we need to collect some logs from the active modules, is there any crash report available. this could be a software bug, have you tried upgrading. for the dhcp client issue too, we need to see what are the logs saying thanks Nadeem ... View more

I am definite, that the overlapping translation rule is causing this issue. instead of having the rule for 10.x.x.x/8, either hav a rule for 10.96,x,x (which is your inside) or define conditional translation rule. you can also test by removing the translation rule with a simple PAT rule. I have seen this issue before, if you have the whole 10x defined for the inside, the ASA will assume that 10x resides on the inside network thanks Nadeem ... View more

HI, when you implement anyconnect or SSL vpn, then https access will take you to VPN pages. For ASDM you need to type https://ipaddress/admin thanks Nadeem ... View more

ACE web interface has the tool. Besides you can go to this site http://ace-tools.cisco.com/cgi-bin/csm2ace/csm2ace/ thanks ... View more

i worked on a design where FWSM was in Routed Mode and CSM Server VLAN was on the secure network and FWSM had the necessary translations and Access-lists to pass the traffic. For FWSM in Transparent mode, it would still be the same case where VIP is on the secure side of the network. thanks Nadeem ... View more

Hi, you cant ping the IP address of the other side by design. Can you ping any other IP? thanks Nadeem ... View more

Hi, setup a tftp server. then issue this command tftp-server [if_name] ip_address write net [[server_ip]:[filename e.g. tftp-server inside 10.1.1.1 write net on the new firewall setup the ip addresses to reach the same tftp server then issue this command configure net or simple copy the configuration to a notepad from your original firewall and paste it into the new firewall, that should work too. thanks Nadeem ... View more

Multicontext configuration can give him another advantage. He can run run two or more separate logical firewalls on the one firewall box. It means you can segregate your networks and apply a different firewall on each one. Each firewall can have its own policies. yes switch configuration is needed to be changed in terms of providing separate vlans. in terms of active active failover, you can take advantage of both firewalls being in working state, but there are several considerations and design scenarios e.g. each firewall will serve its own networks / subnets see if you can access this module http://www.cisco.com/E-Learning/bulk/public/celc/Cisco_QLM6_ASA_beta/course_skin.html check this link out http://www.cisco.com/en/US/partner/products/ps6120/products_configuration_guide_chapter09186a008045247e.html#wp1052847 thanks Nadeem ... View more

this should be all you need User Guidelines To enable packet capturing, attach the capture to an interface with the interface option. Multiple interface statements attach the capture to multiple interfaces. A packet must pass both the Ethernet and access list filters before the packet is stored in the capture buffer. Useful Capture command: No capture command with either the access-list or interface option unless you want to clear the capture itself. No capture without options deletes the capture. If the access-list option is specified, the access list is removed from the capture and the capture is preserved. If the interface option is specified, the capture is detached from the specified interface and the capture is preserved. Clear capture capture_name - command will clear the capture buffer. -------------------------------------------------------------------------------- Note The capture command is not saved to the configuration, and the capture command is not replicated to the standby unit during failover. -------------------------------------------------------------------------------- See the Capture command for additional details on the packet capture command Capture packets between host A & B traversing across both the inside and outside interfaces Step #1 - Packet capture traversing the inside interface access-list capture_in permit host A host B access-list capture_in permit host B host A capture inside access-list capture_in buffer 2000000 interface inside packet-length 1500 (This capture command will capture packets 1500 bytes or less in size with a maximum files size of 2 Mb) Step #2 - Packet capture traversing the outside interface access-list capture_out permit host A host B access-list capture_out permit host B host A capture outside access-list capture_out buffer 2000000 interface outside packet-length 1500 Two Methods for Retrieving the packet capture from the PIX Option #1 - Retrieve the pcap format file from the Pix by browsing to the PIX. Step #1 - If http services are not on then issue the "setup" command and run through the prompts. Step #2 - Next open a browser and then https:// /capture/ (example - https://172.16.171.49/capture/inside/pcap) Option #2 - Send a pcap format file from the PIX to a tftp server. Step #1 - Start the tftp application and set the TFTP root directory where the file will be sent. Step #2 - next issue the following command on the PIX "copy capture: tftp:// /temp pcap" (example - copy capture:inside tftp://172.16.89.8/temp pcap) (example - copy capture:outside tftp://172.16.89.8/temp pcap) Viewing the capture buffer on the PIX If the capture_name is specified, then it displays the capture buffer contents for that capture. Issue "show capture " to see the capture buffer Reset and Remove the capture command To clear the capture buffer enter the following clear capture command clear capture inside clear capture outside To remove the capture command no capture inside no capture outside Don't forget to remove the capture access-lists after you are finished capturing no access-list capture_in no access-list capture_out ... View more

if the deny ip any any command is not there in the end of the ACL, then you dont need to. ... View more

the license is based on IP addresses and not based on the number of connections from a single IP or number of xlat entries. ... View more

yes that is right, PIX doesnt load balance like netscreen. there is no capability of virtual address at the moment. this type of load balancing will not work. All you can do is use the pix pair in failover mode, have two contexts in each pix, each context will be active on one of the pix. basically the idea is to have two separate firewalls serving two different subnets etc. this way you can achive load balancing. ... View more

can you connect a console to this pix and collect messages at teh time when this PIX trips. may be it is crashing and an upgrade is needed. thanks ... View more

check what are teh arp entries on these servers. may be they have mac address of firewall and that is why ping fails ... View more

i think the easiest solution will be to use the local host file on your MX10 server and have an entry of private IP address of MX20. in that way the MX10 need not to resolve the MX20 hostname to a public address. other then that you have to use some routing and stuff or policy routing etc to get around this ... View more