The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (3)

4
votes
2answers
1k views

IPSec tunnel on ASA keeps disconnecting

I have an ASA IPSec tunnel configured between an ASA5505 and Microsoft TMG 2010 SP2. The tunnel sometimes works for a few hours, and then disconnects, and other times it works for 5 minutes and then ...
1
vote
0answers
974 views

Cannot access L2L VPN from RA VPN connected client on Cisco ASA 5510

We have a Cisco 1921 router running IOS 15.1 at one of our branches which is connected via a L2L IPsec VPN to a ASA5510 running ASA 7.2 at our headquarters. The ASA also provides IPSec Remote Access ...
2
votes
0answers
193 views

Keepalived failover not working for Static NAT target behind Cisco ASA

I've got a Cisco ASA[0] with a pair of Linux boxes in the DMZ running Keepalived and HAproxy acting as a load-balancing failover pair for another pair of Windows servers, also in the DMZ. I'm ...
1
vote
1answer
65 views

Cisco ASA crypto keys, SSH, and VPN

I'm new to the ASA and wanted to know if regenerating crypto keys on an existing ASA with established VPN tunnels could negatively affect the tunnels. The reason for wanting to regenerate crypto keys ...
1
vote
0answers
93 views

Cisco ASA ASDM Missing Nat options when creating network object

Hello all hope this is a simple fix. In ASDM of one of our ASA's, when we go to create network object. the NAT options to create automatic NAT rule is completely missing. its just a small box to ...
1
vote
1answer
208 views

Cisco ASA 5500 — List of outbound connections?

Is there a command or GUI option to get a list of outbound connections. Ideally, I'd like to know the internal IP address, the external IP address, and the remote port used. I don't need a lot of ...
2
votes
1answer
732 views

Dual ISP Inbound NAT — Asymmetric routing

routing question here. In a dual ISP scenario is there way to use both external IPs and nat them to a web server in a higher security level? The issue I am running into is on the return path for ...
0
votes
2answers
633 views

Cisco ASA/PIX Can't Access Internal Resources Behind NAT [duplicate]

My servers are natted 1:1 as follows, i.i.i.i maps to x.x.x.x where i is an internal IP, and x is the external IP. From an i.i.i.i machine, I cannot access x.x.x.x resources... What special ...
0
votes
1answer
364 views

Enable Cisco ASA as an SSH Tunneling

I am trying to utilize my Cisco ASA as a SSH Tunnel. I've configured this before when using a Linux server as the SSH target, however I cannot seem to get it to work with the ASA. I have configured ...
0
votes
1answer
338 views

Setup IPsec VPN using ASA5505 behind Juniper SSG5

I have been assigned to establish a Internet IPsecVPN connection between two sites using Cisco ASA5505 A site currently has following setup.(Same setup is expected in another site) Internet----->ADSL ...
0
votes
0answers
116 views

Cisco ASA: backup ISP connected to ASA for ASA access alone

What I'd like to do: Connect an interface to a separate ISP and let home user's VPN into the LAN via that interface, while normal web browsing traffic goes out the outside IF. My initial ...
2
votes
1answer
110 views

Is this a common/bug on this PPPoE setting for Cisco ASA 5505?

We have to change the way the firewall setup due to we've changed the internet provider. The way we setup we have ADSL modem and we have to do a full bridge mode and the firewall configuration has to ...
0
votes
1answer
40 views

Seeing odd (to me) packets in a network capture

This morning I connected a system to our switch connected to our ISP handoff in order to do some wiresharking. I had yet to set up any port mirrors, and confirmed that there were none in place. ...
0
votes
0answers
186 views

Cisco ASA, Windows Server 08, PPTP/GRE issues

I am at the end of my rope on this one. I am trying to simply forward pptp/gre through a Cisco ASA to my Windows server. Here is what I have done: Access Rules: OUTSIDE ...
0
votes
1answer
81 views

ASA 5505 - Outside IPs required for VPN Tunnel?

I've set up a Site-Site VPN and it seems the config is fine as the other site can establish the tunnel fine. The problem I have is that my side never tries to bring the tunnel up. Ping/telnet ...
0
votes
1answer
501 views

Cisco ASA 5510 SNMP config-change

I´m trying to set snmp trap when cisco asa 5510 is changed. I´m using this line: snmp-server host DMZ ZZ.YY.XX.5 community * snmp-server enable traps entity config-change fru-insert fru-remove But ...
0
votes
1answer
273 views

Cisco ASA 5510 : VPN split tunnel Strange behaviour

I work with a Cisco ASA 5510. I have enabled remote VPN connection with radius Authentication to two different internals networks: 10.1.0.0/16 10.10.0.0/16 from mobile VPN pool 192.168.111.0/24. ...
1
vote
0answers
298 views

Cisco SPA504G phone CDP/LLDP issue

Good morning everyone, Just recently signed up for the site because I'm looking for some help with an issue that's been plaguing me for about a week now. I hope I'm posting in the right place. If ...
0
votes
1answer
81 views

Cannot access Cisco ASA-5505 ASDN

I just got my network up-and-running. I would like the ASDN for some of my minions to be able to make minor changes without the need to contact me. This said, I have tried to enable it, and access ...
0
votes
1answer
165 views

Source of RST packet on ASA 5510

In reference to previous posts such as Finding source of RST packet on ASA 5505 I am not seeing any answers about how to FIX the RST from being sent by ASA; I only see discussion of how to provide a ...
2
votes
0answers
393 views

How can configure Cisco ASA 5510 to allow access to Web server in DMZ from LAN with port translation?

I am trying to configure Cisco ASA 5510 firewall to allow access from LAN to DMZ web server. Web server is located in the DMZ and is using port 8080. I don't want users to type port number every time ...
1
vote
0answers
195 views

Setting up an IPSec VPN with Cisco ASDM

I am trying to set up a VPN remote access with a Cisco ASDM 6.4 for ASA 5505 Version 8.2(5). In order to set up the VPN I followed this steps. After this steps my info look like this: VPN Tunnel ...
0
votes
1answer
173 views

Corrupt file copy Windows 2012 -> VPN -> Windows 2012

I've getting problems copying files from one Windows 2012 server to another via Cisco ASA5505 VPN. I've had a similar setup with Win2008 servers & never saw the problem (same ASA5505 this end) ...
0
votes
0answers
221 views

Can Telnet be used to test Direct Push is open “long enough”

I am getting the event below in the Eventlog regarding Direct Push for Activesync. If it matters we have a Cisco ASA and a Citrix Netscaler. Event 1040 MSExchange Activesync The average of ...
2
votes
0answers
80 views

Cisco ASA privilege level for object-groups

I'm trying to set-up privilege level 2, so that it has access to read and modify object and object-groups. Showing them seems to be no problem. I can also enter configure mode. I just can't get the ...
1
vote
2answers
917 views

Using a Cisco ASA 5505 to forward PXE (WDS) Requests

I have a Cisco ASA 5505 that uses around 5 NICS for different networks. Currently I'm using my ASA to route traffic as it's the only Cisco device I have capable of the small amount of routing ...
0
votes
1answer
568 views

How to NAT behind public IP on pFsense before IPSEC to Cisco ASA?

I have two networks: Local 192.168.1.0/24 and Remote 10.8.8.8/24. On the local network I have installed pFsense as gateway. On the remote network there is a Cisco ASA that I don't have control over. ...
2
votes
1answer
181 views

Add IP range to Cisco ASA 5505

I need to allow traffic through TCP/1494 and TCP/2598 (inbound & outbound) to IP range 10.1.25.1 to 10.1.25.254 within a Cisco ASA 5505. Can someone please help me with this? Under Cisco ADSM ...
2
votes
0answers
620 views

ASA5505, 9.1, Static NAT Port Range Forwarding

ASA5505 Version 8.4+ (Using 9.1).. Adding port range for static nat. object network server_x host 123.123.123.123 access-list outside_in extended permit tcp any object server_x range 1000 2000 ...
0
votes
0answers
21 views

Making Cisco IPSEC IKE KEY public

I have some OSX users that connect to our Cisco ASA VPN using the built in OSX VPN client. To configure this client I have to provide the Cisco IKE key. I am wanting to know if this key is something I ...
1
vote
1answer
662 views

LACP : Cisco ASA 5515 & Switch ProCurve 2920

I've two ASAs 5515 connected in failover Active/Stand by (on Gi0/5) My two ASAs are connected to two Switch ProCurve 2920 to have HA if something happens. So I plug something like that (don't pay ...
0
votes
1answer
993 views

ASA 5510 Site to Site VPN works in one direction

I have setup a site to site VPN connection between two Cisco ASA 5510. One site (let's call it A) can see the private network of the other site (site B), but site B cannot see the private network of ...
4
votes
1answer
147 views

Protecting an ASA in a multi tenant environment

I'm interested to know what best practices are for setting limits and policies on an ASA to protect the device to maintain service when used as a multi tenant firewall. For example following several ...
-1
votes
1answer
148 views

New Fiber Installation Resulting in Slow Download Speeds [closed]

TWC 80Mbps Cisco ASA 5510 (MTU 1500) Download speeds on my Windows and Mac machines are ~200KB/sec. If I use a download manager that opens 20 concurrent connections I can hit the full 8MB/sec. I ...
1
vote
1answer
196 views

Cisco ASA: Terrible network speed once or twice a day, fine otherwise

I've been trying to get to the bottom of this for a while now and, well, it seems like I can't. We have two servers behind an ASA5505 (software version 8.3) at a datacenter. They run a wide variety of ...
0
votes
1answer
290 views

Cisco ASA failover can't ping gateway

I'm currently trying to set up a failover network for my Cisco ASA 55x0 using the SLA traking. I have the "outside" interface (network 89.x.x.48/29) and the "outside2" interface (network ...
0
votes
1answer
208 views

Secondary fallback/failover network on Cisco ASA

In my network there is a Cisco ASA 55x0 with "inside" interface (network 192.168.79.0/24) and "outside" interface (network 89.x.x.48/29) There is this nat rule: object network NAToutside nat ...
1
vote
0answers
873 views

ASA Slow IPSec Performance with Inconsistent Window Size

I have a IPSec link between two sites over ASA 5520s running 8.4(3) and I am getting extremely poor performance when traffic passes over the IPSec VPN. CPU on the devices is ~13%, Memory at 408 MB, ...
0
votes
1answer
309 views

Cisco ASA 5505 and slow download speeds for Apple devices [closed]

For traffic routing through my ASA 5505, downloads for all Apple devices, including AppleTV iPad gen 1 IMac MacBook Pro are very slow. speedof.me show less than 1 Mbps download (where I should ...
0
votes
3answers
614 views

Cisco ASA syslog over VPN tunnel

I am struggling to get my Cisco device to send syslog data to a remote server running behind a VPN tunnel. syslog IP 10.1.1.161 on the remote end. 10.23.2.0 is local subnet. SNMP polling from ...
2
votes
1answer
347 views

VPN Failover Cisco ASA 5505

So basically we have a Cisco ASA 5505 (we have inherited this from a customer, none of us have any experience with Cisco's). Now essentially we have to WAN lines which we have setup in Failover, via ...
0
votes
1answer
193 views

Cisco ASA: Why do I sometimes need a username/password when entering enable mode

I'm automating some interaction with Cisco ASA devices. I need to do the following: login over ssh send 'enable', provide enable password send 'configure terminal' send some other commands, never ...
0
votes
1answer
215 views

Route being ignored on core Cisco 6500 switch?

This is less likely a bug, and more likely a lack of my own understanding on routing. I am having an asymmetric routing issue where return traffic is going out the wrong firewall. I have an explicit ...
0
votes
1answer
166 views

How do you configure a Lan to Lan VPN on an ASA without using your outside interface IP address?

I have two /28 subnets A & B. My PIX and ASA's outside interface addresses are both in subnet A. I am in the middle of a migration from the PIX to the ASA and need to use the PIX outside ...
0
votes
2answers
1k views

Cisco ASA-5505 Port Forwarding

I have a Cisco ASA-5505 firewall, which is currently configured to share our internet connection and do NAT for my LAN, as well as forward port 443 to an internal machine. I need to forward port 2222 ...
1
vote
1answer
1k views

ASA 5510 8.4 Nat & Portforwarding

So I'm trying to forward an internal service on a internal server to the external interface on the same port on the outside interface of our ASA. I been searching for a solution for days and found ...
3
votes
2answers
1k views

NTP client on CentOS 5 fails behind Cisco ASA firewall

I have a CentOS server on which I want to set up an NTP client to get accurate time for the server. The server is on a local subnet with NAT behind an ASA 5505 firewall, which acts as NAT router, and ...
0
votes
1answer
52 views

LAN has two entry points - how to manage traffic

I asked this question yesterday when I (seemingly) couldn't get traffic across my router. I've spent a lot of time since then with packet capturing, the ASA 5505 cli/ASDM and wireshark. I've ...
7
votes
2answers
807 views

Routing via Cisco ASA is changing TCP sequence/ACK numbers

Our network has a dedicated VPN appliance that sits inside the office network. We have a Cisco ASA with a static route that routes the VPN subnets to the VPN appliance. So a typical request from the ...
5
votes
1answer
6k views

Strongswan vpn tunnel connected but the traffic is not routed through it

I have just set up a vpn tunnel site-to-site with strongswan (4.5). The tunnel looks fine and connected to the other side, but seems there is a problem routing traffic through the tunnel. Any idea? ...