The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

2
votes
0answers
26 views

ASA 5505: How do I access the DMZ web server from the inside using the public IP?

We are using a 5505 ASA Sec+ (8.2). There are three interfaces: inside (172.17.0.0/24), dmz (172.16.0.0/24) and outside (1.2.3.4 for the example). There are static NAT rules set up translating ...
0
votes
0answers
15 views

Routing and VPN Setup

The network setup is as follows: Router: eth0 1.1.1.1 (outside) eth1 192.168.54.4 (inside) eth1 10.54.4.4 (inside) Cisco ASA5505 192.168.54.1 (inside) 10.54.4.1 ...
3
votes
0answers
41 views
+50

Cisco ASA failback to preferred IPsec peer

I just configured my Cisco ASA 5505 to failover to a backup internet line when the main outside interface is down. This all works fine. Also, I have a site-to-site IPSEC VPN tunnel from this ...
0
votes
1answer
65 views

Cisco ASA site-to-site VPN up but no traffic

I currently have site to site VPN tunnel up between Cisco ASA 5550 & Cisco ASA5506-X. I can see the vpn tunnel is up on both end but no traffic is passing through. Cisco ASA 5550 is receiving ...
1
vote
0answers
23 views

Cisco ASA 5505 no NAT

I have a cisco asa 5505. The outside and inside IPs are private IPs so I do not want to NAT the inside IPs as they go out the Outside interface (there is a router upstream of the ASA 5505. Would I do ...
1
vote
0answers
17 views

Allow Ports 80, 443 and 81 through ASA 5510

We are switching our VoIP provisioning method from TFTP to HTTP provisioning and have been asked by the VoIP provider to allow inbound access on ports 80, 81 and 443 from their two network networks on ...
1
vote
1answer
23 views

CISCO ASA: Add specific command to a privilege level

i am facing the following issue, created a new account with a "read-only" access on a CISCO ASA 5510. This account will be used in a script that will back up the running-config of the ASA. the ...
0
votes
0answers
32 views

asa5512x: ipsec site-to-site vpn with tcp instead of udp? is it possible?

the cisco documentation for ASA 9.1 (I have 9.1.2) seems to imply that ipsec vpn with tcp/ip is only for remote clients, not site to site vpn. But I repeatedly see people mention vpn over tcp to ...
1
vote
0answers
17 views

Tethered VPN on Macbook fails to connect, but standard VPN over WiFi works [closed]

I have a MacBook using the Cisco client and it works fine except when I use the special Mac/iPad ability to tether over the iPad data connection. For those that are unfamiliar with this, the Mac and ...
0
votes
0answers
24 views

Remote Desktop Gateway temporarily unavailable outside LAN

I have setup Microsofts RD Gateway on a server in one of our subnets. We have multiple subnets separated by a Cisco ASA firewall. One for servers, one for desktops etc. If I run mstsc from the server ...
0
votes
0answers
15 views

how can a low security group communicate with a high security group in ASA 5525

My DMZ Interface has security level 50 and my interface "old_network" has security level 40. My DMZ has a range 172.16.20.224/27 and my old_network has 192.168.1.0/24. The DMZ can communicate with ...
0
votes
1answer
23 views

cisco asa 5512-x policing

I have a single 100mb leased line that will be shared by three unrelated companies. We are looking to buy a cisco ASA 5512-X and I need to use policing to ensure that each company receives 1/3 of ...
1
vote
1answer
51 views

Cisco ASA separating networks

We are using a Cisco ASA 5505 running ver 9.0 to separate our corporate (inside) network from a dev lab (outside) network. We would like to use NAT or PAT to forward the inside interface IP to a set ...
-1
votes
3answers
160 views

Why can i not ping my host behind the firewall. Cisco asa 5505 [closed]

Can anyone please help me to figure out what in my configuration of the Cisco asa 5505 is wrong or missing. I have multiple host behind my firewall these hosts run different websites on port 80. I am ...
3
votes
1answer
163 views

Nmap external scan shows port open, ASA says port is not open, but do get an socket

Folks, have a weird one, need your expert help. For one of our heavily used external facing server which came up in an audit, nmap -Pn scan shows the following: Starting Nmap 5.51 ... Host ...
0
votes
0answers
192 views

Site-to site Configuration between OpenSwan and Cisco ASA

I am making site-to-site vpn connection using amazon ec2 linux and cisco asa router ( please note i donot have access to router only configuration is provided.) CISCO ASA CONFIGURATION : ...
0
votes
0answers
57 views

Cisco ASA 5505 VPN users access to local LAN denied

I have this running config: : Saved : ASA Version 8.2(5) ! hostname TESTATES domain-name TEST.com names name 192.168.1.0 AsusWireless ! interface Ethernet0/0 switchport access vlan 2 ! interface ...
2
votes
0answers
171 views

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

I have exported an existing certificate+key from an ASA 5510: asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
0
votes
0answers
32 views

Cisco Cryptochecksum generation

I ran 2 commands - a show start and a show run. I noticed that the cryptochecksums were different. My main question is understanding the cryptochecksum and how it is generated. Is it different ...
0
votes
0answers
32 views

Determining the side-effects of enabling unicast reverse-path forwarding on Cisco ASA 5505

I am trying to find out what (if any) negative side-effects there would be to enabling Unicast Reverse Path Forwarding (uRPF) on a Cisco ASA 5505 - I need to do this on a router which I do not have ...
0
votes
2answers
155 views

HttpServletRequest.getRemoteAddr() always returns 127.0.0.1

We're attempting to identify where specific requests are coming from inside our Java application. We have changed the log files to include the IP address and we're using ...
-1
votes
1answer
81 views

Find source(s) of dropped packages in Cisco ASA GUI

we are using pair of ASA 5520 Firewalls with ASDM 6.4. Can someone enlighten me, how to find out which is(are) the source or target ip(s) when we got a hugh bunch of dropped packages come in (by ASDM ...
0
votes
1answer
42 views

Need help understanding a bandwidth restriction on a Cisco ASA

We have a guest wireless network here and it's bandwidth is limited too 1 Meg per second. I did not configure this and am trying to pick it up. I've found these lines in the cisco config but i'm not ...
1
vote
5answers
114 views

Multiple Computers Running IIS with a Singular Public IP how to handle incoming communications?

At our company, we have three separate servers that house IIS currently. Each of these three servers have the same public IP address and essentially reside on the same network under different subnets. ...
0
votes
0answers
210 views

Cisco ASA firewall blocking requests to internally hosted DNS server

I have a DNS server behind a Cisco ASA firewall. The Cisco firewall is performing NAT. When inside the network, I can NSLOOKUP directly to the server. When the client is external, requests time out. ...
0
votes
2answers
128 views

Cisco Easy VPN - Port forwarding needed at remote end?

I was in the process of setting up a site-to-site ipsec vpn tunnel behind a mobile broadband router when i found out that i wasnt able to port forward on that network so i wont be able to use the ...
1
vote
0answers
99 views

WatchGuard Authentication equivalent with Cisco ASA X series

I am in the process of implementing Cisco ASA 5512-X devices with FirePOWER to replace WatchGuard firewalls. The WatchGuard devices in use are currently wrapping access to various services with a ...
2
votes
3answers
176 views

Cisco ASA NAT - internal host see its public ip

I have a server hosted by a provider which uses Cisco ASA to do nat. The problem I have is that the internal server that is nat-ed with a public ip will see its public ip as source ip. This basically ...
0
votes
0answers
64 views

Cisco vpn access to another router

I am using a Cisco ASA 5505 to VPN into my network (which is working great), and I want to connect to a different network that is on a Asus RT-N66v. For example: network 10.1.1.1 is my VPN and ...
0
votes
1answer
54 views

Cisco asa 5505 w/ seperate subnets and seperate isps

I am trying to join two networks together thru the asa. I have a 192.168.0.1 network that is the main domain and has its own isp and is administered by windows server 2008 for DNS and DHCP i also ...
1
vote
1answer
247 views

Cisco ASA - difference between inside_access_in and inside_access_out?

So a minor problem we have is any internal servers have no (non-icmp) access to the outside is being blocked. Our current config is: inside_access_in any ---> any ---> icmp inside_access_out ...
0
votes
0answers
183 views

Route Email to external IP Cisco ASA 5515

I have a cisco ASA 5515X with two WAN connections and one LAN connection. As far as I understand, I hace the firewall configured to allow SMTP traffic through WAN2 interface, but not through WAN1. ...
-2
votes
1answer
119 views

Can I use ASA5505 to spoof the reply to a heartbeat request?

I have a CISCO ASA 5505 in a home office. It has two subnet, public and private. There is a wifi belkin router on the private net, which provides wifi for some users. That belkin router sends out ...
1
vote
1answer
545 views

NAT Rule changes from ASA software 8.0 to 8.4

I have an Access Rule and a NAT rule that works fine with on the Security Appliance Software Version 8.0 The rule is as follows: However, I am having trouble making the same rule work on an ASA ...
0
votes
0answers
157 views

Include multiple sub-interfaces in Cisco ASA for VPN tunnel

I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces. Say, In Cisco ASA 5550, I created multiple subinterfaces with VLAN ID as below: Inside, int0/1 : ...
0
votes
2answers
128 views

ASA is not forwarding packets to egress interface

We are seeing some very strange behaviour from our Cisco ASA 5505 running 9.1(2) We have a SIP PBX inside our network. It's got a bit of an odd configuration, it listens for inbound SIP requests for ...
3
votes
2answers
229 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
1answer
339 views

Cisco ASA 5510 needs “clear arp <Interface>” periodically to reach a single host

ASA 9.0(3) The symptom is that I can ping from the ASA to any other host in that interface's subnet, save one particular host (that host can ping the interface on the ASA however). If I do "clear arp ...
0
votes
1answer
94 views

Secondary IPs on DMZ machines not working

I am moving some virtual machines from my DMZ in a bladecenter over to my new cisco UCS. We are using Hyper-V, and are running Server 2012 on the old bladecenter, and Server 2012r2 on the new UCS. ...
0
votes
0answers
89 views

ASA 5515-X: Policy based NAT for dedicated uplink

We have bought a Cisco ASA 5515-X and we have the following scenario. Current situation: GigabitInterface 0/0, IP via DHCP, ISP1, Coax, 100M up / 12M down, medium latency GigabitInterface 0/1, ...
0
votes
0answers
187 views

Amazon AWS Site-to-Site VPN doesn't allow concurrent pings

I have some strange behaviour with an AWS VPC site-to-site set up and would like some help to understand where my problem might be. Set Up I have a VPC with a private and public subnet, there is a ...
1
vote
1answer
80 views

vpn connection is OK but can't route some IPs

Our Network is laid out as in the diagram below PC1 can successfully connect to server 2 (with 10.120.20.x/24), and PC4 can successfully connect to server 1 (with 10.120.30.x/24). Our problem is ...
0
votes
0answers
159 views

Cisco ASA 5505 - IPSec remote VPN accessing secondary subnet

Layout: modem (pass through) -> Cisco ASA 5505 (Lan 192.168.10.1) -> (Wan 192.168.10.2) Netgear N600 Router (Lan 10.1.10.1) -> workstations (server=10.1.10.34) VPN connection to ASA no problem. I ...
0
votes
3answers
99 views

How to see traffic traversing a Cisco ASA by inside host?

I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
1
vote
1answer
3k views

Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule

During VPN reconfiguration we have met quite big issue with VPN traffic not passing to peer. Using packet-tracer we have have got following debug: Phase 1 to Phase 9 passed successfully. [...] ...
1
vote
1answer
137 views

Force Cisco ASA to change source port NAT

I have a 2 devices, a Cisco ASA and sitting behind it another device. Both the Cisco and the other device have IPsec tunnels but to different locations. I need to ensure that the source port of the ...
1
vote
1answer
313 views

cisco ASA 5505 l2tp vpn

I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but: when i have "use default gateway on remote network" on NIC enabled i have access to ...
1
vote
0answers
424 views

Configuring ASA 5510 for multiple port-forwarding using TCP-UDP service group

I'm currently trying to configure two different ASA 5510s to properly forward all ports used in h323 video conferencing to the proper video conferencing equipment setup on the internal network on each ...
0
votes
2answers
109 views

Routing between 2 networks and 2 routers

I have a WatchGuard XTM33 and a Cisco ASA 5505, current network is running off of the Cisco and I want to eventually migrate over to the WatchGuard using new IP scheme. ASA 192.168.111.1/24 WG ...
3
votes
2answers
440 views

Static public IP issue on Cisco ASA 5512x

This is our scenario: We have an Cisco ASA 5512x and we have 2 different Internet connections from different ISPs connected with it. ISP A is being used for the users browsing traffic(normal ...