cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
21416
Views
48
Helpful
112
Replies

ASK THE EXPERTS - TROUBLESHOOTING ASA, PIX, and FWSM

ciscomoderator
Community Manager
Community Manager

Welcome to the Cisco Networking Professionals Ask the Expert conversation. This is an opportunity to learn how to address and troubleshoot common problems with Adaptive Security Appliances, Private Internet Exchange and Firewall Service Modules with Kureli Sankar.  Kureli is an engineer supporting Cisco's firewall team in Research Triangle Park, North Carolina. Her team supports the Cisco Adaptive Security Appliance, Firewall Services Module, Cisco Security Manager, the Content Security and Control module, and the Zone Based Firewall module in Cisco IOS Software.

Remember to use the rating system to let Kureli know if you have received an adequate response.

Kureli might not be able to answer each question due to the volume expected during this event. Our moderators will post many of the unanswered questions in other discussion forums shortly after the event. This event lasts through July 30, 2010. Visit this forum often to view responses to your questions and the questions of other community members.

112 Replies 112

Mohamed,

Unfortunately we cannot load balance or do PBR (policy based routing) on the ASA.

Read this thread that I have answered in the past: https://supportforums.cisco.com/message/894920

We can only do SLA route tracking meaning if the primary internet cirucuit goes down, traffic will automatically use the backup internet circuit.

You can view this link: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

-Kureli

Hi Kureli.

The ASA 8.2 documentation suggests you can load balance between 2 ISPs.

Please see the following:

 

 

Configuring a Default Static Route

A default route identifies the gateway IP address to which the adaptive security appliance sends all IP packets for which it does not have a learned or static route. A default static route is simply a static route with 0.0.0.0/0 as the destination IP address. Routes that identify a specific destination take precedence over the default route.

Note In ASA software Versions 7.0 and later, if you have two default routes configured on different interfaces that have different metrics, the connection to the ASA firewall that is made from the higher metric interface fails, but connections to the ASA firewall from the lower metric interface succeed as expected. You can define up to three equal cost default route entries per device. Defining more than one equal cost default route entry causes the traffic sent to the default route to be distributed among the specified gateways. When defining more than one default route, you must specify the same interface for each entry. If you attempt to define more than three equal cost default routes, or if you attempt to define a default route with a different interface than a previously defined default route, you receive the following message: "ERROR: Cannot add route entry, possible conflict with existing routes."

Can you confirm this is correct.

Regards

Mick.

m.raey,

That documentation is correct.

1. You CAN have upto 3 default routes pointing the SAME interface. Meaning 3 routers on the primary interface.

2. You CANNOT have two default routes pointing TWO diff. interfaces in case you have two diff. ISPs and load balance (use both at the same time).

3. The only thing you can have is two ISPs for redundancy. When one fails you can have the other link kick in by SLA route tracking as you can see here:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

You cannot load balance betwee two ISPs. You can only have one as a backup to the other.

I hope it is clear. If not pls. post your question.

-Kureli

Hi Kureli - I am a bit confused when you say you cannot load balance.

The document says "Defining more than one equal cost default route entry causes the traffic sent to the default route to be distributed among the specified gateways."

Surely if I am distributing the traffic among more than 1 specified gateway I am doing load balancing (or more strictly speaking Load Sharing)?

Regards

Mick.

m.reay,

My apologies for not being clear in my response.  When the document says you can load balance - you can only load balance upto 3 routers off the same interface.  Like the following:

possible:

route outside 0.0.0.0 0.0.0.0 192.168.1.1

route outside 0.0.0.0 0.0.0.0 192.168.1.2

route outside 0.0.0.0 0.0.0.0 192.168.1.3

When you have two ISPs both of them would be different interfaces. It is not possible to load balance. In this case your default route will be

not possible:

route Primary 0.0.0.0 0.0.0.0 192.168.1.1

route Secondary 0.0.0.0 0.0.0.0 10.10.1.1

Isn't it your intention to utilize both the ISPs at the same time (load balance)? In which case you would have to configure two default routes which is not supported. When you have two ISPs and two default routes out two different interfaces, we can only do SLA route tracking meaning when the primary route goes down, the secondary route will kick in (we would add the secondary default route with a higher metric).

possible with SLA route tracking:

route Primary 0.0.0.0 0.0.0.0 192.168.1.1 1 track 1 ----------->metric 1

route Secondary 0.0.0.0 0.0.0.0 10.10.1.1 254 ---------> higher metric

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

-Kureli


m.reay

Mohamed Sobair
Level 7
Level 7

Hi Kureli,

I would like to know the major different in the Architecture between ASA and pix? I know there is bugs fixed on the new IOS released in the ASA and some fetures license has been added also. Is this Only the major difference or there is some thing else? could you please rename it?

Thanks!

Mohamed

Mohamed,

Cisco has announced EOL and EOS for PIX. The last code that is available for the PIX platform is 8.0.4(32).

http://www.cisco.com/cgi-bin/tablebuild.pl/pix-interim

We are not doing any development work on the PIX code. No more bug fixes or anything. If the customer's encounter a new defect on the PIX code, they would have to upgrade the hardware to an ASA in order to get the fix for the defect.

Here is the PIX EOL-EOS link:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_eol_notices_list.html


Here is the 6.3.x code.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5709/ps2030/end_of_life_notice_for_cisco_pix_sec_app_v63.html

PIX and ASA are completely different hardware. The ASA's can take either a CSC or an AIP module but the PIX cannot.

Data sheet for PIX: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_data_sheets_list.html

Data sheet for ASA: http://www.cisco.com/en/US/partner/products/ps6120/products_data_sheets_list.html

Now, prior to 8.x code you can simply load pix724-25.bin on an ASA and vice versa but, since 8.x the file size differs and you cannot load one code on the other platform.

For example - see the file size exactly same in 7.x code

asa724-k8.bin
Release Date: 07/Apr/2008
Cisco Adaptive Security Appliance Software version 7.2(4) software. Read Release Note prior to downloading this release.
Size: 8316.00 KB  (8515584 bytes)


pix724.bin
PIX OS version 7.2(4) software.
7.2.4     07-APR-2008     8515584

For example - see the file size difference in the 8.x code.

7538688 pix 8.0.4
14137344 asa 8.0.4

-Kureli

scootertgm
Level 1
Level 1

I am setting up a ASA 5510 that will have users connection via IPSec client  to access a restricted area.  I need to allow then to split tunnel to a few  local resources.

I have tried to use group policy, but the ACL's for the option of exclude the  following networks is a standard ACL.  My challenge is I need to block access to  specific ports on servers to prevent internet access while allowing the PC to  communicate on other ports.

For example, client A coneects to the VPN.  It needs to be able to connect to  a server with ip 10.10.10.15 for printing and updates.  However, that server  also hosts a proxy server that uses port 8080.  I need to prevent the PC from  hitting 8080 on that server.

I have tried a filter on the VPN group but it does not work.

Any ideas?

You have done the right thing. VPN filter is the way to go.  That should work.

Make sure you follow this: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml#configs

Let me know if the deny in this access-list doesn't work.

-Kureli

mbroberson1
Level 3
Level 3

Hi Kureli,

First off thank you for having this "ask the experts" discussion. I always enjoy reading through the many questions.

Regarding the ASA 5520/5510 what are some possible reasons while all of a sudden RA VPN IPSec or AnyConnect users cannot establish a VPN connection? Assuming things (memory/CPU/licensing, etc...) on the ASA seem normal.

For example, at any given time you have on average 30 combined (IPSec/AnyConnect) RA VPN clients and all of a sudden no one can connect. Users that are established seem to maintain their connection, but new sessions cannot be established. The health (memory/CPU/licensing, etc...) all seem perfectly normal on the ASA. To fix/work around the issue you typically have to clear all vpn IPSec/AnyConnect sessions.

Any suggestions on where to start the troubleshooting?

Thanks,

Brandon

Brandon,

Glad to hear that you enjoyed the session. There are sooo many topics that we could cover in the future. Due to limited time, I picked a few most common ones that we see in the forum on a daily basis for my session.

What you see is very interesting.  When no more users can connect, what syslogs do you see on the ASA and what does the vpn client logs say?

-Kureli

Hi Kureli,

I think I may be hittng a bug with when somtimes vpn clients cannot connect. We are going to upgrade next week to see if it resolves the issues.

Heres the bug:

CSCtb01577

ASA unable to assign IP address for VPN client from DHCP intermittently


The bug is fixed in 8.3.1, we are on a 8.0(4)k8.

Thanks,

Brandon

Nice bug CSCtb01577. Glad you found it.


Good luck with the upgrade. Bug is resolved in 008.002(002.001)          008.001(002.039)          008.000(005.006) .

You can upgrade to 8.2.2.x --> latest to get the fix.

8.3 has nat completely re-designed (simplified!). You would be up for a surprise and it is a slight learning curve to get used to the new syntax.  Unless you are looking for new features, I'd just stick to 8.2.2.18 (I believe) if you are just looking for the fix for the above bug.

-Kureli

Hi Kureli,

Thanks for the info about the nat changes in 8.3. It's just the bug I would like to fix for now. Do you know where documentation about the nat changes/differences in 8.3 can be located?

Regards,

Brandon

Hi Kureli,

Never mind, I found the 8.3 doc and the changes regarding nat.

Thanks,

Brandon