Hi therei've met something strange with one of tunnel being built from spoke to hub. both hub & spoke hve been enrolled with quite valid certificates from the CA but hub at the end of phase 1 fails packets from spoke.Here is how debug looks on the hu...
Forum Posts
Resolved! ASA 5516-X Firewall
Greetings, would anyone who has personal experience configuring a ASA 5516-X Firewall be able to give me their input? What features are turned on by default when it comes to security along with layer-6 security and what features are not on but you re...
Hi Support Cisco I have 1 Cisco ASA 5525-x. I don't understand that after 2 weeks running it will automatically reboot. Meanwhile I did not configure auto reboot. I also check the power is relatively stable without power outage. Please support me to ...
Guys, I have been trying to monitor ipsec tunnel peer IP and bandwidth utilization for few of our ipsec tunnel, upon doing some some research i could find below OID for the same. it wors seamlessly on single context mode, howver its not woking on mul...
Hi All, Over two years ago we replaced an aging ASA 5550 with a Palo Alto PA-5050. Palo Alto had a nice conversion tool that I was able to use to migrate the config from our ASA to the PA. Fast forward two years, and long story short, the Palo Alto...
ASR1k drops all incoming ESP packets. Feature: FIA_TRACE Entry : 0x70014590 - IPV4_INPUT_IPSEC_TUNNEL_FORUS Lapsed time: 2240 ns Feature: IPSec Action : DECRYPT SA Handle : 2415 SPI : 0x16329982 Peer Addr : x.x.x.x ...
Resolved! VPN ASA 2110 clustering
Hello, I currently have a 2110 running ASA image. It's used for AnyConnect only. I have 1 arm on the outside(connected through a L2 switch) and 1 arm on the inside (connected through a L2 switch). I bought another 2110 and plan to put ASA image on...
Hi,I have an ASA 5515, config looks like this:All inside IP'a are translated to outside. I'm able to ping everything in the Internet and also the host located in DMZ 111.111.111.11 but I'm unable to ping host translated in DMZ (111.111.111.111)Nat s...
Hi,I have internal dns server which is natted to public ip and dns permitted from inside . I am getting lot of traffic . it is psossible to limit the traffic (inspect dns are in place ) Thanks
Resolved! Firepower FMC log analysis DNS results
Isn't there a way to see what the FQDN is within a DNS request? I have seen some DNS requests to an unexpected external DNS server and I would like to find out what the FQDN was that it sent the request to but I can't seem to find any report or way t...
I have 2 Firepower 4100 Boxes and i would like to build a logical FTD Active Standby HA on them.. want to confirm on a few points as mentioned below : I can select any interface on the chassis to function as Management for FTDs..provided it is in the...
Hello All, We are using Cisco ASA 5585-X for many years however we are facing a lot issues with a stable version of the software image presently we are using Version 9.4(4)20 however present software have seemed to be a bug as memory utilization is...
Hello, we are implementing a RAVPN solution with Firepower and the scenario is:-We have a x.x.x.x/30 for RAVPN solution-Firepower Outisde interface is using private address y.y.y.y/30 and is connected to a Internet Router inside interface-Internet Ro...
Hi, I edited the default policy for ikev2 ( it is done for ipsec site to site vpn policy )The below is before editing crypto ikev2 policy 1encryption aes-256integrity shagroup 5prf shalifetime seconds 86400 and the below is after editing crypto ik...
Hello, everyone. I nee clarification about one thing. We are using FTD devices on out corporate network for RA ans S2S VPNs. FTD has one interface for internet and one WAN interface leased from SP for 3rd Party companies. Currently we have one site-t...
