topic ASA cx not working with traffic redirection in Network Security

ASA cx not working with traffic redirection

networksolution.mann — Tue, 12 Mar 2019 06:38:27 GMT

Hi all,

I am facing an issue with asa cx feature where asa is having all traffice set but there is no traffic coming to asa cx.traffic is only visible in case of monitor only mode.please tell me :

1.How to redirect all traffic from asa to asa cx.

2.How to add all inside envoirment working clients in asa cx for checking there details in place of ip address.

NOTE : I am working through PRSM NOT THROUGH CLI.

Hi, If the traffic is visible

Rishabh Seth — Thu, 24 Sep 2015 07:18:04 GMT

Hi,

If the traffic is visible on CX in the monitor only mode then, your redirection policy are correct.

Only change you need make is that on ASA ensure you do not have monitor-only in your policy-map.

For monitor only:

policy-map CX

class CX
cxsc fail-close monitor-only

For inline:

policy-map CX

class CX
cxsc fail-close

Also on CX GUI turn off the monitor-only mode:

Navigate: Configurations> monitor-only and turn off the monitor-only mode.

Hope it helps!!!

Thanks,

R.Seth

Don't forget to mark the answer as correct if it helps in resolving your query!!!

Hi resseth, Thanx for this

networksolution.mann — Thu, 24 Sep 2015 07:18:05 GMT

Hi resseth,

Thanx for this amazing information but if i off the monitor-only mode then cx is not showing any running traffic in it.

So according to you i need to check asa via cli mode for running config for nat should with policy-map ?

Yes, only change you need

Rishabh Seth — Thu, 24 Sep 2015 07:38:35 GMT

Yes, only change you need make is that on ASA ensure you do not have monitor-only in your policy-map.

Even then if you have issues let us know.

Hope it helps!!!

Thanks,

R.Seth

Don't forget to mark the answer as correct if it helps in resolving your query!!!

HI R.SETH, I wanna say thanx

networksolution.mann — Thu, 24 Sep 2015 14:39:16 GMT

HI R.SETH,

I wanna say thanx to you for help this is a issue which were stuck for many days.

ASA cx is working but when inam going to generate report or ceating policies followed Attched errors has been displayed.

So i am not able to make any further towards asa cx.

Could you please help me with that too ?

I glad to hear that provided

Rishabh Seth — Thu, 24 Sep 2015 16:59:16 GMT

I glad to hear that provided solution helped you.

To me the errors look like related to http server on cx. You may try a different browser. Or if it is possible you can try restarting CX module and check. Also esure you are at latest version, so that you can be sure that you are not hitting any existing defect.

Do share your findings.

Thanks,

R.Seth

Hi R.seth,My issue for for

networksolution.mann — Fri, 25 Sep 2015 08:30:11 GMT

Hi R.seth,

My issue for for those error messages has been resolved just by changing browser to chrome and now its working fine.

I dnt know how should i say thanks to you cause its not enough.

you are amazing and you save the day.

Need to ask one more thing

networksolution.mann — Fri, 25 Sep 2015 08:42:35 GMT

Need to ask one more thing how to add all local users data in CX that it would be easy to identify users according to there names.we are not using server for all the users.its only for half of the users other ones uses the laptop.so they are not included and not using domain.

Are you talking about users

Rishabh Seth — Fri, 25 Sep 2015 09:18:56 GMT

Are you talking about users for accessing CX GUI or users for creating user based policies for pass through traffic?

Thanks,

R.Seth

Seth,I am talking about users

networksolution.mann — Fri, 25 Sep 2015 09:23:31 GMT

Seth,

I am talking about users which are shown in traffic or bandwidth usage.

In case for checking which user uses what.

On CX the only way to get

Rishabh Seth — Fri, 25 Sep 2015 09:39:07 GMT

On CX the only way to get user IP mapping is to use a CDA or AD agent.

So you can integrate CX with AD server or CDA.

I hope this answers your query.

Thanks,

R.Seth

could you tell me this

networksolution.mann — Fri, 25 Sep 2015 09:41:24 GMT

could you tell me this process step by step which i can easily follow and perform.

and where i can find CDA in cx

HI R.seth, I am still waiting

networksolution.mann — Mon, 28 Sep 2015 05:07:58 GMT

HI R.seth,

I am still waiting for yur reply regarding the last mail.

One more thing i have not block any service like online banking can you tell me why i am getting this type of msgs.