Hello. I'm trying to understand the command for configuring a pre-shared key on a ASA 5506-X.   So far, I've already configured my IKE Phase 1 ISAKMP policy on an ASA.  I selected the pre-share option for authentication.     However, the  #crypto isakmp policy 1 command was not available for some unknown reason, so I used #crypto ikev1 policy 1 instead.    The next step, in my understanding for routers at least, is if using pre-share option, I should configure this: #crypto isakmp key cisco12345 address 172.30.2.2 (peer router ip address)   However, I'm on an ASA not a router, not a router, and as mentioned the usual crypto isakmp policy command is gone, but there was a cyrpto ikev1 policy command I used instead.   So given all of the above, what is the command I should use to configure the pre-shared key on the ASA?         ... View more

On ASA 5506-X version 9.8.2, I have configured NTP: NTP server x.x.x.x source outside (Where x.x.x.x is an external public NTP server ip address).   I also configured timezone on the ASA as I read it should be relatively close to the NTP time, though not sure why it matters.   For the internal hosts, I assumed I also need to have the ASA tell them where to find the NTP server via DHCP from the ASA.   My best guess on looking at cisco documentation and searching online, is that tim server can be sent out by DHCP by using:  dhcdp option 4 x.x.x.x   It takes the dhcpd option 4 part, but gives an error marker at the beginning of the IP address.    If I type dhcpd option 4 ?, one option is "ip    configure the option information as IP address(es) after this keyword   But if I type in an IP address, no matter if it is the global NTP address or even the private address of the inside interface, it doesn't work.   The error is a carrot on the first number of the IP address.   Furthermore, typing dhcpd option 4 x.x.x.x ?  says "unrecognized command. "   So what advice can you give to help me configure NTP on an ASA to use a external public NTP server so that the ASA and internal hosts know what time it is.           ... View more

Please explain this configuration.  What kind of NAT is it using and how can I learn how to configure it?   nat(any,outside) source static OBJECT-GROUP-1 OBJECT-GROUP-1 destination static OBJECT-GROUP-2 OBJECT-GROUP-2 no-proxy-arp route-lookup nat(any,outside) after-auto source dynamic any interface ... View more

What are crypto map sequence numbers for?  What is their purpose and reason for being?     ... View more

I'm using an ASA 5506X and I wish to configure two site-to-site vpn tunnels, which go to two other sites with their own ASA's   But the second VPN is not accepting the final configuration step of applying the crypto map to the outside interface.   Why not?       ... View more

Question on Default Routes: I have an ASA 5506-X connected to an inside LAN network, and the outside interface will be connected to an ISP. For the default route, should it be the ISP's next hop that I point to?  For example: route outside 0 0 x.x.x.x Where x.x.x.x is the ISP's router.   ... View more

I'm using ASA 5506-X.  I have an external network, whose computers need to SSH into the ASA.  To do this I configured: ssh x.x.x.x x.x.x.x outside Where x.x.x.x x.x.x.x is the external address range of the outside network somewhere else in the world. With this config, I think the outside interface will then allow connections with the above range coming from the internet (i.e. no VPN needed for SSH).  But, please correct me if I'm wrong.      Then, to be able to have the SSH reach the inside interfaces also,  I simply add the config: management-access inside   Finally, there is a mysterious config from a previous administrator.  It uses a private-address on the outside interface: ssh 10.x.x.x x. 255.255.252.0 outside   What is the purpose of allowing SSH on an outside interface for an private address?  Why was that config likely put on the device?? ... View more