The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (3)

3
votes
1answer
91 views
+50

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
0
votes
1answer
24 views

Cisco ASA 5510 Inter-interface routing

I'm trying to setup a Cisco 5510 to route traffic between the outside and inside interfaces where both belong to public IP subnets. Our ISP assigned us a single point-to-point IP (207.107.110.150/30) ...
0
votes
1answer
30 views

Cisco ASA: port forwarding to different IP depending on client IP/subnet outside

I have Cisco ASA 8.2(5) and would like to configure port forwarding. Cisco ASA has 2 interfaces: outside with IP 192.168.57.2 inside with IP 192.168.1.1 I have two subnets reachable through ...
3
votes
2answers
36 views

Possible to use a console cable from a Cisco ASA and use it interactively with ESXi?

I'm creating procedures to deploy a Cisco ASA and an ESXi machine to remote locations where no local tech contacts are available. I think it may be a wise idea to connect the console cable from the ...
0
votes
0answers
63 views

Cisco ASA + FreeRadius: Downloadable ACL configuration

VPN users that are using FreeRadius are having access to all VLANs. VPN users using local authentication have local ACLs applied to their access. I need to know what configuration change I need to ...
0
votes
0answers
12 views

Cisco ASA Access anyconnect from inside IPsec tunnel

I have a Cisco ASA on a dynamic WAN IP with a IPsec site-to-site tunnel to a remote linux host in a datacenter with a static WAN IP. All non local traffic is tunneled and the datacenter end is the ...
0
votes
0answers
26 views

Cisco ASA 5505: PAT / NAT between 2 IPSec Tunnels

I've the following Setup: Customer <-> HQ <-> Branchoffice The Customer has a 192.168.1.0/24 subnet. On the HQ only the VPN Gateway is in my context, 172.20.10.1 . And on the Branchoffice ...
-2
votes
0answers
29 views

Cisco ASA 5505 ver 7.4 port forwarding

I need sone help over ASA 5505 ver 7.4. This scenario is working with two site to site vpn and working fine. All inside clients able access internet only issue is that they are not able to call means ...
2
votes
1answer
55 views

Cisco ASA 5510 Out-of-Order Packets to Google

We're seeing a large number of packets being dropped due to being Out-of-Order. The numbers are large enough that it may be having an impact on network performance. We've isolated it down to a few ...
0
votes
2answers
23 views

Can I NAT a public ip that is also used as a VPN peer

I have been reading books and sites on the web for two days and have tried all kinds of things to be able to ping a IP address further into my private network. The VPN tunnel is up and passing other ...
0
votes
0answers
56 views

ASA 5540 v8.4(3) vpn to ASA 5505 v8.2(5), tunnel up but I cant ping from 5505 to IP on other side

I am having problems pinging from a 5505(remote) to IP 10.160.70.10 in the network behind the 5540(HQ side). 5505 inside IP: 10.56.0.1 Out: 71.43.109.226 5540 Inside: 10.1.0.8 out: 64.129.214.27 I ...
0
votes
0answers
19 views

Cisco DNS Inspection disallows Reverse Lookup

I'm trying to use DNS Doctoring on my ASA 5505, but apparenly DNS Doctoring required DNS Inspection, and DNS Inspection forbids reverse lookup requests?! How do work around this? I did find this: ...
1
vote
1answer
79 views

Text on Cisco ASA console is garbled/missing letters

I've actually looked up a number of solutions for this problem and none of them work. There's this Cisco ASA 5505 that I'd like to use, that outputs mildly garbled text with missing characters. I did ...
2
votes
0answers
27 views

Does Cisco IOS XRv support logging of TCP connection (e.g. built and/or teardown)?

I have a demo of Cisco IOS XRv and I would like to setup logging for connections. E.g. for ASA "show logging" shows log messages for every TCP connection built or teardown: Jun 11 12:29:31 ...
1
vote
1answer
42 views

DNS doctoring between 3 interfaces

I have a guest network with a range of 192.168.13.x on m y192.168.13.1 interace. I need it to get to my external webpage at 1.2.3.4 on my outside interface. The webserver itself sits in the DMZ at ...
2
votes
1answer
65 views

Packet loss on between firewall and uplink?

I have a moderately complex network topology between my external firewall and the internet, as shown below. Every so often - I haven't found a pattern yet - we're getting a significant degree of ...
0
votes
1answer
96 views

Cisco ASA 8.2 - 106015 (Deny) and 106100 (Permit) Logs for the Same Packet

I'm seeing traffic from numerous internal endpoints where a RST or FIN/ACK is sent by the endpoint to a host on the Internet. These connections are related with a transparent proxy that is not ...
1
vote
1answer
103 views

Cisco ASA 5505 No LAN access through VPN

I have been fighting with this ASA 5505 for a days now. I am verly new to networking and need support by the community! I have completely configured the CISCO 5505 allowing me to browse the internet ...
0
votes
1answer
37 views

Reading .pcap files by CISCO ASA5515-X

I have .pcap file that already includes thousands of packets. I want to analyze these packets via CISCO ASA5515-X to observe how much of them are possible to be an attack packet (malicious). However, ...
0
votes
0answers
21 views

AnyConnect certificate/CA pinning on Cisco ASA 5510

I would like to "pin" the certificate or at least the certificate authority for AnyConnect connections. Given the amount of SSL mitm'ing and compromised CA's, I want to ensure that only certificates ...
0
votes
0answers
32 views

Port mirroring on CISCO 2960S

I am trying to do a port mirroring of the traffic for my core switch to a port on my managed switch. The environment that i have is a stacked switch, with 1 serving as the core switch and 2 serving ...
-1
votes
2answers
43 views

Why am I getting permission error from tftp server?

I'm trying to tftp an image to an ASA 5500 and I'm getting this error: TFTP failure: RX TFTP Error Packet TFTP OP Code: Error Packet Error Msg: Permission denied
1
vote
1answer
369 views

Openswan Cisco ASA 9.1 — cannot resopnd to IPsec SA request because no connection is known for

Ok, so I have a simple VPN IPSEC setup with a single Linux host that has a public IP address and a loopback interface of 172.16.255.1. On the right side I have a Cisco ASA 5505 9.1. the issue is the ...
0
votes
1answer
32 views

How to avoid hairpin VPN on cisco

I currently have a hairpin VPN setup with a Cisco ASA, but I'm not very happy as it messes up service access that are on ASA external IP address and are NAT'ed inwards :( How should I re-design the ...
0
votes
1answer
40 views

Cannot reach internal network on VPN

So i have been configuring a ASA5510 to the best of my knowledge to allow VPN access(IPSEC connection) to our internal network and its resources. There is a alot of step-by-step guides and videos ...
0
votes
1answer
39 views

Cisco ASA IPSec VPN - service discovery (e.g. shared folder browser)

We have an ASA 5505 doing IPSec VPN for remote users. Client access is working almost as expected:clients can reach hosts on the internal LAN, even using DNS, and we are tunneling all client traffic ...
0
votes
0answers
63 views

Preserving VPN Flow on ASA + netsh

I have a tcp connection established over a site-site VPN and when the VPN drops it causes errors on the client when sending after the tunnel is re-established. When having this problem before, ...
1
vote
1answer
133 views

How do I configure an ASA 5505 to pull a DHCP address from a bridged DSL modem/router?

I have a remote office that I am hooking up to our corporate network and this particular site has a centurylink adsl2+ router that I need to negotiate an rfc 1483 via DHCP connection across. The dsl ...
3
votes
1answer
175 views

How should DNS be configured for remote VPN access to a Windows Domain?

Suppose you have a small windows domain configured as follows: domain name is ad.example.com (as per these guidelines) DC1 is at 10.10.10.3 DC2 is at 10.10.10.4 DC1 and DC2 are running the ...
0
votes
0answers
181 views

OpenSwan VPN Connected but can't ping or connect to anything on right side

On my end is an Ubuntu AWS EC2 VM and on the other end is a Cisco ASA 5500 router. Phase 1 and Phase 2 come up but I cannot access anything on the other end. It would seem there's a routing problem, ...
0
votes
1answer
38 views

cisco firewall access rules for intra-subnet traffic

I have a Cisco 5505 in our office, and everything is on the 10.0.1.0 network. We have a cheap wireless router that we would like to use. The router is sitting behind the inside interface, and is ...
0
votes
2answers
54 views

Open HTTP Protocol Cisco ASA

I would like to know if it's possible to open HTTP protocol (whatever the port) for one of my subnet to the outside on Cisco ASA 5510 v9.1(4) (ASDM v7.1(5)? I guess I will have to play with service ...
0
votes
0answers
46 views

Monitor traffic on ASA-5512X IPS module?

Is there a way to monitor traffic from a SPAN port on a switch to test the ASA IPS Module? I would like to setup testing for our ASA. Will using a SPAN port on a switch and connecting that to the ASA ...
-1
votes
1answer
236 views

ASA stops internet when connected to VPN - firmware 9.x

I'm having issues setting up Remote access VPN on Cisco ASA (firmware 9.1) i'm able to connect via the VPN and access all internal resources but i'm not able to access internet when connected to the ...
2
votes
0answers
63 views

How to allow vpn users to access only specific servers?

Currently we have an ASA with an IP pool to allow an outside contractor to remotely connect and access our network. What we would like to do is limit what they can get to once they are connected. I ...
1
vote
1answer
119 views

Many 'Deny IPv6-ICMP reverse path check' alerts from multicast addresses on Cisco ASA

In an effort to prevent IP Source Address Spoofing (RFC 2827) I've enabled reverse path filtering (RPF) on my Cisco ASA 5505. The topology is aprox. like this. Each segment has its own IPv4 subnet ...
1
vote
1answer
519 views

Site-to-site VPN between 5505 and 5512x

I am trying to setup a site-to-site vpn IPsec tunnel between an ASA 5512x and 5505 on an isolated network. I ran through the IPsec VPN wizard on both devices and used the same configuration but they ...
1
vote
2answers
98 views

Cisco router or ASA [closed]

Can you tell me what is the difference between having both a Cisco router and ASA appliance in a network and having only the ASA? I remember that my ISP had set a router in front of our network and ...
1
vote
1answer
72 views

How many IP addresses can I expect to block on a Cisco 5500-X Series firewall?

Considering a Cisco ASA (5500-X) firewall for our internet edge in front of our web cluster. At the moment, we use a Linux box with iptables. A log analysis system detects brute-force attacks on ...
0
votes
1answer
45 views

Cisco ASA Static NAT Rule Explanation

Here is a chunk of my configuration on my ASA: name <my_external_ip> www.testwebsite.com object-group service http_https tcp port-object eq www port-object eq https access-list ...
0
votes
1answer
56 views

IIS7 using old SSL for outside clients (LAN/VPN clients okay)

I have a Windows 2008 R2 terminal server. When accessed over the web (ex. https://ts.domain.com/RDWeb) I get a message that the SSL certificate has been revoked. It appears to be issuing an old SSL ...
0
votes
0answers
82 views

ASDM - ASA Issue

This is actually a two part question, if anyone has had experience with the issue and could help me out it would be greatly appreciated. Backstory: Using GNS3 with ASA 8.4(2) and ASDM 7.1(5). I've ...
2
votes
1answer
405 views

Strongswan VPN Established but no Packets Routed

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a ...
2
votes
1answer
782 views

Can't access ASA website to download ASDM launcher

Hoping someone can give me a pointer on here. I recently took a new position and am currently trying to learn the new system. I'm having trouble getting to ASDM and have Googled plenty to no avail. ...
0
votes
1answer
2k views

Cisco ASA 5505 - NAT or Port Forward for SIP / VoIP ver 8.4

I just had an NEC PBX installed that lets me use SIP trunks for VoIP services, My gateway is a Cisco ASA 5505 running 8.4 and I only have one public/static IP Addresses. So far, my trunks are ...
2
votes
1answer
109 views

ASA High Availability failover link configuration

According to the Cisco ASA 5500 Series Configuration Guide, Cisco's preferred method of configuring your network for ASA High Availability is as such: They have two switches on External, two ...
0
votes
0answers
28 views

Find a VPN Name on a Cisco ASA box given a remote IP address

I have a Cisco ASA box with multiple site-to-site VPNs defined. Is there a way to automate finding the VPN name based on a given remote IP address?
2
votes
3answers
431 views

VLAN over VPN (ASA 5520)? if not any other options available?

Is it possible to extend the local VLANs to a Remote site connected by IPSEC VPN using ASA 5520 / Cisco 1841 DSL router. can we have many VPN tunnels between the ASAs? (from every VLAN one vpn ...
0
votes
2answers
453 views

Cisco ASA syslog format description [closed]

Where can I find Cisco ASA syslog format description? Log example: Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> ...
-1
votes
1answer
60 views

IPsec VPN Server behind Cisco ASA (Transparent mode)

I've a Cisco ASA 5510 with transparent mode, and I'm going to setup a IPsec VPN(Openswan) in a internal linux server(with Public IP). This server has 2 NIC, 1 public IP, and 1 internal IP. I've ...