Q. This is for dst nat. how about the traffic flow of src natting traffic flow?
A. Source address NAT is the 6th stage in the packet flow - just prior to the IPS redirection.
Q: Differentiate NAT translate & NAT ip hdr, which separated by acl & inspection.
A. The first NAT stage translates the destination IP address of the packet and determines the egress interface of the packet. The second NAT stage is for translating the source IP address.
Q: What is the option for packet trace in FWSM?
A. That's a great question but unfortunately FWSMs do not support packet-tracer. We depend on the other tools (such as captures, and syslogs) to troubleshoot network problems.
Q: The order in which the packet will flow to the nat and I very confused with the new nat order.
A. That is completely understandable if you are new to this version of ASAs. Here are some documents that might help you understand this better: https://supportforums.cisco.com/docs/DOC-12690. There are some useful videos at the end of this doc.
Q: Is this capture command cpu intensive?
A. The capture command has very little overhead on the CPU. It is important though to ensure that you are as specific as possible when working with packet captures.
Q: What is the command to take backup via cli so that all keys will backed up?
A. The CLI command to backup certificates using CLI is "crypto ca export <trustpoint_name> pkcs12 <secret_key>".
If you are talking specifically about the AAA/VPN keys, you should use the command "more system:running-config".
Q: Can we execute Packet tracer command in FWSM firewall?
A. FWSMs do not support packet-tracer. You can use other tools like syslogs and captures.
Q: As the ASA an stateful so there is no need of opening ports in bir-direction . for ex: i have opened a port for a user from src to dst ...my question is when the user try to initiate the traffic from dst does that ACL works for me ?
A. As we discussed, the first stage of packet-processing is does the packet match an existing connection. hence, if the DST is responding to a previous packet from the SRC, then yes, the ASA will allow it without an ACL.
Q: How to look encrypted password in show run of asa?
A. One can not view the un-encrypted passwords of users using CLI. You can though, view the un-encrypted passwords for features like AAA or VPN using the "more system:running-config" and "show run all".
Q: SACK 0k is the only flag that is showin in packet capture?
A. That is actually a TCP option and not the TCP flag. Most of the supported TCP options will be shown in the packet captures.
Q: Please share the document for the packet capture
Due to a bug (CSCvq71351) in 188.8.131.52 - inline sets must be deleted/recreated if they need to be edited Is there any potential traffic impact in deleting/recreating an inline set - as long as you don't push policy until after the inline set is rebuilt...
I want to Deployed New DMVPN connection b/w HQ and BR. I don't know what are the requirements need for making DMVPN connection b/w HQ and BR from the beginning( Example: router and ios licenses required for it ). I am planing to buy c931 cisco routers mod...
Hello to everyoneI'm not an network expert but i need an advice about how to troubleshoot problems we face with Anyconnect when one of our user try to connect forom home to our VPN Essentially anyconnect connects and disconnects continuously, w...
Hello, I am confused with the difference between these two commands and their different use. 1: Difference between CLASS-MAP and CLASS-MAP TYPE INSPECTED.2: Difference between POLICY-MAP and POLICY-MAP TYPE INSPECTED. Best regards...
Hi Guys, I'm having issues authenticating (TACACS+ w/AD) to my routers when I set the device type to "routers". When I try logging in, my prompt gives me access denied. ISE gives the below error: When I set device type to "All Device Types", I'm able...