The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

1
vote
0answers
17 views

udp 300 - acl drop - flow is denied

I am facing below issue after connecting l2tp with Cisco asa. Split tunnel is configured. It drops dhcp packets. Here is capture and config. 29: 22:39:38.733909 192.168.255.1.68 > ...
0
votes
0answers
15 views

How to restrict asdm access based on Active Directory group membership?

I have a Cisco ASA 5505. I have enabled AAA authentication for ASDM to authenticate with my Active Directory server. How can I restrict logging into ASDM to certain users that belong to a specific ...
0
votes
1answer
2k views

Cisco ASA 8.2 - 106015 (Deny) and 106100 (Permit) Logs for the Same Packet

I'm seeing traffic from numerous internal endpoints where a RST or FIN/ACK is sent by the endpoint to a host on the Internet. These connections are related with a transparent proxy that is not ...
1
vote
1answer
44 views

Multiple DHCP servers in multiple subnets, one DNS server

I have existing network with two subnets - one is the main company subnet (192.168.1.0/24), the other is completely separate VLAN for Guest Wireless and BYOD devices (192.168.2.0/24). There's Windows ...
4
votes
1answer
2k views

How should DNS be configured for remote VPN access to a Windows Domain?

Suppose you have a small windows domain configured as follows: domain name is ad.example.com (as per these guidelines) DC1 is at 10.10.10.3 DC2 is at 10.10.10.4 DC1 and DC2 are running the ...
0
votes
0answers
24 views

IPSec tunnel through ASA from specific IPs

I'm having some difficulty getting an IPSec tunnel to work through an ASA5510 that is already configured with a number of different tunnels that it terminates, as well as individual VPN clients. ...
4
votes
1answer
4k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
2
votes
1answer
2k views

ASA 5510 Site to Site VPN works in one direction

I have setup a site to site VPN connection between two Cisco ASA 5510. One site (let's call it A) can see the private network of the other site (site B), but site B cannot see the private network of ...
6
votes
1answer
5k views

Cisco ASA Site-to-Site VPN Dropping

I have three sites, Toronto (1.1.1.1), Mississauga (2.2.2.2) and San Francisco (3.3.3.3). All three sites have ASA 5520. All the sites are connected together with two site-to-site VPN links between ...
2
votes
4answers
16k views

VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?

I've got the following set up: LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
0
votes
1answer
38 views

ASA5505 don't allow FTP traffic

I'm new to CISCO and ACLs and NATs but I''m willing to learn. I am having problems allowing FTP access through my ASA5505 ASA 9.2 (2) ASDM 7.3(3) This is my problem, I have a domain which has my ASA ...
0
votes
1answer
42 views

Wireless authentication with DD-WRT, Cisco and Microsoft

I'm looking for a way to authenticate my wireless users beyond them just knowing the wireless password. Ideally they would join the access point then get dumped to the login portal that they'd have to ...
4
votes
4answers
3k views

Cisco ASA user authentication options - OpenID, public RSA sig, others?

My organization has a Cisco ASA 5510 which I have made act as a firewall/gateway for one of our offices. Most resources a remote user would come looking for exist inside. I've implemented the usual ...
1
vote
1answer
1k views

Remote VPN - two-factor authentication with Cisco ASA + OpenLDAP

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)? ...
0
votes
1answer
80 views

Cisco ASA 5550 rebooted itself, logs cleared

we had Cisco ASA5550 in Active/standby mode which worked without any issue for over 1 year. Recently, we started having issue where the VPN tunnels would drop to sites and have internet outages. We ...
1
vote
2answers
1k views

How can I configure my network to allow bi-directional traffic between two lans?

Here's my current setup: (and it may require reworking): 2 LAN networks - 192.168.41.0, 192.168.21.0 2 Public IP's (they are assigned to us by specifying MAC Addresses - not subnetted) ...
0
votes
1answer
63 views

What is the proper way to create a vlan?

My goal is to create a separate VLAN, that will be isolated from the rest of the office, I just want them to have internet. Normal pc stations x1 HP Procurve switch V1910 x1 cisco asa 5512-x What ...
3
votes
1answer
3k views

Strongswan VPN Established but no Packets Routed

I'm setting up a VPN using strongSwan between a Linux instance on an Amazon EC2 instance and a remote network via its Cisco concentrator. I need to route packets from the Linux instance itself a ...
0
votes
1answer
2k views

Allow access to printer between interfaces on Cisco ASA5510

I have a Cisco ASA5510 where we have to separate networks on two separate interfaces. The networks should have nothing to do with each other except that network B needs to access a printer on network ...
0
votes
1answer
2k views

Cisco ASA: port forwarding to different IP depending on client IP/subnet outside

I have Cisco ASA 8.2(5) and would like to configure port forwarding. Cisco ASA has 2 interfaces: outside with IP 192.168.57.2 inside with IP 192.168.1.1 I have two subnets reachable through ...
1
vote
1answer
666 views

Partial VPN connections on Cisco ASA

Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and sh crypto isakmp sa shows active security association. However connectivity to some of our ...
2
votes
0answers
81 views

ASA 5505: How do I access the DMZ web server from the inside using the public IP?

We are using a 5505 ASA Sec+ (8.2). There are three interfaces: inside (172.17.0.0/24), dmz (172.16.0.0/24) and outside (1.2.3.4 for the example). There are static NAT rules set up translating ...
0
votes
2answers
379 views

Cisco ASA 8.4+ redirect multiple ports - best practice?

I was wondering whether anyone could advice on best practices as to the best way to redirect multiple ports for single host in the internal network. As I understand this you can only nat a single ...
0
votes
0answers
19 views

Routing and VPN Setup

The network setup is as follows: Router: eth0 1.1.1.1 (outside) eth1 192.168.54.4 (inside) eth1 10.54.4.4 (inside) Cisco ASA5505 192.168.54.1 (inside) 10.54.4.1 ...
4
votes
0answers
60 views

Cisco ASA failback to preferred IPsec peer

I just configured my Cisco ASA 5505 to failover to a backup internet line when the main outside interface is down. This all works fine. Also, I have a site-to-site IPSEC VPN tunnel from this ...
0
votes
1answer
178 views

Cisco ASA site-to-site VPN up but no traffic

I currently have site to site VPN tunnel up between Cisco ASA 5550 & Cisco ASA5506-X. I can see the vpn tunnel is up on both end but no traffic is passing through. Cisco ASA 5550 is receiving ...
2
votes
3answers
6k views

Cisco ASA rewriting SMTP traffic to prevent mail sending

We have a Cisco ASA 5505 (version 8.0(4)) that is preventing outbound SMTP traffic; testing with telnet shows connections on port 25 are having everything converted to *s while the same does not ...
1
vote
0answers
30 views

Cisco ASA 5505 no NAT

I have a cisco asa 5505. The outside and inside IPs are private IPs so I do not want to NAT the inside IPs as they go out the Outside interface (there is a router upstream of the ASA 5505. Would I do ...
4
votes
3answers
8k views

Why do I start at privilege level 1 when logging into a Cisco ASA 5510?

I have created a test user that is set to privilege 15 in the config: username test password **************** encrypted privilege 15 When I log in to the ASA 5510 I am in privilege 1 according to ...
1
vote
0answers
27 views

Allow Ports 80, 443 and 81 through ASA 5510

We are switching our VoIP provisioning method from TFTP to HTTP provisioning and have been asked by the VoIP provider to allow inbound access on ports 80, 81 and 443 from their two network networks on ...
1
vote
1answer
26 views

CISCO ASA: Add specific command to a privilege level

i am facing the following issue, created a new account with a "read-only" access on a CISCO ASA 5510. This account will be used in a script that will back up the running-config of the ASA. the ...
1
vote
5answers
6k views

Cisco “copy startup-config tftp” results in a 0 byte file on the server?

I'm pulling my hair out figuring this out. My startup-config is good, I can view it with a show command. I'm trying to copy it to a tftp server: asa5505# copy startup-config tftp Address or name of ...
0
votes
0answers
55 views

asa5512x: ipsec site-to-site vpn with tcp instead of udp? is it possible?

the cisco documentation for ASA 9.1 (I have 9.1.2) seems to imply that ipsec vpn with tcp/ip is only for remote clients, not site to site vpn. But I repeatedly see people mention vpn over tcp to ...
1
vote
1answer
933 views

Dual ISPs - Load balancing

We currently have 1 ISP and are adding a second. I need to load balance this into our current network so it shares the bandwidth between our 2 ISPs. We have a total of about 10 external IP addresses ...
1
vote
3answers
2k views

ASA 5505 :: Routed/NAT or Transparent mode for inside Web/DNS Server

I just bought an ASA 5505 that my data center is setting up for me. They have told me that setting the ASA to routed with NAT will break Web/DNS server on inside network. For example: WAN IP address ...
1
vote
0answers
18 views

Tethered VPN on Macbook fails to connect, but standard VPN over WiFi works [closed]

I have a MacBook using the Cisco client and it works fine except when I use the special Mac/iPad ability to tether over the iPad data connection. For those that are unfamiliar with this, the Mac and ...
0
votes
0answers
39 views

Remote Desktop Gateway temporarily unavailable outside LAN

I have setup Microsofts RD Gateway on a server in one of our subnets. We have multiple subnets separated by a Cisco ASA firewall. One for servers, one for desktops etc. If I run mstsc from the server ...
0
votes
1answer
3k views

ASA IPSec tunnel up, but logging errors?

I am getting the following errors on an ASA; Jan 24 2012 17:15:13 ASA1 : %ASA-7-714003: IP = 1.2.3.4, IKE Responder starting QM: msg id = 5293ff7c Jan 24 2012 17:15:13 ASA1 : %ASA-7-713236: IP = ...
3
votes
4answers
4k views

2 Cisco ASA + 4 Cisco switches - best way to connect all together

Until now I have been involved in using Cisco hardware in professional environment but on a small level. Recently, requirement has came up for our new facility to be built with PCI compliance in mind ...
0
votes
0answers
15 views

how can a low security group communicate with a high security group in ASA 5525

My DMZ Interface has security level 50 and my interface "old_network" has security level 40. My DMZ has a range 172.16.20.224/27 and my old_network has 192.168.1.0/24. The DMZ can communicate with ...
0
votes
1answer
29 views

cisco asa 5512-x policing

I have a single 100mb leased line that will be shared by three unrelated companies. We are looking to buy a cisco ASA 5512-X and I need to use policing to ensure that each company receives 1/3 of ...
3
votes
6answers
15k views

ASA 5505 Unable to launch device manager

I've seen similar errors posted but I think mine is a little different. I'm new to Cisco, and was given an ASA 5505 to configure. I intended to do a factory reset, but ended up running an erase, ...
6
votes
5answers
26k views

Monitoring Bandwidth Usage (Per Internal IP) - Cisco ASA 5505

I manage a small network with a Cisco ASA 5505 and a shared DSL connection. I would like to be able monitor the bandwidth usage of the various users/devices on my network (by IP address). Can I do ...
4
votes
3answers
7k views

Can I use Cisco ASA's “NetFlow Security Event Logging” (NetFlow 9) for bandwidth monitoring

Cisco has introduced NetFlow 9 export in the latest software version for ASA firewalls. But it seems to be meant for event logging of security events only (as a replacement for syslog messages). But ...
2
votes
1answer
355 views

Cisco ASA 5500 — List of outbound connections?

Is there a command or GUI option to get a list of outbound connections. Ideally, I'd like to know the internal IP address, the external IP address, and the remote port used. I don't need a lot of ...
2
votes
3answers
9k views

Cisco ASA 5505 Config -> Text File

I'm just starting out learning to config Cisco ASA. My office lent me their old ASA 5505 and I plan to do a factory-reset. Before I do that, I'd like to backup the config to a text file on the ...
1
vote
1answer
681 views

How can I protect my website with cisco ASA Firewall 5520 and do url and web filtering?

I've got a cisco ASA firewall 5520 on my small organization's network, and i'm quite new to ASAs as i have just finished my SNAF course and need time and experience. My question is how can i protect ...
2
votes
2answers
7k views

Cisco ASA VPN - Route all internet traffic from remote site through main site's ISP

I have a situation with two locations connected via site-to-site VPN. Site A has a web filtering appliance. I'd like to route all traffic from Site B over the VPN tunnel and out of Site A's internet ...
0
votes
1answer
430 views

Cisco ASA 5505 and slow download speeds for Apple devices [closed]

For traffic routing through my ASA 5505, downloads for all Apple devices, including AppleTV iPad gen 1 IMac MacBook Pro are very slow. speedof.me show less than 1 Mbps download (where I should ...
0
votes
2answers
270 views

Cisco 5505 ASA firewall how to tell one interface to only allow connections from a specific IP address

Interface 1 connects to WAN Interface 2 connects to PROXY PROXY has an ip of 192.168.1.2 How to I tell the ASA 5505 to only allow connections from 192.168.1.2 through interface 2? I can use ADSM ...