I want to set up a site-to-site IPSEC VPN between 2 locations, where I am the administrator for Site A's Cisco ASA firewalls and Site B is a 3rd party company:   Site A: 10.10.10.0/24 Site B: 192.168.20.0/24   From Site A's Cisco ASA firewall, I want to be able to block anything inbound from Site B (that hasn't been initiated from Site A) and I want to allow ALL outbound traffic from Site A to Site B (and leave it to Site B to decide if there is any specific traffic they want to block)   How can I achieve this with a VPN filter at Site A?   (Note: using "no sysopt connection permit-vpn" and interface ACLs isn't an option due to the large number of VPNs already in use so I'd like to be able to do this using VPN filters)   Thanks. ... View more

Hi,   I've recently started at a new company - as usual, no documentation etc!   Anyway, it seems we have recently been introducing Apple Macs to our previously Windows-only environment.   However, the Mac users are unable to connect to our VPN  (ASA5545 running 9.6 software)   I looked into it and I think I can see what the problem is.   It seems they are still using Cisco Secure Desktop (I'm a bit puzzled by that as I thought it was now obsolete?) and there are Pre-Login policies defined.   The pre-login policy checks if the connecting device is a Windows device with a particular registry setting then assigns it to a "Secure Device" DAP.   When the Mac connects, it obviously doesn't meet that criteria and it is assigned a "Non-Secure Device" DAP which means it's only permitted as a clientless connection with restricted access.   Therefore, when our MAC users attempt to connect with AnyConnect client, it fails after authentication with the message "unauthorised connection  mechanism"    I have a couple of questions:   1)   Does the logic above sound correct in identifying the issue? 2)  What would be the best way to  fix this to allow Mac users to  connect via AnyConnect client and still  maintain security?  Should we simply create a new  prelogin policy that checks for a Mac OS and e.g. a particular file?  Then assign it to a "Secure Mac device" DAP with similar permissions as the "Secure Device" DAP for our Windows users?  Or is there a better way of achieving this?   Any thoughts/advice on this would be welcome!  Thanks. ... View more

Hi, we have to renew our SSL certificate (for AnyConnect VPN) with Entrust and I'm slightly confused over SHA1/SHA2 so thought I'd clarify on here first! Our ASA is running version 8.6 Our current SSL certificate from Entrust is SHA1. Can we renew the SSL certificate from Entrust but this time choose SHA2 for the certificate and simply follow the steps contained in: http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html i.e.   - Generate new RSA key pair (size 2048bit?) - Generate Certificate Signing Request (CSR) on ASA - Use CSR to submit certificat request to Entrust (selecting SHA2 for the certificate from Entrust options) - Install the new certificate on the ASA - Bind new certificat to outside interface And, after following those steps, we should then have our renewed certificate (SHA2 instead of SHA1) in place - and AnyConnect clients will be able to connect without any issue? Is it as straightforward as that or is there anything I am missing or need to be careful of? Thanks. ... View more

We have a large number of branches with Cisco887VAG routers.  They are set-up with 2 x IP SLA monitors, which are tracked such that if both IP SLA's fail then the router will switch from ADSL to it's 3G connection.  IP SLA 1 points to a device on our ISP's network and IP SLA 2 points to a device on the Internet (the idea being that if one fails, it may not necessarily indicate an IP connectivity issue - could just be that particular device that is down but if both fail we can be more confident there is a problem with connectivity over ADSL so we should failover to 3G)   We also monitor the IP SLA's via our monitoring station (using SNMP)  This morning, at exactly the same time, we noticed that IP SLA 2 started failing across a large number of devices (but by no means them all)   Sure enough on logging into the routers concerned, we could see that the IP SLA was showing a timeout and attempts to ping the address used by the SLA monitor also timed out.   Previously, this sort of thing has been an indication of a problem with our ISP's internet transit - however, on this occasion, everything else seemed fine - apart from ICMP communications with this particular address. We could ping other internet addresses without issues and our sites were not reporting any comms issues.   I logged with the ISP but they say they are not blocking any traffic.   I tried rebooting a few routers but they could still not get ICMP response from this particular internet address.   I've ended up changing the address used by the IP SLA 2 monitor but I'm worried the same thing could happen again and also curious as to what could be "blocking" the ICMP traffic in the first place.  I can't see how anything at our end (or on the routers themselves) could be at fault so but, at the same time, the ISP is insistent there are no issues and that they are not interfering with the ICMP traffic.   Does anyone have any idea what the cause of such an issue could be?  I guess it could be the internet server that we are monitoring (We don't own it so I guess technically/morally we shouldn't be using it!) that has decided to block ICMP from certain of our addresses but I just can't see them doing that (its a publically accessible DNS server which I'm sure you can probably guess where!).   Thanks. ... View more