Network Security

can somebody please tell me this single command is enough for Nat limit what value should i set for conn max and embryonic conn max. set connection conn-max 600 embryonic-conn-max 50

Hello. One of our customers wants to change the management ip addres of a firepower management center (aka firesight). They are using this device to manage three other asa with firepower services. what would be the recommended procedure to doing thi...

I have installed all Firepower licenses (L-ASA5506-TAMC-PR=, ASA5506-CTRL-LIC) through ASDM on ASA, created policies and everything works fine. Now I want to use Firepower management center as management tool for Firepower services. I have added devi...

All, Several of my FirePOWER sensors (7020 and 7030's running 5.3.0.8) are alerting for time sync.  The FireSIGHT is syncing fine with the assigned NTP server, but the FirePOWER sensors do not sync.  I have gone through this document Troubleshoot Iss...

Hi, We have a scenario with three ASA: one 5515-X with FirePOWER in the HQ, two 5505 in each branch, and IPsec VPN tunnels from both 5505 to the 5515-X. We are forwarding all the traffic from the branches to the VPN tunnels (vpn acl is from branch ...

Hello,I need to get a file from a sensor but there are several firewalls in between FMC and Sensors and the only open port is 8305 (no ssh).  Could I use the sftunnel to transport that file from sensor to FMC?Has somebody face it before or has any id...

We have a requirement to disable IKE aggressive mode. We are running an ASA v7 and I know how to do this ("isakmp am-disable") but I'm not sure what impact it will have on our existing VPN set-up. We are using pre-shared keys.We have remote offices ...

We are seeing syslog events that indicate some data packets are being discarded due to having more fragments than the default value of 24 on the ASA. There is a global command that allows this to be changed to 1-8200. I wonder if increasing this valu...

Hi guys,We want to connect to physical interfaces from ASA to each Nexus core, so is there any possibility to assign same rule set to both interfaces simultaneously? (a kind of zone aggregation).Regards.Jesus

Hi All, Bit of a puzzler, I've added an interface for a backup line on an ASA. The ACL for the interface is "deny ip any any". An nmap scan of the interface from the outside shows all ports *except* TCP/443 closed: [blah]$ nmap -p0-65000 <snip> Sta...

Dear All, I have a web server which is mapped with public IP and is available over internet, works fine too. My query is as follows. If the internet link fails the service won't be accessible over internet. If I have a secondary link, I can change th...

Hi All, C2811 Router         | C2960 L2 switch |      outside   | ASA -------- ASA I am running a simple topology in my laborary for testing ASA 5516-X failover and it is running active/standby failover. I have tried to power off the active ASA and ...

Can someone help me on this? I am planning to upgrade our Cisco 3850 but I do not have an experience in upgrading it.  Can you help me on this? Thank You. vrian