Hello Team, I noticed one of the sup was faulty and we have gone through RMA.   While inserting the new sup with upgraded version. I got the logs version different but few seconds later it was synced and version got degraded of the new sup.  What kind of errors we can get in the future?   ... View more

Hi Team, I have a requirement from unboxing ASA to the configuration for 10 systems (LAN-connectivity behind the firewall). We have WAN connectivity from UK to IND (assuming) -Like P2P. UK users want to access the application from IND and IND users want to access the UK applications. Connectivity would be : WAN link will drop on ASA firepower and later on we will have to configure the ASA for 10 system/PC/Server (statically - NO DHCP). For WAN connectivity we have (192.168.1.0/29) IP pool. For LAN connectivity we have public IP 141.100.100.0/24). I worked on ASA but didn't get the chance to work on ASA firepower module. can you please share the steps in sequence. ... View more

  I have some queries,     We are going to implement/insstall a new Cisco ASA 5506-X Configuration device in our environment: Requirement: We have 1 vodafone ISP link with public IP (50.50.50.1/30- Lets assume) that would drop on outer interface of the ASA.ASA configuration We will use /24 IP pool (assumed~ 10.1.1.0/24). Requiremnet is simple: **We have to connect 10 system towards lan: What would be the configuration. **No DMZ setup in this environment. ** Any DHCP/DNS configuration is required? I have prepared just correct me If I am wrong & also let me know all process:...     ------------------------ • Internal user LAN: 10.1.1.0/24 • ASA inside IP: 10.1.1.1 • ASA outside IP (static): 50.1.1.1 • NAT: Dynamic overload (PAT) using the outside interface. Step 1: Configure the Internal LAN interface interface GigabitEthernet1/2 description LAN nameif inside security-level 100 <- Security level 100 means it’s the most trusted interface ip address 10.1.1.1 255.255.255.0 no shut Step 2: Configure the Outside WAN interface interface GigabitEthernet1/1 description WAN nameif outside security-level 0 <- Security level 0 means it’s the least trusted interface ip address 50.1.1.1 255.255.255.0 <- Assume we have a static public IP from the ISP no shut NOTE: In case the outside interface will receive IP address dynamically via DHCP use this command: ip address dhcp setroute Step 3: Configure PAT using the outside interface nat (inside,outside) source dynamic any interface <- For traffic going from inside to outside use dynamic NAT on the interface (source IPs will be replaced by the outside interface IP) Step 4: Configure default route towards the ISP (assume default gateway is 50.1.1.2) route outside 0.0.0.0 0.0.0.0 50.1.1.2 OPTIONAL STEPS (But Useful) Step 5: Assign IP addresses via DHCP to internal hosts We can configure the ASA to work as DHCP server and assign IP addresses dynamically to internal hosts. dhcpd address 10.1.1.10-10.1.1.100 inside <- ASA will assign IPs between 10.1.1.10-100 dhcpd dns 208.67.220.220 208.67.222.222 <- ASA will assign DNS servers (these are the opendns by the way) dhcpd enable inside Step 6: Enable SSH access for management hostname ASA5506 crypto key generate rsa modulus 1024 ssh 10.1.1.5 255.255.255.255 inside <- Allow SSH access only from inside host 10.1.1.5 aaa authentication ssh console LOCAL <- Enable local authentication for SSH username admin password [STRONGPASS] privilege 15 enable password Gh4w7$-s39fg#(! Step 7: Apply useful ACL on outside I usually apply the following ACL on the outside interface. It has two purposes: First is to allow ICMP reply packets to come back in (when pinging from inside to outside) and second purpose is to log any denied packets hitting the firewall from outside (for alert and security purposes). access-list OUTSIDE-IN extended permit icmp any any echo-reply access-list OUTSIDE-IN extended deny ip any any log access-group OUTSIDE-IN in interface outside   --------------------------------------- Device details:     Cisco ASA 5506 Firewall 1 ASA5506-FPWR-BUN ASA 5506-X with FirePOWER Svcs. Chassis and Subs. Bundle 2 ASA5506-K9 ASA 5506-X with FirePOWER services, 8GE, AC, 3DES/AES 3 CAB-IND-10A 10A Power cable for India 4 SF-ASA-K-9.8-K8 Cisco ASA 9.8 Software image for ASA 5506/5508/5516 series 5 SF-ASA-FP6.2-K9 Cisco FirePOWER Software v6.2 for ASA 5500-X 6 ASA5506-CTRL-LIC Cisco ASA5506 Control License 7 ASA5506-SSD ASA 5506-X SSD 8 ASA5500-ENCR-K9 ASA 5500 Strong Encryption License (3DES/AES) 9 ASA5506-PWR-AC ASA 5506-X Power Adaptor 10 L-ASA5506-TAMC= Cisco ASA5506 FirePOWER IPS, AMP and URL Licenses 11 FS-VMW-2-SW-K9 Cisco Firepower Management Center,(VMWare) for 2 devices 12 L-ASA5506-TAMC-1Y Cisco ASA5506 FirePOWER IPS, AMP and URL 1YR Subs 13 CON-ECMU-VMWSW2 SWSS UPGRADES Cisco Firepower Management Center,(VMWare) for 14 CON-SNT-ASA5506K SNTC-8X5XNBD ASA 5506-X with FirePOWER services, 8GE,   ... View more

Hi,   Why we use the primary address in eigrp for neighborship?  ... View more

Hello Team, Stack Switch is rebooting continuously. and getting below, error, can you identify the same. (Stack-1)- Switch 033417: 000112: Feb 23 15:15:39.441 UTC: %QOSMGR-4-HARDWARE_NOT_SUPPORTED: Hardware limitation has reached for policymap qos-in-port-2960s (Stack-1) 033418: 000113: Feb 23 15:15:39.441 UTC: %QOSMGR-4-COMMAND_FAILURE: Execution of member:HQM_IDBTRUST_CMD command failed on GigabitEthernet1/0/44 (Stack-1) 033419: 000114: Feb 23 15:46:38.189 UTC: %PLATFORM_RPC-3-MSG_THROTTLED: RPC Msg Dropped by throttle mechanism: type 5, class 20, max_msg 32, total throttled 0 (Stack-1) -Traceback= 37ECE0z 182B74Cz 17638F4z 1C317CCz 1C2BD80z (Stack-1) 033420: 000115: Feb 23 15:48:37.207 UTC: %PLATFORM_RPC-3-MSG_THROTTLED: RPC Msg Dropped by throttle mechanism: type 5, class 20, max_msg 32, total throttled 33 (Stack-1) -Traceback= 37ECE0z 182B74Cz 17638F4z 1C317CCz 1C2BD80z (Stack-1) 033421: Feb 23 15:49:17.440 UTC: %STACKMGR-4-STACK_LINK_CHANGE: Stack Port 2 Switch 2 has changed to state DOWN 033422: Feb 23 15:49:17.786 UTC: %SWITCH_QOS_TB-5-TRUST_DEVICE_LOST: cisco-phone no longer detected on port Gi1/0/44, operational port trust state is now untrusted. 033423: Feb 23 15:49:17.786 UTC: %SWITCH_QOS_TB-5-TRUST_DEVICE_LOST: cisco-phone no longer detected on port Gi1/0/38, operational port trust state is now untrusted. 033424: Feb 23 15:49:17.791 UTC: %SWITCH_QOS_TB-5-TRUST_DEVICE_LOST: cisco-phone no longer detected on port Gi1/0/28, operational port trust state is now untrusted. 033425: Feb 23 15:49:18.436 UTC: %STACKMGR-4-STACK_LINK_CHANGE: Stack Port 2 Switch 2 has changed to state UP 033426: Feb 23 15:49:18.499 UTC: %STACKMGR-4-STACK_LINK_CHANGE: Stack Port 1 Switch 1 has changed to state DOWN ... View more