Yes. The PC where you run CLI analyzer will require simultaneous access to both the ASA and the Internet. You do need cisco.com credentials but not a support contract for the device being analyzed.   There's no guarantee you will get a definitive answer but then it's a free tool. :) If you want guarantees you need to buy support. ... View more

Sorry but you cannot run the tracback tool offline. For that you'd have to have a support contract and upload the file to TAC so that they can analyze it in house. If all you have is access to the files in an offline manner, you're pretty limited in your options.   FYI the Cisco CLI Analyzer tool sends the file to TAC and uses the same tools, just in a way that's directly accessible without requiring a TAC case. ... View more

You can download and run the free Cisco CLI analyzer tool. It will analyze any traceback / crashinfo files on the ASA for known problems.   https://cway.cisco.com/docs/cisco-cli-analyzer/2.0/About_the_Cisco_CLI_Analyzer.htm ... View more

Hi Ajay,   I don't think Option 3 would work. All of the ASAs Etherchannel member interfaces must connect to the same logical interface(s) on the neighboring device(s). The only way the neighbors can be different physical devices are:   a. They are members in the same switch stack b. They are part of a VSS cluster c. They are NX-OS devices with a vPC.   Options 1 and 2 each have advantages and disadvantages.   Given the throughput of an ASA 5515-X, you really aren't getting any additional capacity building an Etherchannel with more than 2 member interfaces.   I would note that most enterprises prefer not to expose their core switches with outside interfaces, even if they are L2 VLANs only. ... View more

Hi Rick,   Whether the remote access VPN is IPsec IKEv1 or SSL/IPsec IKEv2 (AnyConnect) we can always bind the service to any available interface.   The problem is routing. Even though the traffic comes in to a given interface, the return traffic will use a route lookup in the ASA's routing table. For random Internet-based addresses the ASA will only know to use the default route, resulting in asymmetric flows and the inability to establish a connection. ... View more

I'm not sure I understand what you're trying to do.   Is this related to using two ISPs - one as the default route and another to take only VPN traffic? As I noted earlier, you really cannot do that for remote access VPN. You can do it for site-site with static routes. ... View more

ASDM looks for an installation of the 32-bit Java version. If all you have is 64-bit it can fail to open properly.   In any case, you can upgrade from ASDM now. ... View more

Perhaps you have it misconfigured to use a duplicate IP address.   Please provide output from the following ASA cli commands:   show ip address show module sfr detail ... View more

How are you doing "disable Firepower"?   What symptom do you get when ASDM isn't working? Can you share a screen shot? ... View more

It's not supported by Cisco nor recommended but it can be done. You can see this blog post with instructions:   https://ciscoskills.net/2017/07/12/update-firepower-devices-manually/   More importantly you should fix the ASDM access first. If it's not working now you might make things worse by upgrading without performing the recommended Upgrade Readiness Test. ... View more

Sure - you can deploy any or all of the AnyConnect modules as a pre-deployment.   The Admin Guide covers the instructions here:   https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect46/administration/guide/b_AnyConnect_Administrator_Guide_4-6/deploy-anyconnect.html#ID-1425-00000111   Like with most modules, you'll need to prepare a profile for the module. The Admin Guide covers that as well. ... View more

What I was saying in my second paragraph earlier is that the traffic won't pass through the ASA and thus you cannot make it affect same-subnet traffic. ... View more

Since AnyConnect 4.x Cisco changed how they provision the licenses. They now show the platform maximum from the cli output - even when you have have bought fewer than that. I'm told this is to accommodate the new model whereby you are licensed per unique user, not per unique endpoint or headend device (such as the ASA).   It is your responsibility (per the terms and conditions) to not use more than you have purchased the right to use. ... View more