4 votes
Accepted

Cisco IOS -> ASA VTI tunnel not routing traffic

I found the solution to this eventually, with some help. The issue was that on the ASR side, the tunnel was in its default configuration which uses GRE, which the ASA doesn't support. The solution was ...
user avatar
4 votes
Accepted

When in Cisco ASA multiple context mode, does each context have a startup and running config?

Yes. That is the entire purpose of having multiple contexts (also called VDOM (virtual domains) in some devices). It’s designed for segregating regions (production from non-production, for example) ...
user avatar
  • 4,436
4 votes

Cisco ASDM Remote Code Execution VULN

The way to fix or remove the vulnerability is to obtain a newer version of ASDM that does not contain the vulnerability. You would have to get that from Cisco. You can also apply other methods ("...
user avatar
  • 62k
3 votes
Accepted

TACACS+ AAA over L2L VPN

In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA ...
user avatar
  • 4,436
3 votes

TACACS+ AAA over L2L VPN

Your configuration aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10 key testing123 defines the inside interface as the source.
user avatar
  • 62k
3 votes
Accepted

Cisco ASA Clientless SSL VPN Apply Tunnel Group

Because you don't currently have any group-url or group-alias definitions on any tunnel-groups, your users will use DefaultWEBVPNGroup's settings, which use local authentication (rather than something ...
user avatar
  • 4,436
3 votes
Accepted

Cisco ASA Clientless SSL VPN Restrict Network Access

What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”. So, if you want to allow your VPN subnet to only talk with something ...
user avatar
  • 4,436
3 votes
Accepted

Cisco ASA syslog messages, reversed source and destination for outbound communication?

Ok apparently that's what the Splunk plugin does as well. See "Splunk Add-on for Cisco ASA" https://splunkbase.splunk.com/app/1620/ # direction is inbound [...
user avatar
  • 183
3 votes
Accepted

Which command is used in Cisco ASA Firewall to display the whole packet flow?

The packet-tracer command. For example: packet-tracer input inside tcp 192.168.1.100 1234 8.8.8.8 443 would show you each phase/stage of the flow process including which NAT (if any), which ACL (if ...
user avatar
  • 4,436
2 votes

Cisco ASA syslog filtering

You could write your firewall rules so that the "noisy" communication falls into a dedicated "Allow" rule and turn off logging for such rule.
user avatar
  • 183
2 votes
Accepted

Access TACACS+ Server through ASA

On your router, all of your static routes pointing to your firewall are wrong. You need to define the next hop since you aren’t on a PTP link. Please remove all of the routes pointing to Eth0/1 using ...
user avatar
  • 4,436
2 votes

Switching Internet connection on Cisco ASA

I have to create some kind of set of rules that will switch Internet connection from tunnel to local NAT Don't use NAT with the tunnel interface. Your local, private IP addresses make perfect sense ...
user avatar
  • 69.5k
2 votes

Multi-Home BGP on ASA 5500

The solution for me was to add the no-prepend and replace-as options on the neighbor statement with local-as.
user avatar
  • 41
1 vote

Cisco ASA_Anyconnect clients bandwidth

Bandwidth cannot be limited on a per-user basis for AnyConnect. You could define a policy-map and class-map that limits bandwidth in some other means, such as by the subnet used for AnyConnect users, ...
user avatar
  • 4,436
1 vote
Accepted

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

It's a bug in the "Cisco Packet Tracer" that causes NAT not to work correctly. See here: https://community.cisco.com/t5/routing/packet-tracer-asa-nat-problem/td-p/3936024 (Some workarounds ...
user avatar
  • 121
1 vote

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch?

It's not just NAT but also routing in your case. For NAT this should do: nat (inside,outside) after-auto source dynamic any interface For routing you will need to route "inside" networks to ...
user avatar
  • 11
1 vote
Accepted

Cisco ASA nat from inside to outside, but network that is routed to inside interface

First, yes, Packet Tracer is extremely limited. It’s a learning tool for passing exams, so it lacks TONS of functionality that real devices have. As for your main question, absolutely you can do that. ...
user avatar
  • 4,436

Only top scored, non community-wiki answers of a minimum length are eligible