ASA5520     8.2(5)30 Greetings, I have an IPSEC RA policy that's set up to tunnel all traffic (no split-tunnel) through the ASA (terminates on the outside interface).  I need to be able to allow thesesame VPN users to access one web page (hairpinning) on the outside interface. ++++++++++++++++++++++++++++++ Here are the current settings: group-policy L-Admins internal group-policy L_Admins attributes wins-server value 172.16.0.33 172.16.0.9 dns-server value 172.16.0.33 172.16.0.9 vpn-idle-timeout 60 vpn-session-timeout 480 vpn-filter value l-admin-filter      access-list l-admin-test-filter extended permit ip 172.30.4.0 255.255.255.252 host 172.16.0.33      access-list l-admin-test-filter extended permit ip 172.30.4.0 255.255.255.252 host 172.16.0.9      access-list l-admin-test-filter extended permit ip 172.30.4.0 255.255.252.252 host 172.16.1.4      access-list l-admin-test-filter extended permit ip 172.30.4.0 255.255.252.252 host 172.16.1.2      access-list l-admin-test-filter extended permit ip 172.30.4.0 255.255.252.252 10.24.0.0 255.252.0.0      access-list l-admin-test-filter extended permit ip 172.30.4.0 255.255.252.252 host 172.16.0.233 vpn-tunnel-protocol IPSec split-tunnel-policy tunnelall default-domain value IHI.local tunnel-group L_Admins type remote-access tunnel-group L_Admins general-attributes address-pool ili_global authentication-server-group PhoneFactor default-group-policy L_Admins tunnel-group L_Admins ipsec-attributes pre-shared-key * ++++++++++++++++++++++ Hairpinning is currently not enabled, so I assume I need to add: same-security-traffic permit inter-interface and (I assume) ip local pool l_admins 172.30.4.1-172.30.4.2 mask 255.255.255.252 global (outside) 1 interface ***** PAT IP nat (outside) 1 172.30.4.1-172.30.4.2 mask 255.255.255.252 But from here I don't know how to restrict access to a single external IP on the web over port 80. ... View more

Greetings, We are in the process of completly changing one of our networks to a new subnet. As such, the APs at that location are currently configured with static IPs and gateways. What is the best method (GUI, CLI) to be able to change IPs to the new subnet - without having to be hoisted up to do each manually?  Will any changes made with either method be saved and in effect once the new subnet comes online? (routers, switches, etc....) Thanks ... View more

Greetings, I've setup the following AP1041N configuration, but for the life of me - the radio will not enable. Can someone do a check?  Thanks. ++ sho conf Using 3234 out of 32768 bytes ! version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname MAP_1 ! logging rate-limit console 9 ! aaa new-model ! ! aaa authentication login default local aaa authorization exec default local ! aaa session-id common ip domain name IHI.local ip name-server 172.16.0.33 ip name-server 172.16.0.9 ! ! dot11 syslog ! dot11 ssid Admin    vlan 30    authentication open    authentication key-management wpa version 2    wpa-psk ascii 7 020A075E1C0F1D24404B1A0A ! ! crypto pki trustpoint TP-self-signed-319899067 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-319899067 revocation-check none rsakeypair TP-self-signed-319899067 ! ! crypto pki certificate chain TP-self-signed-319899067 certificate self-signed 01   30820249 308201B2 A0030201 02020101 300D0609 2A864886 F70D0101 04050030   30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274   69666963 6174652D 33313938 39393036 37301E17 0D303230 33303132 33343035   335A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F   532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3331 39383939   30363730 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100   DDADD8FC CD117FAA 38E21BD1 537E3A73 5E7FAC56 222F8FEE E4F4C16F 0BF64DB5   A5AABD5B 10AE9241 DFE71027 00EF9318 7A22FC7E B3C1EB56 010E6E04 BEF0A9B5   2B0DB4AB 676A6828 AF081340 37566439 1D50E6FA CDF92E2B B49730A5 96BCBFAB   EEF77740 9379E69F 318894E1 EF38D410 7E963233 6B00F7AD 9807ACBB 79D9EA55   02030100 01A37330 71300F06 03551D13 0101FF04 05300301 01FF301E 0603551D   11041730 1582134D 69616D69 41505F31 2E494849 2E6C6F63 616C301F 0603551D   23041830 1680143C B8ACD446 2FCB1C2D 1208384C 7250CD21 A775B130 1D060355   1D0E0416 04143CB8 ACD4462F CB1C2D12 08384C72 50CD21A7 75B1300D 06092A86   4886F70D 01010405 00038181 005109CF 3DEF417E F19220F0 C1F930F7 A8D75DE5   283166D0 4FB10AD2 213EF9C9 0684B7A2 85F6FAFC AF3E96E9 5F54694C F532FB6C   B7B1BB65 A501EA2B A98000A3 645C4884 49AEA766 CA111E94 95383EDC F0332208   F4F55202 59EEBC73 3E4BD6E3 CB4120AB 106FE542 97E35FF9 0B6AD65B 02C178E8   FF3A6295 31139638 86C5AF0F 97   quit ! username admin privilege 15 secret 5 $1$nC8s$fOV/oYcfHZzFrdIt/OkaW. ! ! bridge irb ! ! interface Dot11Radio0 no ip address no ip route-cache shutdown ! encryption vlan 30 mode ciphers aes-ccm ! ssid Admin ! antenna gain 0 station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled ! interface GigabitEthernet0 no ip address no ip route-cache duplex auto speed auto no keepalive bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled ! interface BVI1 ip address 192.168.9.252 255.255.255.0 no ip route-cache ! ip default-gateway 192.168.9.254 no ip http server ip http authentication aaa ip http secure-server ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag snmp-server community default RO bridge 1 route ip ! ! ! line con 0 line vty 0 4 ! end ... View more

Greetings, We are in the process of transitioning from a hub to a switch network connection on our current inside interface on the ASA 5520. However, in the meantime - we've been observing incrementing errors specifically eth collisions and deferred packets and dropped packets only on that interface that's attached to the hub: Interface GigabitEthernet0/1 "inside", is up, line protocol is up   Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec Auto-Duplex(Half-duplex), Auto-Speed(100 Mbps) MAC address 0013.c480.5e0b, MTU 1500 IP address 172.16.0.32, subnet mask 255.255.0.0 1343330 packets input, 308281070 bytes, 0 no buffer Received 19733 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 1762913 packets output, 1087630810 bytes, 0 underruns 0 output errors, 190190 collisions, 0 interface resets 0 late collisions, 121362 deferred 0 input reset drops, 0 output reset drops, 0 tx hangs input queue (curr/max packets): hardware (0/33) software (0/0) output queue (curr/max packets): hardware (0/155) software (0/0)   Traffic Statistics for "inside": 1343330 packets input, 281302280 bytes 1762913 packets output, 1054835780 bytes 11343 packets dropped       1 minute input rate 2051 pkts/sec,  389541 bytes/sec       1 minute output rate 2697 pkts/sec,  1617916 bytes/sec       1 minute drop rate, 18 pkts/sec       5 minute input rate 2398 pkts/sec,  540898 bytes/sec       5 minute output rate 3128 pkts/sec,  1910413 bytes/sec       5 minute drop rate, 19 pkts/sec ++ interface GigabitEthernet0/1 nameif inside security-level 100 ip address 172.16.0.32 255.255.0.0 Are there any settings (speed/duplex) on the ASA inside int that I could implement as a workaround to fix these errors? Through a number of test windows - when we connect the inside interface to the switch - the current int settings work and we are getting the correct speed/duplex - and the errors disappear. Thanks for your assistance. ... View more