The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

0
votes
1answer
11 views

Using a VPN tunnel on a Cisco ASA to connect locations

I am looking for some advise on how to connect some of our locations together, using a site-to-site VPN on our Cisco ASA 5515-X. At the moment we have a 5515-X at our head office and a Cisco 887A ...
0
votes
0answers
20 views

IPSec - Is it possible to have remote access clients (road warriors) all behind the same NAT device?

This is a topic that I find mixed information on. Is it possible to have two IPSec road warriors that are behind the same NAT, even with an ASA as the VPN endpoint? I have been trying with Libreswan ...
0
votes
0answers
18 views

Port Forward on Cisco ASA 5512-X

i would to improve port forward from an external host to an internal network, on my ASA. The network and the host are on two different interfaces, the internal network is on the internal interface ...
1
vote
0answers
25 views

cisco asa public server nat issue

I have been tasked with some ASA configuration coming in a few weeks, and to test out some configuration options I have setup a web server on my local network which I would like to be able to access ...
1
vote
0answers
14 views

On Cisco firewall, show access-list main rules only (with line numbers)

For example, if I do a sh access-list Lets say I have a rule on line 2 that has one object-group to another object-group connected on X ports. Well, there may be 30 lines below that, that all say ...
0
votes
0answers
17 views

Cisco asa 8.4 PAT with static NAT

I am trying to make sense of the changes that Cisco has made to NAT on ASA > v8.3. I have a network which is being PAT'd to the outside interface address, and want to add a static NAT from the outside ...
0
votes
0answers
30 views

Cisco ASA PBR and multiple ISPS for multiple SIP Providers

Have a question about policy based routing on my Cisco ASA 5515 running 9.5 and think despite it being available in this software version that I might be screwed. I have an asterisk PBX behind the ...
1
vote
0answers
15 views

AnyConnect on ASA5520 licensing required? [duplicate]

longtime reader, first-time poster. I'm currently working in a small shop and I am new to the Sys Admin role. We pay our ISP a lot for our VPN and we are looking for a different provider. We are ...
0
votes
0answers
16 views

Openswan to Cisco ASA IPSec tunnel - specific IP address range required. Netmap?

I'm attempting to set up a VPN tunnel between a Cisco ASA 5520 and an Openswan server running on Ubuntu 14.04 on a Amazon VPC instance. I do not have access to the ASA, and have been given the ...
1
vote
0answers
20 views

How should I use Cisco ASA 5510 and Catalyst 3550 together

So I took on a project at my job moving four separate networks into one Colo center. Currently I broken everything down from the four networks into 4 VLANS on the ASA 5510. Each are assigned IPs ...
1
vote
0answers
20 views

Cisco ASA 5510 ASDM 6.4 (2) unable to do port translation

I have a situation, where I want to do port translation. For example I can acces my service outside ip:8081 that is forwaded to server:8080. I should have a NAT rule option to add PAT like in this ...
0
votes
1answer
72 views

ASA INSIDE to INSIDE traffic being dropped

An ASA 5505 is being used to route between two networks as it contains routes to everything. The following depicts the network topology. I have tried various combinations of access lists such as: ...
2
votes
0answers
35 views

Dual path VPN on ASA 9.2

We have two sites that are joined by a VPN over two WAN links, one primary and one backup only. The VPN endpoints are a pair of active/standby ASA clusters at each site. Each site also has multiple ...
0
votes
0answers
16 views

analyze Cisco ASA high cfwConnectionStatCount value

SNMP monitoring of our Cisco ASAs includes the CISCO-FIREWALL-MIB::cfwConnectionStatCount.protoIp.currentInUse value (OID .1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6), described as "number of connections ...
0
votes
0answers
29 views

Shrewsoft VPN passthrough Cisco ASA 5505

I have a shrewsoft VPN connection setup that passes through a Cisco ASA 5505, it manages to connect okay and i am able to ping etc but if i try to load anything e.g. web interface nothing is returned. ...
1
vote
2answers
30 views

Cisco ASA 5505 - Help understand/update the config

Let me preface by saying I am not a network administrator by trade and this firewall was set up originally by a Cisco consultant who is no longer available. We have a small office with a Cisco ASA ...
2
votes
2answers
45 views

Issue with Cisco ASA 5515-X VPN Connection

I had an existing setup with a 5515-X serving as my firewall and VPN, which worked fine. Since moving to a new location, and thus a new outside interface IP, I can successfully connect to the VPN, but ...
-1
votes
1answer
28 views

Cisco ASA5505 - icmp deny any outside breaks internet - how to block outside pings?

We want to block any ICMP requests that are initiated to our network from the public internet. I ran icmp deny any outside, but when I do that, it takes down our internet - nobody can load web pages. ...
2
votes
2answers
85 views

Route traffic from ASA to different firewall default gateway

I should probably start by explaining the topography, we have two different internet connection with separate firewalls.One is an asa and one is a meraki, the default gateway for all the servers ...
0
votes
1answer
79 views

Cisco ASA TCP connections never time out

Our Cisco ASA 5515 will sometimes have thousands of connections with an idle time > the configured connection timeouts. In many cases the connections show as idle for 100+ hours. This eventually leads ...
1
vote
0answers
55 views

Cannot Route RDP Traffic Through AWS Site-to-Site VPN

Hi I have establish VPN connection to the AWS VPC, but still there are some routing issues that make RDP connections fail to initiate, because the router WAN IP is differs from the Public IP, lets ...
2
votes
0answers
31 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
5
votes
1answer
61 views

Overcome asymmetric routing while migrating between sets of ISPs

We are migrating from one set of addresses to another set, both /24, and trying to minimize any down time during the migration. Ideally we'd run both for a period of time as we shut down the old ...
0
votes
1answer
21 views

ASA 5555-X ACL confusion

I'm wondering what this access list means on the ASA 5555-X? access-list TEST_INSIDE extended permit udp host 192.168.1.99 eq 7600 host 192.168.1.1 I am confused about the 'eq 7600' part since I ...
0
votes
0answers
170 views

Site to Site VPN one-way traffic Azure <-> Cisco ASA

We have a site-to-site static routing VPN (classic VPN, not ARM) attempting to connect to a remote Cisco ASA 5555 (a supported VPN device). The on-premise network can successfully initiate the tunnel ...
1
vote
0answers
55 views

CISCO SSL VPN Apps fail to connect using Java 8 update 71 (Java 8u71)

A remote client uses the SSL VPN apps for port forwarding through an ASA 5505 firewall. Basically no traffic was able to traverse the port forwarded IP addresses. Using the web browser in the VPN ...
1
vote
1answer
64 views

Setting up Cisco ASA VPN to use both radius and local users

I've got a Cisco ASA setup with L2TP/IPSec VPN, all is working well except for one minor issue. Ideally, I'd like to be able to log on to the VPN using either that RADIUS server users or the local ...
1
vote
1answer
49 views

Cisco ASA logging buffered spams terminal and console lines

I have several routers, switches and firewalls that send logs to a syslog server without interfering with the console line. I'm testing an ASA 5506 (running IOS 9.5.2) at a remote location that ...
2
votes
1answer
168 views

ASA 5510 Secondary Public IP Range on outside interface

We are in process of upgrading from an ASA5505 to an ASA5510. I have a co-location configured for 3 ranges of public IP addresses on two different subnets. The 5505 is working as expected. Example ...
1
vote
1answer
32 views

ASA 5505 blocks users

I have recently installed an ASA 5505. But now i have users that are being blocked/kicked from the internet. What can i do to prevent this? Here is the running config: Result of the command: "sh ...
0
votes
0answers
81 views

ASA 5510 Inter-Vlan routing issues

and thank you in advance for your help. I am having an issue where we are migrating from an ASA 5505 to an ASA 5510 and the software versions are quite different as well so they handle VLANs ...
0
votes
0answers
9 views

Unable to Apply Qos Policy map

I have a 20Mbps MPLS connection , when trying to apply the Qos Policy Map (wich is 60% for Silver traffic , and 40% for gold Traffic), i get the Following Error : "I/f FastEthernet0/0 class DSCP-AF31 ...
3
votes
1answer
46 views

Cisco ASA 5505 L2L vpn issue

this is my setup I already have a working L2L VPN between the sites I added the 10.10.0.0/24 to the object-groups that defines the internal network on the 1615 ASA And as a remote subnet on the ...
1
vote
1answer
94 views

Cisco ASA - Allowing external access to a secure server via RDP

I am new to the forums and really hope someone can help me. I am pulling my hair out! I have posted on both the Cisco forums and Windows forums in hopes anyone can suggest something but no one has ...
5
votes
2answers
342 views

How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X

I have a CISCO ASA 5506-X with 4 configured interfaces and a set of access-lists etc. It is configured via CLI and is running in routed mode, not transparent. Everything is running well, but now I ...
0
votes
0answers
28 views

Diffie Hellman Group 20 Cisco Asa

It seems to be that I am a little bit lost in the scrap of documentation. I am looking out for a new ASA Appliance that supports lvl 20+ Diffie Hellman. But I cannot find any documentation if there is ...
0
votes
1answer
16 views

Cisco ASA5505 compatible RAM

I have a Cisco ASA5505 which I've acquired. It boots up first time successfully, and works without issue, however as soon as I reboot, it fails to boot with the flashing light sequence which indicates ...
0
votes
0answers
44 views

Packet Tracer 6.1.1 ISAKMP command not available

I am just going around in circles trying to configure a site to site VPN using the CLI on the ASA 5505 in Packet Tracer 6.1.1 When I am configuring isakmp the command just do not seem to be abailable ...
0
votes
1answer
52 views

Joining computers to domain with ASA firewall in place

I have an ASA firewall (inside interface ip=10.15.15.1 and outside int=192.168.3.1). DNS server is seating on the inside of the ASA. All PCs inside are able to join to domain but the ones outside of ...
0
votes
0answers
446 views

ASA Certifiate does not match the server name

I am trying to install a certificate on my Cisco ASA 5515, It has my local windows 2012 CA as a trusted CA. The domain has also had this CA applied to their trusted root. When ever i try and connect ...
1
vote
0answers
86 views

Is it possible to access inside server using outside address from dmz an a Cisco ASA

We have a Cisco ASA 5506-X (running ASA 9.5(1)) and a /28 public network. The first available address in the public network is assigned to the outside interface of the ASA and has NAT/PAT to several ...
0
votes
0answers
15 views

About to buy Cisco ASA 5506-X [duplicate]

I'm about to buy my first Cisco router and intend to buy the Cisco ASA 5506-X. From reptuation, I've rightly or wrongly, got the impression that Cisco love to bolt on subscriptions for things. When ...
0
votes
0answers
20 views

Can't change Cisco ASA Easy VPN Server Address - no changes were made

I am trying to update an Easy VPN Server address (it is changing) via ASDM, however when I enter the new address and click Apply it says No changes were made. Any ideas how I can change this please? ...
0
votes
0answers
18 views

IP Routing for VPN Failover on ASA - Did I miss anything? Is there another method?

To handle the 4x VPNs I plan to use the following scenario for Routing: Prefered Order for VPN connection: ISP1<-->ISP3 ISP1<-->ISP4 ISP2<-->ISP3 ISP2<-->ISP4 Example Site ...
0
votes
0answers
61 views

No web access behind Cisco Router - Connection denied due to NAT reverse path failure

I have a small network behind a Cisco ASA 5505. From a computer on the network, I can't even ping 8.8.8.8. Web browsing also fails with a "DNS probe finished no internet" error. I'm getting a lot of ...
0
votes
0answers
64 views

The proper way to create a VPN tunnel with one static host and one dynamic host

Note: I have never attempted this before trying today but I knew it was possible due to research online. So I gave it a try and got it to work... I have one static host (let's call it HOST_S) which ...
0
votes
1answer
156 views

NPS Server 2012 with ASA as Radius client not working, Server 2008 Working

for some time I have been using 2008 R2 as my Radius server and I have a Cisco ASA FW who is configured as Radius client and working ok. I have introduced another Windows 2012 DC, and also configured ...
0
votes
0answers
33 views

ASAs are clustered. No WCCP. How do i forward all traffic to my Mcafee Web Gateway

Just like the question states. We have clustered ASAs so WCCP is not available (news to me) I need to forward all web traffic from a specific range to our web gateways aka proxy. proxy is listening ...
3
votes
0answers
179 views

VLAN Communication between Cisco ASA 5510, and VMWare ESXi 5.5

I've having a problem, where my Cisco ASA 5510-v8.2 can't communicate with VM's in a VLAN specific port group. The Cisco ASA is currently sitting in front of a group of VM's that have public IP's. ...
0
votes
1answer
42 views

Cisco ASA access-lists redundant entries

I need to modify existing configuration of the CISCO ASA. While analyzing the configuration I noticed something that looks redundant to me. I would like to see if somebody can confirm my doubts. ...