The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (3)

3
votes
0answers
120 views

Cisco ASA ipsec vs Anyconnect client issue

So I have an iPad that has a IPSec VPN created. I am able to connect from the outside fine and I can access my local LAN files just fine. When I connect with the Cisco AnyConnect client from the same ...
3
votes
0answers
3k views

Cisco ASA Site-to-Site VPN Dropping

I have three sites, Toronto (1.1.1.1), Mississauga (2.2.2.2) and San Francisco (3.3.3.3). All three sites have ASA 5520. All the sites are connected together with two site-to-site VPN links between ...
2
votes
0answers
30 views

Does Cisco IOS XRv support logging of TCP connection (e.g. built and/or teardown)?

I have a demo of Cisco IOS XRv and I would like to setup logging for connections. E.g. for ASA "show logging" shows log messages for every TCP connection built or teardown: Jun 11 12:29:31 ...
2
votes
0answers
68 views

How to allow vpn users to access only specific servers?

Currently we have an ASA with an IP pool to allow an outside contractor to remotely connect and access our network. What we would like to do is limit what they can get to once they are connected. I ...
2
votes
0answers
121 views

Keepalived failover not working for Static NAT target behind Cisco ASA

I've got a Cisco ASA[0] with a pair of Linux boxes in the DMZ running Keepalived and HAproxy acting as a load-balancing failover pair for another pair of Windows servers, also in the DMZ. I'm ...
2
votes
0answers
313 views

How can configure Cisco ASA 5510 to allow access to Web server in DMZ from LAN with port translation?

I am trying to configure Cisco ASA 5510 firewall to allow access from LAN to DMZ web server. Web server is located in the DMZ and is using port 8080. I don't want users to type port number every time ...
2
votes
0answers
65 views

Cisco ASA privilege level for object-groups

I'm trying to set-up privilege level 2, so that it has access to read and modify object and object-groups. Showing them seems to be no problem. I can also enter configure mode. I just can't get the ...
2
votes
0answers
442 views

ASA5505, 9.1, Static NAT Port Range Forwarding

ASA5505 Version 8.4+ (Using 9.1).. Adding port range for static nat. object network server_x host 123.123.123.123 access-list outside_in extended permit tcp any object server_x range 1000 2000 ...
2
votes
0answers
328 views

ASA Site to Site VPN Version 8.4 Natting Same Subnets

My site and client site has same Lan IP range. Both using ASA version 8.4 Site A : 192.168.18.0 Site B : 192.168.18.0 Please tell me how to do Natting on 8.4 Any help would be highly appreciated. ...
2
votes
0answers
3k views

cisco asa NAT to site-to-site VPN

I'm trying to NAT an external address to an internal address which is not local, but on a remote end of a site-to-site VPN connection. Is this possible? Log says Routing failed to locate next hop for ...
2
votes
0answers
661 views

WDS server & Cisco ASA (DHCP)

My setup: WDS server (w2indows 2003 R2) located on subnet 10.1.1.10 Various site locations all on different subnets. Eah site has a Cisco ASA firewall configured to respdon to DHCP requests. ...
1
vote
0answers
28 views

Route two public (ISP assigned) subnets on 'outside' interface of Cisco ASA 5510

We've got a Cisco ASA 5510 that sits on our edge and acts as the PPPoE endpoint for a fibre connection. The fibre connection came with a static IP, which is assigned via PPPoE, and gets picked up by ...
1
vote
0answers
477 views

Cannot access L2L VPN from RA VPN connected client on Cisco ASA 5510

We have a Cisco 1921 router running IOS 15.1 at one of our branches which is connected via a L2L IPsec VPN to a ASA5510 running ASA 7.2 at our headquarters. The ASA also provides IPSec Remote Access ...
1
vote
0answers
178 views

Cisco SPA504G phone CDP/LLDP issue

Good morning everyone, Just recently signed up for the site because I'm looking for some help with an issue that's been plaguing me for about a week now. I hope I'm posting in the right place. If ...
1
vote
0answers
142 views

Setting up an IPSec VPN with Cisco ASDM

I am trying to set up a VPN remote access with a Cisco ASDM 6.4 for ASA 5505 Version 8.2(5). In order to set up the VPN I followed this steps. After this steps my info look like this: VPN Tunnel ...
1
vote
0answers
571 views

ASA Slow IPSec Performance with Inconsistent Window Size

I have a IPSec link between two sites over ASA 5520s running 8.4(3) and I am getting extremely poor performance when traffic passes over the IPSec VPN. CPU on the devices is ~13%, Memory at 408 MB, ...
1
vote
0answers
273 views

UDP Range Nat Translation port forwarding RPT Traffic to inside host PBX Cisco ASA 5505 8.2a

I have an Asterisk based PBX that I'm providing VoIP services with, My gateway is a Cisco ASA 5505 running 8.2 and I only have one public IP Available along with other services I provide with that IP. ...
1
vote
0answers
178 views

Can't remote into server from Android phone after VPN client connects to ASA 5505

I have a Samsung Galaxy Note. I am connecting to an ASA 5505 using NCP as the VPN Client. Connecting is no problem. However, when I try to remote into my server, using xtralogic remote desktop the ...
1
vote
0answers
406 views

Dual pppoe isp connection on a Cisco ASA 8.4

Thank you for helping me. I've a Cisco ASA 8.4 with dual isp connection (pppoe authentication on both line). I configure Two vdpn groups for each connection and add two vpdn username to my cisco's ...
1
vote
0answers
118 views

Disable response from outside interface on ASA 5505 while allowing ping (and response from outside) on the inside interface?

On the ASA 5505 How do I allow icmp requests out (and responses back in) while not allowing a response from the outside interface when pinged.
1
vote
0answers
799 views

ASA 5505 unable to get Lan2Lan and L2TP VPN's working together

I am connecting a remote ASA to a central site with the following settings: Phase 1 IKE: Encryption: DES Authentication: MD5 DH: DH2 Phase 2: Encryption: DES Authentication: MD5 I was getting the ...
1
vote
0answers
473 views

Partial VPN connections on Cisco ASA

Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and sh crypto isakmp sa shows active security association. However connectivity to some of our ...
1
vote
0answers
312 views

LOCAL and RADIUS authentication on ASA

Have configured local authentication which was working fine.And today I wanted to implement RADIUS too .. but after I have done, Im unable to login to my firewall user-identity default-domain LOCAL ...
1
vote
0answers
455 views

Connecting to a Cisco ASA 5510 with Win 7 VPN client

Is it possible to configure a Cisco ASA 5510 to accept a connection from Windows 7 with the built in VPN client software in Win7 ? I know this question has sorta-been asked before on SF but I'm ...
1
vote
0answers
560 views

MAC OS X VPN client / Certificates / Cisco ASA series

I spent a lot of time surfing the web for the solution, but alas, so I finally concluded that this might be an interesting topic to discover. Here's the task: 1. I need to establish VPN connection ...
1
vote
0answers
556 views

Remote VPN - two-factor authentication with Cisco ASA + OpenLDAP

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)? ...
1
vote
0answers
2k views

How to open ports in Cisco ASA 5505 using ASDM?

am new to cisco and i badly need help in opening ports using ASDM. I already tried natting but it only allows 1 outside and 1 inside rule ex. Inside Static Rules 10.x.x.x outside 72.x.x.x Outside ...
1
vote
0answers
348 views

Cisco ASA 8.4 Port Forwarding Site-to-Site VPN

I have a Cisco ASA (running ASA 8.4) which has a Site to Site IPsec tunnel to three sites. These sites have overlapping address ranges, so on my ASA I have setup NAT so everything is accessible. I ...
1
vote
0answers
2k views

Cisco ASA - Duplicate ISAKMP SA - REKEYs

I have an issue with IPSEC VPNs where a single endpoint generates multiple ISAKMP SAs. (in my examples I have replaced the IPs - 1.1.1.1 is the remote endpoint, 10.10.10.10 is an object on the remote ...
1
vote
0answers
146 views

Connect to workgroup computers by name behind ASA 5505 with VPN

We have a Windows workgroup sitting behind an ASA 5505. All clients receive their IP assignment from the ASA. VPN is set up and we can connect to the local LAN and connect to the machines by IP, but ...
1
vote
0answers
131 views

Cisco ASA Dynamic Access Policies with LDAP

When setting up a Dynamic Access Policy on an ASA that is already configured to use SLDAP for authentication, can attributes other than groups be used? Say a single user?
1
vote
0answers
114 views

NAT confusion regarding cisco ASA5510

I'm setting up my first cisco firewalls. A little information first:I have two asa5510 setup in a working active/standby pair. From my ISP i have two public subnets. A /29 and a /26. On my DMZ ...
1
vote
0answers
666 views

Site B FXO configuration for incoming calls

I am trying to configure the FXO port (voice-port 4) on a Cisco SRST881. Currently, there is one working remote extension here (ext 50) and all calls originate from our main office. My goal is to ...
1
vote
0answers
799 views

Cisco ASA - DHCP Relay doesn't seem to be working consistently

I'm having an issue where some users on one of our DMZ networks aren't getting a DHCP address from the Windows DHCP server on our internal interface. Being that not everyone is affected is making ...
1
vote
0answers
1k views

Cisco Remote Access VPN authenticating via RADIUS over Site2Site VPN

Is it possible to setup the remote access VPN to athenticate to a RADIUS server that is on the other end of a Site to site VPN on the same ASA? I have an ASA 5505 that is at a branch office with a ...
1
vote
0answers
769 views

Site-to-site VPN using IPCop and Cisco ASA 5505

So I'm coming into a company who wants to move away from their IPCop firewalls and replace them with Cisco ASA 5505's. Instead of ripping the entire network down and keeping it down for however many ...
0
votes
0answers
24 views

Cisco ASA 8.2, accessing an internal webserver with an external IP-address together with port translation

We have one web server, let's call it SERVER01. It is running two different web servers that both uses HTTPS, INTERNALAPP on port 443 and EXTERNALAPP on port 444. In a previous setup we had an old ...
0
votes
0answers
16 views

ASA 5510 Youtube bandwith limit

Just want to know is it possible to set the limit for youtube. eg I have 45MBPS link, most of the bandwidth consume by youtube only, so i want to limit youtube to 5mbps for all mean for complete ...
0
votes
0answers
81 views

Cisco ASA + FreeRadius: Downloadable ACL configuration

VPN users that are using FreeRadius are having access to all VLANs. VPN users using local authentication have local ACLs applied to their access. I need to know what configuration change I need to ...
0
votes
0answers
18 views

Cisco ASA Access anyconnect from inside IPsec tunnel

I have a Cisco ASA on a dynamic WAN IP with a IPsec site-to-site tunnel to a remote linux host in a datacenter with a static WAN IP. All non local traffic is tunneled and the datacenter end is the ...
0
votes
0answers
32 views

Cisco ASA 5505: PAT / NAT between 2 IPSec Tunnels

I've the following Setup: Customer <-> HQ <-> Branchoffice The Customer has a 192.168.1.0/24 subnet. On the HQ only the VPN Gateway is in my context, 172.20.10.1 . And on the Branchoffice ...
0
votes
0answers
63 views

ASA 5540 v8.4(3) vpn to ASA 5505 v8.2(5), tunnel up but I cant ping from 5505 to IP on other side

I am having problems pinging from a 5505(remote) to IP 10.160.70.10 in the network behind the 5540(HQ side). 5505 inside IP: 10.56.0.1 Out: 71.43.109.226 5540 Inside: 10.1.0.8 out: 64.129.214.27 I ...
0
votes
0answers
24 views

Cisco DNS Inspection disallows Reverse Lookup

I'm trying to use DNS Doctoring on my ASA 5505, but apparenly DNS Doctoring required DNS Inspection, and DNS Inspection forbids reverse lookup requests?! How do work around this? I did find this: ...
0
votes
0answers
23 views

AnyConnect certificate/CA pinning on Cisco ASA 5510

I would like to "pin" the certificate or at least the certificate authority for AnyConnect connections. Given the amount of SSL mitm'ing and compromised CA's, I want to ensure that only certificates ...
0
votes
0answers
35 views

Port mirroring on CISCO 2960S

I am trying to do a port mirroring of the traffic for my core switch to a port on my managed switch. The environment that i have is a stacked switch, with 1 serving as the core switch and 2 serving ...
0
votes
0answers
67 views

Preserving VPN Flow on ASA + netsh

I have a tcp connection established over a site-site VPN and when the VPN drops it causes errors on the client when sending after the tunnel is re-established. When having this problem before, ...
0
votes
0answers
192 views

OpenSwan VPN Connected but can't ping or connect to anything on right side

On my end is an Ubuntu AWS EC2 VM and on the other end is a Cisco ASA 5500 router. Phase 1 and Phase 2 come up but I cannot access anything on the other end. It would seem there's a routing problem, ...
0
votes
0answers
48 views

Monitor traffic on ASA-5512X IPS module?

Is there a way to monitor traffic from a SPAN port on a switch to test the ASA IPS Module? I would like to setup testing for our ASA. Will using a SPAN port on a switch and connecting that to the ASA ...
0
votes
0answers
85 views

ASDM - ASA Issue

This is actually a two part question, if anyone has had experience with the issue and could help me out it would be greatly appreciated. Backstory: Using GNS3 with ASA 8.4(2) and ASDM 7.1(5). I've ...
0
votes
0answers
31 views

Find a VPN Name on a Cisco ASA box given a remote IP address

I have a Cisco ASA box with multiple site-to-site VPNs defined. Is there a way to automate finding the VPN name based on a given remote IP address?