About RJI

RJI · ‎08-16-2019

You could configure the VPN Filter to restrict access. Example here.

RJI · ‎08-16-2019

Hi, First guess would be that you possibly need a NAT exemption rule, to ensure the Remote Access VPN traffic is not natted over the IPSec Site-to-Site VPN tunnel. Can you provide your configuration and the output of "show nat" please.

RJI · ‎08-16-2019

Hi, Can you provide the IPSec Proposal for the ASA? Are you able to confirm what IKEv2 and IPSec algorthims AWS is using? Can you remove the IKEv1 pre-shared key from the tunnel-group on your IKEv2 configuration. Can you also provide the detailed crypto debugs for further analysis.

RJI · ‎08-15-2019

Hi, Remove that NAT rule you have defined there. Add this:- object network Web Server host 192.168.10.20 nat (dmz,outside) static 154.72.196.43 Run "show nat" and confirm this new NAT rule is above any dynamic NAT rules defined. Provide the output if unsure. HTH

RJI · ‎08-15-2019

Hi, I am using FlexVPN Remote Access VPN on my ISR router using certificate authentication. I have the following logging commands configured:- logging trap debugging logging facility syslog logging host 192.168.10.60 The following syslog message below is generated, and this is sent to the syslog server. %CRYPTO-5-IKEV2_SESSION_STATUS: Crypto tunnel v2 is UP. Peer x.x.x.x:49663 Id: cn=username,cn=Users,dc=lab,dc=local HTH

RJI · ‎08-15-2019

Hi, You'll need a NAT exemption rule. You need to ensure the original & translated source is INvlan200 and the original & translated destination is US_Vlan_14 (assuming those are the correct objects). Create another rule for the other objects, or reference a group containing all objects instead. Here is a similar example:- You will also need to ensure the Access Control Policy permits the traffic. EDIT: Sorry, I wasn't as observant as @Rahul Govindan you seem to already have the NAT rule. HTH

RJI · ‎08-15-2019

Hi, When using the VPN client, this allows the users to access the network resources natively without having to browse the webpage, providing the users with a similar user experience if connected to the local LAN. The VPN client this allows you to run posture checks to ensure the health of the computer, by determining whether applications such as Anti-Virus, Anti-Malware or Local Firewall are running on the computer before permitting access to the network. HTH

RJI · ‎08-14-2019

Hi, You could configured SNMP on the ASA and then use your Network Management software, (such as Solarwinds) to poll the ASA regularly. This will provide historical stats of interface usage. HTH

RJI · ‎08-14-2019

Hi, You change your password for the community by going to the main www.cisco.com website. In the top right corner of the webpage, if logged in to the site already, click "Manage Profile" then click "Security" and "Edit" to change your password. HTH

RJI · ‎08-14-2019

If I understand you correctly, ASA1 is only connected to ISP1 and ASA2 is only connected to ISP2? When you say ASA in HA do you mean Active/Standby failover? If yes, obviously the configuration is replicated between the 2 devices and there will be 1 interface down on each ASA. So you could connect a switch on the outside interfaces and then connect to the ISP, so at least both ISPs will be reachable on both interfaces on both ASA. Or potentially not monitor the interface on the respective ASA. So when ISP1 fails and the ICMP probe fails, yes it will failover to ISP2. HTH

RJI · ‎08-14-2019

You would define the IP address and nameif on another interface, which is connected to the 2nd ISP.

RJI · ‎08-14-2019

Hi, You can configure IP SLA to monitor the first ISP, in the event of failure failover to the 2nd ISP. In the example below traffic uses ISP1 via OUTSIDE_1 interface until the icmp probe to 1.1.1.254 fails, it which point the default route is removed and the route via ISP2 is used for all traffic. sla monitor 1 type echo protocol ipIcmpEcho 1.1.1.254 interface OUTSIDE_1 threshold 1 frequency 5 sla monitor schedule 1 life forever start-time now track 1 rtr 1 reachability route OUTSIDE_1 0.0.0.0 0.0.0.0 1.1.1.254 1 track 1 route OUTSIDE_2 0.0.0.0 0.0.0.0 2.2.2.254 100 You would need a dynamic NAT for each interface nat (INSIDE,OUTSIDE_1) after-auto source dynamic any interface nat (INSIDE,OUTSIDE_2) after-auto source dynamic any interface You would obviously need the relevant ACL configured on the outside interfaces. HTH

RJI · ‎08-14-2019

Yes. access-group OUTSIDE_IN in interface Outside

RJI · ‎08-14-2019

Hi, Here is an example of static NAT, you'll need 1 static NAT entry for each device if you want to ping inbound from the outside. You wouldn't normally do that, unless it was for DMZ hosted services. object network SWI-1 host 10.10.0.1 nat (INSIDE,OUTSIDE) static 1.1.1.111 object network SWI-2 host 10.10.1.1 nat (INSIDE,OUTSIDE) static 1.1.1.112 access-list OUTSIDE_IN extended permit icmp any object SWI-1 echo access-list OUTSIDE_IN extended permit icmp any object SWI-2 echo If you were just pinging from in inside to outside you would only need 1 dynamic nat rule. HTH

RJI · ‎08-14-2019

Hi, Use the command "fixup protocol icmp" to enable inspection for icmp, this will allow icmp requests from inside to outside to be permitted. If you want to ping from the outside to inside, it depends, you would probably need to create a static NAT and then permit the traffic on the inbound ACL on the outside interface. HTH

Date Registered	‎12-05-2010 06:35 AM
Date Last Visited
Total Messages Posted	1,970
Total Helpful Votes Received	2467

Re: SSL VPN to IPSEC traffic

Re: SSL VPN to IPSEC traffic

Re: AWS IKEv2 Issues

Re: web server cant be reachable from i...

Re: Cisco AnyConnect - syslog

Re: FTD VPN site-to-site route FTD to r...

Re: webvpn vs client vpn

Re: CISCO ASA BW Usage on Outside Inter...

Re: Change password for this site?

Re: ASA in HA, with different ISPs

Re: ASA in HA, with different ISPs

Re: ASA in HA, with different ISPs

Re: Allowing Ping

Re: Allowing Ping

Re: Allowing Ping