The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

0
votes
1answer
2k views

Allow access to printer between interfaces on Cisco ASA5510

I have a Cisco ASA5510 where we have to separate networks on two separate interfaces. The networks should have nothing to do with each other except that network B needs to access a printer on network ...
0
votes
1answer
1k views

Cisco ASA: port forwarding to different IP depending on client IP/subnet outside

I have Cisco ASA 8.2(5) and would like to configure port forwarding. Cisco ASA has 2 interfaces: outside with IP 192.168.57.2 inside with IP 192.168.1.1 I have two subnets reachable through ...
1
vote
1answer
655 views

Partial VPN connections on Cisco ASA

Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and sh crypto isakmp sa shows active security association. However connectivity to some of our ...
0
votes
1answer
1k views

Cisco ASA 8.2 - 106015 (Deny) and 106100 (Permit) Logs for the Same Packet

I'm seeing traffic from numerous internal endpoints where a RST or FIN/ACK is sent by the endpoint to a host on the Internet. These connections are related with a transparent proxy that is not ...
2
votes
0answers
28 views

ASA 5505: How do I access the DMZ web server from the inside using the public IP?

We are using a 5505 ASA Sec+ (8.2). There are three interfaces: inside (172.17.0.0/24), dmz (172.16.0.0/24) and outside (1.2.3.4 for the example). There are static NAT rules set up translating ...
0
votes
2answers
368 views

Cisco ASA 8.4+ redirect multiple ports - best practice?

I was wondering whether anyone could advice on best practices as to the best way to redirect multiple ports for single host in the internal network. As I understand this you can only nat a single ...
0
votes
0answers
16 views

Routing and VPN Setup

The network setup is as follows: Router: eth0 1.1.1.1 (outside) eth1 192.168.54.4 (inside) eth1 10.54.4.4 (inside) Cisco ASA5505 192.168.54.1 (inside) 10.54.4.1 ...
3
votes
0answers
50 views

Cisco ASA failback to preferred IPsec peer

I just configured my Cisco ASA 5505 to failover to a backup internet line when the main outside interface is down. This all works fine. Also, I have a site-to-site IPSEC VPN tunnel from this ...
0
votes
1answer
73 views

Cisco ASA site-to-site VPN up but no traffic

I currently have site to site VPN tunnel up between Cisco ASA 5550 & Cisco ASA5506-X. I can see the vpn tunnel is up on both end but no traffic is passing through. Cisco ASA 5550 is receiving ...
2
votes
3answers
6k views

Cisco ASA rewriting SMTP traffic to prevent mail sending

We have a Cisco ASA 5505 (version 8.0(4)) that is preventing outbound SMTP traffic; testing with telnet shows connections on port 25 are having everything converted to *s while the same does not ...
4
votes
1answer
2k views

How should DNS be configured for remote VPN access to a Windows Domain?

Suppose you have a small windows domain configured as follows: domain name is ad.example.com (as per these guidelines) DC1 is at 10.10.10.3 DC2 is at 10.10.10.4 DC1 and DC2 are running the ...
1
vote
0answers
23 views

Cisco ASA 5505 no NAT

I have a cisco asa 5505. The outside and inside IPs are private IPs so I do not want to NAT the inside IPs as they go out the Outside interface (there is a router upstream of the ASA 5505. Would I do ...
3
votes
3answers
8k views

Why do I start at privilege level 1 when logging into a Cisco ASA 5510?

I have created a test user that is set to privilege 15 in the config: username test password **************** encrypted privilege 15 When I log in to the ASA 5510 I am in privilege 1 according to ...
4
votes
1answer
4k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
6
votes
1answer
4k views

Cisco ASA Site-to-Site VPN Dropping

I have three sites, Toronto (1.1.1.1), Mississauga (2.2.2.2) and San Francisco (3.3.3.3). All three sites have ASA 5520. All the sites are connected together with two site-to-site VPN links between ...
1
vote
1answer
2k views

ASA 5510 Site to Site VPN works in one direction

I have setup a site to site VPN connection between two Cisco ASA 5510. One site (let's call it A) can see the private network of the other site (site B), but site B cannot see the private network of ...
1
vote
0answers
17 views

Allow Ports 80, 443 and 81 through ASA 5510

We are switching our VoIP provisioning method from TFTP to HTTP provisioning and have been asked by the VoIP provider to allow inbound access on ports 80, 81 and 443 from their two network networks on ...
2
votes
4answers
16k views

VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?

I've got the following set up: LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
1
vote
1answer
23 views

CISCO ASA: Add specific command to a privilege level

i am facing the following issue, created a new account with a "read-only" access on a CISCO ASA 5510. This account will be used in a script that will back up the running-config of the ASA. the ...
4
votes
4answers
3k views

Cisco ASA user authentication options - OpenID, public RSA sig, others?

My organization has a Cisco ASA 5510 which I have made act as a firewall/gateway for one of our offices. Most resources a remote user would come looking for exist inside. I've implemented the usual ...
1
vote
1answer
974 views

Remote VPN - two-factor authentication with Cisco ASA + OpenLDAP

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)? ...
3
votes
1answer
3k views

Strongswan VPN Established but no Packets Routed

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a ...
1
vote
2answers
1k views

How can I configure my network to allow bi-directional traffic between two lans?

Here's my current setup: (and it may require reworking): 2 LAN networks - 192.168.41.0, 192.168.21.0 2 Public IP's (they are assigned to us by specifying MAC Addresses - not subnetted) ...
1
vote
5answers
6k views

Cisco “copy startup-config tftp” results in a 0 byte file on the server?

I'm pulling my hair out figuring this out. My startup-config is good, I can view it with a show command. I'm trying to copy it to a tftp server: asa5505# copy startup-config tftp Address or name of ...
0
votes
0answers
34 views

asa5512x: ipsec site-to-site vpn with tcp instead of udp? is it possible?

the cisco documentation for ASA 9.1 (I have 9.1.2) seems to imply that ipsec vpn with tcp/ip is only for remote clients, not site to site vpn. But I repeatedly see people mention vpn over tcp to ...
1
vote
1answer
915 views

Dual ISPs - Load balancing

We currently have 1 ISP and are adding a second. I need to load balance this into our current network so it shares the bandwidth between our 2 ISPs. We have a total of about 10 external IP addresses ...
1
vote
3answers
2k views

ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server

I just bought an ASA 5505 that my data center is setting up for me. They have told me that setting the ASA to routed with NAT will break Web/DNS server on inside network. For example: WAN IP address ...
1
vote
0answers
17 views

Tethered VPN on Macbook fails to connect, but standard VPN over WiFi works [closed]

I have a MacBook using the Cisco client and it works fine except when I use the special Mac/iPad ability to tether over the iPad data connection. For those that are unfamiliar with this, the Mac and ...
0
votes
0answers
24 views

Remote Desktop Gateway temporarily unavailable outside LAN

I have setup Microsofts RD Gateway on a server in one of our subnets. We have multiple subnets separated by a Cisco ASA firewall. One for servers, one for desktops etc. If I run mstsc from the server ...
0
votes
1answer
3k views

ASA IPSec tunnel up, but logging errors?

I am getting the following errors on an ASA; Jan 24 2012 17:15:13 ASA1 : %ASA-7-714003: IP = 1.2.3.4, IKE Responder starting QM: msg id = 5293ff7c Jan 24 2012 17:15:13 ASA1 : %ASA-7-713236: IP = ...
3
votes
4answers
4k views

2 Cisco ASA + 4 Cisco switches - best way to connect all together

Until now I have been involved in using Cisco hardware in professional environment but on a small level. Recently, requirement has came up for our new facility to be built with PCI compliance in mind ...
0
votes
0answers
15 views

how can a low security group communicate with a high security group in ASA 5525

My DMZ Interface has security level 50 and my interface "old_network" has security level 40. My DMZ has a range 172.16.20.224/27 and my old_network has 192.168.1.0/24. The DMZ can communicate with ...
0
votes
1answer
24 views

cisco asa 5512-x policing

I have a single 100mb leased line that will be shared by three unrelated companies. We are looking to buy a cisco ASA 5512-X and I need to use policing to ensure that each company receives 1/3 of ...
3
votes
6answers
15k views

ASA 5505 Unable to launch device manager

I've seen similar errors posted but I think mine is a little different. I'm new to Cisco, and was given an ASA 5505 to configure. I intended to do a factory reset, but ended up running an erase, ...
6
votes
5answers
25k views

Monitoring Bandwidth Usage (Per Internal IP) - Cisco ASA 5505

I manage a small network with a Cisco ASA 5505 and a shared DSL connection. I would like to be able monitor the bandwidth usage of the various users/devices on my network (by IP address). Can I do ...
4
votes
3answers
7k views

Can I use Cisco ASA's “NetFlow Security Event Logging” (NetFlow 9) for bandwidth monitoring

Cisco has introduced NetFlow 9 export in the latest software version for ASA firewalls. But it seems to be meant for event logging of security events only (as a replacement for syslog messages). But ...
2
votes
1answer
343 views

Cisco ASA 5500 — List of outbound connections?

Is there a command or GUI option to get a list of outbound connections. Ideally, I'd like to know the internal IP address, the external IP address, and the remote port used. I don't need a lot of ...
1
vote
3answers
8k views

Cisco ASA 5505 Config -> Text File

I'm just starting out learning to config Cisco ASA. My office lent me their old ASA 5505 and I plan to do a factory-reset. Before I do that, I'd like to backup the config to a text file on the ...
1
vote
1answer
679 views

How can I protect my website with cisco ASA Firewall 5520 and do url and web filtering?

I've got a cisco ASA firewall 5520 on my small organization's network, and i'm quite new to ASAs as i have just finished my SNAF course and need time and experience. My question is how can i protect ...
2
votes
2answers
6k views

Cisco ASA VPN - Route all internet traffic from remote site through main site's ISP

I have a situation with two locations connected via site-to-site VPN. Site A has a web filtering appliance. I'd like to route all traffic from Site B over the VPN tunnel and out of Site A's internet ...
0
votes
1answer
405 views

Cisco ASA 5505 and slow download speeds for Apple devices [closed]

For traffic routing through my ASA 5505, downloads for all Apple devices, including AppleTV iPad gen 1 IMac MacBook Pro are very slow. speedof.me show less than 1 Mbps download (where I should ...
0
votes
2answers
270 views

Cisco 5505 ASA firewall how to tell one interface to only allow connections from a specific IP address

Interface 1 connects to WAN Interface 2 connects to PROXY PROXY has an ip of 192.168.1.2 How to I tell the ASA 5505 to only allow connections from 192.168.1.2 through interface 2? I can use ADSM ...
1
vote
1answer
51 views

Cisco ASA separating networks

We are using a Cisco ASA 5505 running ver 9.0 to separate our corporate (inside) network from a dev lab (outside) network. We would like to use NAT or PAT to forward the inside interface IP to a set ...
0
votes
2answers
156 views

HttpServletRequest.getRemoteAddr() always returns 127.0.0.1

We're attempting to identify where specific requests are coming from inside our Java application. We have changed the log files to include the IP address and we're using ...
0
votes
4answers
8k views

Allowing inside traffic to outside on ASA 5505

We have an ASA 5505 with an inside interface 10.22.33.0/24 and outside x.x.x.x/26. The inside ip's are obviously private and the outside ip's are public. I've been able to set up a nat rule to route ...
-1
votes
3answers
162 views

Why can i not ping my host behind the firewall. Cisco asa 5505 [closed]

Can anyone please help me to figure out what in my configuration of the Cisco asa 5505 is wrong or missing. I have multiple host behind my firewall these hosts run different websites on port 80. I am ...
3
votes
1answer
169 views

Nmap external scan shows port open, ASA says port is not open, but do get an socket

Folks, have a weird one, need your expert help. For one of our heavily used external facing server which came up in an audit, nmap -Pn scan shows the following: Starting Nmap 5.51 ... Host ...
3
votes
0answers
954 views

cisco asa reloading

After having both memory and code upgrades, we have a significant number of our asa 5520's (in active/standby pairs) develop problems. The problem manifests itself as losing connectivity to the other ...
0
votes
0answers
196 views

Site-to site Configuration between OpenSwan and Cisco ASA

I am making site-to-site vpn connection using amazon ec2 linux and cisco asa router ( please note i donot have access to router only configuration is provided.) CISCO ASA CONFIGURATION : ...
0
votes
0answers
58 views

Cisco ASA 5505 VPN users access to local LAN denied

I have this running config: : Saved : ASA Version 8.2(5) ! hostname TESTATES domain-name TEST.com names name 192.168.1.0 AsusWireless ! interface Ethernet0/0 switchport access vlan 2 ! interface ...