Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
12 votes
Accepted

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

This is strange. I have the same problem and found this question to have no answer. I then did more searching and found a yaleman.org post that says they found the answer and linked to this very ...
8None1's user avatar
  • 265
7 votes
Accepted

Fortinet: Is there any equivalent of the ASA's packet-tracer command?

On the Fortigate you actually don't have command with capability to generate a dummy packet like on your cisco ASA. But the closest utility will be "diagnose debug flow" commands. The difference is ...
Thabo's user avatar
  • 86
6 votes

Recover from Cisco ASA 5508-X internal flash failure?

The boot flash (disk0) on that is an internal eUSB. I don't have a 5508-X handy to see if it can be swapped out easily or if it was soldered in. You might be able to get away with using a USB thumb ...
rnxrx's user avatar
  • 8,163
3 votes

Cisco ASA5505 - icmp deny any outside breaks internet - how to block outside pings?

What you're missing is: First, ICMP, at least in part, is required for proper functioning of the Internet. Second, blocking pings is completely pointless; it has no security benefits whatsoever, and ...
Michael Hampton's user avatar
3 votes

OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

If you have trouble with the decode, check your file and delete any blank lines in it. Our ASA was saving them with leading blanks and openssl doesn't like that.
Seth Randall's user avatar
3 votes

Cisco ASA 5505 can't talk to anything on Site-to-Site VPN

Let me point out the general "hint" what to check based on your description. Hopefully it will help even it is not directly "copy&paste" solution. I am sorry in advance for not going through the ...
Kamil J's user avatar
  • 1,717
3 votes
Accepted

Can VLAN traffic pass through an ASA?

If you configure the interfaces on the Cisco ASA as trunk interfaces and tag the traffic coming from the switch, it can pass along the tags assuming your Cisco ASA has been configured in transparent ...
Tommiie's user avatar
  • 5,675
2 votes

Cisco "copy startup-config tftp" results in a 0 byte file on the server?

The zero byte indicates that cisco sent the WRQ command to tftp port (69). The file is created at this step. The problem happens after this point. The server acks from a different port to the cisco ...
Luiz Angelo Daros de Luca's user avatar
2 votes

Setting up Cisco ASA VPN to use both radius and local users

In a Cisco ASA remote access VPN you do not have the option of adding multiple AAA server groups for a single connection profile. Since each AAA server group is limited to one protocol you cannot ...
user5870571's user avatar
  • 3,164
2 votes

How to allow UDP broadcast between interfaces on a Cisco ASA 5506-X

I know I'm late to the party on this, but I couldn't find an acceptable answer to the question elsewhere. I recently solved this for the SSDP implementation that Sonos uses. It does leave a couple ...
solder2000's user avatar
2 votes

problem with passive FTP behind cisco asa firewall

Ancient topic, but I ran into similar problems recently and figured my $.02 might help somebody. In my case, we're running IIS 7.5 behind a slightly older version of ASA, which we're in the process ...
xyvyx's user avatar
  • 21
2 votes

ASA INSIDE to INSIDE traffic being dropped

The command you are looking for is same-security-traffic permit {inter-interface | intra-interface} By default, traffic entering one interface cannot exit the same interface. The following command ...
TDurden's user avatar
  • 256
2 votes

Cisco ASA 5505 - Help understand/update the config

The part of the configuration you posted does not contain NAT rules or ACLs (both of which are related to allowing a remote IP to print to a printer in your network). object network vendor-srv-...
user5870571's user avatar
  • 3,164
2 votes

Cisco ASA 5505 - Help understand/update the config

There are no actual firewall rules here, these are just name -> IP address (range) mappings used in the configuration to make the configuration easier to read. However, most likely the original ...
Tero Kilkanen's user avatar
2 votes
Accepted

Cisco ASA Site-To-Site VPN change peer IP

Yes, you can change the peer IP address without create new Site-To-Site VPN In general you have to change two parameters. peer IP address tunnel group name According your link they changed only ...
Bilbo Beg's user avatar
2 votes
Accepted

Get all HTTP traffic with a proxy

Your best bet is to setup squid in transparent mode, but your network diagram would change. As the proxy server would NAT, that would replace your cisco as a router too. (and while at it, why not ...
yagmoth555's user avatar
  • 17.2k
2 votes
Accepted

Azure hub, multiple spoke VPN using Meraki MX Security Appliances

As mentioned above, we were able to accomplish this by standing up a Cisco CSR in Azure. We have 50 MX60W's and a few MX100 all connecting into the Azure CSR which then allows a direct connection to ...
Pat Beautz's user avatar
2 votes

Azure hub, multiple spoke VPN using Meraki MX Security Appliances

You'll need a static IP on the CSR, but can use the Meraki dynamic DNS names. The Meraki VPN is setup in the Organization wide VPN section, and distributed to the MXs based on tags. The Phase 1 and ...
Glade Creek's user avatar
2 votes
Accepted

Two public IPv4 addresses on single DMZ server

On ASA 8.3 or later: object-group network myPublicIPs network-object host 198.51.100.1 network-object host 203.0.113.2 object network myServer host 192.168.0.100 nat (dmz,outside) static ...
hertitu's user avatar
  • 337
2 votes
Accepted

Strongswan - Cisco ASA Transaction Request failure

The Cisco box probably doesn't expect a Mode Config exchange (that's the TRANSACTION exchange initiated by strongSwan). So try removing leftsourceip=%config.
ecdsa's user avatar
  • 4,102
2 votes
Accepted

Cisco ASA - What are the advantages of ESP-NULL (Null Encryption)

You are indeed mixing things up. ISAKMP policy refers to parameters used in phase 1&2, i.e. how you authenticate the peer and how you encrypt the ISAKMP conversation. Transform-set refers to ...
hertitu's user avatar
  • 337
2 votes
Accepted

ASA QoS for VoIP traffic

Usually, you want to police the priority queue (VoIP). Give it a guaranteed minimum bandwidth, and police everything above that bandwidth. Not policing the priority queue lets the priority traffic end ...
Ron Maupin's user avatar
  • 3,273
2 votes
Accepted

S2S Issue Google Cloud VPN and Cisco ASA 5545

Using static route and IKEv1 posed significant restrictions but that was what the 3rd party peer would support. The most significant being I could not use multi-cidr blocks and was limited to aes-128 ...
keni's user avatar
  • 139
2 votes
Accepted

Cisco ASA 5506-X - Inside to Outside Traffic

You probably just need to add inspection for icmp. policy-map global_policy class inspection_default inspect icmp inspect icmp error
Aaron D's user avatar
  • 303
2 votes

Why is my IOS EzVPN client not connecting to my ASA EzVPN server?

The salient lines of debug output are *Nov 1 23:17:53.987: ISAKMP:(0):Looking for a matching key for server.demo.company.local in default *Nov 1 23:17:53.987: ISAKMP: no pre-shared key based on ...
Mitch's user avatar
  • 2,353
2 votes

Strongswan to Cisco ASA with multiple right subnet

The answer is simple, Cisco ASAs don't support multiple traffic selectors per CHILD_SA. So you have to negotiate individual CHILD_SAs for each combination of local and remote subnet you want to tunnel....
ecdsa's user avatar
  • 4,102
2 votes

Can I use Linux iptables to replace the functionality of a Cisco ASA/PIX?

Yes. Several distributives based on Linux or FreeBSD can be used as soft router. By example DD-WRT, OPENWRT, BSDRP, ALPINE LINUX and many others. They can do all what can do Cisco router without ...
Mikhail Khirgiy's user avatar
2 votes
Accepted

Cisco ASA 5505 can't talk to anything on Site-to-Site VPN

One thing you will need in a situation like this is the management-access <interface-name> global command, where "< interface-name >" is the inside interface nameif. The ASA will not put its ...
user3629081's user avatar
1 vote
Accepted

Cisco ASDM - giving VPNs a "friendly name"

Is there any way to change the tunnel name so that's easy (or at least, easier) to identify one tunnel from the other? TLDR; if you want to change the tunnel name you must delete the tunnel and ...
user5870571's user avatar
  • 3,164

Only top scored, non community-wiki answers of a minimum length are eligible