Good day, community!   I have an issue with ACL for site-to-site VPN on cisco ASA 5525 9.5.(1). We have remote partner and we have to share some subnets with them. Some of these subnets should be accessible only via dedicated ports. At first, we had  physical connection. Cable from their office came to our Core switch, we have created vlan for them and assigned such kind of ACL inbound: ip access-list extended TEST     permit ip any host 10.0.100.9     permit ip any host 10.0.110.17     permit tcp any host 10.0.110.11 eq 1000     permit tcp any host 10.0.100.10 eq 1100     permit ip any host 10.0.120.115     permit tcp any host 10.0.100.183 eq 1200     permit tcp any host 10.0.100.222 eq 1300   Yesterday we configured site-to-site between ASA and Fortinet firewall. Tunnel is up, everything is working, but I can add hosts in ACL only without port. As I add any port to ACL, it begin to reject packets. Ping is coming from partner side, but isn't going back. This is our ACL on ASA: object network Local_1   host 10.0.100.9 object network Local_2  host 10.0.100.10 object network Local_3  host 10.0.100.183 object network Local_4  host 10.0.110.11 object network Local_5  host 10.0.110.17 object network Local_6  host 10.0.100.222 object network Local_7  host 10.0.120.115 object network REMOTE_1  subnet 10.10.10.0 255.255.255.0 object network REMOTE_2  subnet 10.11.11.0 255.255.255.0 object network REMOTE_3  subnet 10.12.0.0 255.224.0.0 object-group network REMOTE   network-object object REMOTE_2   network-object object REMOTE_3 access-list REMOTE-ACL extended permit ip object Local_1 object-group REMOTE   access-list REMOTE-ACL extended permit ip object Local_5 object-group REMOTE access-list REMOTE-ACL extended permit ip object Local_7 object-group REMOTE access-list REMOTE-ACL extended permit tcp object Local_2 object-group REMOTE eq 1100 access-list REMOTE-ACL extended permit tcp object Local_3 object-group REMOTE eq 1200 access-list REMOTE-ACL extended permit tcp object Local_4 object-group REMOTE eq 1000 access-list REMOTE-ACL extended permit tcp object Local_6 object-group REMOTE eq 1300 access-list REMOTE-ACL extended permit ip object Local_5 object REMOTE_1 access-list REMOTE-ACL extended permit tcp object Local_4 object REMOTE_1 eq 1000 ________________________________________________________________________ I removed port 1000 from rule: access-list REMOTE-ACL extended permit tcp object Local_4 object REMOTE_1 eq 1000 and partner side was able to ping and access everything. I added port again, and telnet didn't worked to this port. On server side there is no restriction. What can be an issue? Thanks in advance! ... View more

Good day to everyone! We have our central cite with DMVPN connection and CUCM in our datacentre. About 1 week ago we connected our branch site with site-to-site and configured one wireless phone. From branch we can call everywhere, but we can't reach that phone in our branch. I'm really weak in cisco voip and I just can't understand what's going on. Can it be a problem of routing or anything else? Because phone sees CUCM server and gets registered. site-to-site vpn is between ASA(5525) and router(ISR4321/K9). I also don't know which additional information should I share with you, so you'll be able to help me. Waiting for reply, thanks in advance. ... View more

Good Day to everyone. We have central cite with remote branches, which are connected via DMVPN. Few days ago we tried to connected another branch, which isn't in DMVPN connection and is on another ISP. We connected them via site-to-site. Everything works fine, there is an ISP connection, VPN connection, APs connected to central WLC and working fine too. There is one issue - browsers on PC can't resolve and open any website. Our local sites are working fine, but internet sites aren't opening. Ping to isp, ping to google.com and etc works fine. It resolves google, but browsers don't open any page. I've tried every possible thing, but wasn't successful. I also post here config of our branch router&switch. Maybe some of you will be able to help me. Thanks in advance! ... View more

Good Day! is there any way to change 4 way navigation button configuration on cisco 8841 or in CUCM? I want to change their places(make all calls down, new call upper button and etc). I wasn't able to find any useful information. ... View more