Network Security

Firewall Migration Tool v7.0.0.1 now live!

Enabling our customers to leverage their install base and take them to the next level with Cisco Secure Firewall Threat Defense has always been a key priority. The migration tool is available for download to migrate the configuration on the on-premi...

Resolved! 8.2 NAT to 9.x NAT

hi all,i'm upgrading a 5510 8.2 ASA to 5525-X 9.2 ASA.can someone confirm my NAT config correct? global (outside) 2 203.199.3.6 nat (inside) 2 172.27.169.0 255.255.255.0 object network PAT1 subnet 172.27.169.0 255.255.255.0 nat (inside,outside) dynam...

is there any memory test method on ASA 5580-40

I test a ASA 5580-40, after reload I found there is only 10GB memory installed(before reload there is 12GB memory).but there are 12 memory on board, I remove 2 memory each time to find which memory has problem.just only A1/A2 i haven't remove and di...

PortChannel in Cisco ASA with subinterface vlan

Dear Cisco Expert,I have problem with portchannel in cisco ASA with subinterface, My asa create port channel two link with switch :my asa configuration (PO3 == int gi0/1 & int gi0/0 ASA) : interface Port-channel3 no nameif no security-level no ip add...

Resolved! Cisco Identity Certificates

HiI am getting to grips with certificates. So if I have installed for example Cisco ASA, Prime, ACS etc, when I try to connect to the server via HTTPS, I usually would get a security warning that the server is not trusted. What can I do in terms of s...

ASA Config Export - 8.4.7

I am trying to export a config from a 5520 running 8.4.7 that includes all network objects. Presently I only get network object groups and the rest are IP addresses. Without changing anything on a 5540 running 8.2.5 it exported everything as desired ...

Deny IP spoof on interface inside

HelloIs there a way I can allow spoofed packets from one server to another through a PIX firewall (version 8). This is for forwarding syslog packets so the destination thinks they were send from the originating IP adrress. But I get the following m...

Can not see trunk status when using command show interface trunk Catlyst 6500

Hi, I can not see some trunk when using command show interface trunk in switch 6500. The output of show ip interface brief and show run interface gx/x are up and trunk configured. Anyone can give me some suggestion ? Thank you

ASDM 7.5(1) Bug?

I am not able to change interface security level through the ASDM. (I can change it through the CLI.)It always comes back as the interface was not specified.The screen captures are attached.Am I doing something wrong?Thanks

Resolved! ASA Client-ID and DHCP question

Hello,I have an ASA whose Outside interface is obtaining DHCP IP & Default Gateway. When I look at the DHCP Client Lease Information I see: Client-ID: cisco-xxxx.xxxx.xxxx-outside-HOSTNAME where x=MAC and HOSTNAME=configured ASA hostname.I am trying...

Resolved! Sync clock time with logging time

Hello community,I guess this could be an easy question for most of the people here, unfortunately not for me.The firewall on which I'm working has an NTP configuration (which works) but the logs are not in sync, see the example below: ASA01p# show cl...

Deny TCP (no connection) RST ACK

ASA 5520 Logs are flooded with multiple Deny TCP entries on interface inside. From internal user IPs to unknown outside public IPs: Deny TCP (no connection) from 172.26.x.x/63422 to 216.58.216.98/443 flags RST ACK on interface insideDeny TCP (no co...

Different ways to run captures

Hi All, Is there a difference in what gets capture when using CLI versus captures run on the ASDM. If so which, would provide greater/ more precise detail on the traffic being captured. Thank uDeena

Resolved! IPS module for Cisco 3925 router?

Hi, To be HIPAA compliant our company needs to have an IPS device. I was looking into it and I came across this router module (See link below). We have about 200 users behind the router and we have 2 branch offices with a similar setup. My concerns ...

Need ASA DHCPD server doesn't pass default gateway attribute

Hello,i need my asa DHCP server not to pass default router ip address. I didn't configure any option 3 but the asa passes it's interface address as default router.Here is my configuration: PV-TEST-ASA# sh run dhcpddhcpd option 121 hex 0d0ad80ae400011...