The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

1
vote
1answer
109 views

vpn connection is OK but can't route some IPs

Our Network is laid out as in the diagram below PC1 can successfully connect to server 2 (with 10.120.20.x/24), and PC4 can successfully connect to server 1 (with 10.120.30.x/24). Our problem is ...
0
votes
3answers
312 views

How to see traffic traversing a Cisco ASA by inside host?

I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
1
vote
1answer
9k views

Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule

During VPN reconfiguration we have met quite big issue with VPN traffic not passing to peer. Using packet-tracer we have have got following debug: Phase 1 to Phase 9 passed successfully. [...] ...
1
vote
1answer
266 views

Force Cisco ASA to change source port NAT

I have a 2 devices, a Cisco ASA and sitting behind it another device. Both the Cisco and the other device have IPsec tunnels but to different locations. I need to ensure that the source port of the ...
1
vote
1answer
506 views

cisco ASA 5505 l2tp vpn

I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but: when i have "use default gateway on remote network" on NIC enabled i have access to ...
1
vote
0answers
634 views

Configuring ASA 5510 for multiple port-forwarding using TCP-UDP service group

I'm currently trying to configure two different ASA 5510s to properly forward all ports used in h323 video conferencing to the proper video conferencing equipment setup on the internal network on each ...
0
votes
2answers
240 views

Routing between 2 networks and 2 routers

I have a WatchGuard XTM33 and a Cisco ASA 5505, current network is running off of the Cisco and I want to eventually migrate over to the WatchGuard using new IP scheme. ASA 192.168.111.1/24 WG ...
3
votes
2answers
617 views

Static public IP issue on Cisco ASA 5512x

This is our scenario: We have an Cisco ASA 5512x and we have 2 different Internet connections from different ISPs connected with it. ISP A is being used for the users browsing traffic(normal ...
0
votes
2answers
397 views

How can I connect to a Cisco ASA5540 from Windows Server 2012 over IPSEC?

Given a windows server 2012 client (which I have under full administrator control), and an external Cisco ASA5540 router (which I don't), I'd like to connect to the router to access their internal ...
2
votes
1answer
1k views

How to set up Cisco AnyConnect VPN Client to only tunnel traffic for specific destinations?

I have an Ubuntu server that needs to be able to connect via Cisco AnyConnect VPN to another server for one of our applications. However, because we're using this server for multiple applications, we ...
0
votes
0answers
2k views

Cisco ASA not allowing DNS traffic to pass?

I have an ASA 5515 as my internet firewall. It is not allowing me to do NS Lookups from any internal DNS Servers, or clients. If I set my nslookup server to 8.8.8.8 (google DNS), I can resolve public ...
0
votes
1answer
79 views

Input traffic spikes on outside interface at same time every day

For the last two days I've had this issue where our internet connection SLOWS to a crawl and is almost unusable. I logged into our Cisco ASA 5500 (not very well versed with it) but I was able to see ...
1
vote
0answers
355 views

Broadcom NICs, Cisco ASA and ARP request collisions

First of all I am sorry for my english mistakes. Help me please to solve the problem with ARP request collision incidents. I have IBM BladeCenter E chasis with blade servers are installed in this ...
-2
votes
1answer
58 views

How do I allow data to span from port to port on a Cisco ASA [closed]

I'm running a Cisco ASA5520. I could have sworn I had this set up when I installed the system and checked the right boxes in the "Wizard" in Cisco's ASDM, but data only goes from port to port if it ...
1
vote
1answer
230 views

TightVNC over VPN encrypted? [closed]

I'm using tightvnc to connect to my servers over a IPSEC VPN connection with split tunneling enabled. Is my communication with my servers via VNC encrypted or unencrypted?
0
votes
0answers
376 views

How To Stop Cisco ASA Spoof Attack

I have thousands of "Deny TCP reverse path check from 10.60.60.X to 10.60.6X.X on interface outside" The IP addresses for the source and destination hosts are all over the board, and the interface is ...
1
vote
1answer
1k views

Cannot RDP from inside to dmz

I'm running an ASA 5505 with security plus I have internet access from the inside and dmz vlans I can Remote Desktop from inside to another machine on the inside I can ping inside machines and ...
2
votes
3answers
1k views

VLAN planning and questions

I currently manage an environment with IP addressing of 10.10.10.x/23. We have 3 VLANS set up, and I use that term very loosely. The reason I say I use the term loosely is, the 3 VLANS have full ...
0
votes
1answer
2k views

Cisco ASA 5500 - SIP ports other than 5060

Is it correct that the SIP inspection in the ASA 5500 firewalls only kicks in for traffic on port 5060? There is some hint at this, while not 100% definitive, on Cisco Docs - ...
1
vote
0answers
223 views

ASA failover mode switching from Active/Active to Active/Standby

We have two ASAs with failover set to Active/Active. This seems to work fine for everything we do except using VPN connections. It seems whenever the primary ASA fails over that all VPN connections ...
0
votes
1answer
940 views

Cisco ASA Outside to Outside NAT (forward from one public ip to another public IP)

I have an ASA (A) with a set of public IPs (A1..A6). And I have another server S with a public IP (S1) . I want all traffic to A2:22 NATed (forwarded) to S1:22. (SSH is just an example here) If ...
0
votes
1answer
563 views

Cisco ASA vague error

I'm getting a very vague error from my cisco ASA that connects our VPN to a branch office running a cisco router. I was hoping some one could give me some incite into how I could possibly pull more ...
1
vote
2answers
475 views

Can I run commands from a file uploaded to my Cisco ASA 5500?

I have to run a lot of ACL/access-group and network-object commands, and I have found a 1024 character limit for each command - even if it spans multiple lines. In code, I use 1,000 chars as the ...
0
votes
1answer
244 views

Proxy servers and ASA5510

I am new to Cisco ASA5510 and need to configure it for following situation: Semi-isolated network 10.18.10.0/24 External excess is via high proxy server to ASA to low proxy server. Each proxy has 2 ...
5
votes
1answer
308 views

ASA5505 slow downstream, fast upstream on VDSL PPPoE

We have recently switched our ADSL2+ connection for a VDSL Connection in our office. The only configuration change I have made to the Cisco ASA for this change, was to change the username/password on ...
1
vote
0answers
785 views

Route two public (ISP assigned) subnets on 'outside' interface of Cisco ASA 5510

We've got a Cisco ASA 5510 that sits on our edge and acts as the PPPoE endpoint for a fibre connection. The fibre connection came with a static IP, which is assigned via PPPoE, and gets picked up by ...
2
votes
1answer
303 views

ASA Static Route over PPPoE interface

I have an ASA5505 with two PPPoE connections. I wish to add a static route to route just a single subnet over the new PPPoE connection, but the ASA does not seem to allow routing over interfaces ...
3
votes
1answer
318 views

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
0
votes
1answer
356 views

Cisco ASA 5510 Inter-interface routing

I'm trying to setup a Cisco 5510 to route traffic between the outside and inside interfaces where both belong to public IP subnets. Our ISP assigned us a single point-to-point IP (207.107.110.150/30) ...
0
votes
2answers
2k views

Cisco ASA: port forwarding to different IP depending on client IP/subnet outside

I have Cisco ASA 8.2(5) and would like to configure port forwarding. Cisco ASA has 2 interfaces: outside with IP 192.168.57.2 inside with IP 192.168.1.1 I have two subnets reachable through ...
3
votes
2answers
246 views

Possible to use a console cable from a Cisco ASA and use it interactively with ESXi?

I'm creating procedures to deploy a Cisco ASA and an ESXi machine to remote locations where no local tech contacts are available. I think it may be a wise idea to connect the console cable from the ...
0
votes
0answers
379 views

Cisco ASA 5505: PAT / NAT between 2 IPSec Tunnels

I've the following Setup: Customer <-> HQ <-> Branchoffice The Customer has a 192.168.1.0/24 subnet. On the HQ only the VPN Gateway is in my context, 172.20.10.1 . And on the Branchoffice ...
2
votes
1answer
1k views

Cisco ASA 5510 Out-of-Order Packets to Google

We're seeing a large number of packets being dropped due to being Out-of-Order. The numbers are large enough that it may be having an impact on network performance. We've isolated it down to a few ...
0
votes
2answers
224 views

Can I NAT a public ip that is also used as a VPN peer

I have been reading books and sites on the web for two days and have tried all kinds of things to be able to ping a IP address further into my private network. The VPN tunnel is up and passing other ...
0
votes
0answers
273 views

ASA 5540 v8.4(3) vpn to ASA 5505 v8.2(5), tunnel up but I cant ping from 5505 to IP on other side

I am having problems pinging from a 5505(remote) to IP 10.160.70.10 in the network behind the 5540(HQ side). 5505 inside IP: 10.56.0.1 Out: 71.43.109.226 5540 Inside: 10.1.0.8 out: 64.129.214.27 I ...
1
vote
1answer
583 views

Text on Cisco ASA console is garbled/missing letters

I've actually looked up a number of solutions for this problem and none of them work. There's this Cisco ASA 5505 that I'd like to use, that outputs mildly garbled text with missing characters. I did ...
2
votes
0answers
89 views

Does Cisco IOS XRv support logging of TCP connection (e.g. built and/or teardown)?

I have a demo of Cisco IOS XRv and I would like to setup logging for connections. E.g. for ASA "show logging" shows log messages for every TCP connection built or teardown: Jun 11 12:29:31 ...
1
vote
1answer
458 views

DNS doctoring between 3 interfaces

I have a guest network with a range of 192.168.13.x on m y192.168.13.1 interace. I need it to get to my external webpage at 1.2.3.4 on my outside interface. The webserver itself sits in the DMZ at ...
2
votes
1answer
1k views

Packet loss on between firewall and uplink?

I have a moderately complex network topology between my external firewall and the internet, as shown below. Every so often - I haven't found a pattern yet - we're getting a significant degree of ...
1
vote
1answer
2k views

Cisco ASA 8.2 - 106015 (Deny) and 106100 (Permit) Logs for the Same Packet

I'm seeing traffic from numerous internal endpoints where a RST or FIN/ACK is sent by the endpoint to a host on the Internet. These connections are related with a transparent proxy that is not ...
1
vote
1answer
519 views

Cisco ASA 5505 No LAN access through VPN

I have been fighting with this ASA 5505 for a days now. I am verly new to networking and need support by the community! I have completely configured the CISCO 5505 allowing me to browse the internet ...
0
votes
1answer
98 views

Reading .pcap files by CISCO ASA5515-X

I have .pcap file that already includes thousands of packets. I want to analyze these packets via CISCO ASA5515-X to observe how much of them are possible to be an attack packet (malicious). However, ...
1
vote
1answer
280 views

AnyConnect certificate/CA pinning on Cisco ASA 5510

I would like to "pin" the certificate or at least the certificate authority for AnyConnect connections. Given the amount of SSL mitm'ing and compromised CA's, I want to ensure that only certificates ...
0
votes
0answers
163 views

Port mirroring on CISCO 2960S

I am trying to do a port mirroring of the traffic for my core switch to a port on my managed switch. The environment that i have is a stacked switch, with 1 serving as the core switch and 2 serving ...
-1
votes
2answers
636 views

Why am I getting permission error from tftp server?

I'm trying to tftp an image to an ASA 5500 and I'm getting this error: TFTP failure: RX TFTP Error Packet TFTP OP Code: Error Packet Error Msg: Permission denied
1
vote
1answer
4k views

Openswan Cisco ASA 9.1 — cannot resopnd to IPsec SA request because no connection is known for

Ok, so I have a simple VPN IPSEC setup with a single Linux host that has a public IP address and a loopback interface of 172.16.255.1. On the right side I have a Cisco ASA 5505 9.1. the issue is the ...
0
votes
1answer
119 views

How to avoid hairpin VPN on cisco

I currently have a hairpin VPN setup with a Cisco ASA, but I'm not very happy as it messes up service access that are on ASA external IP address and are NAT'ed inwards :( How should I re-design the ...
0
votes
1answer
395 views

Cannot reach internal network on VPN

So i have been configuring a ASA5510 to the best of my knowledge to allow VPN access(IPSEC connection) to our internal network and its resources. There is a alot of step-by-step guides and videos ...
0
votes
1answer
266 views

Cisco ASA IPSec VPN - service discovery (e.g. shared folder browser)

We have an ASA 5505 doing IPSec VPN for remote users. Client access is working almost as expected:clients can reach hosts on the internal LAN, even using DNS, and we are tunneling all client traffic ...
1
vote
1answer
1k views

How do I configure an ASA 5505 to pull a DHCP address from a bridged DSL modem/router?

I have a remote office that I am hooking up to our corporate network and this particular site has a centurylink adsl2+ router that I need to negotiate an rfc 1483 via DHCP connection across. The dsl ...