Network Security

hallo We had a active/active Cluster and the primary unit crashed and must be replaced. The secondary is up and running. The config on the active looks like :  ( Failover is already deactived ) ffm-sep-dc/sec/actNoFailover# sh run | grep fail no fa...

Hello, is there a mechanism in the new Firepower that can block IP address originating from different countries? I have a site that gets bombarded by DOS and Dictionary attacks. I have called the ISP in the past but, that can be difficult in getting ...

inter gi0/0 maneif inside ip add 1.1.1.1 255.255.255.0 security-level 100 no shu inter gi0/1 nameif mgmt ip add 2.2.2.1 255.255.255.0 security-level 100 no shu exit same-security-traffic permit inter-interface same-security-traffic permit intra-inter...

Hi All, I have a private IP from one of our partner x.x.x.x and would like to nat it. Only our internal users will be initiating connection towards this IP.  What should the NAT statement look like on ASA 8.5 if have to NAT the outside ip to Y.Y.Y.Y...

I have a DMZ that has a Cisco Nexus switch with VRFs as well as a physical firewall.  Is it common in a DMZ environment to put the gateways for the DMZ systems on a Nexus VRF? Or should they be on the physical firewall?  If they are on the VRF, then ...

Hello Forum Folks! I'm working on a problem I feel should be easy, but I'm just not able to get my head wrapped around it. Our network is configured something like this: Outside 1.1.1.1 (Security lvl 0) Inside 192.168.1.0/24 (Security lvl 100) Othe...

Hi, I tried to configured two object nat as below: Source Y (Internet) to destination Z (DMZ) translate port 443 into 9443 - I need this for a specific solution that only answers requests from Internet on  this port Source Y (Internet) destination...

In our office, we have a two-VLAN setup with Data running on VLAN 1 and VoIP running on VLAN 2. We also have separated modems and gateways for each of them, and would like them to have segregated internet access. Below is a list of all the VLAN IP in...

I have a NAT problem which has been really bugging me. The issue itself relates to Skype for Business. There is client wireless traffic (mobile client software) coming to the inside interface of the ASA that is destined for the public IP address of a...

Simple complex question. Reading best practices, it is best to place the inline IPS behind the firewall. We will be using 7125 Firepower appliances, not the built in Firepower on the ASA. However, how do we protect a DMZ without Inline?  I haven't re...