Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Aditya Ganjoo
08-12-2019
Stats
Member since
11-28-2013
1317
Posts
1057
Helpful
181
Solutions
Created by
Aditya Ganjoo
in Firewalls
in Firewalls
11-12-2018
12:41 AM
11-12-2018
12:41 AM
Hi Tim,
You can check it only from the logs as there is no direct command.
This command would show you the uptime:
show crypto session remote <IP address> detail
From logs, you can check for teardown and VPN peer messages.
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
12-09-2017
04:59 AM
Hi,
Can you share the sanitized config of the ASA?
It may be that ASA cannot communicate to your TACACS server.
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
10-13-2017
05:01 AM
Hi SP,
You can refer to the release notes for ASA 9.6 Interim release notes to check what bugs have been resolved on 9.6.1:
https://www.cisco.com/web/software/280775065/132884/ASA-961-Interim-Release-Notes.html
Upgrade path:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/release/notes/asarn96.html#id_25640
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
Created by
Aditya Ganjoo
in Policy and Access
in Policy and Access
09-30-2017
06:46 AM
09-30-2017
06:46 AM
Hi, Can your machine resolve the ISE hostname? On the ISE under the Authorization profiles, go to the CWA option and check Static IP/FQDN option. Put in the IP of the ISE node rather than the hostname and test. Regards, Aditya Please rate helpful and mark correct answers
... View more
Created by
Aditya Ganjoo
in VPN and AnyConnect
in VPN and AnyConnect
08-23-2017
08:09 AM
08-23-2017
08:09 AM
Hi, Telnet is not allowed on lower security interface of the ASA. https://supportforums.cisco.com/t5/security-management/asa-5510-and-telnet/td-p/1952714 Only SSH is alllowed. Regards, Aditya Please rate helpful and mark correct answers
... View more
08-22-2017
03:12 PM
Hi, Please move the NAT used for this VPN tunnel to line 1. For instance: nat (inside,outside) 1 source static obj-A obj-A destination static obj-b obj-b Regards, Aditya Please rate helpful and mark correct answers
... View more
08-22-2017
09:55 AM
Hi, Config looks fine but I found that you are using dhcp on the outside interface. Does the IP on the outside interface remain same all the time? If not then please check this link for creating dynamic to static VPN tunnel: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119007-config-asa9x-ike-ipsec-00.html Regards, Aditya Please rate helpful and mark correct answers
... View more
Created by
Aditya Ganjoo
in VPN and AnyConnect
in VPN and AnyConnect
08-22-2017
08:30 AM
08-22-2017
08:30 AM
Hi, Cisco has an internal enhancement request to implement redundant peer for ikev1. Right now, there is no option to configure redundant peer or multiple peers for same crypto map on FTD. 6.3 release may address this issue. Regards, Aditya Please rate helpful and mark correct answers
... View more
08-17-2017
08:50 PM
Hi,
The NAT configuration looks fine.
Can you post the packet-tracer output for this traffic?
packet-tracer input outside tcp <internet host ip > 5656 <server's public IP address> 443 detailed
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
08-17-2017
08:46 PM
Hi Nick,
Unfortunately, you have to check individual crypto access-list for the hits.
Apart from this option, I do not think there is any way to check for unused crypto maps.
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
08-17-2017
08:31 PM
Hi,
There is no limit for configuring objects in a single context ASA.
However, there is a limitation on the number of access-control elements on a specific hardware.
There is no hard-coded limit on the number of elements (access control entries) in an ACL, which is bound only by memory. Each ACE uses a minimum of 212 bytes of RAM. However maximum performance may decrease (typically by 10 to 15 percent as you reach or exceed the recommended maximum number of ACEs.
Please check the link for ASA 5585 ( Section: What is the maximum ACL limit on ASA)?
https://www.cisco.com/c/en/us/products/collateral/security/adaptive-security-appliance-asa-software/qa_c67-731962.html
Also, is it possible to block IP address ranges by geographical region versus ip host or cidr block addresses?
On ASA you can only use CIDR block to block IP address, only if use Sourcefire module on ASA you would be able to block on geographical region.
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
08-17-2017
10:19 AM
Hi,
This error is a generic code for an MSI action failure. In this case, the Virtual Adapter installer has failed.
Check whether this registry key is present or not:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce.
In addition, you can try one of these actions in order to resolve the issue:
Execute this command in order to perform a quiet installation of AnyConnect:
msiexec /quiet / norestart /i anyconnect.msi
Scan your registry for AnyConnect related bogus keys and remove them.
Microsoft has released a fix for this in the following update:
https://support.microsoft.com/en-us/help/4015217/windows-10-update-kb4015217
If this does not help try disabling the Anti-Virus software on the PC and then try installing the Anyconnect.
Also try to use MS tool to uninstall AnyConnect (support.microsoft.com/en-us/help/17588/fix-problems-that-block-programs-from-being-installed-or-removed) and then install AnyConnect again.
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
08-17-2017
10:02 AM
Hi,
Yes, you can check the crypto ACL for any increment in hit counters.
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
08-17-2017
07:38 AM
Hi,
In that case, you can turn off this feature.
Just to emphasize the role of Proxy-ARP on ASA:
When you disable proxy arp on the inside (or any other) interface, make sure that you are not doing any NAT on that interface i.e. static ( DMZ,inside ) for example. The moment you disable proxy arp, the firewall will stop proxy- arping for the valid IP addresses it is hosting through NAT. So, in the above scenario, the firewall will not respond to the NATTED IP of the DMZ server.
Reference:
https://supportforums.cisco.com/discussion/10942001/cisco-asa-arp-poison
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
08-17-2017
07:01 AM
Hi,
If that's the issue you can turn off the proxy-arp on that interface.
Also, the switch you were not able to reach through SSH, does it have any NAT on the ASA?
If yes, you can disable proxy-arp on the particular NAT statement.
Regards,
Aditya
Please rate helpful and mark correct answers
... View more
Created by
Aditya Ganjoo
in Firewalls
11-12-2018
11-12-2018
Hi Tim, You can check it only from the logs as there is no direct
command. This command would show y...
12-09-2017
Hi, Can you share the sanitized config of the ASA? It may be that ASA
cannot communicate to your TAC...
10-13-2017
Hi SP, You can refer to the release notes for ASA 9.6 Interim release
notes to check what bugs have ...
Created by
Aditya Ganjoo
in Policy and Access
09-30-2017
09-30-2017
Hi, Can your machine resolve the ISE hostname? On the ISE under the
Authorization profiles, go to th...
08-23-2017
Hi, Telnet is not allowed on lower security interface of the ASA.
https://supportforums.cisco.com/t5...
08-22-2017
Hi, Please move the NAT used for this VPN tunnel to line 1. For
instance: nat (inside,outside) 1 sou...
08-22-2017
Hi, Config looks fine but I found that you are using dhcp on the outside
interface. Does the IP on t...
Created by
Aditya Ganjoo
in VPN and AnyConnect
08-22-2017
08-22-2017
Hi, Cisco has an internal enhancement request to implement redundant
peer for ikev1. Right now, ther...
08-17-2017
Hi, The NAT configuration looks fine. Can you post the packet-tracer
output for this traffic? packet...
08-17-2017
Hi Nick, Unfortunately, you have to check individual crypto access-list
for the hits. Apart from thi...
08-17-2017
Hi, There is no limit for configuring objects in a single context ASA.
However, there is a limitatio...
08-17-2017
Hi, This error is a generic code for an MSI action failure. In this
case, the Virtual Adapter instal...
08-17-2017
Hi, Yes, you can check the crypto ACL for any increment in hit counters.
Regards, Aditya Please rate...
08-17-2017
Hi, In that case, you can turn off this feature. Just to emphasize the
role of Proxy-ARP on ASA: Whe...
Public Statistics
| Date Registered | 11-28-2013 02:24 PM |
| Date Last Visited | 08-12-2019 06:41 AM |
| Total Messages Posted | 1,317 |
| Total Helpful Votes Received | 1057 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
