I'm wondering if you can amend the 5516 Outside Interface to the NAT'd address temporarily , e.g 100.1.1.15 (or whatever the actual static NAT address is) so it will then send a Gratuitous Arp for its Outside Interface. Then amend it back to normal Outside address 100.1.1.1 and upstream devices should have ARP entries for the Static NAT IP. You would need to do this while the 5510 is unplugged from Network so there is no conflict. The issue you have is the ASA won't GratArp for addresses used for static NAT. Just a thought and depends on how much disruption you are allowed to cause.. ... View more

It is not there, so not that. We'd really need to see the config and NATs etc. On the previous Firewall what version of Software was running as there was a big change in NAT format from 8.3 onwards. Also, the interface numbering may be different from the 5510 to the 5516 so I assume a copy and paste wasn't done and rather a detailed analysis of the config before applying to new firewall. I'm sure we can point you in right direction if we can see more info. ... View more

Off the top of my head and just something to check. Is the Firewall sending traffic to a firepower module with default config? What is output from Sh run policy-map   ... View more

Very informative @Joseph W. Doherty , thanks for that. I have been looking over some Cisco docs and an example is shown below -   policy-map grand-parent class class-default shape average 10 mbps service-policy parent policy-map parent class p1 service-policy child police rate 10 mbps bandwidth remaining ratio 1 class p2 service-policy child police rate 10 mbps bandwidth remaining ratio 1 class p3 police rate 10 mbps service-policy child bandwidth remaining ratio 1 class class-default   policy-map child class c1 police rate 2 mbps class c2 police rate 5 mbps class class-default police rate 10 mbps   Am I right in saying that there is an Overall Grand Parent Shaper of 10Mbps and is applied overall to outbound traffic   Would the top level policy section (grand parent) be representative of your comment -   "If its possible there's a congestion point less than the aggregate of all the remote sites, then you want a 3 level hierarchical policy"   The Grandparent shaper would be configured to match the slowest link on the path to the WAN Router (if this is lower than all the sites combined BW)?   The child policy in my example above, is this what would be used to shape to each specific sites BW? What does the Bandwidth remaining ratio 1 do in this case? ... View more

Thanks Guiseppe, This is the thought path I was heading down. Usually I'm configuring one parent and one child. For the various classes would the shape average be equal to the Site BW as per below policy-map PARENT-SHAPER class RSITE1 shape average "Site 1 BW" service-policy CHILD1 class RSITE2 shape average "Site 2 BW" service-policy CHILD2 ... View more

You must be running the ASA code on the FTD device? Is this correct? Someone else may be able to advise further but see below - Firepower 2100 Note You cannot receive an evaluation license for Strong Encryption (3DES/AES); you must register with the License Authority to receive the export-compliance token that enables the Strong Encryption (3DES/AES) license. ... View more

Have you enabled SSH v1 to be used from Putty? From the Putty main window, look down at SSH settings and amend from there. I believe Putty only tries V2 by default. ... View more