Hey, For the moment is a must and you cannot go around. Cheers, ... View more

Hi Mohammad, Regarding to routing when using crypto map I think the best is just to remember that you need to have route to remote LAN going out of the interface on which you have crypto map attached. In your case as an example on R3 you could have: ip route 10.10.10.0 255.255.255.0 192.168.20.3 On R1: ip route 172.16.10.0 255.255.255.0 192.168.10.2 192.168.20.3 or 192.168.10.2 might be nonexisting host, but the most important thing for the router is that it will hit the crypto map while routing the traffic out. Hope that helps. Cheers. ... View more

Hi, Please refer to the bug CSCtl97326 which was feature request for EKU in PKI Server: http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtl97326 Based on this information it is added in: 15.1(1)SY 15.2(0.7.3)PIB17 15.2(0.0.10)PIL17 15.2(0.3.1)PIH16 15.2(1.5)T 15.2(1.5)S 15.1(1.4)DPB22 15.2(1.0.0)IPI2 In case of 15.1.4 I cannot check it without a trendline (T/S/M). ... View more

Hi Han, I don't see myself possibility to do that. You can limit data transferred in one IPSEC SPI before renegotiation using crypto ipsec security-association  but this is not what you are looking for. I guess if you really want to achieve it you would need to use some external script going to ASA periodically through SSH and parsing output of some show commands. ... View more

Hi Filip, You need in certificate that is used by HTTP Server (SSLVPN)  to have Extended Key Usage (EKU) value of 'Server Authentication' . You can use for it Cisco CA on IOS for some time already. Example PKI Server configuration: crypto pki server CA grant auto hash sha1 eku server-auth client-auth Trustpoint: crypto pki trustpoint CA-self enrollment url http://10.1.1.2:80 fqdn 10.1.1.2 ip-address 10.1.1.2 subject-name cn=10.1.1.2,ou=TAC revocation-check none eku request server-auth I hope it helps. Cheers. ... View more

Hi, You can set-up a tunnel from ASA5510 to Forti FW without any problems, you just need to have a proper routing on both ends. There should be routing in London pointing toward India through Forti FW. Provide more outputs (show crypto ipsec sa, show crypto isakmp sa, debug crypto ipsec, debug crypto isakmp) from both ends for tunnel tshoot. ... View more

You can use match tunnel-group in MPF on ASA. Please refer to configuration guide: http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html ... View more

Hello, Please paste debugs from that router: debug crypto ipsec debug crypto isakmp on IOS + paste the configuration from the second side (if this is Cisco router/firewall). ... View more

As I understand this output is from primary standby-ready or when it is active? When you are intiating traffic are the counters in show crypto ipsec sa increasing? The best would be to do some online debugging for it. If possible I would suggest to create TAC case for that. ... View more

Yeah routing to 3.0 network you could do with NAT on >8.3. In configuration that you posted it is pre 8.3 and I am preety sure that traffic from 5.0 won't go to 3.0 through dmz since order of operations on ASA 8.2 is different (first route-lookup). This part you could workaround with ASA > 8.3, but the biggest problem is that you would need to set up the same set peer IP3 in two crypto maps on two different interfaces. On ASA you can have only one route to one host, so there is no chance that ASA with two ISPs will go both links to IP3. Regarding to Erwan statement - if the IP addresses inside are routable that it would be the best to create S2S tunnel with some other router inside the LAN - with ASA you won't achieve exactly what you want. ... View more

Tom, Can you say exactly what is happening on the new active box? show crypto isakmp sa/show crypto ipsec sa to see what exaclty is happening with the tunnels. It seems like a IPSEC replication issue. Are versions on both boxes the same? ... View more

Sorry Erwan, but I don't think you will make it working. You basically need two IP addressess on the LAN3 side. There is no policy based routing on ASA, so no way to achieve something like that. There were people who were trying to do PBR through the NAT, but never heard of this magic really working for outgoing traffic. Especially from the box. ... View more