Questions tagged [cisco-asa]
The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.
770
questions
0
votes
1
answer
3k
views
Cisco ASA VPN tunnel to second location - all traffic flow through first tunnel
I am having trouble setting up a second VPN tunnel from my Cisco ASA 5510. When I run the packet tracer I don't see the packet going throught a NAT exempt stage nor a VPN lookup stage. First tunnel is ...
- 23
2
votes
2
answers
1k
views
Cisco ASA 5505 (8.05): asymmetrical group-policy filter on an L2L IPSec tunnel
I'm trying to find a way to setup a bi-directional L2L IPSec tunnel, but with differing group-policy filter ACLs for both sides.
I have the following filter ACL setup, applied, and working on my ...
- 14k
1
vote
2
answers
5k
views
Shrinking TCP Window Size to 0
Having an issue with any large file transfer that crosses our Cisco ASA unit come to an eventual pause.
Setup
Test1: Server A, FileZilla Client <- 1GBPS -> Cisco ASA <- 1 GBPS -> Server B, ...
- 143
6
votes
5
answers
28k
views
Outbound ports to allow through firewall - core requirements
If I only want to allow HTTP, POP3, IMAP4, SMTP functionality for outbound traffic (i.e. no servers hosted at site) are there any additional ports that need to be open to allow those functions to work ...
- 9,714
1
vote
2
answers
1k
views
Step by step guide for asa 5505 [closed]
Is there any step by step guide for configuring an ASA 5505 out there? Most of the info that i keep running into are repost of the same article. The most useful guide i found so far was this one. http:...
- 27
1
vote
1
answer
991
views
Cisco ASA - NAT'ing VPN traffic
I have an IPsec VPN setup like this:
[Remote users]-[Remote ASA] <-VPN-> [My ASA]-[Subnet A]-[Router 2]-[Subnet B]
The VPN is set to handle traffic between [remote users] and [Subnet A]; it ...
- 7,056
0
votes
3
answers
491
views
What ports do I allow over my internal firewall interface?
I have a Cisco ASA that I have VPN tunnels to connect my internal Windows network. I ran into some trouble logging into my domain so I unblocked all the ports on that internal interface. On a ...
- 1,151
2
votes
1
answer
12k
views
ASA's USB ports
I have three USB ports on my Cisco ASA 5505. All Cisco documentation that I've found says that they're for 'future use'.
Anyone know if this has been updated? Or if it will be?
- 1,151
2
votes
1
answer
617
views
Windows XP clients do not update server 2008 DNS forward lookup zone
I have a Cisco 5505 working as a DHCP server, and a server 2008 DNS server running an AD domain.
I am having problems with all XP computers not updating the forward lookup zone. The reverse lookup ...
- 291
1
vote
1
answer
715
views
Is it possible to upgrade a Cisco ASA 5510 A/S Pair from 7.0(6) to 8.2.4 without downtime?
We currently have a pair of Cisco ASA 5510 firewalls in an active/standby failover configuration. They are currently running 7.0(6) and we'd like to upgrade them to 8.2.4. Is it possible to failover ...
- 33
1
vote
1
answer
807
views
Cisco ASA 5510 <-> Sonicwall Pro 2040 - IPSec half working
Ok... I'm having a really strange IPSec issue (at least strange to me :-) ). I have a Sonicwall Pro 2040 connected to an ASA 5510. When the traffic initiated from the Sonicwall side of the network, it ...
- 1,298
1
vote
1
answer
2k
views
Cisco ASA 5520 AnyConnect Essentials License and IPSec Connections [duplicate]
Possible Duplicate:
Can you help me with my software licensing question?
I'm trying to find the answer to this question, but not really getting anywhere. I'm hoping a ServerFault Cisco Licensing ...
- 222
1
vote
1
answer
173
views
No blocked ports on internal interface of ASA
I have a cisco ASA 5505 with three interfaces: Internal (100), DMZ (50) and External (0). The internal has a IPSEC VPN tunnel to my internal network
I couldn't log in to my domain because of all of ...
- 1,151
1
vote
1
answer
2k
views
Cisco ASA 5510 w/ AIP SSM - Can it inspect SSL traffic?
Is is possible for a AIP module within a Cisco 5510 ASA to decrypt and inspect SSL traffic?
I have asked my local vendor (who placed the devices of which I speak) and they say that the AIP module is ...
- 85
0
votes
1
answer
1k
views
ASA5520 stops sending to splunk syslog
I have an ASA5520 that is set up to send logs to a splunk syslog server. the setup works for a while, usually around 24 hours or so, but then stops until either the logging is reconfigured (twiddling ...
- 951
0
votes
2
answers
2k
views
Cant route VLAN over VPN between Cisco ASA 5505 and Cisco 870
We've had an existing VPN between a 5505 and 870 for some time. We've just added VLANs to the network on the 5505 side. We can't seem to figure out how to get devices on the VLANs to communicate ...
2
votes
1
answer
835
views
CISCO pix/asa Shun command equivalent on Junos
does any one knows if there is some equivalent of the shun command on Juniper Junos OS?
The shun command on the ASA Firewall appliance is used to block connections from an attacking host. Packets ...
- 478
0
votes
1
answer
2k
views
Cisco ASA 5510 multiple time-range commands
I asked this question a while back, and have since discovered the "time-range" command in the ASA 5510. This works as expected.
Is it possible to setup 2 sets of access-list rules that take effect ...
- 859
1
vote
3
answers
8k
views
Exposing Exchange 2010 OWA via Cisco ASA 5520
Has anyone experience with exposing the web access (OWA) of an Exchange 2010 server through a Cisco ASA (my goal is to something like a DMZ)? If so could you give me some advice?
I know that Exchange ...
- 21
1
vote
4
answers
30k
views
CISCO ASA 5510: How to view the number of connections per second?
In my company we have a busy network (over +500 computers), all these computers before go the internet pass through our CISCO ASA 5510.
How can I view the number of connections per second? At a ...
- 1,351
2
votes
7
answers
14k
views
Cisco "copy startup-config tftp" results in a 0 byte file on the server?
I'm pulling my hair out figuring this out. My startup-config is good, I can view it with a show command. I'm trying to copy it to a tftp server:
asa5505# copy startup-config tftp
Address or name of ...
- 273
0
votes
1
answer
127
views
Email trouble with ISA 2004 behind Cisco ASA
Without going into the whys, I've got an ISA 2004 server behind a Cisco ASA.
Since the installation of the ASA, I can no longer send email to one particular domain. I get a "500 Non RFC-compliant ...
- 5,008
3
votes
1
answer
3k
views
Cisco ASA 5510 Time of Day Based Policing
I have a Cisco ASA 5510 setup at a boarding school. I determined that many (most?) of the students were downloading files, watching movies, etc, during the day and this was causing the academic side ...
- 859
0
votes
1
answer
3k
views
Cisco ASA 5520 and "source routing based"
I have a Cisco ASA 5520 (8.3.x) with 3 interface active.
One HDSL internet connection (outsite1), one ADSL internet connection (outside2) and one for internal LAN (inside).
The default gateway is ...
- 25
2
votes
2
answers
842
views
Cisco ASA 5505 restricting traffic between VLANs requires different subnets?
I have a Cisco ASA 5505 that is right now servicing 30 or so machines all on 10.10.0.X.
I want to segregate a few of these machines to a VLAN, so that they can't initiate traffic to all the other ...
- 135
2
votes
2
answers
47k
views
Problem routing between directly connected Subnets w/ ASA-5510
This is an issue I've been struggling with for quite some time, with a seemingly simple answer (Aren't all IT problems?).
And that is the problem of passing traffic between two directly connected ...
- 1,352
1
vote
2
answers
1k
views
Cisco PIX 8.0.4, static address mapping not working?
upgrading a working Pix running 5.3.1 to 8.0.4. The memory/IOS upgrade went fine, but the 8.0.4 configuration is not quite working 100%. The 5.3.1 config on which it was based is working fine.
...
Bill
2
votes
2
answers
1k
views
Cisco ASA 5505 Config
I have looked through a lot of these posts on the Cisco ASA5505 as well as gone online. I am looking for some straight forward step by step instructions to complete the following tasks.
I know how to ...
- 1,609
3
votes
4
answers
26k
views
VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?
I've got the following set up:
LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN
Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
- 329
1
vote
2
answers
6k
views
Cisco ASA 5505 (8.05): interfaces do not come up after reload
For some reason, I have to run no shutdown on each real physical interface to get them to come up after a reload.
To test, I did the following:
write erase to blow away my config, reload and said no ...
- 14k
0
votes
2
answers
13k
views
Cisco ASA 5505 does not initiate site to site VPN?
I am using Cisco ASA 5505 to establish a site to site VPN tunnel.
The problem is that, my ASA 5505 does not seem to initiate the negotiation but once the device on the other starts the negotiation ...
SoulReaver
2
votes
1
answer
2k
views
Cisco ASA 5505 (8.05): egress filtering intermittently
I'm not having any luck setting up egress filtering from the inside network to the outside, with the goal of denying all outbound traffic save for the HTTP Proxy (Squid) server that's also running DNS,...
- 14k
0
votes
1
answer
4k
views
Rules for Cisco ASA 5505 Port Forwarding to enable OpenVPN and WWW
We use Openvpn in our company to connect external clients with our office network. After setting up the new router Cisco ASA 5505 we need to forward the ports for Openvpn and WWW in order to keep this ...
user36461
0
votes
1
answer
88
views
Removed subnet, forwarding rogue software with Cisco firewall
As we moved to another firewall with fewer connectors (PIX 515 -> ASA 5510), I had to prune the network infrastructure a bit, so one of the subnets had to go. Now we've got one piece of hardware that ...
- 143
2
votes
2
answers
702
views
Mysterious WAN Connection Throttling
Setup
2x Cisco ASA 5520's
ASA 8.3(1), ASDM 6.3(1)
IPSec Crypto Settings:
ESP-3DES-SHA, bidirectional, perfect forwarding secrecy group 1, 8 HR lifetime or 4,608,000 Kilobytes, NAT-T enabled
...
- 143
0
votes
2
answers
3k
views
Cisco ASA (Client VPN) to LAN - through second VPN to second LAN
We have 2 site that is linked by an IPSEC VPN to remote Cisco ASAs:
Site 1 1.5Mb T1 Connection Cisco(1) 2841
Site 2 1.5Mb T1 Connection Cisco 2841
In addition:
Site 1 has a 2nd WAN 3Mb bonded T1 ...
2
votes
1
answer
35k
views
Do Cisco ASA 5505 and openvpn work together?
We are planning to use a Cisco ASA 5505 as a router in our company. So far we used opnvpn to connect our mobile clients to the company network.
Our question is if Cisco ASA 5505 and openvpn work ...
user36461
0
votes
1
answer
587
views
ASA VPN :: Why Blocked Packets on Private Network?
Have successfully connected to my ASA via VPN client.
Setup:
ASA >> Switch >> 2 CentOS Linux Servers
When I open a local terminal (OSX), I can ping inside interface on (192.168.0.1) but not inside ...
- 685
0
votes
1
answer
173
views
Port translation in router causing some email to fail
We are in the process of setting up a spam filter (SAVASM). One change we are making is to push incoming email on port 25 through our spam filter/server but have users actually send their email on a ...
- 747
1
vote
3
answers
2k
views
ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server
I just bought an ASA 5505 that my data center is setting up for me. They have told me that setting the ASA to routed with NAT will break Web/DNS server on inside network.
For example: WAN IP address ...
- 685
0
votes
1
answer
348
views
ASA >> Switch >> Server WAN/LAN Routing to NIC ports
I bought a Dell R610 to setup VMware ESXi -- the server has 2X dual port NICs. Normally with a single dual port NIC I assign my WAN IPs to eth0 and LAN IPs to eth1.
With the new server I'd like to ...
- 685
3
votes
1
answer
805
views
ESXi :: ASA NAT + Switch :: Setup on .27 IP Block
Just bought an ASA 5505 and a separate gigabit switch, along with a Dell R610 virtualization server to replace existing bare metal web server.
There will be 2 physical machines, R610 running ESXi 4.1 ...
- 685
5
votes
3
answers
5k
views
Making an ASA TFTP backup through VPN
I have a site to site VPN configured between two ASA 5520s. I have a TFTP server behind ASA1, with an IP of 172.16.1.1 on the "inside" network. I'd like to be able to copy the running config of ASA2 ...
- 277
0
votes
2
answers
7k
views
Cisco ASA WebVPN RDP Plugin Fullscreen
I am using a ASA5520 with 8.2.2(ED) Image and the RDP Java Plugin for Termialserver connections. The version of the Plugin is 1.1.1. "rdp-plugin.090915.jar" and "rdp2-plugin.090211.jar"
everything is ...
- 155
0
votes
1
answer
789
views
CISCO ASA 5505 Base Licence - Ability to interpret http request headers (host headers)
Base licence configured CISCO ASA 5505 is not capable of routing based on interpretation of the inbound http request headers - affectively host header redirect - am I correct?
If I am correct will an ...
- 157
2
votes
1
answer
1k
views
Setup Cisco ASAs WebVPN on a different IP Address than the Outside IP
Out customer has a SSL VPN solution called "SSL Explorer", it's a server based application which runs on a DMZ Hosts.
Because the Software has been announced to be end-of-life, we want to migrate to ...
- 155
1
vote
0
answers
1k
views
Site-to-site VPN using IPCop and Cisco ASA 5505
So I'm coming into a company who wants to move away from their IPCop firewalls and replace them with Cisco ASA 5505's. Instead of ripping the entire network down and keeping it down for however many ...
- 1,151
0
votes
1
answer
3k
views
Clear Cisco ASA connection count
Here's what I'm doing to get a connection count on my ASA
asa# show conn count
100 in use, 3389 most used
asa#
I want to reset the most used count. How do I do that?
- 19.2k
0
votes
3
answers
1k
views
Could my GPRS connection be too slow for IPSec connection?
I'm setting up an IPSec connection from an Westermo MRD310 to our company Cisco ASA5510.
We've had many successful setups using this method, creating a tunnel network between a remote location and ...
- 189
3
votes
3
answers
14k
views
Cisco ASA: Allow established traffic back in
I have a Cisco ASA 5505 (ver 8.2(2)) with two interfaces; inside (security level 100) and outside (security level 50). There is one subnet on inside, 10.1.1.0/24.
There is no NAT for traffic moving ...
- 7,056