ASK THE EXPERTS - TROUBLESHOOTING ASA, PIX, and FWSM

[ciscomoderator]

Welcome to the Cisco Networking Professionals Ask the Expert conversation. This is an opportunity to learn how to address and troubleshoot common problems with Adaptive Security Appliances, Private Internet Exchange and Firewall Service Modules with Kureli Sankar.  Kureli is an engineer supporting Cisco's firewall team in Research Triangle Park, North Carolina. Her team supports the Cisco Adaptive Security Appliance, Firewall Services Module, Cisco Security Manager, the Content Security and Control module, and the Zone Based Firewall module in Cisco IOS Software.

Remember to use the rating system to let Kureli know if you have received an adequate response.

Kureli might not be able to answer each question due to the volume expected during this event. Our moderators will post many of the unanswered questions in other discussion forums shortly after the event. This event lasts through July 30, 2010. Visit this forum often to view responses to your questions and the questions of other community members.

[jgunawardhana]

Hi Kureli,

yes the communication failure is only few seconds  and it recovers by it self. there is no much traffic on this interface and it is not the busiest interface.

Thanks Janaki

[Kureli Sankar]

Janaki,

Pls. make sure this port is configured for specific speed and duplex that matches on the switch end. Make sure there are no errors. Besides that spanning tree toplology change that you mentioned may be causing this.  Verify if the time that a topolgy change occured matches with the time of the logs. Enable "logging timestamp" on the ASA.

-Kureli

[Kureli Sankar]

Yes, load balancing can be done between two or more ASAs. They can share the load at the same time. Cisco has tested up to ten nodes in a load-balancing cluster.

To implement load balancing, you group together logically two or more devices on the same private LAN-to-LAN network, private subnet, and public subnet into a virtual cluster.

Here is the configuration example: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805fda25.shtml

Refer this link as well: https://supportforums.cisco.com/docs/DOC-5964;jsessionid=300A4842A77445415BE985BD497CFBB2.node0

-Kureli

[joe-vieira]

Please let me know about public certificates and load balancing.

Also, another question. We use RDP plug-in for clientless ssl vpn to access terminal servers after authentication but sometimes it doesn't connect and stays in a loading state for active x, or we get Java errors. Is there a list of minimum requirements for this feature to work seamlessly? What would be troubleshooting procedures for this?

Thanks

[Kureli Sankar]

Joe,

I checked with our VPN engineer.  The units can share the same cert. Here is the procedure:

Best Practice Requirement with UCC:

One Unified Client Certificate (UCC) with multiple CNs/SANs (Subject Alternative Name extensions) for each ASA FQDN/IP .

So you need a UCC certificate with the CN for master FQDN or IP, and SANs for each ASA: for ASA-1 FQDN or IP, ASA-2 FQDN FQDN or IP, and so on.

Several vendors support UCC:godaddy.com, entrust.com, verisign,etc.

Note: the ASA cannot generate a CSR with multiple SANS (CSCso70867 ), so you have to have the PKI vendor submit the enrollment for you.

Procedure for deploying UCC:
General Steps:

1. On ASA master configure one trustpoint '' pointing to the virtual/cluster. All ssl outside and ssl outside vpnloadbalanced pointing to that trustpoint
2.Then export that trustpoint as pkcs12
3.Then import the pkcs12 to each ASA member of the cluster
4. configure all ssl outside and ssl outside vpnloadbalanced pointing to the imported trustpoint ''.

Regarding troubleshooting the RDP plugin, our VPN engineer recommend that you open a case with the VPN team as it is pretty involved. It appears the following data may have to be collected.

1) Is the issue seen with an ASA upgrade or is this a new deployment?
2) Is the ASA added as one of the trusted sites in the client's browser?
3) What is the version of the current installed plugin?
4) What type of certs are installed on the ASA: self-signed or third party?
5) Is this an issue with XP SP3 and VISTA SP1?
6) Is the customer trying to RDP into a Vista?
7) Please capture the configuration including SSL versions/settings
8) Enable the event logs for RDP ActiveX?
9) Are there any proxy servers between the client and or ASA?
10) Java debug info:
11) ActiveX debug info

-Kureli

[jgunawardhana]

Hi ,

I have a ASA5550 Failover pair on one of the sites. it failsover regularly and the error message it gives is that it fails the communication to standby on a interface. for the moment I diabled monitoring on that interface so that it will not failover. is there any way I can check whether it fails the communication on that interface  to the standby unit please? I checked all the interfaces on the switches in related to this problem and I couldn't find any port error on any of them. But I saw some spanning tree topology chages. Can there be any connection between spanning tree convegence and this firewall failover issue please?

Thanks,

Janaki

[Vikram_Anumukonda_2]

Hi,

I am running FWSM 3.1(8) and can't find the "inspect ipsec-pass-thru" command.

Is it not supported in FWSM ? if it's not can you suggest any alternate ways of achieving this functionality.

Thanks,

Vikram

[Vikram_Anumukonda_2]

<< apologies for posting twice , replied to the wrong thread first time  >>

Hi kusankar,

I am running FWSM 3.1(8) and can't  find the "inspect ipsec-pass-thru" command.

Is it not supported in FWSM ?  if it's not can you suggest any alternate ways of achieving this  functionality.

Thanks,

Vikram

[Kureli Sankar]

Vikram,

This command "inspect ipsec-pass-thru" is available only in the ASA/PIX platform not in the FWSM. Pls. allow ESP via acl for VPN traffic through the FWSM.

Here is the FWSM command reference:

http://www.cisco.com/en/US/docs/security/fwsm/fwsm41/command/reference/i2.html

Here is the ASA command reference:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i2.html#wp1740887

-Kureli

[Ganesh Hariharan]

Welcome to the Cisco Networking Professionals Ask the Expert 
conversation. This is an opportunity to learn how to address and 
troubleshoot common problems with Adaptive Security Appliances, Private 
Internet Exchange and Firewall Service Modules with Kureli Sankar.  
Kureli is an engineer supporting Cisco's firewall team in Research 
Triangle Park, North Carolina. Her team supports the Cisco Adaptive 
Security Appliance, Firewall Services Module, Cisco Security Manager, 
the Content Security and Control module, and the Zone Based Firewall 
module in Cisco IOS Software. 
Remember to use the rating system to let Kureli know if you have received an adequate response.
Kureli
 might not be able to answer each question due to the volume expected 
during this event. Our moderators will post many of the unanswered 
questions in other discussion forums shortly after the event. This event
 lasts through July 30, 2010. Visit this forum often to view responses 
to your questions and the questions of other community members.

Hi,

I would like to have suggestion from you regarding best method to approach or tackle problem realtes to ASA or FWSM,like how to procede and how to capture the traffic in interface wise to troublehsoot the problem.

Ganesh.H

[Kureli Sankar]

Ganesh,

We need to collect syslogs, debugs and captures  - all of them simultaneously to address most problems.  Debugs may be needed in case of voice issue but, we most certainly need syslogs in debug level and captures during the time of the problem.

You can apply captures right on the FWSM. Here is the link: https://supportforums.cisco.com/docs/DOC-1222

When traffic breaks or fails, you need to apply capture on both the ingress and egress interface so, we can look at the captures and make sure that the FWSM processed all the packets that it received for that session and sent them out the egress inteface.

-Kureli

[jill.johnson]

Kureli,

I want to migrate the configurations from the VPN 3005 Concentrator to the ASA 5550.  Does Cisco provide a tool for migration or do I need to create the config manually?  Thanks.

Jill

[Kureli Sankar]

Jil,

Unfortunately there isn't a customer facing tool to convert the VPN3005 config to an ASA5550.

https://supportforums.cisco.com/thread/263200?tstart=0&viewcondensed

-Kureli

[dianewalker]

Kureli,

I attended your Troubleshooting Common Firewall Products on Tuesday, July 20  under Cisco Live and Networks.  I would like to know if the presentation and Q&A are available on demand.  Your presentation was great and I missed the first 30 minutes of the presentation and would like to review it again.

Thanks.

Diane

[dianewalker]

Kureli,

Please ignore my question.  I have found your session on Cisco Live and Networkers. Thanks.

Diane