The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

0
votes
1answer
1k views

Cisco ASA 5510 needs “clear arp <Interface>” periodically to reach a single host

ASA 9.0(3) The symptom is that I can ping from the ASA to any other host in that interface's subnet, save one particular host (that host can ping the interface on the ASA however). If I do "clear arp ...
1
vote
0answers
805 views

Route two public (ISP assigned) subnets on 'outside' interface of Cisco ASA 5510

We've got a Cisco ASA 5510 that sits on our edge and acts as the PPPoE endpoint for a fibre connection. The fibre connection came with a static IP, which is assigned via PPPoE, and gets picked up by ...
1
vote
5answers
218 views

Multiple Computers Running IIS with a Singular Public IP how to handle incoming communications?

At our company, we have three separate servers that house IIS currently. Each of these three servers have the same public IP address and essentially reside on the same network under different subnets. ...
2
votes
2answers
15k views

show all users on a Catalyst Cisco switch

I am new to Cisco, I am having some difficulty: I'd like to list all user accounts. show users only displays currently logged in users. I have no problem changing the enable password, but I'd like ...
0
votes
0answers
376 views

Cisco ASA firewall blocking requests to internally hosted DNS server

I have a DNS server behind a Cisco ASA firewall. The Cisco firewall is performing NAT. When inside the network, I can NSLOOKUP directly to the server. When the client is external, requests time out. ...
3
votes
1answer
9k views

Can't access ASA website to download ASDM launcher

Hoping someone can give me a pointer on here. I recently took a new position and am currently trying to learn the new system. I'm having trouble getting to ASDM and have Googled plenty to no avail. ...
3
votes
1answer
333 views

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
5
votes
2answers
10k views

Cisco ASA5510 Bandwidth Shaping/Limiting

This question is in two parts: Shape How can I limit the bandwidth on a ASA5510 to less than 10Mbps? Currently I have: policy-map shape_policy class class-default shape average 9000000 36096 ! ...
0
votes
2answers
327 views

Cisco Easy VPN - Port forwarding needed at remote end?

I was in the process of setting up a site-to-site ipsec vpn tunnel behind a mobile broadband router when i found out that i wasnt able to port forward on that network so i wont be able to use the ...
2
votes
3answers
243 views

Cisco ASA NAT - internal host see its public ip

I have a server hosted by a provider which uses Cisco ASA to do nat. The problem I have is that the internal server that is nat-ed with a public ip will see its public ip as source ip. This basically ...
0
votes
1answer
70 views

Cisco asa 5505 w/ seperate subnets and seperate isps

I am trying to join two networks together thru the asa. I have a 192.168.0.1 network that is the main domain and has its own isp and is administered by windows server 2008 for DNS and DHCP i also ...
0
votes
1answer
373 views

ASA 5505 can't add it to switch with VLAN

I have an ASA 5505 and a Cisco switch. I am trying to hook them up together. The ASA has an IP of 10.11.2.5. Servers on the VLAN 1102 on the switch has a default gateway of 10.11.2.1. I do a show ...
0
votes
3answers
2k views

Cisco ASA syslog over VPN tunnel

I am struggling to get my Cisco device to send syslog data to a remote server running behind a VPN tunnel. syslog IP 10.1.1.161 on the remote end. 10.23.2.0 is local subnet. SNMP polling from 10.1.1....
1
vote
1answer
1k views

Cisco ASA - difference between inside_access_in and inside_access_out?

So a minor problem we have is any internal servers have no (non-icmp) access to the outside is being blocked. Our current config is: inside_access_in any ---> any ---> icmp inside_access_out ...
1
vote
1answer
2k views

NAT Rule changes from ASA software 8.0 to 8.4

I have an Access Rule and a NAT rule that works fine with on the Security Appliance Software Version 8.0 The rule is as follows: However, I am having trouble making the same rule work on an ASA ...
3
votes
2answers
344 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
0answers
328 views

Route Email to external IP Cisco ASA 5515

I have a cisco ASA 5515X with two WAN connections and one LAN connection. As far as I understand, I hace the firewall configured to allow SMTP traffic through WAN2 interface, but not through WAN1. ...
0
votes
1answer
181 views

Looking for books to further my training, mainly Cisco ASA and networks [closed]

Work has offered to order books for me to learn new things so I've been googling a bit and now I figured I'd make use of the massive internet collective for help on what books to order. So far I've ...
2
votes
1answer
738 views

ASA firewall newbie tutorial [closed]

I am new to managing routers/firewalls and now need to manage a ASA 5510 in a small enterprise. I used to just demand settings from our network provider, thus I am familiar with the basic concepts, ...
0
votes
2answers
298 views

ASA is not forwarding packets to egress interface

We are seeing some very strange behaviour from our Cisco ASA 5505 running 9.1(2) We have a SIP PBX inside our network. It's got a bit of an odd configuration, it listens for inbound SIP requests for ...
-1
votes
3answers
1k views

Cisco ASA - Restrict IP for WebVPN access

I've got a Cisco ASA5510 with Firmware Version 8.0(5). I'd like to restrict the source IPs that are allowed to access the Router through WebVPN (port 443). Here is the relevant part of the config. ...
2
votes
4answers
3k views

How to backup the configuration of a cisco switch and ASA to an SMB windows share?

How do I backup the configuration of a Cisco switch and ASA to an SMB Windows share? I have full enabled admin through SSH. what would be the full command to save it to an SMB share? Is it "show run, ...
0
votes
1answer
143 views

Secondary IPs on DMZ machines not working

I am moving some virtual machines from my DMZ in a bladecenter over to my new cisco UCS. We are using Hyper-V, and are running Server 2012 on the old bladecenter, and Server 2012r2 on the new UCS. ...
1
vote
1answer
111 views

vpn connection is OK but can't route some IPs

Our Network is laid out as in the diagram below PC1 can successfully connect to server 2 (with 10.120.20.x/24), and PC4 can successfully connect to server 1 (with 10.120.30.x/24). Our problem is ...
0
votes
3answers
338 views

How to see traffic traversing a Cisco ASA by inside host?

I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
1
vote
1answer
286 views

Force Cisco ASA to change source port NAT

I have a 2 devices, a Cisco ASA and sitting behind it another device. Both the Cisco and the other device have IPsec tunnels but to different locations. I need to ensure that the source port of the ...
1
vote
1answer
10k views

Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule

During VPN reconfiguration we have met quite big issue with VPN traffic not passing to peer. Using packet-tracer we have have got following debug: Phase 1 to Phase 9 passed successfully. [...] Phase:...
1
vote
1answer
529 views

cisco ASA 5505 l2tp vpn

I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but: when i have "use default gateway on remote network" on NIC enabled i have access to ...
0
votes
2answers
433 views

How can I connect to a Cisco ASA5540 from Windows Server 2012 over IPSEC?

Given a windows server 2012 client (which I have under full administrator control), and an external Cisco ASA5540 router (which I don't), I'd like to connect to the router to access their internal ...
1
vote
0answers
651 views

Configuring ASA 5510 for multiple port-forwarding using TCP-UDP service group

I'm currently trying to configure two different ASA 5510s to properly forward all ports used in h323 video conferencing to the proper video conferencing equipment setup on the internal network on each ...
0
votes
1answer
2k views

Cisco ASA 5505 communication between VLANs

I have an ASA 5505 running 8.4 with multiple internal networks: inside: 10.1.0.0/16 mfg: 10.2.0.0/16 operator: 10.6.0.0/24 I want the inside and mfg networks to have full access to each other and ...
0
votes
2answers
264 views

Routing between 2 networks and 2 routers

I have a WatchGuard XTM33 and a Cisco ASA 5505, current network is running off of the Cisco and I want to eventually migrate over to the WatchGuard using new IP scheme. ASA 192.168.111.1/24 WG 10.0....
0
votes
2answers
1k views

PBXact Behind ASA 5505 nat udp range 10000-20000

I'm installing a new pbxact phone server onsite and I've ran into an issue using a 3rd party sip, I've got the acl's for the traffic created and the traffic is allowed, I'm assuming i need to create a ...
3
votes
5answers
17k views

Cisco ASA - manually start a VPN tunnel

Using a cisco ASA is it possible manually bring up a lan to lan VPN tunnel & SA from the device, rather than having one of the systems that is part of the VPN initiate traffic to start the VPN? I'...
2
votes
1answer
2k views

How to set up Cisco AnyConnect VPN Client to only tunnel traffic for specific destinations?

I have an Ubuntu server that needs to be able to connect via Cisco AnyConnect VPN to another server for one of our applications. However, because we're using this server for multiple applications, we ...
0
votes
0answers
2k views

Cisco ASA not allowing DNS traffic to pass?

I have an ASA 5515 as my internet firewall. It is not allowing me to do NS Lookups from any internal DNS Servers, or clients. If I set my nslookup server to 8.8.8.8 (google DNS), I can resolve public ...
0
votes
1answer
84 views

Input traffic spikes on outside interface at same time every day

For the last two days I've had this issue where our internet connection SLOWS to a crawl and is almost unusable. I logged into our Cisco ASA 5500 (not very well versed with it) but I was able to see ...
0
votes
2answers
920 views

Autonegotiate errors between HP and Cisco hardware?

This is a bit of a specific extension to this question. I've got two ASA's that feed into a Procurve switch, and then into an IPS. All is well except that the procurve absolutely refuses to ...
1
vote
0answers
377 views

Broadcom NICs, Cisco ASA and ARP request collisions

First of all I am sorry for my english mistakes. Help me please to solve the problem with ARP request collision incidents. I have IBM BladeCenter E chasis with blade servers are installed in this ...
1
vote
1answer
4k views

Openswan Cisco ASA 9.1 — cannot resopnd to IPsec SA request because no connection is known for

Ok, so I have a simple VPN IPSEC setup with a single Linux host that has a public IP address and a loopback interface of 172.16.255.1. On the right side I have a Cisco ASA 5505 9.1. the issue is the ...
0
votes
3answers
2k views

Using a nat rule to translate 80/443 traffic to web server, but internal users cannot access it using external ip/domain name

I am using Cisco ASDM for ASA I have my internal network called soa. My outside interface is called outside. Let's say my outside IP given to me by my ISP isp is y.y.y.y I have a web server inside ...
0
votes
1answer
619 views

Cisco ASA vague error

I'm getting a very vague error from my cisco ASA that connects our VPN to a branch office running a cisco router. I was hoping some one could give me some incite into how I could possibly pull more ...
5
votes
3answers
7k views

How to block a Countries IP range with a Cisco ASA?

To be more specific I have a request from a client to block China's IP range. I know how to do this. I would use the IPs from https://www.countryipblocks.net/e_country_data/CN_netmask.txt and make a ...
-2
votes
1answer
58 views

How do I allow data to span from port to port on a Cisco ASA [closed]

I'm running a Cisco ASA5520. I could have sworn I had this set up when I installed the system and checked the right boxes in the "Wizard" in Cisco's ASDM, but data only goes from port to port if it ...
1
vote
1answer
244 views

TightVNC over VPN encrypted? [closed]

I'm using tightvnc to connect to my servers over a IPSEC VPN connection with split tunneling enabled. Is my communication with my servers via VNC encrypted or unencrypted?
1
vote
1answer
1k views

Cannot RDP from inside to dmz

I'm running an ASA 5505 with security plus I have internet access from the inside and dmz vlans I can Remote Desktop from inside to another machine on the inside I can ping inside machines and ...
0
votes
0answers
451 views

How To Stop Cisco ASA Spoof Attack

I have thousands of "Deny TCP reverse path check from 10.60.60.X to 10.60.6X.X on interface outside" The IP addresses for the source and destination hosts are all over the board, and the interface is ...
1
vote
1answer
300 views

AnyConnect certificate/CA pinning on Cisco ASA 5510

I would like to "pin" the certificate or at least the certificate authority for AnyConnect connections. Given the amount of SSL mitm'ing and compromised CA's, I want to ensure that only certificates ...
2
votes
1answer
9k views

ASA's USB ports

I have three USB ports on my Cisco ASA 5505. All Cisco documentation that I've found says that they're for 'future use'. Anyone know if this has been updated? Or if it will be?
2
votes
3answers
2k views

VLAN planning and questions

I currently manage an environment with IP addressing of 10.10.10.x/23. We have 3 VLANS set up, and I use that term very loosely. The reason I say I use the term loosely is, the 3 VLANS have full ...