Do you know why the Address is failing URPF in the first place?    Is the route to the host on an incorrect interface?     ... View more

Yes it certainly is,   You Simply Specify All the Peers in your Cryptomap: Then create a tunnel-group for each peer,   ASA(config)# crypto map CRYPTO-MAP 1 set peer 1.1.1.1 2.2.2.2 3.3.3.3 ASA(config)# tunnel-group 1.1.1.1 type ipsec-l2l ASA(config)# tunnel-group 1.1.1.1 ipsec-attributes ASA(config-tunnel-ipsec)# pre-shared-key 1234567890   ASA(config)# tunnel-group 2.2.2.2 type ipsec-l2l ASA(config)# tunnel-group 2.2.2.2 ipsec-attributes ASA(config-tunnel-ipsec)# pre-shared-key 1234567890 ASA(config)# tunnel-group 3.3.3.3 type ipsec-l2l ASA(config)# tunnel-group 3.3.3.3 ipsec-attributes ASA(config-tunnel-ipsec)# pre-shared-key 1234567890 Please rate if helpfull :D ... View more

This is not a DNS request althought it is destined for Googles DNS address,   ICMP is essentially a Ping,    Here is some info on the types of ICMP messages involved.   https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Concepts/ICMP%20Types%20and%20Codes.htm   Rate if you found this helpfull.   Steven ... View more

It can look like this too :   This is DNAT   object network dmz-host host 10.0.0.1 object network Public-IP host 100.1.0.1 object service OUTSIDE-PORTs service tcp destination range 17500 17550 object service DMZ-PORTs service tcp destination range 18500 18550 nat (outside,dmz) source static any any destination static Public-IP dmz-host service OUTSIDE-PORTs DMZ-PORTs   This is SNAT   object network dmz-host host 10.0.0.1 object network Public-IP host 100.1.0.1 object service OUTSIDE-PORTs service tcp source range 17500 17550 object service DMZ-PORTs service tcp source range 18500 18550 nat (dmz,outside) source static dmz-host Public-IP service destination static any any  DMZ-PORTs OUTSIDE-PORTs   Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/nat_rules.html  ... View more

Not really. I think we would like to see the output of each member of the cluster on their HA interface.   https://www.tunnelsup.com/understanding-cisco-asa-interface-counters-and-statistics/ ... View more

Hi I would presume/suggest that you have a pair of switches, for fault tolerance,   10G Ethernet is cheap and is almost minimum standard these days. Future proof, with 1-10GB     https://www.cisco.com/c/en/us/products/switches/nexus-3000-series-switches/models-comparison.html#~tab-nexus3200   https://www.arista.com/en/products/7050x-series-network-switch-datasheet             ... View more

Here:   https://www.cisco.com/c/en/us/td/docs/optical/ncs1001/hardware/installation/guide/hardware-install-guide/ncs1000hig_chapter_00.html ... View more

Hi Kirk, Yes that's what I would expect, If I were to zone 1 initiator to 2 targets I would expect the targets to be able to login and complete a SAN copy, Cheers Steven ... View more

You need a layer 2 path between the firewalls, The switching layer will forward the traffic to the correct Palo Alto after the switches update,   The ASA sends a gratuitous arp after a fail-over. This will update the CAM on the switches and thus forward traffic as smoothly as possible.   The best solution would be a stack of switches and Ether-channel to the ISP switch to avoid your infrastructure being a single point of Failure. Although the ISP switch is still a single point of failure.   This solution could remain up even with a failure of the Primary ASA and Palo Alto 2 at the same time.   See attached:         ... View more