Hi guys, I have a serios problem debugging an Site-toSite VPN Tunnel issue and hope to find some help here. Let me first explain the preconditions: The tunnel is established between ASA5505 and ASA5510. On both devices runs the 8.4.1 Software. On ASA5510 site I use B-Class network devided in several C-Class networks (172.20.0.0/16 devidet in 172.20.10.0/24, 172.20.20.0/24 and so on). The other site is a smaller Network with 172.16.1.1/28. I created on both sites the tunnel specific configuration and everything work's fine, the tunnel comes up and traffic flows. So far so good, but now the problem: After adding one more C-Class network to the cryptomaps, there was no traffic flow possible between this C-Class network and the other Site, the other traffic flows like before. Exchanging this C-Class network by another everything is fine, traffic flows. If I substitute in my cryptomaps all the C-Class networks with the B-Class network, I was able to pass traffic from the non-working C-Class network to the other Site. So, only this one specific C-Class network won't work properly. I begin to debug this by myself but become stuck on this point ciscoasa# packet-tracer input inside icmp 172.16.1.3 8 0 172.20.10.1 detailed …#All other Phases passed with allowed. Phase: 8 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: out id=0xcb8e0270, priority=70, domain=encrypt, deny=false hits=3, user_data=0x0, cs_id=0xcb3d34f8, reverse, flags=0x0, protocol=0 src ip/id=172.16.1.0, mask=255.255.255.240, port=0 dst ip/id=172.20.10.0, mask=255.255.255.0, port=0, dscp=0x0 Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule The other sites output is identicly, expect the src and dst are switched How can I find the rule which is the reason for the dropped Packages? Do you have any other advices for me, debugging this problem? Please let me know anymore info that is needed. ... View more

We have some ASA 5510. Because of the update to version 8.2 we upgraded our memory from 256 MB (original) to 512 with the memory upgrade kit from Cisco. Now the new version 8.3 requires again a memory upgrade of 1 GB. So the question is, what is the maximum possible memory size on the ASA 5510? There is only one Slot for one memory module. I guess there is a limitation of memory module size. Because buying 1 GB now, but need more later is not my imagination of cheap total coast of ownership. ... View more

Hello, i want to stop some users from using the hamachi client (www.hamachi.cc). I think blocking port 12975 may not be enough, because the port could be changed. Does anyone know the ip adresses of the hamachi servers ? regards Joerg ... View more

Hello, i have ipsec tunnels between some locations, all equipped with PIX515 (with spare ethernet ports). Now we would like to have backups for the vpn tunnels over lines from other ISPs. As far as i know the pix does not allow multiple routes to a specific network or more than one default route with 6.3(4). So - how should i setup setup this scenario ? Could someone please give me some hints where or what to RTFM ? Thanks! regards Jörg ... View more

Hi, i need some help on PIX515e, which i'm quite a newbie on and i dont want to kill any running service ... I need a kind of NAT from the DMZ to the outside. There is one Mailer in the DMZ which has to bee seen on the outside with a fixed routable IP. Should i use the nat or the static command for this ? Can someone please tell me how to do this or where to RTFM ? Thanks! regards Jörg ... View more