The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (3)

0
votes
0answers
21 views

Include multiple sub-interfaces in Cisco ASA for VPN tunnel

I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces. Say, In Cisco ASA 5550, I created multiple subinterfaces with VLAN ID as below: Inside, int0/1 : ...
0
votes
1answer
24 views

ASA is not forwarding packets to egress interface

We are seeing some very strange behaviour from our Cisco ASA 5505 running 9.1(2) We have a SIP PBX inside our network. It's got a bit of an odd configuration, it listens for inbound SIP requests for ...
3
votes
1answer
1k views

How should DNS be configured for remote VPN access to a Windows Domain?

Suppose you have a small windows domain configured as follows: domain name is ad.example.com (as per these guidelines) DC1 is at 10.10.10.3 DC2 is at 10.10.10.4 DC1 and DC2 are running the ...
2
votes
4answers
2k views

How to backup the configuration of a cisco switch and ASA to an SMB windows share?

How do I backup the configuration of a Cisco switch and ASA to an SMB Windows share? I have full enabled admin through SSH. what would be the full command to save it to an SMB share? Is it "show run, ...
3
votes
2answers
90 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
0answers
49 views

Cisco ASA 5510 needs “clear arp <Interface>” periodically to reach a single host

ASA 9.0(3) The symptom is that I can ping from the ASA to any other host in that interface's subnet, save one particular host (that host can ping the interface on the ASA however). If I do "clear arp ...
0
votes
1answer
36 views

Secondary IPs on DMZ machines not working

I am moving some virtual machines from my DMZ in a bladecenter over to my new cisco UCS. We are using Hyper-V, and are running Server 2012 on the old bladecenter, and Server 2012r2 on the new UCS. ...
0
votes
0answers
23 views

ASA 5515-X: Policy based NAT for dedicated uplink

We have bought a Cisco ASA 5515-X and we have the following scenario. Current situation: GigabitInterface 0/0, IP via DHCP, ISP1, Coax, 100M up / 12M down, medium latency GigabitInterface 0/1, ...
0
votes
0answers
30 views

Amazon AWS Site-to-Site VPN doesn't allow concurrent pings

I have some strange behaviour with an AWS VPC site-to-site set up and would like some help to understand where my problem might be. Set Up I have a VPC with a private and public subnet, there is a ...
4
votes
1answer
3k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
2
votes
1answer
3k views

Can't access ASA website to download ASDM launcher

Hoping someone can give me a pointer on here. I recently took a new position and am currently trying to learn the new system. I'm having trouble getting to ASDM and have Googled plenty to no avail. ...
1
vote
1answer
37 views

vpn connection is OK but can't route some IPs

Our Network is laid out as in the diagram below PC1 can successfully connect to server 2 (with 10.120.20.x/24), and PC4 can successfully connect to server 1 (with 10.120.30.x/24). Our problem is ...
1
vote
1answer
649 views

Remote VPN - two-factor authentication with Cisco ASA + OpenLDAP

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)? ...
2
votes
4answers
13k views

VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?

I've got the following set up: LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
0
votes
0answers
23 views

Cisco ASA 5505 - IPSec remote VPN accessing secondary subnet

Layout: modem (pass through) -> Cisco ASA 5505 (Lan 192.168.10.1) -> (Wan 192.168.10.2) Netgear N600 Router (Lan 10.1.10.1) -> workstations (server=10.1.10.34) VPN connection to ASA no problem. I ...
4
votes
4answers
2k views

Cisco ASA user authentication options - OpenID, public RSA sig, others?

My organization has a Cisco ASA 5510 which I have made act as a firewall/gateway for one of our offices. Most resources a remote user would come looking for exist inside. I've implemented the usual ...
0
votes
3answers
34 views

How to see traffic traversing a Cisco ASA by inside host?

I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
1
vote
1answer
38 views

Force Cisco ASA to change source port NAT

I have a 2 devices, a Cisco ASA and sitting behind it another device. Both the Cisco and the other device have IPsec tunnels but to different locations. I need to ensure that the source port of the ...
1
vote
2answers
830 views

How can I configure my network to allow bi-directional traffic between two lans?

Here's my current setup: (and it may require reworking): 2 LAN networks - 192.168.41.0, 192.168.21.0 2 Public IP's (they are assigned to us by specifying MAC Addresses - not subnetted) ...
1
vote
1answer
46 views

Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule

During VPN reconfiguration we have met quite big issue with VPN traffic not passing to peer. Using packet-tracer we have have got following debug: Phase 1 to Phase 9 passed successfully. [...] ...
0
votes
1answer
998 views

ASA 5510 Site to Site VPN works in one direction

I have setup a site to site VPN connection between two Cisco ASA 5510. One site (let's call it A) can see the private network of the other site (site B), but site B cannot see the private network of ...
0
votes
1answer
1k views

Allow access to printer between interfaces on Cisco ASA5510

I have a Cisco ASA5510 where we have to separate networks on two separate interfaces. The networks should have nothing to do with each other except that network B needs to access a printer on network ...
2
votes
1answer
1k views

Strongswan VPN Established but no Packets Routed

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a ...
1
vote
1answer
84 views

cisco ASA 5505 l2tp vpn

I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but: when i have "use default gateway on remote network" on NIC enabled i have access to ...
0
votes
2answers
74 views

How can I connect to a Cisco ASA5540 from Windows Server 2012 over IPSEC?

Given a windows server 2012 client (which I have under full administrator control), and an external Cisco ASA5540 router (which I don't), I'd like to connect to the router to access their internal ...
4
votes
1answer
565 views

Cisco ASA LDAP Group Privilege Level

We have a pair of ASA 5510s (8.4.3) on which we use LDAP authentication for VPN and SSH access. On all of our Catalyst switches, which use RADIUS, we're able to set the shell:priv-lvl to 15 in the ...
1
vote
0answers
74 views

Configuring ASA 5510 for multiple port-forwarding using TCP-UDP service group

I'm currently trying to configure two different ASA 5510s to properly forward all ports used in h323 video conferencing to the proper video conferencing equipment setup on the internal network on each ...
0
votes
1answer
862 views

Cisco ASA 5505 communication between VLANs

I have an ASA 5505 running 8.4 with multiple internal networks: inside: 10.1.0.0/16 mfg: 10.2.0.0/16 operator: 10.6.0.0/24 I want the inside and mfg networks to have full access to each other and ...
0
votes
2answers
60 views

Routing between 2 networks and 2 routers

I have a WatchGuard XTM33 and a Cisco ASA 5505, current network is running off of the Cisco and I want to eventually migrate over to the WatchGuard using new IP scheme. ASA 192.168.111.1/24 WG ...
3
votes
2answers
92 views

Static public IP issue on Cisco ASA 5512x

This is our scenario: We have an Cisco ASA 5512x and we have 2 different Internet connections from different ISPs connected with it. ISP A is being used for the users browsing traffic(normal ...
0
votes
0answers
13 views

Lync Server 2010 remte users can not use audio or sharing features

Lync Server 2010 - no sip phones, but audio within the application Inside Audio/Video/Conferencing works Recently we were asked to turn on Remote Access (not federation) since users have leared ...
0
votes
0answers
22 views

Route AAA LDAP traffic from ASA through IPSEC-tunnel to Windows DCs

We have one Cisco ASA 5505 in our HQ responsible for connect our remote office with a IPSEC-tunnel and one ASA 5505 at the remote office. The Cisco ASA 5505 in our HQ is also responsible for VPN users ...
0
votes
2answers
958 views

PBXact Behind ASA 5505 nat udp range 10000-20000

I'm installing a new pbxact phone server onsite and I've ran into an issue using a 3rd party sip, I've got the acl's for the traffic created and the traffic is allowed, I'm assuming i need to create a ...
2
votes
5answers
10k views

Cisco ASA - manually start a VPN tunnel

Using a cisco ASA is it possible manually bring up a lan to lan VPN tunnel & SA from the device, rather than having one of the systems that is part of the VPN initiate traffic to start the VPN? ...
2
votes
1answer
65 views

How to set up Cisco AnyConnect VPN Client to only tunnel traffic for specific destinations?

I have an Ubuntu server that needs to be able to connect via Cisco AnyConnect VPN to another server for one of our applications. However, because we're using this server for multiple applications, we ...
0
votes
0answers
75 views

Cisco ASA not allowing DNS traffic to pass?

I have an ASA 5515 as my internet firewall. It is not allowing me to do NS Lookups from any internal DNS Servers, or clients. If I set my nslookup server to 8.8.8.8 (google DNS), I can resolve public ...
0
votes
1answer
37 views

Input traffic spikes on outside interface at same time every day

For the last two days I've had this issue where our internet connection SLOWS to a crawl and is almost unusable. I logged into our Cisco ASA 5500 (not very well versed with it) but I was able to see ...
0
votes
2answers
726 views

Autonegotiate errors between HP and Cisco hardware?

This is a bit of a specific extension to this question. I've got two ASA's that feed into a Procurve switch, and then into an IPS. All is well except that the procurve absolutely refuses to ...
0
votes
0answers
23 views

ASA/AnyConnect will only allow 53/udp to the DNS servers listed in the profile

I found a "bug/feature" in Cisco AnyConnect/ASA 5510: if a VPN client makes a query to udp/53 (DNS query) to any IP address that isn't listed as a DNS server in the VPN profile, then ASA drops this ...
1
vote
0answers
58 views

Broadcom NICs, Cisco ASA and ARP request collisions

First of all I am sorry for my english mistakes. Help me please to solve the problem with ARP request collision incidents. I have IBM BladeCenter E chasis with blade servers are installed in this ...
1
vote
1answer
2k views

Openswan Cisco ASA 9.1 — cannot resopnd to IPsec SA request because no connection is known for

Ok, so I have a simple VPN IPSEC setup with a single Linux host that has a public IP address and a loopback interface of 172.16.255.1. On the right side I have a Cisco ASA 5505 9.1. the issue is the ...
0
votes
3answers
1k views

Using a nat rule to translate 80/443 traffic to web server, but internal users cannot access it using external ip/domain name

I am using Cisco ASDM for ASA I have my internal network called soa. My outside interface is called outside. Let's say my outside IP given to me by my ISP isp is y.y.y.y I have a web server inside ...
0
votes
1answer
116 views

Cisco ASA vague error

I'm getting a very vague error from my cisco ASA that connects our VPN to a branch office running a cisco router. I was hoping some one could give me some incite into how I could possibly pull more ...
4
votes
3answers
3k views

How to block a Countries IP range with a Cisco ASA?

To be more specific I have a request from a client to block China's IP range. I know how to do this. I would use the IPs from https://www.countryipblocks.net/e_country_data/CN_netmask.txt and make a ...
0
votes
0answers
88 views

Cisco ASA 5525 and multiple internet interfaces

I'm replacing a firewall this weekend with a pair of ASA 5525's. The network configuration is as follows :- Inside LAN - 192.168.1.x Internet 1 - 62.0.0.x Internet 2 - 52.0.0.x The currently ...
-2
votes
1answer
41 views

How do I allow data to span from port to port on a Cisco ASA [closed]

I'm running a Cisco ASA5520. I could have sworn I had this set up when I installed the system and checked the right boxes in the "Wizard" in Cisco's ASDM, but data only goes from port to port if it ...
0
votes
0answers
23 views

Tracking connection route with POST data

I have PHP running on client machines. They connect to a webserver using fopen and upload information stored in local databases. Everything works great, except for one group who uses AT&T cell ...
1
vote
1answer
72 views

TightVNC over VPN encrypted? [closed]

I'm using tightvnc to connect to my servers over a IPSEC VPN connection with split tunneling enabled. Is my communication with my servers via VNC encrypted or unencrypted?
1
vote
1answer
246 views

Cannot RDP from inside to dmz

I'm running an ASA 5505 with security plus I have internet access from the inside and dmz vlans I can Remote Desktop from inside to another machine on the inside I can ping inside machines and ...
1
vote
2answers
356 views

Skype performance in IPSEC VPN

I've been challenged to "improve Skype performance" for calls within my organisation. Having read the Skype IT Administrators Guide I am wondering whether we might have a performance issue where the ...