Where is the traceback analyzer? I put a crash file into it for interpretation, says to use the traceback analyzer and I don't see it ?   ... View more

Where is the traceback analyzer? I put a crash file into it for interpretation, says to use the traceback analyzer and I don't see it ?   ... View more

There's n o issue with this setup. You have a default route on the asa pointing to r1 that's why it's going out that way and you have a static route to the outside of the asa from R2 that's exactly what should be happening. ASA only cares if it sees traffic come in one interface and does not see the return traffic. So example outside>inside, the traffic comes in, goes out through another firewall somewhere else, then the return traffic tries to come in through the original ASA outside interface. That will  break it. You can't control the Internet side totally anyways so that stuff will depend on a lot of factors but that's not what you're asking.   ... View more

post the other device's config ... View more

And what was the fix?   ... View more

idle timeout?   ... View more

You're describing two problems. The first problem is you have statics you need to advertise to the 4451's. You can do that with network statements or redistribute static routes into bgp with a route-map. You could also theoretically add the statics to the 4451's pointing to an hsrp address on the 7k's but that's more work.    Second issue, yes you can nat on the remote sides, you then will have the problem of how to advertise those routes back to the head ends since they are not actual networks that live on the remotes.    Look into creating null routes or something then you can advertise them back to the bgp head ends.     ... View more

Problem is you can't have the same public ip's obviously on both firewalls at the same time, so the only way to really do it is to build it in parallel, but offline then put test machines outside and one that corresponds to the public ip's on the inside so say nat outside is 4.4.4.4 to existing server 10.10.10.10   then in your lab, copy over the same stuff in terms of the equivalent config but then just use like a laptop on the inside to show it's working. If you could use different ip's, you could address the new firewalls with new addresses in the same space different internal ip's then you could theoretically flip flop between the two in parallel. You could do interesting things like source nat the traffic coming into the new firewalls so you don't have to change your gateways on the servers etc but that may or may not be an option for you depending on the ip space you have etc...    The other thing is are you using FTD on the new firewalls or asa code? different animal entirely if FTD.  ... View more

hire someone to assist you, that's way too much to ask on a forum imho ... View more

This worked for me Thanks ... View more

There's a way to configure the controller option in dhcp as an option then it will get the appropriate address. Sent from my iPhone ... View more

yes ... View more

Yes although load balancing isn't supported multiple default routes are through object tracking. ... View more

Your post is extremely vague. 1) most likely yes you would want to put your servers behind a firewall. 2) technically no but why wouldn't you. 3) you just want the ASA's to be on a segment behind your external firewall so you can create a VLAN or not. ... View more

Doesn't include admin context. You can create two contexts as in two firewalls. ... View more