10
votes
Accepted
OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx
This is strange. I have the same problem and found this question to have no answer. I then did more searching and found a yaleman.org post that says they found the answer and linked to this very ...
- 245
7
votes
Accepted
Fortinet: Is there any equivalent of the ASA's packet-tracer command?
On the Fortigate you actually don't have command with capability to generate a dummy packet like on your cisco ASA. But the closest utility will be "diagnose debug flow" commands. The difference is ...
- 86
6
votes
Recover from Cisco ASA 5508-X internal flash failure?
The boot flash (disk0) on that is an internal eUSB. I don't have a 5508-X handy to see if it can be swapped out easily or if it was soldered in. You might be able to get away with using a USB thumb ...
- 8,123
4
votes
Cisco ASA VPN: Drop-reason: (acl-drop) Flow is denied by configured rule
Fortunatelly I'm already able to answer - I want to allow someone else to spare several hours and lot of headache.
we have had configured everything correctly - NAT, ACL, CACL, routes etc. But we we ...
- 81
4
votes
Why do I start at privilege level 1 when logging into a Cisco ASA 5510?
You can login directly in enable mode if your privilege level allows it.
I am running asa916-k8.bin on 5510
The command is aaa authorization exec LOCAL auto-enable
Ravi L
- 115
4
votes
Accepted
Cisco ASA - difference between inside_access_in and inside_access_out?
what is the difference between inside_access_in and inside_access_out ?
Inside_access_in and Inside_access_out are just friendly names for your access lists.
In your case, Inside_access_in is an '...
- 1,379
3
votes
Cisco ASA NAT - internal host see its public ip
Does your host use a DNS name? If so, ask for DNS rewrite to be enabled on the Cisco ASA NAT rule for your host.
- 196k
3
votes
Accepted
Problems with installing Cisco ASDM on a Windows Server 2008 R2
Did you issue the following commands?
Enable the HTTP server for ASDM
http server enable
Allow the management host(s) to access ASDM
http management_host_ip mask interface_name
After doing the ...
- 146
3
votes
Accepted
How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X
I think the issues here is that you misunderstand what 255.255.255.255 means. Its not a "global Broadcast". The definition from the RFC (https://www.rfc-editor.org/rfc/rfc919):
"The ...
- 1,302
3
votes
Cisco ASA5505 - icmp deny any outside breaks internet - how to block outside pings?
What you're missing is: First, ICMP, at least in part, is required for proper functioning of the Internet. Second, blocking pings is completely pointless; it has no security benefits whatsoever, and ...
- 240k
3
votes
Cisco ASA 5505 can't talk to anything on Site-to-Site VPN
Let me point out the general "hint" what to check based on your description. Hopefully it will help even it is not directly "copy&paste" solution. I am sorry in advance for not going through the ...
- 1,617
3
votes
Accepted
Can VLAN traffic pass through an ASA?
If you configure the interfaces on the Cisco ASA as trunk interfaces and tag the traffic coming from the switch, it can pass along the tags assuming your Cisco ASA has been configured in transparent ...
- 5,597
2
votes
Strongswan vpn tunnel connected but the traffic is not routed through it
My situation is very similar to the one described by @telemaco. I have some test VMs running on KVM on my laptop computer. My laptop receives its IP address via DHCP, thus the VPN endpoint IP address ...
2
votes
Cisco ASA - Restrict IP for WebVPN access
first define the extended ACL that permits specific source-adresses for VPN/WEBVPN, I have used the name internet
ciscoasa(config)# access-list internet extended permit tcp host 59.59.59.140 any
...
- 21
2
votes
Cisco "copy startup-config tftp" results in a 0 byte file on the server?
The zero byte indicates that cisco sent the WRQ command to tftp port (69).
The file is created at this step. The problem happens after this point.
The server acks from a different port to the cisco ...
2
votes
WatchGuard Authentication equivalent with Cisco ASA X series
I have just completed the implementation of Cisco 5515's for our network and after doing my own research on this topic and working with Cisco, the only real way of doing this is by running the ...
- 21
2
votes
problem with passive FTP behind cisco asa firewall
Ancient topic, but I ran into similar problems recently and figured my $.02 might help somebody.
In my case, we're running IIS 7.5 behind a slightly older version of ASA, which we're in the process ...
- 21
2
votes
High number connections coming from an IP
This port is used for STUN (Simple Traversal of UDP for NAT), which is used by VoIP in some cases. It is also used by the Apple FaceTime application. It could also be used by malware.
You may have ...
- 27.5k
2
votes
Need help understanding a bandwidth restriction on a Cisco ASA
Regarding your question on the policing/limiting :
The input and output are being policed to 1000000 bits per second with a maximum burst of 1500 bytes. The burst value is the max number of bytes in ...
- 491
2
votes
OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx
If you have trouble with the decode, check your file and delete any blank lines in it. Our ASA was saving them with leading blanks and openssl doesn't like that.
- 21
2
votes
Accepted
Multiple DHCP servers in multiple subnets, one DNS server
Windows 2012 R2 DC in main subnet, with DNS and DHCP server, of course
Why the "of course"? The DHCP server doesn't have to be on the DC - in fact, I would argue that if you have other servers ...
- 7,885
2
votes
How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X
There is no feature for this in the current version (probably for security reasons). Cisco implemented "dhcprelay" instead and didn't provide a means for more general broadcast forwarding.
I'd ...
- 376
2
votes
How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X
I know I'm late to the party on this, but I couldn't find an acceptable answer to the question elsewhere. I recently solved this for the SSDP implementation that Sonos uses. It does leave a couple ...
- 21
2
votes
Cisco ASA - Allowing external access to a secure server via RDP
Well, the NAT rules don't seem to be correctly set up. The port forwarding concept for Cisco ASA is a bit tricky:
Port Redirection (Forwarding) with Static
Port forwarding or port redirection ...
- 8,921
2
votes
Accepted
ASA 5510 Secondary Public IP Range on outside interface
You will need arp permit-nonconnected enabled for the NAT to work properly.
arp permit-nonconnected
To enable the ARP cache to also include non-directly-connected
subnets, use the arp permit-...
- 8,921
2
votes
Setting up Cisco ASA VPN to use both radius and local users
In a Cisco ASA remote access VPN you do not have the option of adding multiple AAA server groups for a single connection profile.
Since each AAA server group is limited to one protocol you cannot ...
- 3,059
2
votes
Cisco ASA 5505 - Help understand/update the config
There are no actual firewall rules here, these are just name -> IP address (range) mappings used in the configuration to make the configuration easier to read.
However, most likely the original ...
- 35.7k
2
votes
Cisco ASA 5505 - Help understand/update the config
The part of the configuration you posted does not contain NAT rules or ACLs (both of which are related to allowing a remote IP to print to a printer in your network).
object network vendor-srv-...
- 3,059
2
votes
Accepted
Get all HTTP traffic with a proxy
Your best bet is to setup squid in transparent mode, but your network diagram would change. As the proxy server would NAT, that would replace your cisco as a router too. (and while at it, why not ...
- 16.5k
2
votes
Accepted
Cisco ASA Site-To-Site VPN change peer IP
Yes, you can change the peer IP address without create new Site-To-Site VPN
In general you have to change two parameters.
peer IP address
tunnel group name
According your link they changed only ...
- 36
Only top scored, non community-wiki answers of a minimum length are eligible