Questions tagged [cisco-asa]
The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.
770
questions
0
votes
1
answer
3k
views
IOS Port Forwarding and NAT involving a VPN
We have a Cisco 1921 router running IOS 15.1 at one of our branches which is connected via a L2L IPsec VPN to a ASA5510 running ASA 8.2 at our headquarters.
The network looks something like this:
...
3
votes
4
answers
26k
views
VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?
I've got the following set up:
LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN
Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
1
vote
2
answers
8k
views
Windows 10 Built in VPN L2TP/IPsec Authentication
I am trying to set up an Remote-VPN IPsec ikev1 from a Windows 10 built in VPN-client to a Cisco asa 5505, using a L2TP/IPsec runnel with a Pre-shared key and xAuth.
After some struggle, I manage to ...
1
vote
0
answers
49
views
Internet failover on Cisco ASA 5500 series Primary ISP is on DHCP address and so is backup. Always defaults to backup
I had SLA MONITOR setup on my ASA and working fine for months. All traffic was routing through my primary connection. I rebooted my ASA after a firmware upgrade.
When it came back, it would always ...
0
votes
1
answer
888
views
site to site(IpSec) between AWS and Cisco is not working
I am trying to set up a site-to-site VPN connection between AWS and Cisco ASA, but the tunnel status is shown as "Down," and under the details section, the message is "IPSEC IS DOWN.&...
2
votes
1
answer
4k
views
Allow access to printer between interfaces on Cisco ASA5510
I have a Cisco ASA5510 where we have to separate networks on two separate interfaces.
The networks should have nothing to do with each other except that network B needs to access a printer on network ...
0
votes
2
answers
1k
views
Cisco ASA: How to modify a logging list that is in use?
When attempting to modify/remove a logging list on a Cisco ASA 5545, I'm getting an error:
ERROR: Can not modify logging list LOGGING_TEST while in use
What steps are required to modify/remove a ...
0
votes
1
answer
433
views
ansible backups for cisco asa devices: ERROR: % Invalid input detected at '^' marker
I have been tasked with backing up all of our network devices, so natuarally I chose ansible. I am no expert but I sure need help on this one! I have tried everything under the moon and cannot ...
0
votes
1
answer
4k
views
Can't ping outside IP address
Our firewall is Cisco ASA and our switch catalyst 2960.
One computer keeps having the following problem :
Once for a while (in one or two days), the computer can't ping outside IP address like 4.2....
-1
votes
1
answer
93
views
Cisco ASA to Watchguard
I have never worked with watchguard firebox firewalls in depth before and we are replacing a Cisco ASA 5515 with a Watchguard M390. I am having a hard time interpreting the configuration settings in ...
0
votes
1
answer
7k
views
Cisco ASA not allowing DNS traffic to pass?
I have an ASA 5515 as my internet firewall. It is not allowing me to do NS Lookups from any internal DNS Servers, or clients. If I set my nslookup server to 8.8.8.8 (google DNS), I can resolve public ...
0
votes
0
answers
62
views
TCP Session drops because of FIN signal
I have two servers communicating with each other through ISO 8385 messages over TCP sessions. Basically host-to-host interface between two payment switches. The problem is that the session keeps ...
1
vote
1
answer
3k
views
Overwriting Cisco ASA config using only console access
I'd like to be able to apply a pre-written config to a Cisco ASA 5505, but presently I only have access to it via the serial console and not over the network.
Various sources suggest pasting the ...
4
votes
3
answers
7k
views
List of Cisco ASA pre-defined services
Where/How can I get a list of all the services that are pre-defined on a Cisco ASA device?
For example, I can do the following in a config:
object-group service ALLOWTOSERVER
service-object tcp www
...
2
votes
2
answers
2k
views
Route traffic from ASA to different firewall default gateway
I should probably start by explaining the topography, we have two different internet connection with separate firewalls.One is an asa and one is a meraki, the default gateway for all the servers ...
3
votes
1
answer
4k
views
Microsoft NPS 2012 R2 - Can't perform authentication from Cisco ASA with PAP
I am trying to setup a Cisco ASA (version 9.1(7)6) to authenticate against a Microsoft Network Policy Server 2012 R2.
The ASA is able to communicate with the NPS server, however the test aaa-server ...
1
vote
1
answer
2k
views
How do I configure an ASA 5505 to pull a DHCP address from a bridged DSL modem/router?
I have a remote office that I am hooking up to our corporate network and this particular site has a centurylink adsl2+ router that I need to negotiate an rfc 1483 via DHCP connection across. The dsl ...
1
vote
1
answer
2k
views
Site-To-Site VPN does not work for one specific subnet
We are using Cisco 5500 series ASA for sites HQ and BX and there is a site-to-site vpn in between,
BX (subnet 192.168.6.0) can access to subnet 192.168.200.0 subnet at HQ but can't access 192.168.0.0 ...
1
vote
1
answer
3k
views
Cisco ASA 5505 - Access to DMZ with one public IP
I am trying to configure my Cisco ASA 5505 firewall to allow access from the internet to DMZ web and mail server. I'm new to the Cisco world so excuse me if this is a newbie question. I know that this ...
1
vote
1
answer
3k
views
Cisco Remote Access VPN authenticating via RADIUS over Site2Site VPN
Is it possible to setup the remote access VPN to athenticate to a RADIUS server that is on the other end of a Site to site VPN on the same ASA?
I have an ASA 5505 that is at a branch office with a ...
8
votes
3
answers
102k
views
show all users on a Catalyst Cisco switch
I am new to Cisco, I am having some difficulty:
I'd like to list all user accounts. show users only displays currently logged in users.
I have no problem changing the enable password, but I'd like ...
1
vote
1
answer
463
views
Client error after installing custom certificate
I've followed (I believe) all the right steps to install a trusted certificate on my ASA firewall:
install company root authority into ASA as a CA
issue a certificate for the ASA's hostname
install ...
0
votes
1
answer
2k
views
Cisco ASDM issue "cannot open device"
I've just gotten my ASA 5510 set up to run AnyConnect VPN (w/ client). Unfortunately, it appears that I broke whatever allows the ASDM to connect in somewhere during that process. I get a "cannot open ...
0
votes
1
answer
2k
views
ASA Can ping between subnets, but not pass IP traffic (access rules in place, security levels ok)
I have tried getting my ASA to route traffic between subnets, i got it working for 10 minutes but after some changes (unfortunately not an ASA expert) i have broken something.
One example is 192.168....
9
votes
4
answers
24k
views
OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx
I have exported an existing certificate+key from an ASA 5510:
asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD
Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
0
votes
1
answer
1k
views
How Do I Reconfigure My Cisco ASA in order to Move it to a Colocation Facility?
My office DSL modem has a static IP address. In the ASA startup wizard, I connected to it using PPPoE.
I now have it configured VPN and NAT and tested it in this environment. This weekend, I am going ...
2
votes
3
answers
7k
views
VPN packet capture on ASA5505
Following up from a previous question regarding how to capture packets on the ASA5505 I'm having some difficulty in distinguishing which traffic has come through the VPN and which was generated from ...
1
vote
1
answer
434
views
Cisco ASA IPv6 single ::/64 prefix assignment
I am configuring public IPv6 (dual stack w/static IPv4 block) on an ASA 5506 ver 9.9(2)36. The ISP has assigned a single /64 prefix where 2001:2:3:4::1 (not actual IP) is their equipment and 2001:2:3:...
5
votes
3
answers
7k
views
How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X
I have a CISCO ASA 5506-X with 4 configured interfaces and a set of access-lists etc. It is configured via CLI and is running in routed mode, not transparent. Everything is running well, but now I ...
0
votes
1
answer
158
views
Port forwarding on ASA 5510 internal - internal
I have an ASA connected to the primary network and I'd like it to do an easy port forward so that when a pc tries to telnet the ASA on port 500, for example, the ASA forward the request to a server.
...
1
vote
2
answers
5k
views
Cisco ASA 8.2 - 106015 (Deny) and 106100 (Permit) Logs for the Same Packet
I'm seeing traffic from numerous internal endpoints where a RST or FIN/ACK is sent by the endpoint to a host on the Internet. These connections are related with a transparent proxy that is not ...
0
votes
1
answer
1k
views
Wireless authentication with DD-WRT, Cisco and Microsoft
I'm looking for a way to authenticate my wireless users beyond them just knowing the wireless password. Ideally they would join the access point then get dumped to the login portal that they'd have to ...
0
votes
1
answer
9k
views
Strongswan to Cisco ASA with multiple right subnet
I've got an ikev2 tunnel up, initiated on the left from an ubuntu box with strongswan going to a cisco asa. Using ASA to ASA multiple networks work but I can not get it with strongswan.
#config setup
...
1
vote
2
answers
2k
views
Monitoring ASA packet loss via SNMP
I want to monitor packet loss on my ASA 5505 VPN endpoints using SNMP. This is so I can graph the rates in Cacti and/or get alerts in Nagios.
However, I am not sure what SNMP values I should use to ...
4
votes
1
answer
33k
views
Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule
During VPN reconfiguration we have met quite big issue with VPN traffic not passing to peer. Using packet-tracer we have have got following debug:
Phase 1 to Phase 9 passed successfully.
[...]
Phase:...
5
votes
6
answers
17k
views
Fortinet: Is there any equivalent of the ASA's packet-tracer command?
I would like to know if there is not Fortigates an equivalent of the packet-tracer command that we can find on the ASA.
Here is an example of execution for those who don't know it:
NAT and pass :
...
0
votes
1
answer
1k
views
Trying to configure FTP in a Cisco ASA 5510. Bellow is the configuration. How do I configure FTP on the ASA?
Trying to configure FTP in a Cisco ASA 5510. Below is the configuration. How do I configure FTP on the ASA?
ASA Version 7.0(8)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password &...
0
votes
2
answers
2k
views
Cisco IPSec Issue with Windows 10
How can I connect a Windows 10 laptop to a Cisco ASA via VPN using L2TP/IPSec rather than AnyConnect? Apparently, the Cisco client is no longer supported, and the Windows 10 built-in client gives me ...
0
votes
0
answers
169
views
Can Cisco ASA PBR route to specific IP/port?
I am working on setting up PBR on our ASA-5505, and was trying to figure out if this scenario is possible.
Traffic coming in via one public externa IP on port 443.
ASA identify traffic via ACL and ...
2
votes
7
answers
14k
views
Cisco "copy startup-config tftp" results in a 0 byte file on the server?
I'm pulling my hair out figuring this out. My startup-config is good, I can view it with a show command. I'm trying to copy it to a tftp server:
asa5505# copy startup-config tftp
Address or name of ...
2
votes
1
answer
3k
views
How to adjust ASA Failover Times?
I want to adjust my failover poll timing.
The proposed column is what I am wanting to set it up as.
I believe the following commands will obtain what I want from the first two rows but Im not sure ...
2
votes
1
answer
366
views
Can VLAN traffic pass through an ASA?
Let's say I had the topology L3Switch1 -> ASA -> L3Switch2
Is it possible for the ASA to pass VLAN information to L3Switch2?
Example Setup
1
vote
1
answer
1k
views
cisco ASA 5505 l2tp vpn
I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but:
when i have "use default gateway on remote network" on NIC enabled i have access to ...
0
votes
0
answers
2k
views
Site-to-Site VPN from Cisco ASA 5505 to Amazon VPC
I am trying to establish a VPN connection from our on-premises rack to our Amazon VPC. The router/firewall that we have is a Cisco ASA 5505 running software version 9.1(7)23. According to Amazon's ...
0
votes
0
answers
2k
views
Postfix pix workaround for short mail work fine, but for long mail not worked
My postfix send email without problems. But one client domain enabled PIX workarounds. If mail message is short mail send without problems. But if mail is long - in log file I see " conversation with ...
10
votes
2
answers
8k
views
L2TP/IPSec from Windows 7 to ASA 5520
I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
0
votes
0
answers
977
views
ASA allow DNS service inside to be accessed from outside
I have a shared networking environment for tenants on our building, the ASA sits between a small business internet modem and each tenant's network.
Gateway Modem Cisco ASA DNS ...
1
vote
0
answers
341
views
Cisco ASA5506: NAT issue (packet blocked even though permit rule exists)
We're having a problem with our ASA5506.
The public interface "outsideSub" has internet connection via PPPoE.
The ping test to a public DNS server from the outsideSub interface is successful.
...
4
votes
1
answer
7k
views
Configure Freeradius to check a connecting user against multiple LDAP groups
I'm setting up a Cisco ASA as a client vpn server.
The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP.
The modules/ldap file ...
0
votes
2
answers
1k
views
Does factory reset for Cisco ASA 5505 keep the added licenses/features?
I bought a used Cisco ASA 5505 with existing SecurityPlus (and other) licenses already installed.
A factory reset (configure factory-default) from the console will reset just the config and not ...