Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About WStoffel1
10-09-2017
Stats
Member since
11-24-2006
153
Posts
5
Helpful
1
Solution
07-17-2015
07:19 AM
Good enough for me, it is verrrrrrrrrrry old code. And pretty inexplicable why it was happening. thank you.
... View more
Created by
WStoffel1
in VPN and AnyConnect
in VPN and AnyConnect
07-16-2015
07:20 AM
07-16-2015
07:20 AM
I had two L2L tunnels connected to my ASA. Both far ends are a single customer, two offices, both with Sonicwalls. Tunnel to each site was fine, then there came the need to have the two sites be able to talk, RTP for new voip set up. Updated the tunnels accordingly and had no issues, it all worked perfectly. Then i added PFS to the crypto, group 2 and the second SA dropped. In other words the two remote networks could not talk, but the SA from my ASA to each Sonicwall remained up. I cant post the configs but as long as i keep PFS out of the equation i have no issue, is there something very general i'm missing or should be adding? Wondering if anyone just has a thought or two on it, thank you!
... View more
Labels:
06-15-2015
05:56 AM
I'm currently battling a bot-net on a 8.2 ASA but i dont have the license. So enabling the botnet filter is not an option. Yet. I'm curious if anyone has struggled with this, and has a few ideas on finding and tracking down the offending machine....? thank you.
... View more
Labels:
11-26-2014
07:23 AM
Meaning updated code *would* be able to correctly route traffic? What version? I can get it updated. :)
... View more
11-24-2014
07:25 AM
ciscoasa# show ver Cisco Adaptive Security Appliance Software Version 8.2(5) Device Manager Version 6.4(5) Compiled on Fri 20-May-11 16:00 by builders System image file is "disk0:/asa825-k8.bin" Config file at boot was "startup-config" ciscoasa up 4 days 17 hours Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz Internal ATA Compact Flash, 128MB BIOS Flash Firmware Hub @ 0xffe00000, 1024KB Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0) Boot microcode : CN1000-MC-BOOT-2.00 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03 IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05 0: Int: Internal-Data0/0 : address is 881d.fcbb.f49e, irq 11 1: Ext: Ethernet0/0 : address is 881d.fcbb.f496, irq 255 2: Ext: Ethernet0/1 : address is 881d.fcbb.f497, irq 255 3: Ext: Ethernet0/2 : address is 881d.fcbb.f498, irq 255 4: Ext: Ethernet0/3 : address is 881d.fcbb.f499, irq 255 5: Ext: Ethernet0/4 : address is 881d.fcbb.f49a, irq 255 6: Ext: Ethernet0/5 : address is 881d.fcbb.f49b, irq 255 7: Ext: Ethernet0/6 : address is 881d.fcbb.f49c, irq 255 8: Ext: Ethernet0/7 : address is 881d.fcbb.f49d, irq 255 9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255 10: Int: Not used : irq 255 11: Int: Not used : irq 255 Licensed features for this platform: Maximum Physical Interfaces : 8 VLANs : 20, DMZ Unrestricted Inside Hosts : 10 Failover : Active/Standby VPN-DES : Enabled VPN-3DES-AES : Enabled SSL VPN Peers : 2 Total VPN Peers : 25 Dual ISPs : Enabled VLAN Trunk Ports : 8 Shared License : Disabled AnyConnect for Mobile : Disabled AnyConnect for Cisco VPN Phone : Disabled AnyConnect Essentials : Disabled Advanced Endpoint Assessment : Disabled UC Phone Proxy Sessions : 2 Total UC Proxy Sessions : 2 Botnet Traffic Filter : Disabled This platform has an ASA 5505 Security Plus license. Serial Number: Configuration register is 0x1 Configuration last modified by enable_15 at 16:40:04.047 UTC Thu Nov 20 2014 There's the version info. Misread your reply initially, thank you.
... View more
11-21-2014
06:56 AM
So i've been confronted with an interesting problem. As of right now it's a blank slate as I'm not sure how to do this. There's a broadband Internet connection from the cable company that needs to be configured as the internet connection for the Lan, 192.168.0.0/23. That traffic obviously needs to be natted through the Outside interface. This would also be the default route. So far a pretty plain vanilla setup is my point. There's an Exchange server at 192.168.0.5 that needs to have email traffic sourced out of ISP2. That outside interface is also the MX record for the mail server. 12.3.11.16/30 is the network, .17 being the default gateway. .18 being my interface that needs to be natted to 192.168.0.5 allowing pop3, imap, https, smtp. then there's an RDS (terminal server) at 192.168.0.6 that they want rdp or port 3389 to use ISP3. This outside network is 12.5.14.56/29, 12.5.14.57 is the default gateway, .58 is my outside interface. My terminal server clients would connect to 12.5.14.58. Interfaces would look like this based on info so far: interface Vlan1 nameif inside security-level 100 ip address 192.168.0.254 255.255.254.0 ! interface Vlan2 nameif outside security-level 0 ip address 50.7.89.4 255.255.255.248 ! interface Vlan3 nameif ISP2 security-level 0 ip address 12.3.11.18 255.255.255.252 ! interface Vlan4 nameif ISP3 security-level 0 ip address 12.5.14.58 255.255.255.248 which then becomes more of a design thing if it's technically possible...do i create a dmz and put isp2 an 3 there? the current set up is a hodge podge of equipment with this meant to consolidate...when i say blank slate i mean it, anything can be done to get this working :) it's the third wan link thats a hang up. any ideas?
... View more
Labels:
08-29-2014
12:27 PM
Settle an argument: 2 Cisco 5505's at either end of a 20Mbps leased line. Both ports are locked at 100Full. There are no communication issues. Consistent throughput on the links is 20%. Is the line saturated?
... View more
Labels:
05-16-2014
06:34 AM
sysopt connection tcpmss 1000 still same result. i've opened a ticket with the carrier, still pending on that. but I can see icmp requests from the remote end, pass my asa, the device responds, i see the icmp reply and then it appears to drop when exiting the asa. i'll also start running packet captures from both ends, and start looking at sequence numbers and go from there..thanks for the ideas though.
... View more
05-13-2014
10:24 AM
Some additional info. Aside from the ping they have running from the remote network, which is shown in the above icmp trace, if i run packet tracer from the local network to the remote, tunnel's up/traffic is allowed. Not a big surprise since the tunnel does negotiate and stay up. I captured packets from the ASA and I can see the local 10.220.78.23 device sending the reply to 192.168.191.10. Matching up with the icmp trace. I had them run a packet capture on their firewall and confirmed, the ICMP requests from 192.168.191.10 are being encapsulated and sent on the tunnel. Again confirmed in my mind since i see the requests on the ASA. But they don't ever see the response. There's no tcp adjust mss command on the ASA but there's this in the config: ASA# sh run all sys no sysopt connection timewait sysopt connection tcpmss 1380 sysopt connection tcpmss minimum 0 sysopt connection permit-vpn sysopt connection reclassify-vpn no sysopt connection preserve-vpn-flows no sysopt nodnsalias inbound no sysopt nodnsalias outbound no sysopt radius ignore-secret no sysopt noproxyarp inside no sysopt noproxyarp outside Any other ideas?
... View more
05-13-2014
09:53 AM
It's a windows server sending the icmp request, 32 bytes by default. So that length is actually correct. However if I set the DF bit, i get a somewhat odd response, 1410 is my MTU...?
... View more
Created by
WStoffel1
in VPN and AnyConnect
in VPN and AnyConnect
05-13-2014
08:57 AM
05-13-2014
08:57 AM
I've had a tunnel in place on a 5505 to a remote network i don't control...so my troubleshooting there is limited. But the tunnel has been in place for over a year without issue. Suddenly it doesn't appear to be passing traffic. But it is in at least one direction. Remote network:192.168.191.0/24 Local ASA side: 10.220.78.0/24 I had a constant ping started from 192.168.191.10 > 10.220.78.23 Which is a Windows server pinging a Windows workstation. When i debug icmp on the ASA i get: ICMP echo request from outside:192.168.191.10 to inside:10.220.78.23 ID=1 seq=2866 len=32 ICMP echo reply from inside:10.220.78.23 to outside:192.168.191.10 ID=1 seq=2866 len=32 Which confirms to me that the remote network is in fact traversing the tunnel and hitting the 10.220.78.23 device, which is in fact responding, and the reply is being sent out the ASA. The tunnel negotiates and comes up any time I reset it, by all accounts it looks correct. The problem is not limited to ICMP as I'm unable to net use or map drives, nor can 192.168.191.10 print to the printer at 10.220.78.20. But once i saw the icmp trace output I pretty much figured it has to be on the remote end...so.... My question, can I absolutely infer from this that the issue resides on the remote end?
... View more
Labels:
02-08-2014
09:02 AM
Thanks guys. I just wanted a feel for others thoughts/experiences. We actually had an experience with a remote "IT" user that didn't or wouldn't grasp the concept of vlans. And on this new VoIP installation was dead convinced that although i put voice and data on different vlans, there was no difference in performance than if they were on the same vlan. This is part of a larger issue with this client, their lan is a 10/8 over 15+ sites, some fiber runs between sites in excess of 20 miles (yes a giant geographic broadcast domain), broadcast storms a nearly daily occurrence, and with no metrics, making a comparison to a dated digital phone pbx. The bandwidth is an interesting point that I hadn't dived into yet, but yes thats a concern as well. Thanks again.
... View more
02-05-2014
07:00 AM
Just got into a discussion with someone abotu it and wanted another perspective. There's a thought that in the exact situation where the PC hangs off the phone, since it's the same cable coming down from the switch, that both devices are seeing all the traffic. Thank you.
... View more
02-05-2014
06:58 AM
Actually you helped more than you know right now...yes, set of creds per link and different IP's....what i really needed to know was WHO was supposed to bond them. This was sold to our customer completely incorrectly and I'm just trying to triage the situation. But I have very very limited experience with DSL...... I have more than i need configured simply because I had the router in my posession. It has now been shipped to the site. I will have a non-IT person that will plug it in, hook up the console cable to a laptop, and use a 3rd internet connection that I'll be able to remote in and configure, change, troubleshoot, and debug this setup. So, to PS2 above, I'm going to be using ATM, ethernet was done only becaue the config allowed me to But I was a little confused, admittedly, on the dialer pools as I thought each dialer had to be in it's own pool. That will be the first change I make on the config. So thank you, very much appreciated. We'll see next week how it goes when it gets all hooked up.
... View more
07-17-2015
Good enough for me, it is verrrrrrrrrrry old code. And pretty
inexplicable why it was happening. tha...
07-16-2015
I had two L2L tunnels connected to my ASA. Both far ends are a single
customer, two offices, both wi...
06-15-2015
I'm currently battling a bot-net on a 8.2 ASA but i dont have the
license. So enabling the botnet fi...
11-26-2014
Meaning updated code *would* be able to correctly route traffic? What
version? I can get it updated....
11-24-2014
ciscoasa# show verCisco Adaptive Security Appliance Software Version
8.2(5)Device Manager Version 6....
11-21-2014
So i've been confronted with an interesting problem. As of right now
it's a blank slate as I'm not s...
08-29-2014
Settle an argument:2 Cisco 5505's at either end of a 20Mbps leased line.
Both ports are locked at 10...
05-16-2014
sysopt connection tcpmss 1000 still same result. i've opened a ticket
with the carrier, still pendin...
05-13-2014
Some additional info. Aside from the ping they have running from the
remote network, which is shown ...
05-13-2014
It's a windows server sending the icmp request, 32 bytes by default. So
that length is actually corr...
Created by
WStoffel1
in VPN and AnyConnect
05-13-2014
05-13-2014
I've had a tunnel in place on a 5505 to a remote network i don't
control...so my troubleshooting the...
02-08-2014
Thanks guys. I just wanted a feel for others thoughts/experiences. We
actually had an experience wit...
02-05-2014
Just got into a discussion with someone abotu it and wanted another
perspective. There's a thought t...
Public Statistics
| Date Registered | 11-24-2006 08:25 AM |
| Date Last Visited | 10-09-2017 01:29 PM |
| Total Messages Posted | 153 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
