I have an internal application which requires operators to have a static IP address.  I'm looking for a way to do this for our VPN users.  At the moment they are given a random DHCP address from a pool.  Is there an easy way to get a static address assigned to VPN users on a Cisco ASA5510 anyconnect VPN? ... View more

I've got a site-to-site VPN running on a pair of Cisco 5510 firewalls. One end is with me at my primary site and the other several miles away at a datacenter. I'd like to find out which ports are open across the VPN and which are not prior to attempting some installs at the datacenter. Is there an easy way to tell using the ASDM interface? I would also need to know how to open specific ports if I find that they are closed. Thanks in advance for any help!           ... View more

        Hi - I'm setting up a Site-to-Site Cisco VPN between ASAs. I'm being told by the remote site engineer to set the maximum MTU at 1362. Is it possible to set the MTU for one specific site-to-site VPN on my ASA 5510 Security Plus to MTU 1362? I see my interfeces are all set at 1500. If not, would you recommend I setup a subinterface on my inside network router and a subinterface on the ASA with an MTU of 1362 to get around this issue? Then use this subinterface for traffic from my inside network to transverse through prior to hitting the VPN. Thank you. ... View more

Problem Details:  HI - I have a pair of Cisco ASA 5510's with Security Plus Licensing setup in Active/Standby mode. I also have the AIP SSM device in each ASA. At the main office there are 5 ISP connections. But only one of them goes through the ASA pair. Between the two firewalls and the ISP i have a switch. The switch has the ISP connection plugged in, then a wire going to each of the ASA's. The other ISP connections go through their individual routers, then connect to our network bypassing the Cisco ASA's. They are used as follows. ISP 1 - Internet (150Mb/s down, 35Mb/s up) ISP 2 - SAN Replication (35Mb/s down, 35Mb/s up) ISP 3 - AnyConnect VPN for remote staff (50Mb/s down, 10Mb/s up) ISP 4  - Multiple bonded MPLS T1's for branch access (Terminal services and IP phones) ISP 5 - 4G Internet (25Mb/s Up, 25Mb/s Down)(Not currently used) My goal is to have all 5 ISP connections ultimately run through the ASA Pair. I added a crude picture of the desired setup. Sorry, i'm not at my PC so had to use MS Paint. Is this a wise idea? What hardware below do you recommend to make the following happen? I have spare 2811 Routers. From what I understand I need to do PBR (Policy Based Routing), but have no idea what hardware i would need. 1)Have each ISP connection failover to the ISP of my choosing. For example, I want ISP 1 to failover to ISP 2, and if ISP 3 is down then have it failover to ISP 5. 2) Have a Failover ISP link be active while waiting for a failover to happen. For example, can ISP 2 be active for SAN replication while it is waiting for ISP 1 to fail and if ISP 1 fails I don't want it to interrupt the current activity on ISP 2. 3) I want my AnyConnect VPN to failover between ISP 3 and ISP 5. ... View more

I have a Cisco ASA 5510. The memory load keeps increasing. Unfortunately, i can't restart the device this week. Right now I'm at 84%. How can i find out what is causing this every slighly increasing usage of memory and reverse it? This is the e-mail notification i'm receiving every 5 minutes: <162>Aug 09 2012 11:53:15 ASA : %ASA-2-321006: System Memory usage reached 84% I have attached the output from "sh pro mem" and below is "sh ver", but not sure if this is enough information for you. Result of the command: "sh ver" Cisco Adaptive Security Appliance Software Version 8.4(4)1 Device Manager Version 6.4(9) Compiled on Thu 14-Jun-12 11:20 by builders System image file is "disk0:/asa844-1-k8.bin" Config file at boot was "startup-config" ASA up 25 days 19 hours failover cluster up 49 days 12 hours Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz Internal ATA Compact Flash, 256MB BIOS Flash M50FW016 @ 0xfff00000, 2048KB Thank you for your help! ... View more

The Cisco IPS 4240 is a little too expensive and has too much "horse power" for our needs. I know I can connect the AIP-SSM to our ASA 5510 to scan traffic going through the ASA. What if I have my core router on our internal network send all traffic from all nodes to the ASA as the next hop for review by the AIP-SSM instead of sending the traffic directly to the internal destination? Is this recommended? Will it work? Have you tried it? ... View more

I use a Cisco ASA 5510 with the AnyConnect VPN for remote workers. Now we want to give access to a select group of consultants who only need access to one sever and block everything else. I was thinking this could be done by creating a separate AnyConnect Connection Profile on the ASA. From that new connection will come a new GroupPolicy with a ACL to only allow access to the one system. That GroupPolicy will point to the Radius Server looking for an account in a specific MemberOf group. My question is - Could you explain how the ASA knows what Connection Profile to use when a user tries to authenticate? Does it automatically hunt down each Connection Profile until there is a username match via RADIUS in the Connect Profile? ... View more

I'm looking to replace another vendor's IPS system we have at our company. We do have an ASA 5510 in our envionment currently. Considering I don't need the extra bandwidth of the IPS 4240 series and the AIP SSM-10 requires an ASA 5510 what are the differences? ... View more