The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

learn more… | top users | synonyms (1)

13
votes
4answers
8k views

Hardware firewall vs VMware firewall appliance

We have a debate in our office going on whether it's necessary to get a hardware firewall or set up a virtual one on our VMWare cluster. Our environment consists of 3 server nodes (16 cores w/ 64 GB ...
10
votes
3answers
591 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
8
votes
3answers
16k views

How do I reach my internal server on the external IP?

We are trying to configure our Cisco 5505, and it has been done through ASDM. There is one big problem that we're not able to solve, and that's when you go from inside to outside and back in again. ...
7
votes
2answers
1k views

Routing via Cisco ASA is changing TCP sequence/ACK numbers

Our network has a dedicated VPN appliance that sits inside the office network. We have a Cisco ASA with a static route that routes the VPN subnets to the VPN appliance. So a typical request from the ...
6
votes
1answer
442 views

How do I configure NAT rules when using ASA IP-SLA when leveraging post-ASA-8.3 NAT syntax?

We are currently running ASA9 at a location with redundant ip connectivity. We'd love to configure ip sla so that internet access survives a single carrier outage. I'm aware of the ip sla commands, ...
6
votes
2answers
3k views

DMZ subnet: to NAT or not to NAT?

I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts. ...
6
votes
5answers
24k views

Monitoring Bandwidth Usage (Per Internal IP) - Cisco ASA 5505

I manage a small network with a Cisco ASA 5505 and a shared DSL connection. I would like to be able monitor the bandwidth usage of the various users/devices on my network (by IP address). Can I do ...
6
votes
1answer
4k views

ASA site-to-site IPSec vpn to linux ipsec-tools endpoints stops working after a random period of time

We swapped to ASA's over the weekend, and we replaced our VPN infrastructure which was previously based on openvpn and are now using IPSec between our ASA 5520's and our other sites that have linux ...
6
votes
0answers
4k views

Cisco ASA Site-to-Site VPN Dropping

I have three sites, Toronto (1.1.1.1), Mississauga (2.2.2.2) and San Francisco (3.3.3.3). All three sites have ASA 5520. All the sites are connected together with two site-to-site VPN links between ...
5
votes
1answer
603 views

How can I configure an ASA such that I can use a sub-priviledge 15 user to download the current config from http?

I am setting up our new ASA's at Stack Exchange and am trying to follow some best practices like using configuration management and minimum-permissions-necessary users. What I'm trying to do is ...
5
votes
3answers
3k views

Making an ASA TFTP backup through VPN

I have a site to site VPN configured between two ASA 5520s. I have a TFTP server behind ASA1, with an IP of 172.16.1.1 on the "inside" network. I'd like to be able to copy the running config of ASA2 ...
5
votes
2answers
10k views

Cisco ASA5510 Bandwidth Shaping/Limiting

This question is in two parts: Shape How can I limit the bandwidth on a ASA5510 to less than 10Mbps? Currently I have: policy-map shape_policy class class-default shape average 9000000 36096 ! ...
5
votes
1answer
8k views

Strongswan vpn tunnel connected but the traffic is not routed through it

I have just set up a vpn tunnel site-to-site with strongswan (4.5). The tunnel looks fine and connected to the other side, but seems there is a problem routing traffic through the tunnel. Any idea? ...
5
votes
2answers
160 views

Connecting to basic office network from the outside

Back Story: I work in the IT Department for a company that got its start by being given space to work out of from a warehouse when my company first got its start about a decade ago. Ever since then, ...
5
votes
1answer
1k views

Cisco ASA Config for PCI Compliant Office

We have a small business office, but due to PCI compliance we need to segment this into two internet networks (one 'compliant' and one for any other devices to use). We currently have a Draytek ...
5
votes
1answer
1k views

IPv6 over Cisco IPSec VPN?

We use a Cisco ASA 5505 as the firewall and IPSec VPN endpoint on our network. We use split-tunneling to reduce the load on our internet link. In other words, when someone is connected to the VPN ...
5
votes
1answer
192 views

ASA5505 slow downstream, fast upstream on VDSL PPPoE

We have recently switched our ADSL2+ connection for a VDSL Connection in our office. The only configuration change I have made to the Cisco ASA for this change, was to change the username/password on ...
4
votes
4answers
3k views

Cisco ASA 5505 - need more site-to-site VPNs

I'm using a Cisco ASA 5505 50-user firewall in a co-location facility. The systems at this location are performing monitoring of additional remote sites (also running Pix or ASA devices) I've ...
4
votes
3answers
6k views

Cisco ASA 5505 :: Techniques for limiting consumed hosts (max 10 with base license)

Was not aware that ASA 5505 base license restricts number of concurrent hosts to 10 (RTFM, I know). Running a "show local-host" I see my host count at 8, a bit too close for comfort with a production ...
4
votes
3answers
2k views

Backups take so long that the firewall closes the connection

A bit of a mashup of systems here, so bear with me. Essentially, I'm having some trouble using the Backup Exec agent for Oracle, while trying to backup a remote Linux server. The BE agent appears to ...
4
votes
3answers
4k views

Does Windows 7 VPN work with a Cisco ASA 5510

We have a Cisco ASA 5510 router and are trying to get a couple users setup for VPN access. They are running Windows 7 x64 at home and cannot install the VPN client we have for our router (it only ...
4
votes
3answers
984 views

Can our firewall detect traffic sniffing inside the network?

We use Cisco ASA's firewall and NAT functions in our network (200 computers). Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
4
votes
3answers
7k views

Denying ICMP type 3 code 4 traffic - good or bad?

Investigating a slow VPN connection (Cisco ASA IPSec) to a remote office, I noticed on our firewall a lot of access rule matches: Denied ICMP type=3, code=4 from *ip_address* on interface outside I ...
4
votes
1answer
2k views

Is my ASA 5505 almost dead?

I just got a refurbished ASA 5505. It works fine until un need to reload it or unplug it from power and replug it, when I do this and it's warm (even after some minutes of uses, so still physicaly ...
4
votes
1answer
776 views

Cisco ASA ipsec IKEv1 remote access for Avaya VPN phone - no client address assigned

I'm having a strange issue with remote access VPN connectivity on our ASA cluster. Normal site-to-site tunnels and AnyConnect connections works just fine. However, a special ipsec ikev1 tunnel does ...
4
votes
3answers
4k views

How to block a Countries IP range with a Cisco ASA?

To be more specific I have a request from a client to block China's IP range. I know how to do this. I would use the IPs from https://www.countryipblocks.net/e_country_data/CN_netmask.txt and make a ...
4
votes
3answers
8k views

Cisco ASA - NAT Reverse Path behavior

Recently ran into an issue where adding a dynamic NAT to an interface broke all translated traffic going through the interface with RPF failures. We found that the addition of the command caused NAT ...
4
votes
3answers
5k views

What might prevent IKE handshake success in building an IPSEC tunnel?

We use Cisco ASA for our IPSEC VPNs, using the EZVPN method. From time to time we encounter problems where an ISP has made a change to their network and our VPN stops working. Nine times out of ten ...
4
votes
1answer
3k views

Cisco ASA and static IPv6 tunnel endpoint?

I recently installed a Cisco ASA 5505 firewall on the edge of our LAN. The setup is simple: Internet <--> ASA <--> LAN I would like provide the hosts in the LAN with IPv6 connectivity by ...
4
votes
3answers
7k views

Can I use Cisco ASA's “NetFlow Security Event Logging” (NetFlow 9) for bandwidth monitoring

Cisco has introduced NetFlow 9 export in the latest software version for ASA firewalls. But it seems to be meant for event logging of security events only (as a replacement for syslog messages). But ...
4
votes
3answers
8k views

QoS basics on a Cisco ASA

Could someone briefly explain how to use QoS on Cisco ASA 5505? I have the basics of policing down, but what about shaping and priorities? Basically what I'm trying to do is carve out some bandwidth ...
4
votes
7answers
27k views

problem with passive FTP behind cisco asa firewall

i've problems connecting to an ftp-server behind a cisco asa firewall using passive mode. ftp works using active and "extended passive" mode, however: when i turn off "extended passive" (epsv in ftp ...
4
votes
1answer
14k views

Is there a “show cdp neighbors” type command for Cisco ASA devices?

I have been working on a project to map out my organization's network infrastructure. For the networking devices (we are a Cisco shop) I have been running the show cdp neighbors command to see how ...
4
votes
1answer
163 views

Protecting an ASA in a multi tenant environment

I'm interested to know what best practices are for setting limits and policies on an ASA to protect the device to maintain service when used as a multi tenant firewall. For example following several ...
4
votes
3answers
800 views

Opening Ports on a Cisco ASA 5505

I am trying to configure a new 5505 but I am having difficulties opening ports that allow traffic in from the outside. My setup is Comcast Business Modem (w/ single static IP) -> ASA (10.0.0.1) -> ...
4
votes
1answer
11k views

Configure the management interface on a Cisco ASA to allow access from an existing management LAN

(Redefined the question to match actual LAN topology...) I have a new Cisco ASA-5512-X firewall, which is going into an existing network stack to separate some specific client servers from the rest ...
4
votes
1answer
736 views

Cisco ASA 5505, tcp window scaling (rfc1323)

I have a very odd issue with our cisco firewall, If on our osx machines we run the following to disable window scaling support: sudo sysctl -w net.inet.tcp.rfc1323=0 We see near 40% ...
4
votes
1answer
1k views

ASA 5505 vLAN Routing - 2 LAN 1 WAN

I am setting up a Cisco ASA 5505 with the base license. TCP/UDP communication works from inside->outside, outside->inside, inside->secure, which is my desired traffic security. HTTP, SSH, and other ...
4
votes
1answer
2k views

How should DNS be configured for remote VPN access to a Windows Domain?

Suppose you have a small windows domain configured as follows: domain name is ad.example.com (as per these guidelines) DC1 is at 10.10.10.3 DC2 is at 10.10.10.4 DC1 and DC2 are running the ...
4
votes
2answers
1k views

IPSec tunnel on ASA keeps disconnecting

I have an ASA IPSec tunnel configured between an ASA5505 and Microsoft TMG 2010 SP2. The tunnel sometimes works for a few hours, and then disconnects, and other times it works for 5 minutes and then ...
4
votes
1answer
2k views

Cisco ASA: Prevent any single internal host from saturating bandwidth of outside Internet interface

We have an ASA 5510 at the edge of our network connected to a 10Mb Internet pipe. All internal IPs are private so we have external and internal interfaces. I'd like to prevent any single internal host ...
4
votes
1answer
708 views

Cisco ASA LDAP Group Privilege Level

We have a pair of ASA 5510s (8.4.3) on which we use LDAP authentication for VPN and SSH access. On all of our Catalyst switches, which use RADIUS, we're able to set the shell:priv-lvl to 15 in the ...
4
votes
1answer
3k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
4
votes
4answers
3k views

Cisco ASA user authentication options - OpenID, public RSA sig, others?

My organization has a Cisco ASA 5510 which I have made act as a firewall/gateway for one of our offices. Most resources a remote user would come looking for exist inside. I've implemented the usual ...
3
votes
2answers
766 views

Cisco ASA Latency

What is the typical latency added when using a Cisco firewall such as ASA 5505? Are we talking less than 50 microseconds?
3
votes
5answers
6k views

ASA 5505, is BGP supported?

I need to configure BGP on an ASA 5505, according to certain sources it isn't supported, yet I can find resources on the internet giving information on how to configure BGP. I'd really like an ...
3
votes
5answers
11k views

Cisco ASA - manually start a VPN tunnel

Using a cisco ASA is it possible manually bring up a lan to lan VPN tunnel & SA from the device, rather than having one of the systems that is part of the VPN initiate traffic to start the VPN? ...
3
votes
1answer
211 views

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
3
votes
1answer
3k views

cisco ASA - redirect a port on external interface to an internal server port

Using a cisco ASA device with an external IP of 200.20.20.20 (interface OUTSIDE) and an internal subnet of 10.1.1.1/24 (interface INSIDE), how can I configure the ASA so that all traffic to a specific ...
3
votes
6answers
14k views

ASA 5505 Unable to launch device manager

I've seen similar errors posted but I think mine is a little different. I'm new to Cisco, and was given an ASA 5505 to configure. I intended to do a factory reset, but ended up running an erase, ...