Reputation
314
Top tag
Next privilege 500 Rep.
Access review queues
Badges
2 9
Newest
 Yearling
Impact
~40k people reached

  • 0 posts edited
  • 0 helpful flags
  • 6 votes cast
Aug
20
answered Cisco ASA config management
Jul
15
comment Cisco ASA 5550 rebooted itself, logs cleared
As Drifter said, you need a syslog server to capture the logs. You can also use an snmp server for trap messages. Googling will return free options for this. You can't retroactively find root causes when you have no info to work from.
Jun
26
comment Egress Interface Routing - Potential Solution?
I do know that egress interface route selection CAN work in some scenarios, as I discovered it accidentally via a misconfigured NAT that forced a particular route, skipping the routing table process entirely. There seem to be some nuances of this though, and I haven't yet been able to determine if it will satisfy our goals. To your point, adding another firewall to the design, and doing PBR prior to it, could definitely work. We have an active/passive pair - perhaps we can manage with a single device in each path for the duration of the project, each with a simple 0.0.0.0/0 out its own ISP.
Jun
25
asked Egress Interface Routing - Potential Solution?
Nov
30
awarded  Yearling
Oct
8
awarded  Popular Question
Jul
19
comment Weird network problems with Vagrant, VirtualBox, Ansible and Ubuntu Server box
Do you have a working ipv6 internet connection from these boxes? If not, you should investigate why your boxes are resolving ubuntu.com via a AAAA record and/or try disabling ipv6 on the box and retest.
May
25
awarded  Popular Question
May
24
comment DNS doctoring between 3 interfaces
Can you clarify which interface the webserver is off of? You say that it is both on the outside 1.2.3.4 and DMZ 10.10.10.x networks. Also, what version of software are you running?
May
24
comment DNS doctoring between 3 interfaces
Use the packet-tracer utility (either ssh or ASDM) to determine the affect of your existing NAT rules. Also, what version of software are you running?
Aug
5
comment “Unballooning” RAM that's been ballooned by VMware
If you identify the ballooned VMs programmatically, then you'd need to supply a destination to your script to move them to. If this is a huge number of VMs/hosts, that may get complicated. Would it be easier to just maintenance-mode each host, serially, until the whole cluster has been migrated?
Jul
24
comment ASA 5510 Site to Site VPN works in one direction
you said the acls are "equal on both sides". do you mean that they are reversed, or equal? do you have rules allowing siteA -> siteB, and siteB -> siteA, in the same acl?
Jul
10
awarded  Notable Question
Jul
1
comment Secondary fallback/failover network on Cisco ASA
Are you sure your next hop IP is correct - 192.168.70.1? You'd be NAT'ing your internal traffic to another non-global IP.
Feb
8
comment Allowing multiple IP addresses for a single VPN user
I also, have not used this product, but with regex, adding additional IPs should be pretty "clean". Can you not just do (IP1)|(IP2)|(IP3), etc? So the other staff just keeps appending |(IPnew) to the value. The pipe is an or.
Jan
16
comment ASA 5505 not allowing traffic to lower security interface
I've found that "any" gives access to the inside network, which I don't want to do. Our ACLs are all applied as ingress filters.
Jan
16
comment ASA 5505 not allowing traffic to lower security interface
There are static bidirectional NATs for the devices on this dmz interface, and they are functioning correctly. Are you saying that for outbound to the internet usage, you are specifying all the allowed possible Inet ranges of IPs for all your devices?
Jan
15
asked ASA 5505 not allowing traffic to lower security interface
Dec
9
awarded  Critic
Dec
9
comment Cisco IOS switch dropping legit DHCP requests
Is the client on the same vlan as the dhcp server, or are you using an ip helper-address?