Hi all, i reviewed older posts-  I'm migrating an 881 to a 5508 that uses private address  for bgp to isp router , which routes from /32 addresses to them. nat on the loopback.   I've used private addresses on the outside of the ASA( router ahead doing nat) In this case though I have to migrate BGP on the outside using private address to the ISP device. Is there anyway to use another 'virtual type' interface with a public address (routed to the ASA by isp) to terminate a vpn connection?     [ISP]--- rfc 1918--- (ASA)-----LAN                                      |                        public add for anyconnect     thank you for any ideas you might have, Sincerely Zac ... View more

I came across this today while migrating a L2L / site to site tunnel from our ASA to a PaloAlto firewall (formerly Cisco ios device) From my side I would see : 17  IKE Peer: x.x.x.x     Type    : L2L             Role    : initiator      Rekey   : no              State   :  MM_WAIT_MSG6   Solution 1: This typically means the PSKs don't match, after we fixed that we saw this. Some Mfgrs do not process special characters the same. Debugging shows: %ASA-vpn-4-713903: IP = x.x.x.x, Header invalid, missing SA payload! (next payload = 4) or  Oct 01 10:33:43 [IKEv1]: IP =x.x.x.x Header invalid, missing SA payload! (next payload = 4)   The other side was able to see this: "IKE phase-1 negotiation failed. When pre-shared key is used, peer-ID must be type IP address. Received type FQDN." These errors mean that the ASA is sending it's DNS name entry for some reason. Solution 2:  Configure "isakmp identity address" ASA(config)# isakmp identity ? configure mode commands/options:   address      Use the IP address of the interface for the identity   auto            Identity automatically determined by the connection type: IP address for preshared key and Cert DN for Cert based connections                      hostname   Use the hostname of the router for the identity   key-id         Use the specified key-id for the identity   Citation: http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/vpn_ike.html D   Determining an ID Method for IKEv1 and IKEv2 ISAKMP Peers During ISAKMP Phase I negotiations, either IKEv1 or IKEv2, the peers must identify themselves to each other. You can choose the identification method from the following options: Address Uses the IP addresses of the hosts exchanging ISAKMP identity information. Automatic Determines ISAKMP negotiation by connection type: • IP address for preshared key. • Cert Distinguished Name for certificate authentication. Hostname Uses the fully qualified domain name of the hosts exchanging ISAKMP identity information (default). This name comprises the hostname and the domain name. Key ID Uses the string the remote peer uses to look up the preshared key.   The ASA uses the Phase I ID to send to the peer. This is true for all VPN scenarios except LAN-to-LAN IKEv1 connections in main mode that authenticate with preshared keys. The default setting is auto. To change the peer identification method, enter the following command: crypto isakmp identity {address | hostname | key-id id-string | auto} For example, the following command sets the peer identification method to hostname: hostname(config)# crypto isakmp identity hostname ... View more

Hi guys, The issue : I cannot reserve 443 nat'd to my interface  as below.  I get the error ' unable to reserve port' object network EDM_GMalic_RDP nat (inside,outside) static interface service tcp 443 443 This makes sense since ASDM is running by default on this port so I change it to 444. http server enable 444 Still get the error. So I disable http # no http server enable  and try it, same error. Show asp table socket shows a DTLS connection on the socket , is this anyconnect reserving the port?  What can I do to get this to work? Protocol  Socket    Local Address               Foreign Address         State SSL       00015baf  20x.2xx.8x.x3x:443          0.0.0.0:*               LISTEN DTLS      0002871f  20x.2xx.8x.x3x: 443         0.0.0.0:*               LISTEN Thanks a bunch, Zac ... View more