Make sure that your ASDM version supports your handshake version. Also, you need to upgrade your JRE to supported version. Also, you may want to have Java Cryptography extension https://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html See this post for more details https://community.cisco.com/t5/security-analytics-and/asdm-aes-256-not-supported/td-p/2790184 **** remember to rate useful posts ... View more

CME SIP trunk will always initiate to destination port 5060 by default. It impossible to initiate to random ports. I think you are not looking at the right capture. >From debug ccsip mess, you should be able to see why the calls are failing ... View more

Having the cable directly connected between ASAs is a bad design because this won't allow you to find which ASA triggered the failover. Move this to connect ASAs failover link through L2 switch. This way you can find which ASA had comm failure. Comm Failed means that failover flapped. With L2 link between the ASAs you can tell which unit had the actual failure. With current design, if either ASA fails, it will show comms failure at both sides ***** remember to rate useful posts ... View more

Yes, once you updates from asdm it will update the crypto acl but the tunnel has to be restarted for the new entry to be included in IPsec sa ... View more

Hi, Its failing because the DNS is failing to resolve reg.sip-trunk.telekom.de which is used as your outbound proxy. - do you need outbound proxy or registrar server is only required ... View more

Hi, Yes, it will ping every 15 seconds. If ping is dead, it will wait for 45 mins for the object using the tracking (such as route) to be deactivated. This means that the tracking needs 3 pings to fail to deactivate the object. This is good to make sure that the reason for ping loss isn't intermittent flapping. Similarly, the object using the tracking will wait 180 seconds to be reactivated after ping is reachable again. This means that it needs 12 pings to be successful before confirming that the tracking online and reactivated the object ***** remember to rate useful posts ... View more

It depends on how your dialplan configured at the gateway. The best option is to globalize the called number at the input voice port or trunk at the gateway then forward that to CUCM. At the same time using configure your SRST DNs with primary dn as standard extension format (e.g. 4-digits) and secondary dn as globalized format (e.g. e164). This way when your srst dns register, the calls will work with same config. ****remember to rate useful posts ... View more

This should help you https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115904-asa-config-dmz-00.html **** remember to rate useful posts ... View more

show full debug. Also, do you have DSP module installed and compatible with 3845 ****** remember to rate useful posts ... View more

You can create a bypass rule for mgmt access. this can be at the bottom. usually mgmt access isn't inspected. ... View more