The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

0
votes
0answers
22 views

Microsoft NPS 2012 R2 - Can't perform authentication from Cisco ASA with PAP

I am trying to setup a Cisco ASA (version 9.1(7)6) to authenticate against a Microsoft Network Policy Server 2012 R2. The ASA is able to communicate with the NPS server, however the test aaa-server ...
2
votes
1answer
25 views

Cisco ASA Site-To-Site VPN change peer IP

We use Cisco ASA 5510 and I have to change peer IP address on the current Site-To-Site VPN. Every time when I have similar issue I deleted current vpn and then create new one from scratch.After ...
2
votes
0answers
43 views

Squid3 WCCPv2 with ASA not working

So I have begun the awful adventure of getting Squid 3.3.8 working with my Cisco ASA 5520 (9.1(5)). I think the problem is that the traffic is getting to the squid box but it is either not getting to ...
0
votes
0answers
12 views

ASA-5508 blocking routing INSIDE to INSIDE networks

I am setting up a new ASA-5508. I have G1/1 setup as my WAN (external IP) OUTSIDE. I have G1/2 setup as THE INSIDE (192.168.1.1/24) I have the default rules (this is truly the initial ASDM wizard ...
1
vote
1answer
28 views

Get all HTTP traffic with a proxy

I’d like to setup a proxy server that get all HTTP traffic on my network. I think to use Squid installed on Debian. Below the network diagram: I don’t want to setup a proxy server on my LAN ...
1
vote
1answer
20 views

Cisco ASA: Part of the traffic via VPN is blocked

We inherited the management of an ASA 5520 running IOS 8.2(3) from a previous company, and now we are switching the connectivity to a VPN from a LAN link directly connected to one of ASA interfaces. ...
1
vote
0answers
32 views

CISCO ASA ASDM Allow internal IP to access external IP

I'm running ASDM 7.2 and have 2 servers on the same local ip range that can communicate ok. These 2 servers have external IP's and I need to get them communicating on the external IP's but this fails. ...
-1
votes
1answer
54 views

Overwriting Cisco ASA config using only console access

I'd like to be able to apply a pre-written config to a Cisco ASA 5505, but presently I only have access to it via the serial console and not over the network. Various sources suggest pasting the ...
0
votes
0answers
9 views

Convert 8.3+ NAT to 8.2 Cisco ASA

The following NAT rule setup works on 8.3+: nat (inside,outside) source static inside_net inside_net destination static vpn_net vpn_net no-proxy-arp route-lookup However, trying the same on 8.2(5) ...
0
votes
1answer
32 views

ACL NAT'ing on Cisco ASA 9.2

I'm trying to implement (P)NAT on a active/standby pair of 5525X running v9.2 I need to NAT an ACL not an object and I've been unable to work out how to do this. The ACL is access-list 3G_traffic ...
1
vote
0answers
37 views

Cisco ASA 5505 Issue - “Flags SYN on interface..”

I've been trying to remotely configure a Cisco ASA 5505 in front of a dedicated server hosted with OVH. Unfortunately my qualifications and even experience very rarely touched on Firewalls. However I ...
0
votes
2answers
90 views

Is it possible to configure a Cisco AnyConnect VPN to use two separate LDAP authentication methods simultaneously?

I have a Cisco ASA 5505 with a Security Plus license along with an AnyConnect Plus license. I don't currently have any VPN configuration on the ASA as I'm still in the planning phase. I would like to ...
0
votes
1answer
26 views

Using a VPN tunnel on a Cisco ASA to connect locations

I am looking for some advise on how to connect some of our locations together, using a site-to-site VPN on our Cisco ASA 5515-X. At the moment we have a 5515-X at our head office and a Cisco 887A ...
0
votes
0answers
29 views

IPSec - Is it possible to have remote access clients (road warriors) all behind the same NAT device?

This is a topic that I find mixed information on. Is it possible to have two IPSec road warriors that are behind the same NAT, even with an ASA as the VPN endpoint? I have been trying with Libreswan ...
0
votes
1answer
31 views

Port Forward on Cisco ASA 5512-X

i would to improve port forward from an external host to an internal network, on my ASA. The network and the host are on two different interfaces, the internal network is on the internal interface g0/...
1
vote
0answers
38 views

cisco asa public server nat issue

I have been tasked with some ASA configuration coming in a few weeks, and to test out some configuration options I have setup a web server on my local network which I would like to be able to access ...
1
vote
0answers
27 views

On Cisco firewall, show access-list main rules only (with line numbers)

For example, if I do a sh access-list Lets say I have a rule on line 2 that has one object-group to another object-group connected on X ports. Well, there may be 30 lines below that, that all say ...
0
votes
0answers
44 views

Cisco asa 8.4 PAT with static NAT

I am trying to make sense of the changes that Cisco has made to NAT on ASA > v8.3. I have a network which is being PAT'd to the outside interface address, and want to add a static NAT from the outside ...
0
votes
0answers
68 views

Cisco ASA PBR and multiple ISPS for multiple SIP Providers

Have a question about policy based routing on my Cisco ASA 5515 running 9.5 and think despite it being available in this software version that I might be screwed. I have an asterisk PBX behind the ...
1
vote
0answers
15 views

AnyConnect on ASA5520 licensing required? [duplicate]

longtime reader, first-time poster. I'm currently working in a small shop and I am new to the Sys Admin role. We pay our ISP a lot for our VPN and we are looking for a different provider. We are ...
0
votes
0answers
24 views

Openswan to Cisco ASA IPSec tunnel - specific IP address range required. Netmap?

I'm attempting to set up a VPN tunnel between a Cisco ASA 5520 and an Openswan server running on Ubuntu 14.04 on a Amazon VPC instance. I do not have access to the ASA, and have been given the ...
1
vote
0answers
24 views

How should I use Cisco ASA 5510 and Catalyst 3550 together

So I took on a project at my job moving four separate networks into one Colo center. Currently I broken everything down from the four networks into 4 VLANS on the ASA 5510. Each are assigned IPs ...
1
vote
0answers
24 views

Cisco ASA 5510 ASDM 6.4 (2) unable to do port translation

I have a situation, where I want to do port translation. For example I can acces my service outside ip:8081 that is forwaded to server:8080. I should have a NAT rule option to add PAT like in this ...
0
votes
0answers
106 views

ASA INSIDE to INSIDE traffic being dropped

An ASA 5505 is being used to route between two networks as it contains routes to everything. The following depicts the network topology. I have tried various combinations of access lists such as: ...
2
votes
0answers
39 views

Dual path VPN on ASA 9.2

We have two sites that are joined by a VPN over two WAN links, one primary and one backup only. The VPN endpoints are a pair of active/standby ASA clusters at each site. Each site also has multiple ...
0
votes
0answers
27 views

analyze Cisco ASA high cfwConnectionStatCount value

SNMP monitoring of our Cisco ASAs includes the CISCO-FIREWALL-MIB::cfwConnectionStatCount.protoIp.currentInUse value (OID .1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6), described as "number of connections ...
0
votes
0answers
36 views

Shrewsoft VPN passthrough Cisco ASA 5505

I have a shrewsoft VPN connection setup that passes through a Cisco ASA 5505, it manages to connect okay and i am able to ping etc but if i try to load anything e.g. web interface nothing is returned. ...
1
vote
2answers
32 views

Cisco ASA 5505 - Help understand/update the config

Let me preface by saying I am not a network administrator by trade and this firewall was set up originally by a Cisco consultant who is no longer available. We have a small office with a Cisco ASA ...
2
votes
2answers
50 views

Issue with Cisco ASA 5515-X VPN Connection

I had an existing setup with a 5515-X serving as my firewall and VPN, which worked fine. Since moving to a new location, and thus a new outside interface IP, I can successfully connect to the VPN, but ...
-1
votes
1answer
37 views

Cisco ASA5505 - icmp deny any outside breaks internet - how to block outside pings?

We want to block any ICMP requests that are initiated to our network from the public internet. I ran icmp deny any outside, but when I do that, it takes down our internet - nobody can load web pages. ...
2
votes
2answers
113 views

Route traffic from ASA to different firewall default gateway

I should probably start by explaining the topography, we have two different internet connection with separate firewalls.One is an asa and one is a meraki, the default gateway for all the servers ...
0
votes
1answer
208 views

Cisco ASA TCP connections never time out

Our Cisco ASA 5515 will sometimes have thousands of connections with an idle time > the configured connection timeouts. In many cases the connections show as idle for 100+ hours. This eventually leads ...
1
vote
0answers
59 views

Cannot Route RDP Traffic Through AWS Site-to-Site VPN

Hi I have establish VPN connection to the AWS VPC, but still there are some routing issues that make RDP connections fail to initiate, because the router WAN IP is differs from the Public IP, lets say:...
2
votes
0answers
32 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
5
votes
1answer
70 views

Overcome asymmetric routing while migrating between sets of ISPs

We are migrating from one set of addresses to another set, both /24, and trying to minimize any down time during the migration. Ideally we'd run both for a period of time as we shut down the old ...
0
votes
1answer
24 views

ASA 5555-X ACL confusion

I'm wondering what this access list means on the ASA 5555-X? access-list TEST_INSIDE extended permit udp host 192.168.1.99 eq 7600 host 192.168.1.1 I am confused about the 'eq 7600' part since I ...
0
votes
0answers
246 views

Site to Site VPN one-way traffic Azure <-> Cisco ASA

We have a site-to-site static routing VPN (classic VPN, not ARM) attempting to connect to a remote Cisco ASA 5555 (a supported VPN device). The on-premise network can successfully initiate the tunnel ...
1
vote
0answers
74 views

CISCO SSL VPN Apps fail to connect using Java 8 update 71 (Java 8u71)

A remote client uses the SSL VPN apps for port forwarding through an ASA 5505 firewall. Basically no traffic was able to traverse the port forwarded IP addresses. Using the web browser in the VPN ...
1
vote
1answer
102 views

Setting up Cisco ASA VPN to use both radius and local users

I've got a Cisco ASA setup with L2TP/IPSec VPN, all is working well except for one minor issue. Ideally, I'd like to be able to log on to the VPN using either that RADIUS server users or the local ...
1
vote
1answer
61 views

Cisco ASA logging buffered spams terminal and console lines

I have several routers, switches and firewalls that send logs to a syslog server without interfering with the console line. I'm testing an ASA 5506 (running IOS 9.5.2) at a remote location that ...
2
votes
1answer
294 views

ASA 5510 Secondary Public IP Range on outside interface

We are in process of upgrading from an ASA5505 to an ASA5510. I have a co-location configured for 3 ranges of public IP addresses on two different subnets. The 5505 is working as expected. Example (...
1
vote
1answer
34 views

ASA 5505 blocks users

I have recently installed an ASA 5505. But now i have users that are being blocked/kicked from the internet. What can i do to prevent this? Here is the running config: Result of the command: "sh ...
0
votes
0answers
99 views

ASA 5510 Inter-Vlan routing issues

and thank you in advance for your help. I am having an issue where we are migrating from an ASA 5505 to an ASA 5510 and the software versions are quite different as well so they handle VLANs ...
0
votes
0answers
9 views

Unable to Apply Qos Policy map

I have a 20Mbps MPLS connection , when trying to apply the Qos Policy Map (wich is 60% for Silver traffic , and 40% for gold Traffic), i get the Following Error : "I/f FastEthernet0/0 class DSCP-AF31 ...
3
votes
1answer
49 views

Cisco ASA 5505 L2L vpn issue

this is my setup I already have a working L2L VPN between the sites I added the 10.10.0.0/24 to the object-groups that defines the internal network on the 1615 ASA And as a remote subnet on the ...
1
vote
1answer
128 views

Cisco ASA - Allowing external access to a secure server via RDP

I am new to the forums and really hope someone can help me. I am pulling my hair out! I have posted on both the Cisco forums and Windows forums in hopes anyone can suggest something but no one has ...
5
votes
2answers
491 views

How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X

I have a CISCO ASA 5506-X with 4 configured interfaces and a set of access-lists etc. It is configured via CLI and is running in routed mode, not transparent. Everything is running well, but now I ...
0
votes
1answer
40 views

Diffie Hellman Group 20 Cisco Asa

It seems to be that I am a little bit lost in the scrap of documentation. I am looking out for a new ASA Appliance that supports lvl 20+ Diffie Hellman. But I cannot find any documentation if there is ...
0
votes
1answer
16 views

Cisco ASA5505 compatible RAM

I have a Cisco ASA5505 which I've acquired. It boots up first time successfully, and works without issue, however as soon as I reboot, it fails to boot with the flashing light sequence which indicates ...
0
votes
0answers
59 views

Packet Tracer 6.1.1 ISAKMP command not available

I am just going around in circles trying to configure a site to site VPN using the CLI on the ASA 5505 in Packet Tracer 6.1.1 When I am configuring isakmp the command just do not seem to be abailable ...