Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Rahul Govindan
Rahul Govindan
.jpg){kind=icon}
VIP Advocate
Network Security Engineer/Consultant.
CCIE Security (#29948) and CISSP from ISC2. Cisco Live presenter at CL Melbourne 2015.
Awards
2
Recent Badges
Stats
Member since
10-28-2015
1660
Posts
1940
Helpful
365
Solutions
Created by
Rahul Govindan
in Firewalls
Rahul Govindan
in Firewalls
10-23-2019
08:26 AM
10-23-2019
08:26 AM
This is the patch files for the Firepower services component inside some of the later hardware models. If you had an ASA with Firepower Services, then you can use the patch to update the Firepower module via the FMC. IF you don't use Firepower services on the ASA, this is not relevant to you.
... View more
10-23-2019
08:17 AM
Correct. The FMC version is always higher than the managed device. The FMC will not let you register a device with a higher version than itself.
... View more
Created by
Rahul Govindan
in Firewalls
Rahul Govindan
in Firewalls
10-22-2019
12:02 PM
10-22-2019
12:02 PM
What is under the object definition VPN_LOCAL and VPN_REMOTE?
One of the problems that I usually see is when there is an overlap between the source and destination networks. Since identity NAT is bidirectional in nature, you could match the rule in the reverse direction causing it to route it to the wrong interface.
So in your case, say both VPN_LOCAL and VPN_REMOTE are the same, say 10.0.0.0/8. This means your rule can be interpreted in two ways:
nat (inside,outside) source static VPN_LOCAL VPN_LOCAL destination static VPN_REMOTE VPN_REMOTE no-proxy-arp
or
nat (inside,outside) source static VPN_REMOTE VPN_REMOTE destination static VPN_LOCAL VPN_LOCAL no-proxy-arp
IF I match the first interpretation of the rule, I send the inbound traffic to the inside interface (correctly), but if I match the second one, I send it to the outside. To avoid all this, we use the route-lookup to make these decisions solely on the routing table rather than the nat source and destination interfaces.
This is a fairly complicated concept to write about in one post without real-world examples. Hope this helps.
... View more
Created by
Rahul Govindan
in Firewalls
Rahul Govindan
in Firewalls
10-22-2019
09:54 AM
10-22-2019
09:54 AM
What does your NAT config look like?
The route-lookup keyword is used when you want the ASA to use the routing table to determine the egress interface instead of the nat rule. So, for example, if your rule has (inside, any), it could translate to (inside, inside) or (inside, outside). The route-lookup is meant to avoid that ambiguity and let the routing table take care of finding the egress interface.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
10-22-2019
08:17 AM
10-22-2019
08:17 AM
Looks like the ASA is decrypting traffic but not encrypting much:
access-list outside_cryptomap_1 extended permit ip 172.16.128.0 255.255.128.0 172.16.0.0 255.255.128.0
local ident (addr/mask/prot/port): (172.16.128.0/255.255.128.0/0/0)
remote ident (addr/mask/prot/port): (172.16.0.0/255.255.128.0/0/0)
current_peer: 22.22.22.22
#pkts encaps: 46, #pkts encrypt: 46, #pkts digest: 46
#pkts decaps: 24516, #pkts decrypt: 24516, #pkts verify: 24516
Add the "route-lookup" keyword to the end of your NAT exempt statement.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
10-22-2019
08:14 AM
10-22-2019
08:14 AM
You can only make one connection at a time with AnyConnect. What is your use case for multiple connections?
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
10-22-2019
08:11 AM
10-22-2019
08:11 AM
AnyConnect uses SSL or IKEv2 as the transport protocol. The aggressive mode only applies to IKEv1. So you can disable aggressive mode if you are using AnyConnect as the client.
... View more
Created by
Rahul Govindan
in Firewalls
Rahul Govindan
in Firewalls
10-21-2019
09:04 AM
10-21-2019
09:04 AM
You cannot use the ASA's outside interface for 1-1 NAT if you also want to use AnyConnecton the ASA. My suggestion is to use another IP address in the outside IP space for the NAT. Or you can reserve the ASA IP address for just certain ports instead of all ports.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
10-21-2019
08:16 AM
10-21-2019
08:16 AM
Good job getting detailed symptoms. From what you have mentioned, it definitely looks like there might be drops in the path. IF we assume that local ASA sends encrypted traffic outbound successfully, then one of the differences between each of the SA's would be the SPI value. If there is an ISP device that keeps session status based on SPI, it might be dropping when it sees traffic with the same source/destination containg new SPI's.
I would also apply a capture on the outside interface of both ASA's to make sure that you see outbound encrypted traffic on the local ASA. This will also help you see any differences in traffic from different SA's.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
10-08-2019
09:29 AM
10-08-2019
09:29 AM
You can do this if you use DUO with LDAPS and set is as the secondary authentication server on the ASA. You will get 1 username and 2 password fields. For the second one, type the word "sms". This will send you a batch of SMS passcodes that you can use with the same prompt the next time you connect. I think this process is a little convoluted. It looks they have removed this from most of their recent documentation.
... View more
09-12-2019
06:42 AM
@Mike.Cifelli
AFAIK, there is no correlation between the threat detection feature and VPN pool assignment. If I recall correctly, the ASA puts the unassigned IP address back to the top of the queue to be assigned next, irrespective of it being shunned or not.
But your situation could be remedied by adding a re-use delay for the VPN pool address assignment.
https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/vpn/asa_91_vpn_config/vpn_addresses.html#18588
This way, the ASA does not use the IP address for a certain period after re-assigned back to the pool. You can align this with the shun duration period if you wanted to.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
08-21-2019
04:50 PM
08-21-2019
04:50 PM
Looks like the is sending the IKE_AUTH message with the cert and re-transmitting this till the SA dies.
IKEv2-PLAT-3: (88): SENT PKT [IKE_AUTH] [My_ASA_IP]:500->[REMOTE_PEER_IP]:500 InitSPI=0x73e01ccdd50690cd RespSPI=0xd637074fdd003a45 MID=00000001
IKEv2-PROTO-5: (88): SM Trace-> SA: I_SPI=73E01CCDD50690CD R_SPI=D637074FDD003A45 (I) MsgID = 00000001 CurState: I_BLD_AUTH Event: EV_CHK_EAP_POST_ASYNC
IKEv2-PROTO-2: (88): Check for EAP exchange
IKEv2-PROTO-5: (88): SM Trace-> SA: I_SPI=73E01CCDD50690CD R_SPI=D637074FDD003A45 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_NO_EVENT
IKEv2-PROTO-5: (88): SM Trace-> SA: I_SPI=73E01CCDD50690CD R_SPI=D637074FDD003A45 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_RE_XMT
IKEv2-PROTO-2: (88): Retransmitting packet
(88):
IKEv2-PROTO-2: (88): Sending Packet [To REMOTE_PEER_IP:500/From My_ASA_IP:500/VRF i0:f0]
(88): Initiator SPI : 73E01CCDD50690CD - Responder SPI : D637074FDD003A45 Message id: 1
(88): IKEv2 IKE_AUTH Exchange REQUESTIKEv2-PROTO-3: (88): Next payload: ENCR, version: 2.0 (88): Exchange type: IKE_AUTH, flags: INITIATOR (88): Message id: 1, length: 2445(88):
Payload contents:
(88): ENCR(88): Next payload: VID, reserved: 0x0, length: 2417
(88): Encrypted data: 2413 bytes
(88):
IKEv2-PLAT-3: (88): SENT PKT [IKE_AUTH] [My_ASA_IP]:500->[REMOTE_PEER_IP]:500 InitSPI=0x73e01ccdd50690cd RespSPI=0xd637074fdd003a45 MID=00000001
IKEv2-PROTO-5: (88): SM Trace-> SA: I_SPI=73E01CCDD50690CD R_SPI=D637074FDD003A45 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_NO_EVENT
IKEv2-PROTO-5: (88): SM Trace-> SA: I_SPI=73E01CCDD50690CD R_SPI=D637074FDD003A45 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_RE_XMT
IKEv2-PROTO-2: (88): Retransmitting packet
One possible reason could be an increase in size of certificate causing a fragmentation of the outbound packet. Any chance of getting simultaneous debugs from both sides?
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
08-20-2019
07:28 AM
08-20-2019
07:28 AM
Can you get the full output of "debug crypto ikev1 127" and "debug crypto ipsec 127" from the ASA when the tunnel is establishing?
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
08-20-2019
07:26 AM
08-20-2019
07:26 AM
Then it's most likely not an issue with NAT or routing. Can you ping from the ASA outside interface to the internet (say 8.8.8.8)? Share your ASA config if possible.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
08-20-2019
06:43 AM
08-20-2019
06:43 AM
I don't see why this would not work. The DMZ interface on the ASA is just like an Inside interface. You would have to create NAT exemption between DMZ and outside on the ASA. Also the routes on both ASA and Fortigate should be correct to allow for traffic to flow bidirectionally.
What is not working for you? Are you able to connect but not reach internal resources?
... View more
Created by
Rahul Govindan
in Firewalls
10-23-2019
10-23-2019
This is the patch files for the Firepower services component inside some
of the later hardware model...
10-23-2019
Correct. The FMC version is always higher than the managed device. The
FMC will not let you register...
10-23-2019
Memory refers to RAM. You can change your memory of the vFMC from 8GB to
16 GB RAM and run TID.
10-22-2019
What is under the object definition VPN_LOCAL and VPN_REMOTE? One of the
problems that I usually see...
10-22-2019
What does your NAT config look like? The route-lookup keyword is used
when you want the ASA to use t...
Created by
Rahul Govindan
in VPN and AnyConnect
10-22-2019
10-22-2019
Looks like the ASA is decrypting traffic but not encrypting much:
access-list outside_cryptomap_1 ex...
Created by
Rahul Govindan
in VPN and AnyConnect
10-22-2019
10-22-2019
You can only make one connection at a time with AnyConnect. What is your
use case for multiple conne...
Created by
Rahul Govindan
in VPN and AnyConnect
10-22-2019
10-22-2019
AnyConnect uses SSL or IKEv2 as the transport protocol. The aggressive
mode only applies to IKEv1. S...
10-22-2019
FTD (managed by FDM) guide should be here:
https://www.cisco.com/c/en/us/support/docs/network-manage...
10-21-2019
Thanks @Arne Bier . I was discussing this with @Damien Miller just today
and his lab setup settings ...
Created by
Rahul Govindan
in Firewalls
10-21-2019
10-21-2019
You cannot use the ASA's outside interface for 1-1 NAT if you also want
to use AnyConnecton the ASA....
Created by
Rahul Govindan
in VPN and AnyConnect
10-21-2019
10-21-2019
Good job getting detailed symptoms. From what you have mentioned, it
definitely looks like there mig...
10-21-2019
@Arne Bier Did you ever figure this out? I am running into the same
thing in 2019 with all the lates...
Created by
Rahul Govindan
in VPN and AnyConnect
10-08-2019
10-08-2019
You can do this if you use DUO with LDAPS and set is as the secondary
authentication server on the A...
Created by
Rahul Govindan
in Identity Services Engine (ISE)
09-20-2019
09-20-2019
You can use the same redirect mechanism as what the NAC agent uses to
get the posture configuration ...
Public Statistics
| Date Registered | 10-28-2015 01:28 PM |
| Date Last Visited | 10-23-2019 09:44 AM |
| Total Messages Posted | 1,660 |
| Total Helpful Votes Received | 1940 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
Awards
Cisco Designated VIPs
2018 AAA Firewalling VPN
Cisco Designated VIPs
2019 VPN, Firewalls
