Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Introduction
By design or to avoid multiples VPN endpoints, you might want to have the VPN client and S2S VPN on the same device and shared the networks between the 2 VPN tunnels.
With the following config , we simplify the configuration requirements...
Introduction
An existing VPN tunnel requires active traffic every so often to keep the tunnel up and running If the tunnel is used for backup purposes and the traffic is generated only once per day , most likely the tunnel will remain down until new...
Recommendation about this feature
This feature works only between the following platforms:
•Two Cisco ASA 5500 series security appliances
•A Cisco ASA 5500 series security appliance and a Cisco VPN 3000 concentrator
•A Cisco ASA 5500 series security ...
Objective:
Traffic between Branch 1 and Branch 2 should be able to talk across the existing IPSec VPN on headquarters ASA (HQ).
Concepts:
Hairpinning (U-turn Traffic): Hairpinning is a term to describe traffic that is routed out of the same interfac...
What is DART ?
DART is the AnyConnect Diagnostics and Reporting Tool that you can use to collect data useful for troubleshooting AnyConnect installation and connection problems. DART supports Windows,MAC and Linux.
DART is currently available as ...
Hi Pete,
Yes, It does apply for Site-to-Site tunnels and remote users using IKEv1 or IKEv2 connections, the attack is based on IPSEC malformed packets, hence the attacker does not need to spoof a valid peer address, it takes advantage of the ASA l...
Hi Ray,
Unfortunately any version prior 8.4 has reach the End of software maintenance and won't have a direct fix for this vulnerability. The only known not affected ASA version is 8.5 , any other version must be consider potentially vulnerable to ...
Hi chanchiahuei
According to the chat you need to move to 9.4(2.4) , if you don't have access to download the image feel free to open a TAC case to have the image published.
Cisco ASA Major Release First Fixed Release 7.21 Affected; migrate to 9.1(7...
Hi awysocki,
The documentation states you need either a Site-to-Site tunnel running Ikev1 or ikev2 , or a remote connection with ipsec technologies. If you don't have any of those technologies the exploit can't be executed.
You can check if the I...
Hi Christian,
According to the chart, the only version not affected is code 8.5 for 9.1 code you need to upgrade to 9.1.7 to be safe of this vulnerability.
Cisco ASA Major Release First Fixed Release 7.21 Affected; migrate to 9.1(7) or later 8.21Af...