Network Security

I have a asa5510 that we created a seperate DMZ for vendorss to have internet access when they are in the building.We have http, https, dns and isakmp allowed outbound on this DMZ.We have used it before with no problem, but one vendor came in and nee...

Its easy to configure L2L VPN between two ASAs.Is it possible to create a L2L VPN between a cisco ASA and an ISR Router?Whats the major difference between the two configurations?

I'm setting up a ASA5520 (version 8.2(1))and would like to enable Traceroute from the Inside to the Outside. Most articles tell you to use ICMP Inspection instead of ACL's for this. ICMP Inspection appears to only allow replies that are from the d...

Hello,Is there any way to change the administrative distance on the reverse-route feature of VPN tunnels? When using reverse-route it installs it as static, which gives it an admin distance of 1 it seems, so makes it very hard to use that as a backu...

We just migrated to an ASA5550 and an internal contractor cannot finish ISAKMP negotiation back to her IPSec VPN server (it's a Nortel client). She does get her DNS and IP adddress, so I presume something is trying to connect back to her PC. We fixe...

Hi All, whenever I turn on debug in ASA to start troubleshooting, it shows lots of output from access-list and connection teardown, and I can't see my debug output. how can I turn off those message to see debug output instead? any suggestion would be...

Hello,I am having issues with the IPS sensor not doing the global correlation updates. The IPS module has access to the internet and I can ping the server which serves the updates. Anything else to be checked?

hi,we have AIP-SSM-40 modeule installed on ASA 5540 but it is just physically present.Is it possible to configure to this modeule in inline or like IDS mode? It has only one Ethernet interface. Can this interface be treated as sensor interface and ma...

Hello,I have been provided a server in which I have installed Ciscoworks, which is running fine. I also wish to install IME on the same machine, so that our monitoring is running on a proper, ups-powered, server machine instead of a desktop.However I...

Hello all,I'm having a problem with NAC 4.6.1 and agent 4.6.2.113. If a client already has an older CAA installed they get prompted to upgrade and it works fine. However, if no agent is installed and you try to install it from the http page, it acts ...

greetingI have log:Sep 10 03:19:37 [10.4.3.20.2.2] %ASA-6-106015: Deny TCP (no connection) from 10.15.6.164/6389 to 10.4.27.102/4486 flags ACK on interface insideIs it any possible to open firewall to allow this traffic pass? I believe, it is defaul...

Sig 1307/0 TCP Window Variation is constantly firing on my IPS. The explanation mentions that some "improperly implemented" firewalls can cause this signature to fire. I have an ASA 5520 between my users and the internet and all internet traffic is...