The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

1
vote
0answers
21 views

cisco asa public server nat issue

I have been tasked with some ASA configuration coming in a few weeks, and to test out some configuration options I have setup a web server on my local network which I would like to be able to access ...
1
vote
0answers
9 views

On Cisco firewall, show access-list main rules only (with line numbers)

For example, if I do a sh access-list Lets say I have a rule on line 2 that has one object-group to another object-group connected on X ports. Well, there may be 30 lines below that, that all say ...
0
votes
0answers
11 views

Cisco asa 8.4 PAT with static NAT

I am trying to make sense of the changes that Cisco has made to NAT on ASA > v8.3. I have a network which is being PAT'd to the outside interface address, and want to add a static NAT from the outside ...
1
vote
2answers
3k views

How can I configure my network to allow bi-directional traffic between two lans?

Here's my current setup: (and it may require reworking): 2 LAN networks - 192.168.41.0, 192.168.21.0 2 Public IP's (they are assigned to us by specifying MAC Addresses - not subnetted) ...
0
votes
0answers
18 views

Cisco ASA PBR and multiple ISPS for multiple SIP Providers

Have a question about policy based routing on my Cisco ASA 5515 running 9.5 and think despite it being available in this software version that I might be screwed. I have an asterisk PBX behind the ...
1
vote
1answer
1k views

How to adjust ASA Failover Times?

I want to adjust my failover poll timing. The proposed column is what I am wanting to set it up as. I believe the following commands will obtain what I want from the first two rows but Im not sure ...
2
votes
4answers
18k views

VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?

I've got the following set up: LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
3
votes
1answer
2k views

Remote VPN - two-factor authentication with Cisco ASA + OpenLDAP

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)? ...
1
vote
0answers
15 views

AnyConnect on ASA5520 licensing required? [duplicate]

longtime reader, first-time poster. I'm currently working in a small shop and I am new to the Sys Admin role. We pay our ISP a lot for our VPN and we are looking for a different provider. We are ...
0
votes
1answer
2k views

Cisco ASA site-to-site VPN up but no traffic

I currently have site to site VPN tunnel up between Cisco ASA 5550 & Cisco ASA5506-X. I can see the vpn tunnel is up on both end but no traffic is passing through. Cisco ASA 5550 is receiving ...
5
votes
4answers
3k views

Cisco ASA user authentication options - OpenID, public RSA sig, others?

My organization has a Cisco ASA 5510 which I have made act as a firewall/gateway for one of our offices. Most resources a remote user would come looking for exist inside. I've implemented the usual ...
4
votes
1answer
1k views

Cisco ASA LDAP Group Privilege Level

We have a pair of ASA 5510s (8.4.3) on which we use LDAP authentication for VPN and SSH access. On all of our Catalyst switches, which use RADIUS, we're able to set the shell:priv-lvl to 15 in the ...
0
votes
1answer
2k views

Allow access to printer between interfaces on Cisco ASA5510

I have a Cisco ASA5510 where we have to separate networks on two separate interfaces. The networks should have nothing to do with each other except that network B needs to access a printer on network ...
0
votes
0answers
14 views

Openswan to Cisco ASA IPSec tunnel - specific IP address range required. Netmap?

I'm attempting to set up a VPN tunnel between a Cisco ASA 5520 and an Openswan server running on Ubuntu 14.04 on a Amazon VPC instance. I do not have access to the ASA, and have been given the ...
6
votes
1answer
5k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
1
vote
0answers
18 views

How should I use Cisco ASA 5510 and Catalyst 3550 together

So I took on a project at my job moving four separate networks into one Colo center. Currently I broken everything down from the four networks into 4 VLANS on the ASA 5510. Each are assigned IPs ...
0
votes
1answer
66 views

ASA INSIDE to INSIDE traffic being dropped

An ASA 5505 is being used to route between two networks as it contains routes to everything. The following depicts the network topology. I have tried various combinations of access lists such as: ...
1
vote
0answers
18 views

Cisco ASA 5510 ASDM 6.4 (2) unable to do port translation

I have a situation, where I want to do port translation. For example I can acces my service outside ip:8081 that is forwaded to server:8080. I should have a NAT rule option to add PAT like in this ...
5
votes
1answer
4k views

How should DNS be configured for remote VPN access to a Windows Domain?

Suppose you have a small windows domain configured as follows: domain name is ad.example.com (as per these guidelines) DC1 is at 10.10.10.3 DC2 is at 10.10.10.4 DC1 and DC2 are running the ...
2
votes
0answers
34 views

Dual path VPN on ASA 9.2

We have two sites that are joined by a VPN over two WAN links, one primary and one backup only. The VPN endpoints are a pair of active/standby ASA clusters at each site. Each site also has multiple ...
0
votes
0answers
8 views

analyze Cisco ASA high cfwConnectionStatCount value

SNMP monitoring of our Cisco ASAs includes the CISCO-FIREWALL-MIB::cfwConnectionStatCount.protoIp.currentInUse value (OID .1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6), described as "number of connections ...
1
vote
1answer
48 views

Setting up Cisco ASA VPN to use both radius and local users

I've got a Cisco ASA setup with L2TP/IPSec VPN, all is working well except for one minor issue. Ideally, I'd like to be able to log on to the VPN using either that RADIUS server users or the local ...
4
votes
1answer
1k views

Outbound Traffic Logging on ASA 5520 possible?

Taking a look at the ASDM (6.4) for my ASA 5520, I get a nice summary of the traffic status, with items like "interface traffic usage", and "connections per second". This works well, but only shows ...
2
votes
2answers
41 views

Issue with Cisco ASA 5515-X VPN Connection

I had an existing setup with a 5515-X serving as my firewall and VPN, which worked fine. Since moving to a new location, and thus a new outside interface IP, I can successfully connect to the VPN, but ...
0
votes
1answer
21 views

ASA 5555-X ACL confusion

I'm wondering what this access list means on the ASA 5555-X? access-list TEST_INSIDE extended permit udp host 192.168.1.99 eq 7600 host 192.168.1.1 I am confused about the 'eq 7600' part since I ...
1
vote
2answers
30 views

Cisco ASA 5505 - Help understand/update the config

Let me preface by saying I am not a network administrator by trade and this firewall was set up originally by a Cisco consultant who is no longer available. We have a small office with a Cisco ASA ...
0
votes
0answers
26 views

Shrewsoft VPN passthrough Cisco ASA 5505

I have a shrewsoft VPN connection setup that passes through a Cisco ASA 5505, it manages to connect okay and i am able to ping etc but if i try to load anything e.g. web interface nothing is returned. ...
-1
votes
1answer
20 views

Cisco ASA5505 - icmp deny any outside breaks internet - how to block outside pings?

We want to block any ICMP requests that are initiated to our network from the public internet. I ran icmp deny any outside, but when I do that, it takes down our internet - nobody can load web pages. ...
2
votes
0answers
1k views

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

I have exported an existing certificate+key from an ASA 5510: asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to ...
2
votes
2answers
70 views

Route traffic from ASA to different firewall default gateway

I should probably start by explaining the topography, we have two different internet connection with separate firewalls.One is an asa and one is a meraki, the default gateway for all the servers ...
0
votes
1answer
728 views

CISCO ASA 5505 Base Licence - Ability to interpret http request headers (host headers)

Base licence configured CISCO ASA 5505 is not capable of routing based on interpretation of the inbound http request headers - affectively host header redirect - am I correct? If I am correct will an ...
0
votes
1answer
47 views

Cisco ASA TCP connections never time out

Our Cisco ASA 5515 will sometimes have thousands of connections with an idle time > the configured connection timeouts. In many cases the connections show as idle for 100+ hours. This eventually leads ...
1
vote
0answers
53 views

Cannot Route RDP Traffic Through AWS Site-to-Site VPN

Hi I have establish VPN connection to the AWS VPC, but still there are some routing issues that make RDP connections fail to initiate, because the router WAN IP is differs from the Public IP, lets ...
1
vote
3answers
14k views

“NAT reverse path failure” ASA 8.3

Forgive me, as I'm not very experienced with ASAs, but I believe what I have configured should be working. I have an ASA 5510 running version 8.3(2), which is connected to internal, external, and dmz ...
5
votes
1answer
59 views

Overcome asymmetric routing while migrating between sets of ISPs

We are migrating from one set of addresses to another set, both /24, and trying to minimize any down time during the migration. Ideally we'd run both for a period of time as we shut down the old ...
9
votes
1answer
6k views

Cisco ASA Site-to-Site VPN Dropping

I have three sites, Toronto (1.1.1.1), Mississauga (2.2.2.2) and San Francisco (3.3.3.3). All three sites have ASA 5520. All the sites are connected together with two site-to-site VPN links between ...
2
votes
0answers
28 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
8
votes
2answers
16k views

Strongswan vpn tunnel connected but the traffic is not routed through it

I have just set up a vpn tunnel site-to-site with strongswan (4.5). The tunnel looks fine and connected to the other side, but seems there is a problem routing traffic through the tunnel. Any idea? ...
0
votes
0answers
134 views

Site to Site VPN one-way traffic Azure <-> Cisco ASA

We have a site-to-site static routing VPN (classic VPN, not ARM) attempting to connect to a remote Cisco ASA 5555 (a supported VPN device). The on-premise network can successfully initiate the tunnel ...
1
vote
0answers
49 views

CISCO SSL VPN Apps fail to connect using Java 8 update 71 (Java 8u71)

A remote client uses the SSL VPN apps for port forwarding through an ASA 5505 firewall. Basically no traffic was able to traverse the port forwarded IP addresses. Using the web browser in the VPN ...
1
vote
1answer
42 views

Cisco ASA logging buffered spams terminal and console lines

I have several routers, switches and firewalls that send logs to a syslog server without interfering with the console line. I'm testing an ASA 5506 (running IOS 9.5.2) at a remote location that ...
2
votes
1answer
124 views

ASA 5510 Secondary Public IP Range on outside interface

We are in process of upgrading from an ASA5505 to an ASA5510. I have a co-location configured for 3 ranges of public IP addresses on two different subnets. The 5505 is working as expected. Example ...
1
vote
1answer
31 views

ASA 5505 blocks users

I have recently installed an ASA 5505. But now i have users that are being blocked/kicked from the internet. What can i do to prevent this? Here is the running config: Result of the command: "sh ...
0
votes
0answers
74 views

ASA 5510 Inter-Vlan routing issues

and thank you in advance for your help. I am having an issue where we are migrating from an ASA 5505 to an ASA 5510 and the software versions are quite different as well so they handle VLANs ...
0
votes
0answers
8 views

Unable to Apply Qos Policy map

I have a 20Mbps MPLS connection , when trying to apply the Qos Policy Map (wich is 60% for Silver traffic , and 40% for gold Traffic), i get the Following Error : "I/f FastEthernet0/0 class DSCP-AF31 ...
2
votes
1answer
2k views

Fortinet: Is there any equivalent of the ASA's packet-tracer command?

I would like to know if there is not Fortigates an equivalent of the packet-tracer command that we can find on the ASA. Here is an example of execution for those who don't know it: NAT and pass : ...
3
votes
2answers
10k views

Cisco ASA - Blocking BitTorrent Traffic

Due to DMCA takedown notices, trying to block bitTorrent traffic for client on a Cisco ASA 5520. ASA Software : 7.2 ASDM: 5.2 The device is really just used for for NAT and VPN's currently. Is there ...
3
votes
1answer
44 views

Cisco ASA 5505 L2L vpn issue

this is my setup I already have a working L2L VPN between the sites I added the 10.10.0.0/24 to the object-groups that defines the internal network on the 1615 ASA And as a remote subnet on the ...
1
vote
1answer
78 views

Cisco ASA - Allowing external access to a secure server via RDP

I am new to the forums and really hope someone can help me. I am pulling my hair out! I have posted on both the Cisco forums and Windows forums in hopes anyone can suggest something but no one has ...
5
votes
2answers
267 views

How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X

I have a CISCO ASA 5506-X with 4 configured interfaces and a set of access-lists etc. It is configured via CLI and is running in routed mode, not transparent. Everything is running well, but now I ...