Hi We have an ASA firewall in a HA setup and currently are moving over to a new internet circuit that is provided by the Data Centre. Previously the Public range extended out to the next hop address so the VPNs terminated on the outside interface. However now the DC have provided a new public range for us to use which will sit inside the firewall, however the outside interface is on a different subnet for the point to point to the internet.  So my question is: 1. When configuring IPSEC VPNs, do they need to terminate on a physical interface, which would mean I would have to use the outside interface IP which is on a different subnet from my actual public range, or can I use an IP from the new range provided (even if it means configuring a loopback for VPN peer)   I would like to use an IP from the new range so in the future if we ever need to move internet providers, I don't want to be changing the VPN peer address.   Thanks     ... View more

Hi   We are using a HA pair of 5516X firewalls running software version 9.8 We are looking to migrate over to a new internet connection with a bigger subnet. Currently we have few IPSEC VPNs, some natted services with inbound access, and normal outbound traffic.   I am planning to configure a second outside interface for the new circuit and then moving the default route to the new circuit which moves over our outbound traffic and also migrate the NATs over to the new IP addressing and update the DNS.   However I want to keep routing the IPSEC VPNs via the old internet and migrate these one at a time as and when the 3rd parties are available to update the IPs at their end. Maybe even keep the NATs on the old and migrate these over based on services.   My question is  Will a static route for the VPN destinations with the next hop of the old internet be enough to keep the VPNs via the old internet connection, and then remove certain static routes for VPNs as I migrate each to the new internet connection. In regards to NATS, how do I keep the NAT on the old internet and migrate over individually to allow me to move over and test the service properly. Do the NATs require any routes or will the DNS changes be enough. Also any other advice from you previous experiences will be really appreciated   Thanks ... View more

Hi This may be a bit of a simple one, but my understanding is slightly different from a colleague. So if i was to allow 2 hosts on a firewall rule that are part of a /24 subnet, my take is i need to allow 10.10.10.51/32 and 10.10.10.52/32 which is something i have always done for hosts. However my colleague thinks allowing 10.10.10.51/24 and 10.10.10.52/24 achieves the same in that it will still only allow the 2 hosts and not the entire subnet. I explained to him that a /24 mask means the last octect is not considered so it will allow the whole subnet. He thinks otherwise. Who is correct, i know i am correct but is he also correct in any sense? ... View more

Hi   I am looking to include the following range of hosts into a single subnet, 10.10.20.1 - 10.10.26.254 just for summary purposes. That gives me 2046 hosts so I need a /21 subnet. So I am looking to use 10.10.20.0/21.   However when I check the range 10.10.20.0/21 on an online subnet calculator, it provides the range from  10.10.16.1 - 10.10.23.254   Am I correct or is the online calculator? I understand I can start from the beginning of the range but those addresses are in use.   TIA ... View more

Hi I have access to a couple of ASA firewalls with only ASDM access to all. I have tried to SSH to them but unable to do so despite having the correct configuration, None of the firewalls currently have a crypto key generated (i used "show crypto key generate rsa mypubkey" using cli option in asdm).   Previously I have always generated a crypto key pair when configuring an ASA from scratch. My question is will generating a crypto key using "crypto key generate rsa mod 2048" using the cli option in asdm break anything as currently there is no crypto key. The ASAs do have VPNs configured. Because it is a live environment, I just want to ensure it will be as simple as running the command and getting ssh access to the firewalls.   TIA ... View more

Hi I have a PCI compliancy vulnerability that states "Your firewall/VPN system allows a crackable transform to be used. Transforms are a combination of encryption cipher, hashes, authentication types and mod key exchanges. This is used to support encryption over a VPN connection. Crackable transforms (e.g. using DES or DH Group 1) could potentially be attacked by users."   How can I go about disabling certain transform sets. I have 3 IPSEC VPNs on the firewalls. One of the VPNs does have DES and 3DES available in the proposal, can I just remove DES from the proposal without affecting the VPN. What other action may be required.   TIA ... View more

Hi I am looking at disabling TLS V1.0 on our ASAs. I am running ASA Version 9.8 and ASDM Version 7.9. Currently I have 2 IPSEC VPNs and 0 RA VPNs. I can see in ASDM how to change the minimum SSL level to use. So i can change it from here to use atleast TLS 1.1.    What effect will this have on my IPSEC tunnels and my access to the ASA using ASDM. I would make the changes out of hours.    TIA ... View more