I recently ran into a telnet, console, and enable password issue that was unexpected and I am hoping someone can explain what happened.  I had two working Cisco ASA 5505's that were two end-points of a Site-to-Site VPN .  I had used the ASDM file management tools to copy disk0 startup-config.cfg to a file named old-startup-config.cfg on disk0, on both ASA systems, and I wanted those two files to function as good working startup-config backups that I could return to, right there on the firewall, if I had to.  I also used the ASDM file management tools to make configuration "zip" backups to my local computer.  I am aware that the actual startup-config file is some type of hidden file. I had made some changes to both Cisco ASA 5505s, but no password changes , and everything was working great and was reloading great.  Then, I suddenly found that I needed to revert back to the old working configurations that I had backed up previously.  I used the ASDM file management tools to copy old-startup-config.cfg back to startup-config.cfg on disk0 on both machines.  I think I may have also issued the CLI command copy old-startup-config.cfg startup-config.  I asked both systems to reload without writing the running-config's to memory. When the systems reloaded, the console, telnet, and enable passwords were no longer recognized on the CLI and Web interface.  The interfaces loaded normally, but the passwords didn't work and the cisco default passwords didn't work either.  I had to go to each unit's physical location and perform a power cycle and console password recovery. I am not sure why that happened.  Is the startup-config.cfg file on disk0 an altered version of the actual startup-config configuration with missing or encrypted password credentials?  I would have never guessed in a million years that my procedure would have knocked out the enable password. Instead of copy startup-config.cfg old-startup-config.cfg, should I have issued the command copy startup-config old-startup-config.cfg to make a local backup of a working configuration? I have one more semi-related question.  If one uses ASDM file management to create a zip backup of a startup-config or running-config and then proceeds to restore a running-config, when does the restored running-config take effect?  ... View more

I have a situation where I have ethernet traffic from two separate networks/ip subnets (Subnet A and Subnet B) on a single ethernet connection.  I have the need to separate the traffic into two separate networks and two isolated broadcast domains.  I thought this could easily be accomplished with a Cisco 300 Layer 3 switch, but I can't get it to work correctly. I have the switch set to IP routing mode.  I have three VLANs configured.  VLAN 1 sees the combined Layer 2 & 3 ethernet traffic for both subnet A and subnet B.  VLAN 10 has an IP address assigned from subnet A and is the gateway for devices within that subnet.  VLAN 20 has an IP address assigned from subnet B and is the gateway for devices within that subnet. IP proxy arp is on by default and should be active. Devices in VLAN 10 can ping devices in VLAN 20 and devices in VLAN 20 can ping devices in VLAN 10.  This appears to be working only because the switch is the default gateway for those components.  No devices or servers in VLAN 1 can ping VLAN 10 or VLAN 20 components, and VLAN 10 and VLAN  20  components can not ping VLAN 1.  I analyzed the ARP traffic on VLAN 1 and the switch  is not responding with its own MAC address for requests for IPs for active devices connected to VLAN 10 or VLAN 20.  The Cisco documentation says that the device should be responding and acting as a router. I can not physically connect everthing on VLAN 1 directly to the switch, I can not make the switch the default gaeway for all devices on VLAN 1, and I can not create static routes directly to the VLAN 1 switch IP address for all devices that are part of VLAN 1, so I am stuck.  I need the switch to let VLAN 1 components automatically know what is connected to VLAN 10 and VLAN 20. I am willing to scrap this approach entirely if there is an easier way to do this.  Put simply, I have a few devices in Subnet A that need to be isolated from Layer 2 & 3 traffic destined for a few devices in Subnet B, but I can't reconfigure my entire network to create these isolated broadcast domains.       ... View more

I have a very basic question about Cisco ASA 5505 IPsec Site to Site VPNs.  I want to install a Cisco ASA 5505 at a Data Center, in a LAN subnet that utilizes publicly routable IP addresses.  I would like to install a second Cisco ASA 5505 in a remote branch office as its peer.  Regardless of whether I use publicly routable IPs at the branch office in the "inside" network or non-routable IPs, how would the devices and servers at the Data Center know to route IP packets destined for the branch office back through the Cisco ASA instead of through the default gateway at the Data Center?  I can see accomplishing this if every single device at the Data Center is configured with routing table entries, but that isn't feasible.  It also isn't feasible to use the Cisco ASA 5505 as the default gateway for all of the devices as the Data Center, allowing it to decide where the traffic should go. What am I missing?  Is the solution to try to map branch office IPs to IP addresses within the Data Center's LAN subnet so that all of the traffic is on the same subnet? ... View more