Network Security

Hi, I have an ASA on the edge of my network. When I traceroute from an outside host to an inside host, the last few hops all appear as the NAT IP for the inside host. I have turned on ICMP inspection and ICMP error inspection. I was able to replicate...

Hello Team, We have a problem regarding in sourcefire. We are unable to ssh and gui the management. Our resolution is we need to restart 4 times the appliance before it's work. What would be need to prevent this behavior?

I am having issues with a site to site tunnel between an ASA and a CheckPoint firewall.  All of the devices on 8.2 work fine but the new ones are not working.  Part of the config is not being copied over so I was hoping to get some help in the conver...

Hello friends,this time I have a problem with my ASA 5540. It has configured an outside interface and 3 inside interfaces. The outside interface has a public IP address and is Nating everything from inside interfaces. So far so good. My problem is th...

Is it possible to nat as required by the below parameter's? We wish to nat 192.168.200.0/24 (our private MPLS will not route any 192.168.x.x subnets by design) to another private range that our MPLS will route; 10.52.1.0/24. We also wish to do the ab...

Hello Gents, we have on our ASA huge number of connections which seems to be idle. Similar to below:TCP INET_FW: XX.XXX.XXX.XXX/56535 INET_CORE: YY.YY.YY.YY/20406,    flags UfIB , idle 1h3m, uptime 1h9m, timeout 15m0s, bytes 444 For this specific con...

Hello! We have encountered a problem with our Identity Firewall scheme recently (it works on CDA, 4 Microsoft 2012R2 DCs and Cisco ASA as a consumer device). We've noticed that some ip-to-user mappings are missing on CDA although users are in domain ...

Hi, I have to configure static nats with diferrent range of ISP2, they forward another range over this link. For example, they foward range 5.5.5.0/32 to we use from their address : 4.4.4.0/24. I configured the follow configs but donw works: inter...

Hello I upgraded our Cisco ASA 5520 with a Cisco ASA 5585. Though both ASA were configured with default TCP Idle Connection Timeout values people are now starting to complaint that idle SSH connections are being terminated. This is proper behavior bu...

Hello, Good Day! Just wanted to ask what is the fix for this alert? %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x229, sequence number= 0x4A2) from  (user= ) to  that failed anti-replay checking.

I have run into this issue many times with FirePower deployments.  Customers want to see what the interface utilization for each ASA/FTD device is at on the dash board.  Ive gone through all the widgets and while I found I can create what looks like ...

I have been wrestling with enabling tcp-bypass recently. We have assymetrical routing happening between two providers with BGP configured. I have tried configuring tcp-bypass on the inside interface, outside interface, and globally. Each time the PAT...