Hi,   I have question regarding Global Packet Inspection on a Cisco ASA. So, since by default all traffic from higher security Interface is allowed towards a lower security interface but NOT the other way around, traffic is inspected in>out to create a stateful entry to dynamically allow inbound traffic out>in. Now in case of Static 1 to 1 NAT. i.e. nat (inside,outside) source static 10.1.1.1 133.133.133.133 access-list Outside_Access_In ext permit ip any host 10.1.1.1 Since there is an ACL on the outside interface that is explicitly allowing any outside host inbound towards the inside host, once that ACE is matched, will the packet be inspected inbound aswell? or will it skip inspection as the traffic is already allowed inbound via the ACL. To recap the question is, whether inspection is performed for inbound traffic (out>in) if it is already allowed in an inbound ACL.   Kind regards     ... View more

Hi all, I have an ASA5516 that is hosting several Anyconnect VPNs using a Radius Server for authentication.   The Split tunnel list is configured on the ASA. The "SPLIT TUNNEL LIST" injects static routes onto the clients PC for the resources specified. However we have recently discovered that if the user is to manually enter a route on its PC to any destination with the VPN gateway as the next hop, Traffic to that destination will actually go via the VPN and if there is a route for the destination on the Firewall, it will route it all the way and back. Which is a huge security risk. Am I missing something here? Is there an attribute that can allow me to add security ACL per user on the Radius Server? or one on the ASA? We use the same group-policy and tunnel-group for every user. However each user has access to different resources. ASA config: group-policy Anyconnect internal group-policy Anyconnect attributes wins-server none vpn-idle-timeout 480 vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelspecified address-pools value Anyconnect_Pool webvpn anyconnect profiles value DfltProfile type user always-on-vpn profile-setting tunnel-group Anyconnect webvpn-attributes group-url https://1.1.1.1/Anyconnect enable The users are configured and authenticated by the Radius Server using the attributes: CVPN3000-IPSec-Split-Tunnel-List ; Framed-IP-Netmask ; Service-Type ; Class ; NAS-Port-Type.   Kind regards   ... View more

Hi, I'm trying to understand why on 1 of my policy based (crypto map) IKEv2 IPSec the IKEv2 SA's are not expiring and are going way over their lifetime; Which caused new SAs to generate and thus I am seeing a whole bunch of SAs while the old ones are still active. Even after I manually clear the SAs they still stay up. Does any one know how and why this is happening and how can I fix this behaviour? PS: I am using a Cisco ASR1001 but am unsure of the remote side.   ACTIVE ONE: Tunnel-id     Local                 Remote                fvrf/ivrf            Status 60            1.1.1.1/500       2.2.2.2/500          FVRF/IVRF          READY       Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK       Life/Active Time: 36000/7621 sec       ------ (Active time is lower than Lifetime as expected)     ALL MANUALLY DELETED ONES THAT ARE STILL ACTIVE: As you can see the Active time has way surpassed Lifetime. And I have manually deleted the SAs using "clear crypto ikev2 sa" but they still show up here. Tunnel-id Local                 Remote                fvrf/ivrf            Status 42       1.1.1.1/500      2.2.2.2/500              FVRF/IVRF         DELETE       Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK       Life/Active Time: 36000/457740 sec Tunnel-id Local                 Remote                fvrf/ivrf            Status 40        1.1.1.1/500    2.2.2.2/500      FVRF/IVRF         DELETE       Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK       Life/Active Time: 36000/493743 sec Tunnel-id Local                 Remote                fvrf/ivrf            Status 39        1.1.1.1/500    2.2.2.2/500      FVRF/IVRF         DELETE       Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK       Life/Active Time: 36000/529759 sec Tunnel-id Local                 Remote                fvrf/ivrf            Status 34        1.1.1.1/500    2.2.2.2/500      FVRF/IVRF         DELETE       Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK       Life/Active Time: 36000/565760 sec THUS Showing a whole lot of IPSec Phase2 SAs: Router#show crypto session brief Status: A- Active, U - Up, D - Down, I - Idle, S - Standby, N - Negotiating         K - No IKE ivrf = IVRF       Peer     I/F                            Group/Phase1_id   Uptime Status    2.2.2.2  gig1 /1                            2.2.2.2             1w4d    UA    2.2.2.2  gig1/1                             2.2.2.2             1w5d    UA    2.2.2.2  gig1/1                             2.2.2.2             6d23h    UA    2.2.2.2  gig1/1                             2.2.2.2             1w3d    UA    2.2.2.2  gig1/1                             2.2.2.2             1d03h    UA   Kind regards ... View more