10 votes
Accepted

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

This is strange. I have the same problem and found this question to have no answer. I then did more searching and found a yaleman.org post that says they found the answer and linked to this very ...
  • 245
7 votes
Accepted

Fortinet: Is there any equivalent of the ASA's packet-tracer command?

On the Fortigate you actually don't have command with capability to generate a dummy packet like on your cisco ASA. But the closest utility will be "diagnose debug flow" commands. The difference is ...
  • 86
6 votes

Recover from Cisco ASA 5508-X internal flash failure?

The boot flash (disk0) on that is an internal eUSB. I don't have a 5508-X handy to see if it can be swapped out easily or if it was soldered in. You might be able to get away with using a USB thumb ...
  • 8,123
4 votes

Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule

Fortunatelly I'm already able to answer - I want to allow someone else to spare several hours and lot of headache. we have had configured everything correctly - NAT, ACL, CACL, routes etc. But we we ...
4 votes

Why do I start at privilege level 1 when logging into a Cisco ASA 5510?

You can login directly in enable mode if your privilege level allows it. I am running asa916-k8.bin on 5510 The command is aaa authorization exec LOCAL auto-enable Ravi L
  • 115
4 votes
Accepted

Cisco ASA - difference between inside_access_in and inside_access_out?

what is the difference between inside_access_in and inside_access_out ? Inside_access_in and Inside_access_out are just friendly names for your access lists. In your case, Inside_access_in is an '...
  • 1,379
3 votes

Cisco ASA NAT - internal host see its public ip

Does your host use a DNS name? If so, ask for DNS rewrite to be enabled on the Cisco ASA NAT rule for your host.
  • 196k
3 votes
Accepted

Problems with installing Cisco ASDM on a Windows Server 2008 R2

Did you issue the following commands? Enable the HTTP server for ASDM http server enable Allow the management host(s) to access ASDM http management_host_ip mask interface_name After doing the ...
  • 146
3 votes
Accepted

How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X

I think the issues here is that you misunderstand what 255.255.255.255 means. Its not a "global Broadcast". The definition from the RFC (https://www.rfc-editor.org/rfc/rfc919): "The ...
  • 1,302
3 votes

Cisco ASA5505 - icmp deny any outside breaks internet - how to block outside pings?

What you're missing is: First, ICMP, at least in part, is required for proper functioning of the Internet. Second, blocking pings is completely pointless; it has no security benefits whatsoever, and ...
3 votes

Cisco ASA 5505 can't talk to anything on Site-to-Site VPN

Let me point out the general "hint" what to check based on your description. Hopefully it will help even it is not directly "copy&paste" solution. I am sorry in advance for not going through the ...
  • 1,617
3 votes
Accepted

Can VLAN traffic pass through an ASA?

If you configure the interfaces on the Cisco ASA as trunk interfaces and tag the traffic coming from the switch, it can pass along the tags assuming your Cisco ASA has been configured in transparent ...
  • 5,597
2 votes

Strongswan vpn tunnel connected but the traffic is not routed through it

My situation is very similar to the one described by @telemaco. I have some test VMs running on KVM on my laptop computer. My laptop receives its IP address via DHCP, thus the VPN endpoint IP address ...
2 votes

Cisco ASA - Restrict IP for WebVPN access

first define the extended ACL that permits specific source-adresses for VPN/WEBVPN, I have used the name internet ciscoasa(config)# access-list internet extended permit tcp host 59.59.59.140 any ...
  • 21
2 votes

Cisco "copy startup-config tftp" results in a 0 byte file on the server?

The zero byte indicates that cisco sent the WRQ command to tftp port (69). The file is created at this step. The problem happens after this point. The server acks from a different port to the cisco ...
2 votes

WatchGuard Authentication equivalent with Cisco ASA X series

I have just completed the implementation of Cisco 5515's for our network and after doing my own research on this topic and working with Cisco, the only real way of doing this is by running the ...
2 votes

problem with passive FTP behind cisco asa firewall

Ancient topic, but I ran into similar problems recently and figured my $.02 might help somebody. In my case, we're running IIS 7.5 behind a slightly older version of ASA, which we're in the process ...
  • 21
2 votes

High number connections coming from an IP

This port is used for STUN (Simple Traversal of UDP for NAT), which is used by VoIP in some cases. It is also used by the Apple FaceTime application. It could also be used by malware. You may have ...
  • 27.5k
2 votes

Need help understanding a bandwidth restriction on a Cisco ASA

Regarding your question on the policing/limiting : The input and output are being policed to 1000000 bits per second with a maximum burst of 1500 bytes. The burst value is the max number of bytes in ...
  • 491
2 votes

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

If you have trouble with the decode, check your file and delete any blank lines in it. Our ASA was saving them with leading blanks and openssl doesn't like that.
2 votes
Accepted

Multiple DHCP servers in multiple subnets, one DNS server

Windows 2012 R2 DC in main subnet, with DNS and DHCP server, of course Why the "of course"? The DHCP server doesn't have to be on the DC - in fact, I would argue that if you have other servers ...
  • 7,885
2 votes

How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X

There is no feature for this in the current version (probably for security reasons). Cisco implemented "dhcprelay" instead and didn't provide a means for more general broadcast forwarding. I'd ...
  • 376
2 votes

How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X

I know I'm late to the party on this, but I couldn't find an acceptable answer to the question elsewhere. I recently solved this for the SSDP implementation that Sonos uses. It does leave a couple ...
2 votes

Cisco ASA - Allowing external access to a secure server via RDP

Well, the NAT rules don't seem to be correctly set up. The port forwarding concept for Cisco ASA is a bit tricky: Port Redirection (Forwarding) with Static Port forwarding or port redirection ...
  • 8,921
2 votes
Accepted

ASA 5510 Secondary Public IP Range on outside interface

You will need arp permit-nonconnected enabled for the NAT to work properly. arp permit-nonconnected To enable the ARP cache to also include non-directly-connected subnets, use the arp permit-...
  • 8,921
2 votes

Setting up Cisco ASA VPN to use both radius and local users

In a Cisco ASA remote access VPN you do not have the option of adding multiple AAA server groups for a single connection profile. Since each AAA server group is limited to one protocol you cannot ...
  • 3,059
2 votes

Cisco ASA 5505 - Help understand/update the config

There are no actual firewall rules here, these are just name -> IP address (range) mappings used in the configuration to make the configuration easier to read. However, most likely the original ...
2 votes

Cisco ASA 5505 - Help understand/update the config

The part of the configuration you posted does not contain NAT rules or ACLs (both of which are related to allowing a remote IP to print to a printer in your network). object network vendor-srv-...
  • 3,059
2 votes
Accepted

Get all HTTP traffic with a proxy

Your best bet is to setup squid in transparent mode, but your network diagram would change. As the proxy server would NAT, that would replace your cisco as a router too. (and while at it, why not ...
  • 16.5k
2 votes
Accepted

Cisco ASA Site-To-Site VPN change peer IP

Yes, you can change the peer IP address without create new Site-To-Site VPN In general you have to change two parameters. peer IP address tunnel group name According your link they changed only ...

Only top scored, non community-wiki answers of a minimum length are eligible