Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cisco-asa]

The Cisco ASA (Adaptive Security Appliance) series of products provide Firewall and VPN functionality.

0
votes
0answers
13 views

Redirect Outside Traffic to other Outside Address Using Cisco ASA Firewall

Is it possible to send traffic from the internet to another internet address using a Cisco ASA firewall? It needs to be transparent, so that the client, using UDP or TCP behaves exactly as if it were ...
0
votes
0answers
17 views

How to Block Unknown VPN Clients(e.g openconnect) connect to ASA Anyconnect VPN

I Configured a Cisco AnyConnect on ASAv, Now I want just Cisco Anyconnect clients to connect to server and drop openconnect client.
0
votes
1answer
28 views

Google Cloud VPN issue Cisco ASA Cryptomap

I am trying to set up an IPSec tunnel on a Cisco ASA. In my routes on google, I can see that only 172.0.99.0/24 and 172.0.100.0/24 should be routed through this tunnel. Google seems to be requesting ...
0
votes
1answer
18 views

Issues with Cisco IPSec VPN speed. Fast uploads, slow downloads from external to internal servers

We are using a Cisco ASA5516, configured with a IPsec (IKEv1) split tunnel VPN. When uploading files to a server behind the firewall, the transfer speeds are normal (up to 10mbps). When downloading ...
0
votes
0answers
16 views

Cisco ASA Hairping NAT

I'm struggling with a problem here. I have a NAT rule to allow access to a web server on 1 network from the outside. I have a specific need to access that web server via the outside address from ...
0
votes
0answers
28 views

Failover issues when running multiple firewalls with multiple switches

We have 2 cisco asa 5506-x configured in an active/standby configuration. We have 2 switches which have 2 vlans configured, vlan 1 for internal traffic, vlan 2 for external traffic. Each firewall ...
0
votes
0answers
37 views

Dropping SNMP request from 10.20.30.20/26611 to LAN:10.20.30.10/snmptrap because: authentication algorithm failure for user: <username>

I got a problem. After restarting (power off/on) Cisco ASA 5525 Version 9.1(2), I got this (show logging result): Nov 21 12:11:03 TJT: %ASA-snmp-3-212006: Dropping SNMP request from 10.20.30.20/9708 ...
0
votes
0answers
45 views

VPN IPSEC through an internet box on one side and preserving the internet connection on the other side

I want to setup a VPN IPSec tunnel between two sites, let's say PARIS and Toulouse. The tunnel rose well and statues on VPN Gateway routers at both sides shows it's up and OK. The problem is that I ...
1
vote
0answers
18 views

WDS boot taking a long time over site-to-site VPN connection

We have three sites and a new server colocation facility that we are in the process of bringing online. We have several WDS servers at each site. We are moving servers from the smallest site to the ...
0
votes
1answer
104 views

CISCO ASA tunnel is up but no traffic

I have reviewed the very similar questions to mine, but my scenario seems different. ASA Version 9.7(1)4 I had a VPN site-to-site ikev1 connection from a remote network in AWS to a remote network ...
0
votes
0answers
46 views

Cisco ASA 5515 - huge amount of long running idle connections

I've got a Cisco ASA 5515 and it's come to my attention that the connections usage is quite high. Here's the result of running show resource usage summary Resource Current Peak ...
-1
votes
1answer
239 views

Router work as IPsec client to Cisco ASA

Is it possible to configure mikrotik as IPsec vpn client to Cisco Asa? I have ASA connected with static IP to the internet and want to connect mikrotik router behind dynamic IP internet connection to ...
0
votes
0answers
35 views

Two ISPs for two different VLANs with CISCO ASA

I am deploying a CISCO ASA 5506X as part of larger network segmentation and cleanup to improve security. Currently we have two SOHO routers connecting to two different ISPs. One handles strictly ...
0
votes
0answers
20 views

ASA same-security level (or now) and access lists

On ASA I got two interfaces with same security LAN, and LAN2. I want only specific traffic to pass from LAN to LAN2. Let say that I want to pass 10.0.0.0/12 but block 172.16/12. How to achive this? ...
1
vote
0answers
80 views

Cisco Bridge and MAC address blocking

I have two locations connected with two Cisco 861 routers. They are connected using a bridge. The subnet is the same 192.168.100.x.The routers are on E-line connection from provider. Location A is ...
4
votes
2answers
178 views

Monitoring for most recent version of Cisco Adaptive Security Appliance (ASA)

How does one automatically check if your Cisco ASA is running the most recent or non-vulnerable version with external monitoring? With SNMP, you can get the version number of an ASA: $ snmpget -v2c -...
0
votes
0answers
147 views

Cisco ASA and Squid with WCCP2

Configure a transparent proxy Squid redirection with a Cisco ASA via WCCP. Squid is already configured with authorization through Active Directory (Kerberos and LDAP groups), works if the client to ...
0
votes
1answer
971 views

ASA Can ping between subnets, but not pass IP traffic (access rules in place, security levels ok)

I have tried getting my ASA to route traffic between subnets, i got it working for 10 minutes but after some changes (unfortunately not an ASA expert) i have broken something. One example is 192.168....
0
votes
0answers
74 views

Config ASA with SDWAN router behind broadband cable modem

Having problems getting an ASA 5508-X to route traffic to an SDWAN box. The WAN connection on the SDWAN box is part of a /29 public address block. But apparently it NATs to our internal private block. ...
0
votes
0answers
474 views

VPN Tunnel - Crypto map policy error

Good day! GCP reports the following error: The peer gateway notifies: Proposal mismatch in CHILD SA (phase 2), Please look at peer logs. On the ASA 5505 side I'm getting: Map Policy not found for ...
0
votes
1answer
139 views

Can I use Linux iptables to replace the functionality of a Cisco ASA/PIX?

I know iptables can route packets like a router. I've read tutorials where a Raspberry Pi can replace a home router. iptables can allow only specific ports through. However, in my enterprise ...
0
votes
0answers
58 views

Cisco ASA Failover/Failback doesn't work as expected

I have two Cisco ASA with Active - Standby configuration. At first, active and standby device's failover status are like this: ASA-A : Primary - Active ASA-B : Secondary - Standby Recently, there ...
0
votes
1answer
60 views

Cisco AnyConnect disconnects when prompted by UAC

I have a secure network configured with Cisco AnyConnect SSL VPN and Cisco ISE for authentication. (VPN head is a Cisco ASA, AnyConnect v4.5, ISE v2.3) The client VPN works perfectly except when a ...
0
votes
1answer
1k views

Strongswan to Cisco ASA with multiple right subnet

I've got an ikev2 tunnel up, initiated on the left from an ubuntu box with strongswan going to a cisco asa. Using ASA to ASA multiple networks work but I can not get it with strongswan. #config setup ...
0
votes
1answer
284 views

FirePower Malware Notification - Track Destination

Good Morning, I received a notification from FirePower that there was a MALWARE-CNC Win.Trojan.Gh0st variant outbound connection to our exchange server. I'm guessing there was an email sent to one ...
0
votes
0answers
82 views

CISCO ASA 5512-X internet traffic drops intermittently for a few seconds on the WAN after adding VLANs to the network

we recently separated our internal network into VLANs for better manageablility over WiFi. All the VLANs were created as sub-interfaces of GE1. The previously connected GE2 and GE3 were disconnected ...
0
votes
1answer
345 views

Recently I configured a Site-2-Site VPN Tunnel and I'm getting this errors:

Recently I configured a Site-2-Site VPN Tunnel and I'm getting this errors: 3 Feb 27 2018 09:21:57 Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to ...
0
votes
0answers
119 views

SYSLOG traffic is not visible on wireshark

At my workplace I am facing this issue. we have dual homed network. taken MPLS links from two providers. We are trying to send syslogs to the syslog server which is in US. I am trying to send these ...
0
votes
1answer
627 views

Cisco ASA 5505 - Access to DMZ with one public IP

I am trying to configure my Cisco ASA 5505 firewall to allow access from the internet to DMZ web and mail server. I'm new to the Cisco world so excuse me if this is a newbie question. I know that this ...
0
votes
1answer
87 views

Communication between ASA 5525X and a L3 switch 3750

I Have to make authorize communication between ASA 5525X and an L3 switch 3750, in the switch I've created 3 VLANs, Vlan server, Vlan Workstation, and Vlan Interconnection (Vlan number 5) the ...
-1
votes
1answer
262 views

Changing existing NAT rule on Cisco ASA

This is the exact line I want to edit nat (inside,outside) source static thatplace thatplace destination static thisplace thisplace no-proxy-arp route-lookup All I want to do is enable proxy-arp. ...
0
votes
1answer
186 views

Is my VLAN configuration ideal for 2 subnets where one contains a hypervisor?

I’m not sure my VLAN is setup correctly or effectively. I’ve had my layer 3 switch for ages (Extreme Summit x450e-48p). Honestly I’ve just plugged everything into it and used it unmanaged. Before ...
1
vote
1answer
210 views

Why is my IOS EzVPN client not connecting to my ASA EzVPN server?

I have a Cisco 867VAE connecting as an EzVPN NEM client to an ASA 5505 server which will not connect. The server ASA has the repeated messages: 4 Nov 01 2017 23:16:45 713903 ...
2
votes
2answers
104 views

How to add access list to Cisco ASA?

I have the following rules configured at my Cisco ASA firewall: access-list OUTSIDE_IN extended permit tcp any host xx.xx.xx.xx eq 3306 access-list OUTSIDE_IN extended permit tcp any host xx.xx.xx....
0
votes
1answer
501 views

Cisco ASA 5506-X - Inside to Outside Traffic

I'm unable to get traffic on one of my inside ports to route outside. I believe I have the proper NAT, route, and object configurations. The goal is to have web traffic be accessible on the inside ...
0
votes
1answer
235 views

Google Cloud Platform VPN

Is there a way to change the lifetime in seconds for Phase 1 and Phase 2 of Ipsec? I am trying to connect to a Cisco ASA 5550 at a customer site and their lifetime in seconds setting is 86,400(Phase ...
2
votes
1answer
322 views

Cisco ASA v.s. pfSense - How packet inspection works with VPNs

We have a small office, about 75% of our infrastructure is cloud based including a pfSense deployment we use for remote access and site to site connections which is currently public facing. We've ...
0
votes
0answers
183 views

Configuring port forwarding for a Cisco ASA that is behind NAT

I would like to forward ports on a Cisco ASA such that they can be accessed from the Internet. However, this is complicated by the fact that the ASA itself is behind NAT and not directly connected to ...
0
votes
1answer
114 views

Site to Site Ipsec VPN - Tunnel is Up but can't get to route packages from left to right

I have a working tunnel. Packages are being routed from right to left properly (Cisco side can reach my server). Here's all the info. Any help, more than welcome. Network Diagram ...
0
votes
1answer
665 views

Add AWS VPN to Cisco ASA 5515x where a VPN to another office exist

Story: I have Cisco ASA 5515x in the HQ (10.9.1.0/24) connected via site-to-site VPN to office A [10.9.2.0/24 and 10.9.3.0/24]. Challenge: I need to connect Cisco ASA 5515x to AWS VPN to reach AWS ...
0
votes
1answer
48 views

Cisco ASA 5200 LAN Traffic not getting out

I have a remote client with an ASA 5200. They are going to get fiber, but for now are using their building's internet. The ASA config is below (edited for anonymity). It is able to ping the gateway (...
0
votes
1answer
145 views

Aws VPN - Cisco ASA connect vpc with a single device behind cisco ASA

I want to configure an IPsec VPN connection between Cisco ASA and AWS VPN. In this configuration, I want only one IP address, which is a machine behind Cisco ASA in AWS VPN. Is it possible to set ...
2
votes
0answers
62 views

CISCO ASA: Static external 1:1 NAT, but also with Internal Access

We have a NAT rule in our ASA 5525-X here, which basically makes it so that 1.2.3.4 on the outside and 10.1.9.10 on the inside are essentially NAT'd. That is, you can reach 1.2.3.4 on the outside, ...
-2
votes
1answer
528 views

How to block an Internal IP address talking to an external IP Address on Cisco ASA 5505 [closed]

I want to block my server talking to an external IP address continously. The IP address in question is I think is being hijacked or spoofed. When Used who.is it resolves to Netherlands. But if you ...
0
votes
1answer
50 views

Cisco ASA 5510 odd interface issue

Cisco ASA 5510 running Version 8.0(5) Two routers on separate ports. One works as it should, the other is being finnicky for a completely unknown reason. ping PORT1 8.8.8.8 Sending 5, 100-byte ICMP ...
0
votes
1answer
147 views

Cisco ASA 5510 configuration

I have a working config but just acquired a secondary (backup/redundant) ISP so I have to configure it. I found the article that describes doing that, including tracking and SLA: http://www.cisco.com/...
1
vote
1answer
2k views

Cisco ASA Determine If Configuration Has Been Saved

On the Cisco ASA, changes to the running-config are not automatically saved to the startup-config. This is done manually with "write memory" or "copy running-config startup-config" to write the ...
0
votes
2answers
170 views

ASA 5505 Blocking traffic

This 5505 is blocking traffic both in and out. I have asked for help from good IT guys and they say it looks like it is configured correctly. It was working a week ago. I show the config here. If ...
0
votes
1answer
503 views

S2S Issue Google Cloud VPN and Cisco ASA 5545

I'm using Google Cloud VPN gateway and attempting to connect to a CISCO ASA 5545 device on a 3rd party premise. It's a static route setup and the Cisco router is using IKE v1 only. I have this ...
0
votes
0answers
984 views

Cant connect to SSH outside port Cisco ASA 5506

Im configuring an ASA for my home and i got SSH working for internal networks but when trying to configure it for outside, it cant connect. The steps i took to setup the ASA was to allow the internal ...