Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Florin Barhala
06-06-2019
Florin Barhala
Member since
02-02-2009
Frequent Contributor
Network field engineer with a good understanding of nowadays network technologies and customer necessities. Direct experience with securing network perimeters and establishing safe network borders for a large array of companies profiles.
Personal Web Page : http://www.laf.ro
06-03-2019
11:09 PM
For anyone landing here I had the same error for a site-to-site between Cisco ASA 9.6.x and Palo Alto. The ASA was behind a STATIC/bidirectional NAT, so it used a private IP on the outside interface. Tunnel got fixed after two changes: - Enable NAT-T on the PaloAlto side so UDP/4500 was accepted - Update Peer ID on the PaloAlto side with my private IP address used on the ASA, while the PeerAddress was the public IP used by the ASA.
... View more
Created by
Florin Barhala
in Cisco Software Discussions
in Cisco Software Discussions
05-07-2019
03:50 AM
05-07-2019
03:50 AM
The next two steps required: 1. share the output of "show call-home smart-licensing" 2. Make sure you have firewall/ports connectivity from the mgmt. IP to the right licensing server either it's on cloud or on premises.
... View more
Created by
Florin Barhala
in Smart Call Home Discussions
in Smart Call Home Discussions
03-29-2019
02:59 AM
03-29-2019
02:59 AM
Hi mate, The GUI password is different from the CLI password setup during installation. Please check here: https://www.cisco.com/web/software/286285517/144301/Smart_Software_Manager_satellite_Enhanced_Edition_6.1.0_Installation_Guide.pdf for the default admin password.
... View more
03-27-2019
06:45 AM
Hello RJI, Thanks for the headsup! Ahead of rule 10 there're only Allow rules; I moved it as rule no1&2 and I got the same output. Review other causes: 1) ACL configured on an interface - ICMP permit on 1st position 2) ACL configured for AAA and AAA denied the user = no AAA policy 3) Thru-box traffic arriving at management-only ifc = not the case, traffic arrives on WAN interface 4) Unencrypted traffic arriving on a ipsec-enabled interface = no NAT or crypto policies are existing on this firewall; both are taken care upstream. I will open a case to TAC next week and let you all know.
... View more
03-25-2019
03:31 AM
My opinion is that you need to be more specific on either TCP or UDP as each have a myriad of ports available. So you can select from each protocol, what port to inspect: HTTP, DNS, SMTP..........
... View more
03-21-2019
04:58 AM
Marvin, I have to disagree: decrement-ttl is present, had it not been present then those * * * should not show up as ASA IP will not be shown. Anyway here's the config: show run policy-map policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect sqlnet inspect sunrpc inspect http inspect icmp inspect dns preset_dns_map inspect icmp error inspect tftp class SFR sfr fail-open class global-class flow-export event-type all destination 10.22.10.63 class class-default user-statistics accounting set connection decrement-ttl
As for the ACL, the ACE is on aka ENABLED; it's only logging that's disabled.
Thanks,
Florin.
... View more
03-20-2019
11:43 PM
Thank you guys, but this is not about ASA showing up.
On my original post I mentioned those * * * from traceroute are on the ASA.
There's also the asp-drop acl-drop capture I also shared on the ASA. So the issue is that ASA drops the traceroute...
... View more
03-20-2019
01:36 AM
Hello, Thanks for reviewing this. Here's my reply: - outside uses 10.22.1.62 NOT 10.62. - traffic goes THROUGH ASA - traffic comes to ASA outside passes through moves to one of the inside interfaces and then reaches the host connected to the inside interface.
... View more
03-19-2019
02:04 AM
Hi guys,
I have this "common scenario" where ASA drops traceroute traffic.
C:\Windows\system32>tracert -d 10.22.10.63
Tracing route to 10.22.10.63 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 10.22.20.254 2 2 ms 2 ms 2 ms 10.22.25.4 3 * * * Request timed out. 4 1 ms 1 ms 1 ms 10.22.10.63
Obviously the * is on outside ASA interface. Here's the related config:
1. Capture on ASA for dropped traffic
capture cap4 type asp-drop acl-drop [Capturing - 774 bytes] match icmp any any
4: 10:37:09.632840 10.22.1.62 > 10.22.20.1: icmp: time exceeded in-transit Drop-reason: (acl-drop) Flow is denied by configured rule
5: 10:37:13.346493 10.22.1.62 > 10.22.20.1: icmp: time exceeded in-transit Drop-reason: (acl-drop) Flow is denied by configured rule
6: 10:37:17.346966 10.22.1.62 > 10.22.20.1: icmp: time exceeded in-transit Drop-reason: (acl-drop) Flow is denied by configured rule
2. Interface config and acl-applied
show ip | i 10.22.1.62 Port-channel1.90 outside 10.22.1.62 255.255.255.240 CONFIG
access-group outside_in in interface outside
3. ACL config
sa outside_in | i icmp access-list outside_in line 10 extended permit icmp any4 any4 log disable (hitcnt=20821163) 0xb47d85da access-list outside_in line 12 extended permit icmp any4 any4 time-exceeded (hitcnt=0) 0xa0979724
4. ASA ICMP config
show run icmp icmp unreachable rate-limit 10 burst-size 5
show run policy-map | i icmp inspect icmp inspect icmp error
Any idea is welcome!
... View more
Labels:
01-13-2019
11:08 AM
Hi mate,
I had same issue and I got it solved with a reboot of the stack and then finally the command worked.
... View more
11-08-2018
06:38 AM
I have read it, but since my config currently points to a PortChannel interface, hence my question: will LACP run and up_the_port between the two ASAs?
... View more
11-08-2018
03:31 AM
Hi guys,
I want to migrate current STATE and FAILOVER physical connections from using switches in between to direct cables.
I read some design concerns and ack that tshoot event troublesome.
Now I have a dedicated Port-Channel for failover and another one for Stateful failover.
Can I still use these two port-channels with direct cables? Will LACP go up between ASA primary and ASA secondary?
Here's LACP status for Failover link (using switches):
show lacp 7 internal
Flags: S - Device is requesting Slow LACPDUs F - Device is requesting Fast LACPDUs A - Device is in Active mode P - Device is in Passive mode
Channel group 7 LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State ----------------------------------------------------------------------------- Gi0/4 SA bndl 32768 0xd 0xd 0x5 0x3d Gi0/5 SA bndl 32768 0xd 0xd 0x6 0x3d
... View more
Labels:
Created by
Florin Barhala
in Security Analytics and Management
in Security Analytics and Management
10-01-2018
08:38 PM
10-01-2018
08:38 PM
Nice, we are getting there! Now let's dig into the next step: 1. As default action at the bottom I have a profile named IPS profile. This means adding just ONE rule in Mandatory field plays safe in regard to the overall traffic flow ? 2. I looked over web browser category, there're 49 listed today but there's no trace about the one I need to block, let's call it no 50. Do you think if I just add a 2nd rule of block any other web browser would it work for me ? If not a TAC case on Cisco could give me the signature to block "no 50"? Thanks, Florin.
... View more
You Have No Messages
Public Statistics
| Date Registered | 02-02-2009 03:30 AM |
| Date Last Visited | 06-06-2019 07:01 PM |
| Total Messages Posted | 857 |
| Total Helpful Votes Received | 250 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 28 | |
| 10 | |
| 190 | |
| 5 | |
| 5 |
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
.jpg "VIP Advocate"){kind=icon}
