Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Ben Walters
09-18-2019
Stats
Member since
12-05-2017
223
Posts
275
Helpful
42
Solutions
08-23-2019
06:48 AM
Do you have a limit on the traffic volume set in the SA lifetime? If you run the command show run | in lifetime it should show your SA lifetime setting for the tunnels. I would try setting it to unlimited and testing again.
... View more
Created by
Ben Walters
in Network Management
in Network Management
08-23-2019
06:07 AM
08-23-2019
06:07 AM
If you don't want any "!" in the output use show run | exclude ! it should only provide the running-config without all of the ! padding.
... View more
08-20-2019
06:44 AM
When you try to SSH to the firewall do you get a timeout or is the connection refused? If you are getting a timeout the SSH connection is likely being blocked, check that you are in the allowed subnet and SSH access is enabled on the correct interface. If the connection is refused it may be an issue with the crypto key that SSH is using you can try generating a new one to see if that helps with the crypto key generate command.
... View more
08-20-2019
06:26 AM
We recently had a pair of 5525x that we needed to add stateful failover to for our phone system and we are able to enable it without a disruption in service. The phone system we have was also quite sensitive to disruptions too, if a failover occurred without stateful enabled all phones would reboot and join the backup controller.
... View more
08-14-2019
12:58 PM
It seems that command was for old version of hardware only, it won;t be available on the X series. The ASA 5500-X platforms already integrate this capability to switch large modulus operations; therefore, crypto engine commands are not applicable on these platforms. I guess the SSL encryption using the DH ciphers may be the only valid workaround besides seeing if it was fixed in the specified software versions as per the bug notes.
... View more
08-14-2019
11:53 AM
I would have expected the fix to be in 9.8(3)8 too since the fixed releases for that bug were from Jan 2018 (your code is from Aug 2018) 9.2(4.25) 9.1(7.21) There are 2 suggested workarounds from Cisco on this if you want to try them though. Workaround: - Enable "crypto engine large-mod-accel" in the ASA configuration. This configuration change might reduce the maximum SSL throughput by up to 50%. This workaround is not available for the ASA 5505. or - Configure "ssl encryption" to only allow cipher suites based on Diffie-Hellman key exchange (like "dhe-aes128-sha1" and "dhe-aes256-sha1"). This mitigation may have an impact on interoperability with legacy clients that might not support these ciphers.
... View more
08-13-2019
01:05 PM
The session timeout is a hard limit on the connection time, even if the session is being used, if you had it set to say 10 min the ASA would end the session after 10 minutes even if you were actively using it. As for multi context mode I'm not too familiar with it but according to the config guide you should be able to use the commands. In multiple context mode, complete this procedure in the context execution space. To change from the system to a context configuration, enter changeto context name .
... View more
08-12-2019
05:44 AM
Yes, this is possible, you can connect each ISP router to a different interface on the firewall and then use SLA to monitor the routes in the event of a failure. This guide here is a good place to start and I think it still applies to 8.2 https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/70559-pix-dual-isp.html Otherwise have a look at the SLA section of the 8.2 config guide here: https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/route_static.html Hopefully this is helpful.
... View more
08-09-2019
10:35 AM
I believe this is related to the idle timeout, the command would be http server idle-timeout x and you would specify a value in minutes. Hopefully this is helpful.
... View more
Created by
Ben Walters
in Network Management
in Network Management
07-29-2019
04:52 AM
07-29-2019
04:52 AM
Is it possible that this particular 829 doesn't have the PoE module? If you do a show inventory do you see the following line? NAME: "IR800-IL-POE", DESCR: "POE module"
... View more
Created by
Ben Walters
in Network Management
in Network Management
07-26-2019
05:49 AM
07-26-2019
05:49 AM
I see that the g1 interface is down when you ran show ip int br on the 829 the VLAN interface will be in a down state until a port on that VLAN has a device connected and the port is up/up. If you want the VLAN interface to be active regardless of any device connected use the no autostate command on the VLAN interface. If you have the device connected to g1 and are expecting it to be functional I would start by looking at the physical layer, cabling, the port itself, PoE. Hopefully this is helpful.
... View more
Created by
Ben Walters
in VPN and AnyConnect
in VPN and AnyConnect
06-26-2019
12:26 PM
06-26-2019
12:26 PM
It would be possible to create 2 IPSec tunnels between 2 devices you would just need separate interfaces with different addresses on both the router and the firewall. Just create 2 separate connection profiles on each device and apply them to the corresponding interfaces.
... View more
Created by
Ben Walters
in Network Management
in Network Management
06-12-2019
08:50 AM
06-12-2019
08:50 AM
I ran into a similar issues creating custom sensors in our monitoring solution. I ran show environment temperature on the ASA and cross referenced with the values when I did an SNMP walk on the OID. The 4 temperature values should be for the processor, chassis back, chassis front and chassis back left according to sho env temp. The processor value will be the highest.
... View more
Created by
Ben Walters
in Network Management
in Network Management
06-06-2019
08:29 AM
06-06-2019
08:29 AM
We use 1.3.6.1.2.1.99.1.1.1.4 to obtain the temperature values for our 5525s it might be the same for the 5516s 1.3.6.1.2.1.99.1.1.1 is the table if you need any more info around the values. Hopefully this is helpful.
... View more
04-26-2019
12:35 PM
Like the object group for the servers you could also create a service groups for the services and reference it that way. object-group service <NAME> tcp port-object eq 8080 port-object eq 8082 port-object eq http port-object eq https access-list OUTSIDE-INBOUND line 23 extended permit tcp any object-group web servers object-group <NAME>
... View more
Public Statistics
| Date Registered | 12-05-2017 09:10 AM |
| Date Last Visited | 09-18-2019 01:01 AM |
| Total Messages Posted | 223 |
| Total Helpful Votes Received | 275 |
.jpg "VIP Advisor"){kind=icon}
Helpful Votes From
.jpg "Hall of Fame Master"){kind=icon}
