Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About asmlicense
03-18-2019
asmlicense
Member since
01-13-2016
Beginner
01-12-2019
04:48 AM
Hi.
For the last lines you suggested, I have this configured right now, which maps all crypto maps to outside interface:
crypto map CMAP interface Outside
I think that this line will have huge impact on working production, so I should change all working config. I'll try to find another way, I think:
no sysopt connection permit-vpn
access-group REMOTE-ACL in interface outside
... View more
01-12-2019
04:12 AM
One suggestion, You need to plan it put change request/ do a packet capture and find out what port are in use/coming in your vpn network than lock them down to port filter on ASA with the earlier command.
Let me clarify one thing. Traffic will come from remote network and have to access server in our local network on specified ports. So, I don't need to filter incoming ports, but to restrict traffic incoming from remote network to ports, which I dedicated in config above.
I think that this config isn't right. I tried these variations:
access-list REMOTE-ACL extended permit tcp object Local_4 object REMOTE_1 eq 1000
access-list REMOTE-ACL extended permit tcp object Local_4 eq 1000 object REMOTE_1
access-list REMOTE-ACL extended permit tcp object REMOTE_1 object Local_4 eq 1000
But they didn't work.
... View more
01-12-2019
02:23 AM
No, we have many site-to-site and remote access vpns. We have acl and etc for each of them, but port filtering will be used first for this VPN.
No, I don't have Firepower, we use Palo Alto firewall, but it's in virtual wire mode, so I can't affect to any VPN connections with it.
Mayble I can use some kind of VPN filter, or config additional ACL on core switch on the same vlan, which goes to our production subnets to allow traffic from remote network to specified ports?
Anyway, thank you for your help! I'll try to find some way to fix it. Now it's working without any port filtering.
... View more
01-12-2019
02:06 AM
Hi! Just a quick question, I have these commands on my ASA and dozens of RA and Site-to-Site vpns:
sysopt connection tcpmss 1350 sysopt connection preserve-vpn-flows
WIll 'no sysopt connection permit-vpn' command affect to these connections or there is no issue to use it?
Thanks in advance.
... View more
01-12-2019
01:32 AM
Good day, community!
I have an issue with ACL for site-to-site VPN on cisco ASA 5525 9.5.(1).
We have remote partner and we have to share some subnets with them. Some of these subnets should be accessible only via dedicated ports.
At first, we had physical connection. Cable from their office came to our Core switch, we have created vlan for them and assigned such kind of ACL inbound:
ip access-list extended TEST permit ip any host 10.0.100.9 permit ip any host 10.0.110.17 permit tcp any host 10.0.110.11 eq 1000 permit tcp any host 10.0.100.10 eq 1100 permit ip any host 10.0.120.115 permit tcp any host 10.0.100.183 eq 1200 permit tcp any host 10.0.100.222 eq 1300
Yesterday we configured site-to-site between ASA and Fortinet firewall.
Tunnel is up, everything is working, but I can add hosts in ACL only without port. As I add any port to ACL, it begin to reject packets. Ping is coming from partner side, but isn't going back. This is our ACL on ASA:
object network Local_1 host 10.0.100.9 object network Local_2 host 10.0.100.10 object network Local_3 host 10.0.100.183 object network Local_4 host 10.0.110.11 object network Local_5 host 10.0.110.17 object network Local_6 host 10.0.100.222 object network Local_7 host 10.0.120.115 object network REMOTE_1 subnet 10.10.10.0 255.255.255.0 object network REMOTE_2 subnet 10.11.11.0 255.255.255.0 object network REMOTE_3 subnet 10.12.0.0 255.224.0.0 object-group network REMOTE network-object object REMOTE_2 network-object object REMOTE_3 access-list REMOTE-ACL extended permit ip object Local_1 object-group REMOTE access-list REMOTE-ACL extended permit ip object Local_5 object-group REMOTE access-list REMOTE-ACL extended permit ip object Local_7 object-group REMOTE access-list REMOTE-ACL extended permit tcp object Local_2 object-group REMOTE eq 1100 access-list REMOTE-ACL extended permit tcp object Local_3 object-group REMOTE eq 1200 access-list REMOTE-ACL extended permit tcp object Local_4 object-group REMOTE eq 1000 access-list REMOTE-ACL extended permit tcp object Local_6 object-group REMOTE eq 1300 access-list REMOTE-ACL extended permit ip object Local_5 object REMOTE_1 access-list REMOTE-ACL extended permit tcp object Local_4 object REMOTE_1 eq 1000
________________________________________________________________________
I removed port 1000 from rule: access-list REMOTE-ACL extended permit tcp object Local_4 object REMOTE_1 eq 1000
and partner side was able to ping and access everything. I added port again, and telnet didn't worked to this port. On server side there is no restriction.
What can be an issue?
Thanks in advance!
... View more
Labels:
10-31-2018
12:28 AM
Good day to everyone! We have our central cite with DMVPN connection and CUCM in our datacentre.
About 1 week ago we connected our branch site with site-to-site and configured one wireless phone. From branch we can call everywhere, but we can't reach that phone in our branch. I'm really weak in cisco voip and I just can't understand what's going on. Can it be a problem of routing or anything else? Because phone sees CUCM server and gets registered. site-to-site vpn is between ASA(5525) and router(ISR4321/K9). I also don't know which additional information should I share with you, so you'll be able to help me. Waiting for reply, thanks in advance.
... View more
10-23-2018
04:41 AM
I made changes, which Georg and Paul adviced and now everything is working. I'll test once more to see which one of them was the issue. Thank you all one more time!
... View more
10-22-2018
04:41 AM
Paul,
I made like you said. I'll check it tomorrow. 192.168.10.250 isn't only ntp server, It's also our local dns server. I changed them as you said.
Georg, sla is for site-to-site connection. It just sends pings to destination address, which I commented here. I changed nat as you said, hope it will help.
Richard, I've applied ip tcp adjust-mss 1460 to gi interface, which is looking to ISP side, but it doesn't really helped. Browsers still don't open any page.
Thank you all, I'll test again everything you advised to me. Hope it'll help.
... View more
10-21-2018
05:44 AM
Good Day to everyone.
We have central cite with remote branches, which are connected via DMVPN.
Few days ago we tried to connected another branch, which isn't in DMVPN connection and is on another ISP. We connected them via site-to-site. Everything works fine, there is an ISP connection, VPN connection, APs connected to central WLC and working fine too.
There is one issue - browsers on PC can't resolve and open any website. Our local sites are working fine, but internet sites aren't opening.
Ping to isp, ping to google.com and etc works fine. It resolves google, but browsers don't open any page. I've tried every possible thing, but wasn't successful. I also post here config of our branch router&switch. Maybe some of you will be able to help me.
Thanks in advance!
... View more
Labels:
Created by
asmlicense
in IP Telephony and Phones
in IP Telephony and Phones
10-12-2018
05:37 AM
10-12-2018
05:37 AM
It changed after software upgrade and I was looking for any way to change it.
Down - favorites, Up - all calls. Left and right one do nothing.
Thank you for your reply!
... View more
Created by
asmlicense
in IP Telephony and Phones
in IP Telephony and Phones
10-12-2018
05:28 AM
10-12-2018
05:28 AM
I mean this button, covered with red. In the documentation it's called navigation cluster.
... View more
Created by
asmlicense
in IP Telephony and Phones
in IP Telephony and Phones
10-12-2018
04:16 AM
10-12-2018
04:16 AM
Good Day!
is there any way to change 4 way navigation button configuration on cisco 8841 or in CUCM?
I want to change their places(make all calls down, new call upper button and etc).
I wasn't able to find any useful information.
... View more
Labels:
01-12-2019 04:48 AM
Hi. For the last lines you suggested, I have this configured right now,
which maps all crypto maps t...
01-12-2019 04:12 AM
One suggestion, You need to plan it put change request/ do a packet
capture and find out what port a...
01-12-2019 02:23 AM
No, we have many site-to-site and remote access vpns.We have acl and etc
for each of them, but port ...
01-12-2019 02:06 AM
Hi!Just a quick question, I have these commands on my ASA and dozens of
RA and Site-to-Site vpns: sy...
01-12-2019 01:32 AM
Good day, community! I have an issue with ACL for site-to-site VPN on
cisco ASA 5525 9.5.(1). We hav...
10-31-2018 12:28 AM
Good day to everyone!We have our central cite with DMVPN connection and
CUCM in our datacentre. Abou...
10-23-2018 04:41 AM
I made changes, which Georg and Paul adviced and now everything is
working. I'll test once more to s...
10-22-2018 04:41 AM
Paul, I made like you said. I'll check it tomorrow. 192.168.10.250 isn't
only ntp server, It's also ...
10-21-2018 05:44 AM
Good Day to everyone. We have central cite with remote branches, which
are connected via DMVPN. Few ...
Created by
asmlicense
in IP Telephony and Phones
10-12-2018 05:37 AM
10-12-2018 05:37 AM
It changed after software upgrade and I was looking for any way to
change it. Down - favorites, Up -...
Created by
asmlicense
in IP Telephony and Phones
10-12-2018 05:28 AM
10-12-2018 05:28 AM
I mean this button, covered with red. In the documentation it's called
navigation cluster.
Created by
asmlicense
in IP Telephony and Phones
10-12-2018 04:16 AM
10-12-2018 04:16 AM
Good Day! is there any way to change 4 way navigation button
configuration on cisco 8841 or in CUCM?...
Created by
asmlicense
in Identity Services Engine (ISE)
09-27-2018 12:35 AM
09-27-2018 12:35 AM
Hi everybody! We have cisco ISE integration with WLC. I have config
another vlan/int vlan/dhcp pool ...
Public Statistics
| Date Registered | 01-13-2016 09:51 PM |
| Date Last Visited | 03-18-2019 04:11 PM |
| Total Messages Posted | 97 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 15 | |
| 5 |
.jpg "VIP Advisor"){kind=icon}
