9

This is strange. I have the same problem and found this question to have no answer. I then did more searching and found a yaleman.org post that says they found the answer and linked to this very question. Yet there was no answer here. Retroactively fixing that, full props to yaleman. Long and short: You need to convert the pfx from Base64 to openssl's ...


7

On the Fortigate you actually don't have command with capability to generate a dummy packet like on your cisco ASA. But the closest utility will be "diagnose debug flow" commands. The difference is that, with fortigate you need real traffic traversing through the firewall. Below are the complete commands that you need to execute: diagnose debug reset ...


6

The risks you're taking should covered by the service level agreement you have with that major cloud server company. Are you getting "a managed firewall" with certain capabilities, where a model is an indication of those capabilities and depending on the SLA the service provider is responsible for the configuration, maintenance and life cycle management? ...


6

The boot flash (disk0) on that is an internal eUSB. I don't have a 5508-X handy to see if it can be swapped out easily or if it was soldered in. You might be able to get away with using a USB thumb drive connected to one of the external ports and adjusting boot variables accordingly. You should be able to format the drive on the primary box and copy the ...


5

I see that this question was asked in April 2010. Good news is that four years later (April 2014) Cisco released ASA software version 9.2(x) with new BGP support! See the ASA 9.2(x) release notes for details. If you're using the ASA 5505, you should review the 5505 RAM requirements listed in the release notes. ASA users have been asking for this feature for ...


5

Console cable, or connect a laptop with a static 192.168.1.2 directly to the LAN port of the ASA. Or if you didn't save the running config to startup, simply reboot the ASA.


4

You can login directly in enable mode if your privilege level allows it. I am running asa916-k8.bin on 5510 The command is aaa authorization exec LOCAL auto-enable Ravi L


4

Fortunatelly I'm already able to answer - I want to allow someone else to spare several hours and lot of headache. we have had configured everything correctly - NAT, ACL, CACL, routes etc. But we we have forgot for one crucial thing - this interface was new and IPSEC was not enabled on that interface. crypto ikev1 enable newiface was the solution for our ...


4

what is the difference between inside_access_in and inside_access_out ? Inside_access_in and Inside_access_out are just friendly names for your access lists. In your case, Inside_access_in is an 'Inbound' access-list, and inside_access_out is an 'Outbound' access list. An inbound access-list is applied to traffic as it ENTERS that interface. Inversely, an ...


3

You can try... sh conn. This show active connections. asa# sh conn ? address Enter this keyword to specify IP address all Enter this keyword to show conns including to-the-box and from-the-box count Enter this keyword to show conn count only detail Enter this keyword to show conn in detail long ...


3

As other similar questions are being marked as duplicates with a reference to here, I wish to complement the excellent answer by @pauska with a 4th option. Solution 4: Routing the traffic through NAT Hairpinning Allowing traffic back through an interface on a Cisco PIX/ASA appliance, such as when a nat:ed client accesses a nat:ed server through its public ...


3

Sorry to necropost on the topic, there's just not much info out there in one place on this particular configuration in terms of troubleshooting. My config: AWS: Strongswan 5.1.3 Corp: Cisco ASA5520 8.4(4)1 Symptoms: Could initiate tunnel and ping from Cisco ASA private LAN to AWS private LAN always. On tunnel timeout/restart I could not initiate or ...


3

Communications between your machine and the VPN endpoint are encrypted. That includes the VNC connection. However, once the packets reach the remote network, the VNC communications between the servers and the VPN endpoint are not encrypted. TightVNC only encrypts passwords, not traffic (as per http://www.tightvnc.com/faq.php).


3

Does your host use a DNS name? If so, ask for DNS rewrite to be enabled on the Cisco ASA NAT rule for your host.


3

Did you issue the following commands? Enable the HTTP server for ASDM http server enable Allow the management host(s) to access ASDM http management_host_ip mask interface_name After doing the above in configuration mode, access ASDM from Firefox browser (you need to have Java JRE and Java browser plugin installed) using the URL https://<ASAv IP ...


3

I think the issues here is that you misunderstand what 255.255.255.255 means. Its not a "global Broadcast". The definition from the RFC (https://www.rfc-editor.org/rfc/rfc919): "The address 255.255.255.255 denotes a broadcast on a local hardware network, which must not be forwarded. This address may be used, for example, by hosts that do not ...


3

What you're missing is: First, ICMP, at least in part, is required for proper functioning of the Internet. Second, blocking pings is completely pointless; it has no security benefits whatsoever, and can cause you trouble later on when you decide you need to be able to ping your device from outside for troubleshooting or other reasons. If you're really ...


3

Let me point out the general "hint" what to check based on your description. Hopefully it will help even it is not directly "copy&paste" solution. I am sorry in advance for not going through the configuration you have provided... :-) NAT - source address / interface for this LDAP traffic Usually the NAT is set up against the network so the traffic ...


3

If you configure the interfaces on the Cisco ASA as trunk interfaces and tag the traffic coming from the switch, it can pass along the tags assuming your Cisco ASA has been configured in transparent mode. With regards to your comment, a transparent firewall is as secure as a firewall in routed mode. Both can check L3/L4 traffic.


2

I've created a script where all you have to do is choose an authority and it'll give you the configuration to drop into the ASA. It's incredibly accurate. regional-asa You can block or allow a specific region if you want. I'll be updating it soon to do specific countries but now it does authorities like ARIN, RIPE, APNIC, etc.


2

The zero byte indicates that cisco sent the WRQ command to tftp port (69). The file is created at this step. The problem happens after this point. The server acks from a different port to the cisco client tftp port. Cisco, then, sends the data to this different port. The problem might be either with the ack not reaching or being rejected by cisco or the ...


2

My situation is very similar to the one described by @telemaco. I have some test VMs running on KVM on my laptop computer. My laptop receives its IP address via DHCP, thus the VPN endpoint IP address is assigned by Strongswan to my laptop via leftsourceip=%config. The VMs use a private network 192.168.100.0/24. My laptop (KVM host) receives the IP address ...


2

first define the extended ACL that permits specific source-adresses for VPN/WEBVPN, I have used the name internet ciscoasa(config)# access-list internet extended permit tcp host 59.59.59.140 any ciscoasa(config)# access-list internet extended deny ip any any then bind the extended ACL with the access-group command and the option control-plane together ...


2

Ancient topic, but I ran into similar problems recently and figured my $.02 might help somebody. In my case, we're running IIS 7.5 behind a slightly older version of ASA, which we're in the process of replacing. We have an existing FTP site and my plan was to simply add FTPS support with the certificate & maybe getting our network admins to open up a ...


2

Cisco ASAs do not support SSH Tunneling, that's why it doesn't work.


2

UDP port 500 is only used for the initial handshake. If you're running IPsec in transport mode, the actual secured traffic is ESP-encapsulated. So you will also need to let all ESP-encapsulated packets through. This is not TCP or UDP traffic, but a different protocol on top of IP.


2

Is it possible to extend the local VLANs to a Remote site connected by IPSEC VPN No, per definition. IpSec is an IP level security tunnel. Vlans are ethernet level. can we have many VPN tunnels between the ASAs Yes. This is a maintenance nightmare if it gets too much and is not automated in management, but it is possible. if not any other options/...


2

Normally you can extend your local LAN to a remote site using common IPsec / Layer 3. Search for Site-to-site, lan-to-lan ipsec VPN. There are a lot of options, my favorite one is to use GRE over IPsec, but you need routers on both ends. If you can tell us what devices you have available on hub/spoke sites it would help in order to give you a more specific ...


2

I suspect your reasoning is right. Since the idea is to create a fully redundant failover solution then any single point of failure must be addressed. As you say if you don't have a Standy failover link then the failure of one port could cause a serious problem. Since this in theory no less likely to happen than a failure on one of the other physical ports ...


2

A router is mainly better at routing via routing protocols, especially dynamic routing protocols like RIP, OSPF and BGP. Some firewalls will do RIP routing (and occasionally BGP or OSPF), but it's generally discouraged -- you don't want to store an entire internal-network routing table on an external access-control device. For non-Ethernet services, like ...


Only top voted, non community-wiki answers of a minimum length are eligible