Network Security

VPN ipssec Remote ID ASA 5515

Hi AllWe have a working ASA with some VPNs IPSec up & running, now we configured a new one but it doesn't reach phase 2, this is the debug message: IKE MM Initiator FSM error history (struct &0x00007f6e86ee17c0) <state>, <event>: MM_DONE, EV_ERROR--...

ASA cluster cli question

when i connect to my primary asa VIA SSH / CLI is it possible to switch the failover unit?i want to run "sh inventory" on the fail over unit. How would i do that if i don't have CONSOLE access to the fail over unit.

How the firewall handles return traffic

Hello All,Please ignore my ignorance as I tried to wrap my head around this question lingering in my mind.This is more of a query on how the Cisco firewall handles return traffic when an 'any any' policy is in place. The traffic is originating from a...

ASA 7.2 - override Nat0 for single IP

I have inherited a very old and very ugly ASA firewall policy. I'm more of a Checkpoint firewall engineer but do have some basic Cisco knowledge and have been muddling through on the CLI as best I can until we can get this site to our corporate stan...

Asa 5506-X SWITCH POWER LIKE ASA 5505

i buy cisco asa 5506-x ios 9.8 to replace asa 5505.I use the port ge1 / 1 for outside and I configured the other ports as interface inside using the channel port.my problem that I can connect only one computer at a time, the other computers have the ...

Resolved! 2 switches are no longer able to ping after IPSEC configured on Firewalls

Not fluent at IPSEC tunnels yet.See attached of lab topology. So everything could ping each other fine before I made IPSEC configs for 1 tunnel on both ASAs and now the Nexus on both side are not able to ping each other - everything else can still pi...

Resolved! Need ACL Manager - Access Control List Manager is EOL

Hi every body;CiscoWorks Access Control List Manager was a great tool for managing and Optimizing ACLs (Removing covered ACEs, Merging maskable ACE address ranges, Merging covered ACE port ranges, Removing redundant ACEs, Removing duplicate ACE and A...

Resolved! ASA 5510 - inside network cannot connect to web server in dmz using public ip address

I have tried everything I can think of and everything I found on the net, but nothing works.I attached my config minus a few lines.This is the relevant part of my config:: Saved:ASA Version 8.2(5)!hostname ASA5510namesname 12.33.204.205 storename 172...

Resolved! Cannot access to dmz server from inside with public ip address

Hi everyone,On Asa i configured 4 interfaces .Inside1 - 172.16.2.0/24 security level 100Inside2 - 172.16.3.0/24 security level 100Dmz - 10.10.10.0 security level 50Outside - 100.100.100.2/29 security level 0 In inside2 i have a host wih ip 172...

Resolved! Firepower PAT bug ?

Hi,I noticed that port scans had been querying all the internal hosts with bidirectional NATs defined which is obviously expected. But I also noticed that odd internal hosts that shouldn't be routable were also in scope on occasion. Further investi...

ASA Webserver not accessible from Internet

I try seit a week to publich web server but until moment from internet not accessible.my internal network hat 2 Gateways 10.0.0.0/16 GW 10.0.0.1(another Route) , 10.0.0.0/16 GW 10.0.19.50(inside interface asa)web server in DMZ 172.16.0.2/24 GW 172.16...

Cisco ASA 5545 Certificate Generation

We are trying to generate certificates on Cisco ASA 5545. ASA Version 9.4(4)32 ASDM Version 7.12(1)The issue is when we are going through: Configuration>Certificate Management>Identity Certificates>AddWe select the Add a new identity certificate radi...

ACL duplicates removal

Hi, I use a file to add ACL to my ASA. The file contains set of rules (both inbound and outbound traffic). I run this file on my ASA using conf net command. Now because of a huge list (~1.7MB file) and having many duplicates the file takes longer ti...