You can pull the power plug on the standby unit safely without any interruption to traffic. If you want to just pull out network cables from the unit but keep it powered on, then do the data connections before the failover interface.  This way you can avoid being in an Active/Active state.  ... View more

To add to what @Seb Rupik mentioned, here is a guide on how to deal with overlapping subnets on the ASA:   https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/211275-Configuration-Example-of-ASA-VPN-with-Ov.html ... View more

Are you advertising the /24 also through the split tunnel? Any chance you could make it a /8 or /16? This way a more generic route gets installed on the users routing table. Anything headed to the 10.0.0.0/24 would go to the users home network because of the more specific home network route.    If you truly have conflict between ip addresses in your network and the home user network (say both of you have 10.0.0.5), then the best possible solution is to have the user change his home network ip subnet. You could have the NAT workaround as mentioned in your post, but that affects everyone receiving the same vpn pool subnet. ... View more

Is this is a site to site or a Remote access vpn? When the issue happens take the following output from the router?   show crypto ipsec sa show crypto session detail   Run the following debugs as well:   debug crypto isakmp debug crypto ipsec   ... View more

Few things to check:   1) Is the ACL applied on the inside interface using the access-group command? 2) What are the security levels of inside, outside and DMZ?  4) Any of the interfaces in a down state?  ... View more

Translating traffic to the inside network is not necessary, but you could do it. The more common implementation is to exempt traffic between VPN and LAN from any NAT translation. If you don't do this, there is a chance that this traffic could hit the dynamic NAT rule on the way back. You NAT exemption rule should look something like this:   nat (inside,outside) 1 source static LAN_subnet LAN_subnet destination static VPN_subnet VPN_subnet no-proxy-arp route-lookup ... View more

Option #1 L-AC-PLS-3Y-S2     Cisco AnyConnect Plus – 3-Year License   (100-249 users)   List Price   $12   This is a 3 year subscription based license for 100 authorized VPN users across the network. This number can be shared among multiple devices.   Option #2 L-AC-VPNO-100=    Cisco AnyConnect VPN Only – Perpetual License/100 simultaneous connections   List Price  $13,995   This is a perpetual license for 100 VPN users to be used on a single device only.    I always recommend my customers towards the Plus or Apex subscription licenses. My guess is that Cisco would customers to go the subscription route, hence the big price difference if you want to buy perpetual licenses.   https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html#anc5 ... View more

I think you are confused between the Identity and CA certificates. For CA certificates, you can have the same CA certificates associated with multiple trustpoints. So if you had cert1 issued by GoDaddy CA installed on Trustpoint3, and then installed a new cert on Trustpoint7, then the Godaddy CA is associated with both TP3 and 7.    Paste your "show crypto ca certificate" output from the ASA after removing any names/private data if you can.  ... View more

I have seen similar issues when the non-Cisco side is set up for route based VPN instead of policy based. What happens is that the remote side all traffic through just 1 security association (SA). The ASA has checks in place to make sure that the actual data packet matches the SA source an destination IP.   In your case, it looks like the Fortigate is sending the packet from src  192.168.110.2 across the wrong SA from time to time. The ASA drops it as expected. This should be something that the Fortigate side fixes. The first check that they have to do is that they have the same proxy-id's as what the ASA has and it is not set to send everything via 1 SA. The fortigate KB to fix this is explained here:   https://kb.fortinet.com/kb/documentLink.do?externalID=10440 ... View more

You can buy it separately from the bundle and link it to your Smart account. When the FTD registers with the FMC (or directly to Cisco smart license cloud), you will enable the AnyConnect Plus or Apex option. This will assign licenses from your smart license to the device.    On a side note, I would recommend getting the AnyConnect Plus/Apex depending on your use case. This can be shared among multiple devices and is cheaper than the VPN Only license last I checked.  ... View more