Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Sheraz.Salim
Online
Sheraz.Salim
Member since
03-08-2005
Rising star
912
Posts
763
Helpful
80
Solutions
Recent Badges
Awards
Spotlight Awards Member's Choice, February 2019
1
Created by
Sheraz.Salim
in Firewalls
in Firewalls
07-19-2019
10:04 AM
07-19-2019
10:04 AM
kindly please mark this post answered. Thank you.
... View more
07-19-2019
10:02 AM
Here is the list of CPU OID's on ASA-5515-X [284] 1.3.6.1.4.1.9.9.109.1.1.1.1.2. cpmCPUTotalPhysicalIndex
[285] 1.3.6.1.4.1.9.9.109.1.1.1.1.7. cpmCPUTotal1minRev
[286] 1.3.6.1.4.1.9.9.109.1.1.1.1.8. cpmCPUTotal5minRev
[287] 1.3.6.1.4.1.9.9.109.1.1.1.1.9. cpmCPUMonInterval
[288] 1.3.6.1.4.1.9.9.109.1.1.1.1.10. cpmCPUTotalMonIntervalValue
[289] 1.3.6.1.4.1.9.9.109.1.1.1.1.11. cpmCPUInterruptMonIntervalValue
[293] 1.3.6.1.4.1.9.9.109.1.2.4.1.2. cpmCPURisingThresholdValue
[294] 1.3.6.1.4.1.9.9.109.1.2.4.1.3. cpmCPURisingThresholdPeriod
... View more
Created by
Sheraz.Salim
in Firewalls
in Firewalls
07-19-2019
10:00 AM
07-19-2019
10:00 AM
have a look on this link bit old but will do the work for you https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/110322-asa-pppoe-00.html and this one https://www.petenetlive.com/KB/Article/0000831 and this one https://www.routexp.com/2018/06/asa-configuration-pppoe-client.html
... View more
Created by
Sheraz.Salim
in Firewalls
in Firewalls
07-19-2019
09:56 AM
07-19-2019
09:56 AM
if you using ikev1 than make sure your life time are same. also you have to make sure you are the initiator and also if possible set up a keep alive from your site. means once the tunnel is up and running from the server the one is specified in interesting traffic set up/run continuous ping to other side.
... View more
07-19-2019
09:51 AM
First thing first. this is a firewall not a router. you have to specify in ASA what ports you want to open and what ports you want to close.
... View more
07-19-2019
09:49 AM
why dont you tell us what exactly you want. what is your network setup and share your configuration. than we can help you.
... View more
Created by
Sheraz.Salim
in Firewalls
in Firewalls
07-19-2019
09:47 AM
07-19-2019
09:47 AM
your configuration looks fine. it could be your dump switch is playing up. make sure the dump switch to firewall and from your pc to dump switch are in correct order (cabling etc). what this command show you show interface GigabitEthernet1/3
... View more
07-16-2019
12:06 PM
have a look on below link. It more CLI but will achieve your objective. https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html#anc17
... View more
Created by
Sheraz.Salim
in Cisco Bug Discussions
in Cisco Bug Discussions
07-08-2019
01:17 AM
07-08-2019
01:17 AM
Hi All. hitting this bug using FMC virtual appliance 6.3.0.1. any idea when it will fixed.
... View more
- Tags:
- FMC BUG CSCvk40714
Labels:
Created by
Sheraz.Salim
in VPN and AnyConnect
in VPN and AnyConnect
06-23-2019
02:05 PM
06-23-2019
02:05 PM
curious have you give this command on the ASA. crypto ikev2 enable outside ! and make sure you have configured your VPN in this way. You dont have to give pre-sharedkey 3 times. see the template for IKEV2 ! asa1(config)#crypto ikev2 policy 1 ! asa1(config-ikev2-policy)#encryption aes ! asa1(config-ikev2-policy)#integrity sha ! asa1(config-ikev2-policy)#group 2 ! asa1(config-ikev2-policy)#prf sha ! asa1(config-ikev2-polocy)#lifetime seconds 86400 ! asa1(config)#crypto ikev2 enable outside ! asa1(config)#crypto ipsec ikev2 ipsec-proposal ikev2-proposal ! asa1(config-ipsec-proposal)#protocol esp encryption aes ! asa1(config-ipsec-proposal)#protocol esp integrity sha-1 ! asa1(config)# access-list ikev2-list extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0 ! asa1(config)#tunnel-group 10.10.10.2 type ipsec-l2l ! asa1(config)#tunnel-group 10.10.10.2 ipsec-attributes ! asa1(config-tunnel-ipsec)#ikev2 local-authentication pre-shared-key this_is_a_key ! asa1(config-tunnel-ipsec)# ikev2 remote-authentication pre-shared-key this_is_a_key ! asa1(config)#crypto map ikev2-map 1 match address ikev2-list ! asa1(config)#crypto map ikev2-map 1 set peer 10.10.10.2 ! asa1(config)#crypto map ikev2-map 1 set ikev2 ipsec-proposal ikev2-proposal ! asa1(config)#crypto map ikev2-map interface outside
... View more
Created by
Sheraz.Salim
in Firewalls
in Firewalls
06-23-2019
01:48 PM
06-23-2019
01:48 PM
you might have many nat rules in place if we suggest you one it could break the other functional nat. from above post i see you want to allow a whole subnet to be access able from outside. curious if you have any spare public ip addresses. as landing/coming from outside to mapping to (if you have a single ip address) your interested subnet is not a good practice. however, you can change the ip addresses if you thing they are sensitive. remember we are here to help. and give you a good advise to make things works where you get stuck :) as you have a dynamic rule in your nat. you need to change this to static. as mentioned earlier by GRANT I wont recommand this to you but unless you do not have any public ip addresses. but here is the config like are ! Object network BlackBelt subnet 192.168.100.0 255.255.255.0 ! nat (inside,outside) 1 source static BlackBelt interface ! access-list outside_in exten permit tcp any subnet 192.168.100.0 255.255.255.0 eq https (or) access-list outside_in exten permit tcp any object BlackBelt eq https ! access-group outside_in in interface outside ! you need to narrow down what protocol in regards to transport layer need to be access from outside to your inside(interested) subnet.
... View more
Created by
Sheraz.Salim
in Firewalls
in Firewalls
06-23-2019
01:17 PM
06-23-2019
01:17 PM
Just make sure you are on 9.7 onward version of the ASA code. As VTI was introduce in 9.7 code here is the link in case you need it in regards to configurations https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/vpn-vti.pdf
... View more
Created by
Sheraz.Salim
in VPN and AnyConnect
in VPN and AnyConnect
06-23-2019
01:09 AM
06-23-2019
01:09 AM
In your debug output you see this message REN-ASA5510# no IKEv2-PLAT-2: Received PFKEY Acquire SA for SPI 0x0, error FALSE where mean could be a typo error in presharekey between two firewalls. also see the link https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115935-asa-ikev2-debugs.html
... View more
Created by
Sheraz.Salim
in Firewalls
in Firewalls
06-19-2019
02:00 PM
06-19-2019
02:00 PM
kindly please if possible to upload the config in order to help you.
... View more
06-15-2019
11:28 AM
have a read on this doc https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/nat_objects.html will clear all your concepts
... View more
Friday
you can spin the same version of your FMC as the last version and import
the backup from your previo...
Friday
as long as your FMC is configured to drop in line it will drop the
packet and log it in the event lo...
Friday
Here is the list of CPU OID's on ASA-5515-X [284]
1.3.6.1.4.1.9.9.109.1.1.1.1.2. cpmCPUTotalPhysical...
Friday
have a look on this link bit old but will do the work for
youhttps://www.cisco.com/c/en/us/support/d...
Friday
if you using ikev1 than make sure your life time are same. also you have
to make sure you are the in...
Friday
First thing first. this is a firewall not a router. you have to specify
in ASA what ports you want t...
Friday
why dont you tell us what exactly you want. what is your network setup
and share your configuration....
Friday
your configuration looks fine. it could be your dump switch is playing
up. make sure the dump switch...
Tuesday
have a look on below link. It more CLI but will achieve your objective.
https://www.cisco.com/c/en/u...
Created by
Sheraz.Salim
in Cisco Bug Discussions
2 weeks ago
2 weeks ago
Hi All. hitting this bug using FMC virtual appliance 6.3.0.1. any idea
when it will fixed.
Created by
Sheraz.Salim
in VPN and AnyConnect
a month ago
a month ago
curious have you give this command on the ASA. crypto ikev2 enable
outside!and make sure you have co...
a month ago
you might have many nat rules in place if we suggest you one it could
break the other functional nat...
Public Statistics
| Date Registered | 03-08-2005 10:42 AM |
| Date Last Visited | 07-19-2019 09:45 AM |
| Total Messages Posted | 912 |
| Total Helpful Votes Received | 763 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Engager"){kind=icon}
Helpful Votes From
Awards
Community Spotlight Award
Member's Choice, February 2019
