The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (3)

3
votes
0answers
148 views

Cisco ASA ipsec vs Anyconnect client issue

So I have an iPad that has a IPSec VPN created. I am able to connect from the outside fine and I can access my local LAN files just fine. When I connect with the Cisco AnyConnect client from the same ...
3
votes
0answers
3k views

Cisco ASA Site-to-Site VPN Dropping

I have three sites, Toronto (1.1.1.1), Mississauga (2.2.2.2) and San Francisco (3.3.3.3). All three sites have ASA 5520. All the sites are connected together with two site-to-site VPN links between ...
2
votes
0answers
58 views

Does Cisco IOS XRv support logging of TCP connection (e.g. built and/or teardown)?

I have a demo of Cisco IOS XRv and I would like to setup logging for connections. E.g. for ASA "show logging" shows log messages for every TCP connection built or teardown: Jun 11 12:29:31 ...
2
votes
0answers
120 views

How to allow vpn users to access only specific servers?

Currently we have an ASA with an IP pool to allow an outside contractor to remotely connect and access our network. What we would like to do is limit what they can get to once they are connected. I ...
2
votes
0answers
193 views

Keepalived failover not working for Static NAT target behind Cisco ASA

I've got a Cisco ASA[0] with a pair of Linux boxes in the DMZ running Keepalived and HAproxy acting as a load-balancing failover pair for another pair of Windows servers, also in the DMZ. I'm ...
2
votes
0answers
393 views

How can configure Cisco ASA 5510 to allow access to Web server in DMZ from LAN with port translation?

I am trying to configure Cisco ASA 5510 firewall to allow access from LAN to DMZ web server. Web server is located in the DMZ and is using port 8080. I don't want users to type port number every time ...
2
votes
0answers
80 views

Cisco ASA privilege level for object-groups

I'm trying to set-up privilege level 2, so that it has access to read and modify object and object-groups. Showing them seems to be no problem. I can also enter configure mode. I just can't get the ...
2
votes
0answers
619 views

ASA5505, 9.1, Static NAT Port Range Forwarding

ASA5505 Version 8.4+ (Using 9.1).. Adding port range for static nat. object network server_x host 123.123.123.123 access-list outside_in extended permit tcp any object server_x range 1000 2000 ...
2
votes
0answers
384 views

ASA Site to Site VPN Version 8.4 Natting Same Subnets

My site and client site has same Lan IP range. Both using ASA version 8.4 Site A : 192.168.18.0 Site B : 192.168.18.0 Please tell me how to do Natting on 8.4 Any help would be highly appreciated. ...
2
votes
0answers
4k views

cisco asa NAT to site-to-site VPN

I'm trying to NAT an external address to an internal address which is not local, but on a remote end of a site-to-site VPN connection. Is this possible? Log says Routing failed to locate next hop for ...
2
votes
0answers
739 views

WDS server & Cisco ASA (DHCP)

My setup: WDS server (w2indows 2003 R2) located on subnet 10.1.1.10 Various site locations all on different subnets. Eah site has a Cisco ASA firewall configured to respdon to DHCP requests. ...
1
vote
0answers
72 views

Configuring ASA 5510 for multiple port-forwarding using TCP-UDP service group

I'm currently trying to configure two different ASA 5510s to properly forward all ports used in h323 video conferencing to the proper video conferencing equipment setup on the internal network on each ...
1
vote
0answers
54 views

Broadcom NICs, Cisco ASA and ARP request collisions

First of all I am sorry for my english mistakes. Help me please to solve the problem with ARP request collision incidents. I have IBM BladeCenter E chasis with blade servers are installed in this ...
1
vote
0answers
460 views

Route two public (ISP assigned) subnets on 'outside' interface of Cisco ASA 5510

We've got a Cisco ASA 5510 that sits on our edge and acts as the PPPoE endpoint for a fibre connection. The fibre connection came with a static IP, which is assigned via PPPoE, and gets picked up by ...
1
vote
0answers
973 views

Cannot access L2L VPN from RA VPN connected client on Cisco ASA 5510

We have a Cisco 1921 router running IOS 15.1 at one of our branches which is connected via a L2L IPsec VPN to a ASA5510 running ASA 7.2 at our headquarters. The ASA also provides IPSec Remote Access ...
1
vote
0answers
93 views

Cisco ASA ASDM Missing Nat options when creating network object

Hello all hope this is a simple fix. In ASDM of one of our ASA's, when we go to create network object. the NAT options to create automatic NAT rule is completely missing. its just a small box to ...
1
vote
0answers
298 views

Cisco SPA504G phone CDP/LLDP issue

Good morning everyone, Just recently signed up for the site because I'm looking for some help with an issue that's been plaguing me for about a week now. I hope I'm posting in the right place. If ...
1
vote
0answers
195 views

Setting up an IPSec VPN with Cisco ASDM

I am trying to set up a VPN remote access with a Cisco ASDM 6.4 for ASA 5505 Version 8.2(5). In order to set up the VPN I followed this steps. After this steps my info look like this: VPN Tunnel ...
1
vote
0answers
871 views

ASA Slow IPSec Performance with Inconsistent Window Size

I have a IPSec link between two sites over ASA 5520s running 8.4(3) and I am getting extremely poor performance when traffic passes over the IPSec VPN. CPU on the devices is ~13%, Memory at 408 MB, ...
1
vote
0answers
333 views

UDP Range Nat Translation port forwarding RPT Traffic to inside host PBX Cisco ASA 5505 8.2a

I have an Asterisk based PBX that I'm providing VoIP services with, My gateway is a Cisco ASA 5505 running 8.2 and I only have one public IP Available along with other services I provide with that IP. ...
1
vote
0answers
203 views

Can't remote into server from Android phone after VPN client connects to ASA 5505

I have a Samsung Galaxy Note. I am connecting to an ASA 5505 using NCP as the VPN Client. Connecting is no problem. However, when I try to remote into my server, using xtralogic remote desktop the ...
1
vote
0answers
493 views

Dual pppoe isp connection on a Cisco ASA 8.4

Thank you for helping me. I've a Cisco ASA 8.4 with dual isp connection (pppoe authentication on both line). I configure Two vdpn groups for each connection and add two vpdn username to my cisco's ...
1
vote
0answers
127 views

Disable response from outside interface on ASA 5505 while allowing ping (and response from outside) on the inside interface?

On the ASA 5505 How do I allow icmp requests out (and responses back in) while not allowing a response from the outside interface when pinged.
1
vote
0answers
961 views

ASA 5505 unable to get Lan2Lan and L2TP VPN's working together

I am connecting a remote ASA to a central site with the following settings: Phase 1 IKE: Encryption: DES Authentication: MD5 DH: DH2 Phase 2: Encryption: DES Authentication: MD5 I was getting the ...
1
vote
0answers
559 views

Partial VPN connections on Cisco ASA

Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and sh crypto isakmp sa shows active security association. However connectivity to some of our ...
1
vote
0answers
387 views

LOCAL and RADIUS authentication on ASA

Have configured local authentication which was working fine.And today I wanted to implement RADIUS too .. but after I have done, Im unable to login to my firewall user-identity default-domain LOCAL ...
1
vote
0answers
517 views

Connecting to a Cisco ASA 5510 with Win 7 VPN client

Is it possible to configure a Cisco ASA 5510 to accept a connection from Windows 7 with the built in VPN client software in Win7 ? I know this question has sorta-been asked before on SF but I'm ...
1
vote
0answers
596 views

MAC OS X VPN client / Certificates / Cisco ASA series

I spent a lot of time surfing the web for the solution, but alas, so I finally concluded that this might be an interesting topic to discover. Here's the task: 1. I need to establish VPN connection ...
1
vote
0answers
2k views

How to open ports in Cisco ASA 5505 using ASDM?

am new to cisco and i badly need help in opening ports using ASDM. I already tried natting but it only allows 1 outside and 1 inside rule ex. Inside Static Rules 10.x.x.x outside 72.x.x.x Outside ...
1
vote
0answers
376 views

Cisco ASA 8.4 Port Forwarding Site-to-Site VPN

I have a Cisco ASA (running ASA 8.4) which has a Site to Site IPsec tunnel to three sites. These sites have overlapping address ranges, so on my ASA I have setup NAT so everything is accessible. I ...
1
vote
0answers
3k views

Cisco ASA - Duplicate ISAKMP SA - REKEYs

I have an issue with IPSEC VPNs where a single endpoint generates multiple ISAKMP SAs. (in my examples I have replaced the IPs - 1.1.1.1 is the remote endpoint, 10.10.10.10 is an object on the remote ...
1
vote
0answers
170 views

Connect to workgroup computers by name behind ASA 5505 with VPN

We have a Windows workgroup sitting behind an ASA 5505. All clients receive their IP assignment from the ASA. VPN is set up and we can connect to the local LAN and connect to the machines by IP, but ...
1
vote
0answers
160 views

Cisco ASA Dynamic Access Policies with LDAP

When setting up a Dynamic Access Policy on an ASA that is already configured to use SLDAP for authentication, can attributes other than groups be used? Say a single user?
1
vote
0answers
115 views

NAT confusion regarding cisco ASA5510

I'm setting up my first cisco firewalls. A little information first:I have two asa5510 setup in a working active/standby pair. From my ISP i have two public subnets. A /29 and a /26. On my DMZ ...
1
vote
0answers
763 views

Site B FXO configuration for incoming calls

I am trying to configure the FXO port (voice-port 4) on a Cisco SRST881. Currently, there is one working remote extension here (ext 50) and all calls originate from our main office. My goal is to ...
1
vote
0answers
904 views

Cisco ASA - DHCP Relay doesn't seem to be working consistently

I'm having an issue where some users on one of our DMZ networks aren't getting a DHCP address from the Windows DHCP server on our internal interface. Being that not everyone is affected is making ...
1
vote
0answers
1k views

Cisco Remote Access VPN authenticating via RADIUS over Site2Site VPN

Is it possible to setup the remote access VPN to athenticate to a RADIUS server that is on the other end of a Site to site VPN on the same ASA? I have an ASA 5505 that is at a branch office with a ...
1
vote
0answers
800 views

Site-to-site VPN using IPCop and Cisco ASA 5505

So I'm coming into a company who wants to move away from their IPCop firewalls and replace them with Cisco ASA 5505's. Instead of ripping the entire network down and keeping it down for however many ...
0
votes
0answers
16 views

Include multiple sub-interfaces in Cisco ASA for VPN tunnel

I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces. Say, In Cisco ASA 5550, I created multiple subinterfaces with VLAN ID as below: Inside, int0/1 : ...
0
votes
0answers
45 views

Cisco ASA 5510 needs “clear arp <Interface>” periodically to reach a single host

ASA 9.0(3) The symptom is that I can ping from the ASA to any other host in that interface's subnet, save one particular host (that host can ping the interface on the ASA however). If I do "clear arp ...
0
votes
0answers
23 views

ASA 5515-X: Policy based NAT for dedicated uplink

We have bought a Cisco ASA 5515-X and we have the following scenario. Current situation: GigabitInterface 0/0, IP via DHCP, ISP1, Coax, 100M up / 12M down, medium latency GigabitInterface 0/1, ...
0
votes
0answers
28 views

Amazon AWS Site-to-Site VPN doesn't allow concurrent pings

I have some strange behaviour with an AWS VPC site-to-site set up and would like some help to understand where my problem might be. Set Up I have a VPC with a private and public subnet, there is a ...
0
votes
0answers
20 views

Cisco ASA 5505 - IPSec remote VPN accessing secondary subnet

Layout: modem (pass through) -> Cisco ASA 5505 (Lan 192.168.10.1) -> (Wan 192.168.10.2) Netgear N600 Router (Lan 10.1.10.1) -> workstations (server=10.1.10.34) VPN connection to ASA no problem. I ...
0
votes
0answers
13 views

Lync Server 2010 remte users can not use audio or sharing features

Lync Server 2010 - no sip phones, but audio within the application Inside Audio/Video/Conferencing works Recently we were asked to turn on Remote Access (not federation) since users have leared ...
0
votes
0answers
22 views

Route AAA LDAP traffic from ASA through IPSEC-tunnel to Windows DCs

We have one Cisco ASA 5505 in our HQ responsible for connect our remote office with a IPSEC-tunnel and one ASA 5505 at the remote office. The Cisco ASA 5505 in our HQ is also responsible for VPN users ...
0
votes
0answers
73 views

Cisco ASA not allowing DNS traffic to pass?

I have an ASA 5515 as my internet firewall. It is not allowing me to do NS Lookups from any internal DNS Servers, or clients. If I set my nslookup server to 8.8.8.8 (google DNS), I can resolve public ...
0
votes
0answers
23 views

ASA/AnyConnect will only allow 53/udp to the DNS servers listed in the profile

I found a "bug/feature" in Cisco AnyConnect/ASA 5510: if a VPN client makes a query to udp/53 (DNS query) to any IP address that isn't listed as a DNS server in the VPN profile, then ASA drops this ...
0
votes
0answers
86 views

Cisco ASA 5525 and multiple internet interfaces

I'm replacing a firewall this weekend with a pair of ASA 5525's. The network configuration is as follows :- Inside LAN - 192.168.1.x Internet 1 - 62.0.0.x Internet 2 - 52.0.0.x The currently ...
0
votes
0answers
22 views

Tracking connection route with POST data

I have PHP running on client machines. They connect to a webserver using fopen and upload information stored in local databases. Everything works great, except for one group who uses AT&T cell ...
0
votes
0answers
19 views

Is setting an access rule any to any permit the same as the implicit rule?

I have the default setup of outside=0, dmz=50, inside=100. I'm trying to allow the machines on the inside network to talk to each other over a certain port, but a packet trace shows that the acl is ...