4
votes
Accepted
Cisco IOS -> ASA VTI tunnel not routing traffic
I found the solution to this eventually, with some help.
The issue was that on the ASR side, the tunnel was in its default configuration which uses GRE, which the ASA doesn't support.
The solution was ...
- 193
4
votes
Accepted
When in Cisco ASA multiple context mode, does each context have a startup and running config?
Yes. That is the entire purpose of having multiple contexts (also called VDOM (virtual domains) in some devices). It’s designed for segregating regions (production from non-production, for example) ...
- 4,436
4
votes
Cisco ASDM Remote Code Execution VULN
The way to fix or remove the vulnerability is to obtain a newer version of ASDM that does not contain the vulnerability. You would have to get that from Cisco.
You can also apply other methods ("...
- 62k
3
votes
Accepted
TACACS+ AAA over L2L VPN
In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA ...
- 4,436
3
votes
TACACS+ AAA over L2L VPN
Your configuration
aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10
key testing123
defines the inside interface as the source.
- 62k
3
votes
Accepted
Cisco ASA Clientless SSL VPN Apply Tunnel Group
Because you don't currently have any group-url or group-alias definitions on any tunnel-groups, your users will use DefaultWEBVPNGroup's settings, which use local authentication (rather than something ...
- 4,436
3
votes
Accepted
Cisco ASA Clientless SSL VPN Restrict Network Access
What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”.
So, if you want to allow your VPN subnet to only talk with something ...
- 4,436
3
votes
Accepted
Cisco ASA syslog messages, reversed source and destination for outbound communication?
Ok apparently that's what the Splunk plugin does as well.
See "Splunk Add-on for Cisco ASA" https://splunkbase.splunk.com/app/1620/
# direction is inbound
[...
- 183
3
votes
Accepted
Which command is used in Cisco ASA Firewall to display the whole packet flow?
The packet-tracer command.
For example:
packet-tracer input inside tcp 192.168.1.100 1234 8.8.8.8 443 would show you each phase/stage of the flow process including which NAT (if any), which ACL (if ...
- 4,436
2
votes
Cisco ASA syslog filtering
You could write your firewall rules so that the "noisy" communication falls into a dedicated "Allow" rule and turn off logging for such rule.
- 183
2
votes
Accepted
Access TACACS+ Server through ASA
On your router, all of your static routes pointing to your firewall are wrong. You need to define the next hop since you aren’t on a PTP link.
Please remove all of the routes pointing to Eth0/1 using ...
- 4,436
2
votes
Switching Internet connection on Cisco ASA
I have to create some kind of set of rules that will switch Internet connection from tunnel to local NAT
Don't use NAT with the tunnel interface. Your local, private IP addresses make perfect sense ...
- 69.5k
2
votes
Multi-Home BGP on ASA 5500
The solution for me was to add the no-prepend and replace-as options on the neighbor statement with local-as.
- 41
1
vote
Cisco ASA_Anyconnect clients bandwidth
Bandwidth cannot be limited on a per-user basis for AnyConnect. You could define a policy-map and class-map that limits bandwidth in some other means, such as by the subnet used for AnyConnect users, ...
- 4,436
1
vote
Accepted
NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?
It's a bug in the "Cisco Packet Tracer" that causes NAT not to work correctly.
See here: https://community.cisco.com/t5/routing/packet-tracer-asa-nat-problem/td-p/3936024
(Some workarounds ...
- 121
1
vote
How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch?
It's not just NAT but also routing in your case.
For NAT this should do:
nat (inside,outside) after-auto source dynamic any interface
For routing you will need to route "inside" networks to ...
- 11
1
vote
Accepted
Cisco ASA nat from inside to outside, but network that is routed to inside interface
First, yes, Packet Tracer is extremely limited. It’s a learning tool for passing exams, so it lacks TONS of functionality that real devices have.
As for your main question, absolutely you can do that. ...
- 4,436
Only top scored, non community-wiki answers of a minimum length are eligible