Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About vsurresh
Stats
Member since
03-12-2018
41
Posts
20
Helpful
2
Solutions
08-01-2019
08:48 AM
Have you replaced the Mikrotek router with the ASA as per Balaji's comments?
... View more
06-04-2019
09:57 AM
Can you please run a packet-tracer command and post the output? #packet-tracer input inside tcp 172.17.67.27 25000 8.8.8.8 80
... View more
06-04-2019
09:29 AM
Do you want users to access this host via the public IP as well? For example, users can internally access the host via 172.17.67.27:80 and external users can access it via 25.26.26.27:80 Is this what are you trying to achieve? If that is the case please add the below object network host-name host 172.17.67.27 nat (inside,outside) static 25.26.26.27 service tcp 80 80 You will also need inbound ACL to permit the traffic from outside to inside.
... View more
06-04-2019
08:28 AM
Are you going to use a public IP on both interfaces or just a private IP? IF you are planning on using private IPs on both end, you can use VPC-peering to get connectivity between both IP
... View more
06-04-2019
08:14 AM
Looking at your requirements I assume you might as well use Dynamic Access Policies. I have used them with LDAP where users in different AD group will get a different kind of access. I believe Radius can be used as well.
... View more
06-04-2019
08:05 AM
If you are using the asa_config module, conf t line is not needed. Please remove the line and try again. I followed the below Ansible guide and was able to send config commands via ssh
... View more
06-04-2019
07:56 AM
Try the below NAT command. object-group network INSIDE-SUBNET subnet 172.17.67.0 255.255.255.0 nat (inside,outside) dynamic interface
... View more
06-04-2019
07:52 AM
You can get the SAML metadata file by issuing show saml meatadata TUNNEL-GROUP-NAME command Please let me know if you require further information. Thanks Suresh
... View more
02-07-2019
06:59 AM
Hi, Static NAT is only applied if the server is behind the ASA. Even if you have an ASA, you still require to use the public IP to connect to the server. (ASA will handle the private to public IP translation)
... View more
02-04-2019
08:51 AM
Hi, From my understanding, you will need to access the SSH server from all three PCs right? 1. You need dynamic PAT on the ASA so your PCs can go out to the internet. 2. You will need to configure port forwarding on the TP-link router, for example, 1.1.1.1:22 >> 10.109.80.85:22 3. You will need to initiate the SSH connection from the PC using the public IP of the TP-Link router. What is the issue you are having at the moment?
... View more
01-18-2019
08:08 AM
These are the syslog IDs in case if you are interested and yes these are connection logging. %ASA-6-302013 - Built outbound/inbound TCP connection %ASA-6-302014 - Teardown TCP connection %ASA-6-302015: Built outbound/inbound UDP connection %ASA-6-302016: Teardown UDP connection %ASA-6-302020: Built outbound/inbound ICMP connection %ASA-6-302021: Teardown ICMP connection
... View more
01-18-2019
06:58 AM
Adding to Marius comments, If you are going to use the new ASA 5506 for pure firewall purposes then BVI is not needed. In regards to NAT conversion, please refer to this link https://www.tunnelsup.com/nat-converter/ Also, a good idea to disable telnet and change the console timeout to anything other than 0 (0 timeout - unlimited) Let me know if you need further help. Regards
... View more
01-18-2019
06:50 AM
Hi, Adding to Karsten's comments, if you want to log everything then set up a syslog server and log everything at debug level. logging enable logging trap debugging logging host INSIDE 10.1.1.1
... View more
Created by
vsurresh
in VPN and AnyConnect
in VPN and AnyConnect
01-13-2019
11:14 AM
01-13-2019
11:14 AM
Hello all, At present, Remote access users are getting authenticated from our AD server using LDAP. Moving forward we are planning to implement SSO/SAML for authentication. Is there any way to import the IDP XML metadata directly into the ASA? https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/webvpn-configure-users.html#concept_06F1AC0D353C462F9AB48C877F94863A I am using this link for my reference and configuration. Any suggestions would be greatly appreciated. Please let me know if you require further information. Thanks
... View more
- Tags:
- anyconnect
Labels:
06-04-2019
Are you going to use a public IP on both interfaces or just a private
IP?IF you are planning on usin...
06-04-2019
Looking at your requirements I assume you might as well use Dynamic
Access Policies. I have used the...
06-04-2019
If you are using the asa_config module, conf t line is not needed.
Please remove the line and try ag...
06-04-2019
You can get the SAML metadata file by issuing show saml meatadata
TUNNEL-GROUP-NAME command Please l...
02-07-2019
Hi,Static NAT is only applied if the server is behind the ASA. Even if
you have an ASA, you still re...
02-04-2019
Hi,From my understanding, you will need to access the SSH server from
all three PCs right? 1. You ne...
01-18-2019
These are the syslog IDs in case if you are interested and yes these are
connection logging.%ASA-6-3...
01-18-2019
Adding to Marius comments, If you are going to use the new ASA 5506 for
pure firewall purposes then ...
01-18-2019
Hi,Adding to Karsten's comments, if you want to log everything then set
up a syslog server and log e...
Public Statistics
| Date Registered | 03-12-2018 08:17 AM |
| Date Last Visited | 08-05-2019 01:09 PM |
| Total Messages Posted | 41 |
| Total Helpful Votes Received | 20 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Expert"){kind=icon}
