14
The way that we deal with this is to create an separate object group for interface that we want to have redundant connectivity to, it is a little messy but it should work for what you need.
So you would have a FIOS object
object network FIOS_NYHQ_GUESTWIRELESS_10.110.6.0_24
nat (NYHQ-GUESTWIRELESS,NYHQ-OUTSIDE_FIOS) dynamic interface
and a Cogent ...
11
I've always been reluctant to host a firewall in a virtual machine, for a couple of reasons:
Security.
With a hypervisor, the attack surface is wider. Hardware firewalls usually have a hardened OS (read-only fs, no build tools) which will reduce the impact of a potential system compromise. Firewalls should protect the hosts, not the other way around.
...
10
q
10
Q1. How do I list all user accounts?
From the enable prompt, run show run | i username...
CORE01.PUB.DAL01#sh run | i user
username operator password 7 <someHashedPassword>
CORE01.PUB.DAL01#
Q2. How would I reset the password for a specific user?
Change the password from configuration mode
CORE01.PUB.DAL01#conf t
CORE01.PUB.DAL01(config)#...
10
The output of the tcpdump session on starfleet reveals the problem. Due to the NAT rule here
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -j MASQUERADE
the ICMP request with source address 192.168.100.100 gets natted to xx.xx.xx.195. As the negotiated IPsec policy is for traffic from 192.168.100.0/24 and not xx.xx.xx.195 these packets won't get ...
9
The management-access command is a bit of a misnomer - it doesn't dictate which interface can receive management traffic.
Management traffic (which interfaces it listens on, and which addresses are allowed) is controlled by the http and ssh commands (telnet too, but leave it off!):
http server enable
http 10.0.0.0 255.0.0.0 inside
ssh version 2
ssh 10.0.0....
9
Assuming the software is the same (usually isn't), virtual firewalls can be better than a physical firewall because you have better redundancy. A firewall is just a server with CPU, RAM, and uplink adapters. It's the same argument as a physical web server verses a virtual one. If the hardware fails a virtual server can be migrated to another host ...
8
I go with dedicated hardware because it's purpose-built. Having an appliance is handy in that respect, especially if it's a VPN endpoint or some other gateway. It frees your VMWare cluster up from that responsibility. In terms of hardware/RAM/CPU resources, running a software solution is definitely fine. But that's not really a concern.
7
You'd need to modify the terminal width parameter on the ASA to a value greater than the default of 80 columns.
7
Of course it's not necessary, and for most people, it will get the job done. Just make some considerations that your traffic may trombone across your virtual switch uplinks unless you dedicate NICs to the firewall VM. (You'll have to do this on each box you want to be able to vMotion to).
Personally? I prefer dedicated hardware because it's really not that ...
6
While I am a big fan of the ASA platform, I will be the first to admit that QoS paradigms and capabilities are rather limited on ASA's. Standard IOS ISR's run circles around what the ASA is capable of in regard to QoS.
If you have not read both the ASA QoS Configuration Guide and the IOS QoS Solutions Guide please read them. They are required reading for ...
6
As of 2011.11.28 the accepted answer, while correct in some cases, is not accurate in others.
The ASA uses a slightly different model than traditional IOS routers and this where some of the confusion sits. The second piece is whether or not aaa authentication enable console LOCAL is configured.
Scenario 1 - Enable Authentication Not Configured
Relevant ...
6
You could do this if you have a script with ssh capability. But much better are the ASA "Track" and "Ip SLA" options. look into those to track the route from the asa and add a SLA to that to switch over the network route.
6
As of version 8.3, access lists applied with an access-group statement always use the real IP address, even if the incoming packet is directed at a NAT'd IP; see the ASA Version 8.3 Migration Guide for details.
Your access list should instead look like this:
access-list VM_IN extended permit tcp any host 172.16.1.125 eq 777
Or, even better, use the object ...
6
It appears the memory is bad or not compatible. This site references that all the lights blink when incompatible memory is installed:
http://www.gomjabbar.com/2011/05/26/cisco-asa-5505-diy-ram-upgrade/
6
Seems like you've already found your answer:
After doing some frantic google research, I think I can safely say that our primary issue here is the need to change the public ip address of our DNS record to accurately reflect the change in ip address that came along with our changing of ISPs.
In other words, this has nothing to do with the ASA or the ...
6
In the ASA CLI your home, end and delete functions are replaced by:
Ctrl+A home
Ctrl+E end
Ctrl+D delete
6
The risks you're taking should covered by the service level agreement you have with that major cloud server company.
Are you getting "a managed firewall" with certain capabilities, where a model is an indication of those capabilities and depending on the SLA the service provider is responsible for the configuration, maintenance and life cycle management? ...
6
The boot flash (disk0) on that is an internal eUSB. I don't have a 5508-X handy to see if it can be swapped out easily or if it was soldered in. You might be able to get away with using a USB thumb drive connected to one of the external ports and adjusting boot variables accordingly.
You should be able to format the drive on the primary box and copy the ...
5
I see that this question was asked in April 2010. Good news is that four years later (April 2014) Cisco released ASA software version 9.2(x) with new BGP support! See the ASA 9.2(x) release notes for details. If you're using the ASA 5505, you should review the 5505 RAM requirements listed in the release notes.
ASA users have been asking for this feature for ...
5
In Cisco ASA7.0 or greater OS, you can establish the tunnel by simulating interesting traffic with the packet-tracer command. Here's an example - substitute IP addresses from your networks:
packet-tracer input inside tcp 10.100.0.50 1250 10.200.0.100 80
Source Interface^ | Src IP^ Src Port | |
Protocol^ ...
5
Two risks: info disclosure and vulnerability exploit. In case you trust your ISP regarding abovementioned issues, and make sure SNMP is only accessible with some whitelisted ISP's hosts, it can be considered ok. But configure it as tightly as possible, of course.
5
If I had to guess, I would guess that you didn't have BOOTP/DHCP forwarders set up on your L3 switches/firewall, so clients couldn't get to the second server. I wouldn't run DHCP on my firewall unless there were no other alternative. In this case, I would recommend isolating what exactly broke your configuration with 2008R2 and fix that.
5
Your AAA command is aaa authentication http console [your LDAP server group]
As far as the privilege level for that URL, it should just use the show run authorization level which you can change with privilege show level 1 mode exec command running-config but you might try turning on debug aaa authorization if that doesn't work.
By default only a few ...
5
The high-end Cisco ASA 5580 series has a published spec of 30μs latency as a selling point for ultra low-latency environments. The entry-level ASA 5505 would not be close to that level. I'd assume that 50μs is out of reach for the 5505.
5
Short answer
If you need to sync Cisco boxes to these Win2008 servers, disable the w32time service and install an NTPv4 server for Windows. This is the free Meinberg ntpv4 for windows.
If you don't want to disable w32time for whatever reason, you can host ntpd on a (u|li)nux server, sync that ntpd to an external ntp pool (such as a server from pool.ntp.org)...
5
This took some work to figure out..
First of all - the reason that the client (or phone, to be precise) didn't get an IP address was because of a misconfiguration of the phone. It didn't have a "Config IKE" flag set, which means that it basically discarded any configuration pushed from the ASA.
When I fixed this, another major problem appeared. It turns ...
5
Sorta... You cannot use the CSC modules on the ASA5505, all other ASA models can take that. It's required to do real HTTPS inspection (and thus blocking). However, you could configure an ACL on the 'inside' interface that disallows traffic to port 443, which could effectively cut off most HTTPS traffic.
5
Disabling ACK randomisation on the ASA resolves this issue (this scenario matches Example B - Multiple Internet Paths):
access-list tcp_bypass extended permit tcp 192.168.161.0 255.255.255.0 any
class-map tcp_bypass
match access-list tcp_bypass
policy-map tcp_bypass_policy
class tcp_bypass
set connection advanced-options tcp-state-bypass
set connection ...
5
Console cable, or connect a laptop with a static 192.168.1.2 directly to the LAN port of the ASA. Or if you didn't save the running config to startup, simply reboot the ASA.
Only top voted, non community-wiki answers of a minimum length are eligible
