hosts is unlimited, the maximum available ...


5

what impact could this SPAN operation cost me on performance ? If you are referring to a possible performance penalty on your firewalls ability to process packets, then there shouldn't be any for this simple of an operation. The only time that would come into play is if you begin setting up multiple filters to inspect packet headers in real-time on multiple ...


Only top voted, non community-wiki answers of a minimum length are eligible