Hi everyone   We are planning to reimage our ASA 5516-X to FTD image, however, we have a concern about the licensing.   Currently, we have our ASA running Firepower Services (HDD Module), when migrating to FTD image, the same license that we are using with the FMC works for the new image?   As I understand, FTD image works with Smart Licensing, do I need to open a case so Cisco change the classic license to Smart License? or do I need to purchase a new license?   Hope you can help me with this question.   Best regards. ... View more

Hi everyone   I'm having issues configuring a site to site VPN between ASA and Checkpoint device. At this point, we have check that interesting traffic, encryption and hashing algorithms are ok.   When we originate traffic from the network attached to ASA phase 1 comes up and also phase 2, we saw traffic getting encapsulated but there is no response inside the tunnel. We take captures from the ASA and we saw that responses are coming from port 4500 out of the tunnel. For this, we disable NAT-T on the crypto map for that specific VPN.   However, now we are seeing a lot of phase 2 negotiations going up and down on this VPN, where ASA is generating new ISAKMP Initiator request and modifying SPI values.     Any ideas about what can be happening here?   Thanks in advanced for any comment you have.   Regards ... View more

Hi everyone   I'm having an odd issue with Cisco Catalyst Switches. We have several VLAN (more than a 100) where we use 4500-X VSS as the distribution Layer, and 2960X stacks as Access Layer (10 stacks directly attach to the 4500X VSS).   The 4500-X VSS is the default gateway for 4 VLANs. a few weeks ago, one of this VLANs began to fail. Where users in it cannot reach any device outside the stack where they connect.   For testing, we assigned an IP in this VLAN to the 2960X stack, we see that this stack (access layer), also, cannot ping anything outside it. But all other VLANs that reside in this same stack does not have this issue.   We look at the trunk links to see if the VLAN disappear from it, we look the "show vlan" output to see if the VLAN was remove from the stack (because we are using VTP to replicate all the VLANs).   Have you ever had a similar issue? can you recommend something?   Regards     ... View more

Hi everyone Is there a way to allow access to corporate google mail while blocking access to personal emails accounts on google? We are working with an ASA5545 with Firepower Services. Hope you can help me with this doubt. Regards ... View more

Hi everyone Hope you can help me with this issue. I set up an ASA5516X in a network that has asymmetric routing, but now we are having issues with ICMP and a XMPP app. I'm asuming that both symptoms occur for the same reason. The internet connection is attached to our ASA, but we have a data connection with a remote office that arrive directly to the local network. Default gateway for Server XMPP is the ASA, when we ping from the server to the PC on the remote office there is no problem with it, however, when we ping from the remote PC to the Server, the ASA seems to be blocking the icmp reply from the Server. We already configure TCP-state-bypass on the ASA, enable ICMP inspection on a policy-map and allow communication inter-interface We did some captures on the ASA, receiving this output ciscoasa(config-pmap-c)# capture PING interface inside real-time Warning: using this option with a slow console connection may result in an excessive amount of non-displayed packets due to performance limitations. Use ctrl-c to terminate real-time capture 1: 04:06:25.634183 arp who-has 192.168.1.254 (ff:ff:ff:ff:ff:ff) tell 192.168.1.50 2: 04:06:25.644116 arp reply 192.168.1.254 is-at 0:0:ab:3b:c0:0 3: 04:06:27.166602 arp who-has 192.168.1.254 (ff:ff:ff:ff:ff:ff) tell 192.168.1.50 4: 04:06:27.176626 arp reply 192.168.1.254 is-at 0:0:ab:3b:c0:0 5: 04:06:28.274201 arp who-has 192.168.1.254 (ff:ff:ff:ff:ff:ff) tell 192.168.1.50 6: 04:06:28.284256 arp reply 192.168.1.254 is-at 0:0:ab:3b:c0:0 7: 04:06:29.553544 192.168.1.50 > 192.168.2.2: icmp: echo reply 8: 04:06:31.011336 192.168.1.50 > 192.168.2.2: icmp: echo reply 9: 04:06:33.838823 192.168.1.50 > 192.168.2.2: icmp: echo reply 10: 04:06:37.023085 192.168.1.50 > 192.168.2.2: icmp: echo reply (this is when we ping from the remote PC, when we ping from the local lan to the remote office we receive this output ciscoasa(config-pmap-c)# capture PING interface inside real-time Warning: using this option with a slow console connection may result in an excessive amount of non-displayed packets due to performance limitations. Use ctrl-c to terminate real-time capture 1: 04:08:26.833483 802.3 encap packet 2: 04:08:28.355526 192.168.1.50 > 192.168.2.2: icmp: echo request 3: 04:08:28.356381 192.168.1.50 > 192.168.2.2: icmp: echo request 4: 04:08:29.888473 192.168.1.50 > 192.168.2.2: icmp: echo request 5: 04:08:29.889282 192.168.1.50 > 192.168.2.2: icmp: echo request 6: 04:08:31.422707 192.168.1.50 > 192.168.2.2: icmp: echo request 7: 04:08:31.423531 192.168.1.50 > 192.168.2.2: icmp: echo request 8: 04:08:32.982874 192.168.1.50 > 192.168.2.2: icmp: echo request 9: 04:08:32.983698 192.168.1.50 > 192.168.2.2: icmp: echo request 10: 04:08:34.560395 192.168.1.50 > 192.168.2.2: icmp: echo request 11: 04:08:34.561158 192.168.1.50 > 192.168.2.2: icmp: echo request Is there any issue with asymmetric routing that is impacting the icmp packets and xmpp connectiongs? Note: We replicate the scenario in GNS3 as we have limited access to the functional ASA Best regards ... View more