Hi, When using the VPN client, this allows the users to access the network resources natively without having to browse the webpage, providing the users with a similar user experience if connected to the local LAN. The VPN client this allows you to run posture checks to ensure the health of the computer, by determining whether applications such as Anti-Virus, Anti-Malware or Local Firewall are running on the computer before permitting access to the network. HTH ... View more

You would define the IP address and nameif on another interface, which is connected to the 2nd ISP. ... View more

Hi, You can configure IP SLA to monitor the first ISP, in the event of failure failover to the 2nd ISP.   In the example below traffic uses ISP1 via OUTSIDE_1 interface until the icmp probe to 1.1.1.254 fails, it which point the default route is removed and the route via ISP2 is used for all traffic.   sla monitor 1 type echo protocol ipIcmpEcho 1.1.1.254 interface OUTSIDE_1 threshold 1 frequency 5 sla monitor schedule 1 life forever start-time now track 1 rtr 1 reachability route OUTSIDE_1 0.0.0.0 0.0.0.0 1.1.1.254 1 track 1 route OUTSIDE_2 0.0.0.0 0.0.0.0 2.2.2.254 100 You would need a dynamic NAT for each interface   nat (INSIDE,OUTSIDE_1) after-auto source dynamic any interface nat (INSIDE,OUTSIDE_2) after-auto source dynamic any interface You would obviously need the relevant ACL configured on the outside interfaces.   HTH ... View more

Hi, Here is an example of static NAT, you'll need 1 static NAT entry for each device if you want to ping inbound from the outside. You wouldn't normally do that, unless it was for DMZ hosted services.   object network SWI-1 host 10.10.0.1 nat (INSIDE,OUTSIDE) static 1.1.1.111 object network SWI-2 host 10.10.1.1 nat (INSIDE,OUTSIDE) static 1.1.1.112 access-list OUTSIDE_IN extended permit icmp any object SWI-1 echo access-list OUTSIDE_IN extended permit icmp any object SWI-2 echo If you were just pinging from in inside to outside you would only need 1 dynamic nat rule.   HTH ... View more

Of course. You could leave it open to begin with for testing and then restrict it further once you know it's working. ... View more

Hi, You shouldn't really mix and match using ZBFW for some zones and then an ACL on the Cell0/1/0 interface. You should make a zone pair from self to outside and another for outside to self. When using zones with the self interface they can only be "pass" not inspect".   Example (outside to self):- ip access-list extended ACL_EXTERNAL-TO-SELF-IPSEC permit udp any any eq non500-isakmp permit udp any any eq isakmp permit esp any any ip access-list extended ACL_EXTERNAL-TO-SELF-MGMT permit icmp any any echo permit icmp any any echo-reply permit tcp any any eq telnet permit tcp any any eq 22 class-map type inspect match-any CMAP_EXTERNAL-TO-SELF-IPSEC match access-group name ACL_EXTERNAL-TO-SELF-IPSEC class-map type inspect match-any CMAP_EXTERNAL-TO-SELF-MGMT match access-group name ACL_EXTERNAL-TO-SELF-MGMT policy-map type inspect PMAP_EXTERNAL-TO-SELF class type inspect CMAP_EXTERNAL-TO-SELF-IPSEC pass class type inspect CMAP_EXTERNAL-TO-SELF-MGMT pass class class-default drop log zone-pair security EXTERNAL-TO-SELF source OUTSIDE destination self service-policy type inspect PMAP_EXTERNAL-TO-SELF Example (self to outside):- class-map type inspect match-any CMAP_SELF-OUT-ICMP match protocol icmp class-map type inspect match-any CMAP_SELF-OUT-ISAKMP match protocol isakmp policy-map type inspect PMAP_SELF-OUT class type inspect CMAP_SELF-OUT-ISAKMP pass class type inspect CMAP_SELF-OUT-ICMP pass class class-default drop zone-pair security self-ext source self destination OUTSIDE service-policy type inspect PMAP_SELF-OUT   Also you've not included the class-map for OUTSIDE_IN_CLASS, so I can't tell what thats doing.   For testing purposes define a class-default that is last in the policy, that drops and logs traffic, so you can get some hits and determine what is not matching.   HTH ... View more

Hi, Without seeing your configuration I wouldn't be able to identify the exact issue...but you would reference the real (private) IP address in the ZBFW ACLs. Also, if you were referring to connecting the local router itself via SSH then the zone would be "self" rather than outside. Upload your configuration and some debugs if you'd like some further pointers. HTH ... View more