Cisco Firewall :: 5505 - How To Apply Policing On ASAs With Leased Lines

Jul 2, 2012

I'm trying to configure policing and/or shaping on a setup of 2 x ASA 5505 Sec Plus. The units are placed in office A and office B and each have a ISP connection to the internet and a leased line with a capacity of 4/4 Mbit/s for interoffice communication.
 
On each ASA there's four subnets. VLAN 200 is used to connect the offices through the leased line.
 
Subnets:
Outside = 2
Data = 10
Voice = 100
Linknet = 200
 
I've read a lot of articles and posts about shaping and policing on the ASA but still can't get it to work like I wan't to. I'm trying to limit all traffic besides IP-telephony traffic to 3 Mbit/s and thus reserving 900 Kbit/s for voice traffic. I tried setting a service-policy on the linknet interface on each ASA and set Traffic match to Any traffic and QoS settings for both input and output.
 
I can see traffic passing the policy when I run the "show service-policy police" command but it never seems to be high enough to be policed which is strange since the ASDM monitoring shows that I'm pushing 3900 kbit/s. I file transfers verifies that policing does'nt work.

View 2 Replies


ADVERTISEMENT

Cisco Switching/Routing :: 2951 / 2 Leased Lines In LAN Network

Oct 24, 2011

My current setup.
 
Layout:
 
Line01              Line02        
     |                    |
Cisco 2951     Cisco 2951
     ---------------------
               |
     Cisco 3750G - Server #1 & #2 for domain controller, sharepoint, etc
               |
     ---------------------
     |                    |
Cisco 2960     Cisco 2960
     | | | | | | | ... | | | | |
workstation #1, #2, .... #70
 
And I would like to ask some opinion on the best configuration for the above layout:

1. Configuration #1 - Using load sharing and automatic failover So I want to ask whether there's any link/url that provides details/guides on how to setup the load sharing and failover?
 
2. Configuration #2 - Workstations 1 - 35 will be routed through Line01 gateway and workstations 36 - 70 will be routed through Line02 As for this configuration, it's done now. However, I want to know whether there's any software (preferred web based application which allows me to change the gateway from line #1 to line #2 for all 70 computers instead of having to go to each workstation to update the gateway).

View 1 Replies View Related

Cisco Firewall :: QoS Policing Configuration On An ASA 5505?

Jun 10, 2013

I'm working on QoS policing configuration on an ASA 5505.The ASA is situated behind a cable modem which provides an SLA of 3.2Mbps out.I've configured a QOS policy to place VoIP and other essential traffic (RDP/Citrix/PCoIP) into a priority queue, whilst policing default class to 3.2Mbps to police out to the cable modem.I can see on the outside interface graphs that this is rating the output traffic down to 3.2Mbps as expected, but noticing at certain points of high output traffic drops down to 1.6Mbps.  I can't see anything obvious in syslog or any other areas to look, so looking for any pointers as to why the speed is suddenly dropping down.  Likewise if I rate the output to 2Mbps, it will suddenly drop down to 1Mbps at high output rates.the ASA is running on 8.0(5) and I enclose a copy of the sample QoS config below and attached a sanitized run config, as well as screenshot taken of the outside interface Bit Rates plus service-policy.
 
access-list VoIP-Traffic-OUT extended permit tcp 172.16.6.0 255.255.255.0 host 68.98.217.252 eq h323
access-list VoIP-Traffic-OUT extended permit udp 172.16.6.0 255.255.255.0 host 68.98.217.252 object-group rtp
access-list VoIP-Traffic-OUT extended permit tcp 172.16.6.0 255.255.255.0 host 68.98.217.252 eq 2000  
access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 3389
access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq citrix-ica
access-list VMs-Traffic-Out extended permit tcp 172.16.6.0 255.255.255.0 192.168.168.0 255.255.255.0 eq 4172

[code]....

View 6 Replies View Related

Cisco Firewall :: 5505 / 5585 - Licensing Change On ASAs

Jan 16, 2013

I just learned that the licensing structure for the ASAs is changing, but I don't have any details. We have roughly 30 ASAs (from 5505s to 5585s).  If there's a licensing change, I need to do an impact assessment and plan accordingly. 

View 5 Replies View Related

Cisco WAN :: HWIC 4ESW Need To Configure Point To Point Data Dual Leased Lines

Jan 18, 2012

We have 1841 router with HWIC-4ESW we need to config point to point data Dual leased lines failover concept please find attached diagram.

View 3 Replies View Related

Cisco VPN :: 5505 - EasyVPN Between Two ASAs

Oct 18, 2012

I've two sites, the branch with an ASA 5505 and on the corporate office i've an ASA 5510.I need to make a easy vpn tunnel between this to sites and I've made some configuration, but for now, the ikev1 isn't working.

View 1 Replies View Related

Cisco :: VPN Failover Two 5505 ASAs To 5510

Feb 17, 2013

I'm looking for automating a couple failover scenarios. Both VPN redundancy and black hole internet traffic redundancy.I currently use the more reliable T1 connection for the VPN connection and the DSL for internet traffic.My current configuration is working but requires a manual update to get the VPN or black hole back up and operational when either link fails.
 
[code]....

View 7 Replies View Related

Cisco VPN :: 5505 / IPSec VPN Between ASAs With Same Subnet For Disaster Recovery

Feb 9, 2012

We have to make disaster recovery site EasyVPN tunnels on Cisco 5505 ASA firewalls. Now there is only one main site and 3 remote sites.For DR we have to use the same subnet as it is on the main site because the Vmware virtual machines will be replicated to DR.For DR we are using Double Take software.What is the best solution for this? I think that we could use Destination NAT on ASAs. The other sites (HQ and remote) will se only the NAT address of theDR and not the real one which is the same as on the main site.We are using IPSec VPN? In packet-tracer on ASA I see that the packet is first NATed and then encrypted, so it should work, yes?

View 2 Replies View Related

Cisco Firewall :: 1841 / Failover Between Leased Line And VPN

Jul 15, 2011

I am going to design one network. I had queries with this design.Let me explain scenario first( it was attached below).I have two sites, Site-A and Site-B, repectively.

In site-A i have one Cisco 1841 router, one Cisco ASA 5510 firewall and One cisco 3560 layer 3 switch.
in site-B i have one Cisco 1841 router, one Cisco ASA 5505 firewall and One Cisco 3560 layer 3 switch.

From ISP side

I have point-to-point leased line between sites A and B. And both sites have internet connectivity from another ISP.

I planned to terminate leased line in cisco 1841 router in both branches for branch to branch connectivity.

I will configure site to site VPN between two sites, A and B.

Here my query was i want make VPN as failover connectivity if leased line fails. In both the cases, i need internet to the inside users in both sides.

Summary requirement:Leased line is Primary and VPN is Back-up, if leased line fails. In both cases internet is needed to inside users.

View 3 Replies View Related

Cisco VPN :: Site To Site Route ASAs 5505

Aug 1, 2011

I have site-to-site VPN using two ASAs 5505. I can ping between two computers C1 and C2. Now I want to add subnet 192.168.1.0. How do I configure routes on ASA so that I can ping between computers C3 and C2?

View 5 Replies View Related

Cisco Firewall :: 5510 QoS Policing Giving More Bandwidth

May 5, 2011

I'm working in my lab trying to do proof of concept for traffic policing on the ASA 5510 running 8.0(4).  I have two laptops running Ubuntu one on the outside and one on the inside.  Both laptops have 100Mbps interfaces.  My tests consists of downloading a file from one laptop using HTTP.  Without any QoS I can see speeds close to 100Mbps which I would expect.  On a side note, try using XP and you won't come close to those speeds.  Anyhow,  I implement policing using the config below and expect to see the max rate on the laptops during the transfer max out close to the CIR.  However, I see speeds much higher on the laptops.
 
When I set the CIR to 10000 bps with bc at 1500 bytes I get speeds that range from 300Kbps to 700Kbps.  I would expect to see speeds max out at the CIR which would be 10Kbps.I'm having a hard time understanding why my numbers don't match.

View 6 Replies View Related

Cisco Firewall :: 5515x Apply On Firewall / Switches To Make Implementation Successful

Apr 22, 2013

I will be implementing a new firewall (cisco asa 5515x) on my existing  3750x (server switches) and my 2960s (user switches). What should I need to apply on my firewall and swtiches to make the  implementation successfull.  I will put my 3750x as my DMZ and my 2960s  as my inside.  The 3750x have multiple subnet and also the 2960s.which  features and technologies i need to know on those 3 products.  my 3750x  and 2960s don't have any ACL defined and most common features are vlan,  switchport, trunking, spanning-tree, stacking, vtp.how  my asa knows that my 3750x/2960s have multiple vlans.  my current  connection right now on 3750x and 2960s is just through 6 ports i  assigned as one trunk, below is my config [code]

my  2960s vlans are almost the same with my 3750x except vlan 160, 170,  192.  but of course when i put this in asa, i have to segragate vlan for  3750x (192, 100, 110,160, 170) and 2960s (130, 150).  for my 2960s  connection to the asa and since this will have big bandwidth, i will use  3 ports on my asa (and trunk it) connecting to my 2960s and i will use 2  ports on my asa (and trunk it) connecting to my 3750x.  the one  internet ports and my one management ports on my asa will stay like  that.

View 2 Replies View Related

Cisco Firewall :: 5510 - Connections Routing Between Two Internal ASAs Fail

May 19, 2012

We have a site with two inbound circuits, one for internet and one for our MPLS.  Each circuit is being terminated by a 2921 Router and matching ASA 5510 Firewall.  For the internal network, the Internet ASA's inside interface (172.16.0.1) is the default gateway for all hosts.  OSPF is the routing protocol between all the routers and ASA's and routing is working.  In fact, ICMP is working as well.  From an inside host (172.16.0.81), we can ping anything on the MPLS network.  But when I try to use telnet (for example), the connection fails.  If I add a route to 10.10.10.0 to the host, or re-configure the host to point to the MPLS ASA (172.16.0.254) as it's default gateway, connections will establish.
  
Both ASAs are running 8.4(3), and have the following commands:
 
same-security-traffic permit intra-interface
interface Ethernet0/0
nameif outside

[Code]....

And from the MPLS nodes, I can see a tcp request is made. 

View 6 Replies View Related

Cisco Firewall :: Zero-downtime DRAM Upgrade Of Failover Pair Of 5510 ASAs

Apr 12, 2011

I need to upgrade the active/standby failover pair of 5510 ASA's to have1 Gig DRAM each, and I am trying to plan out the upgrade process. I'm looking for a zero downtime upgrade process.
 
I know that the failover pair has to have the same amount of memory, so how do I perform a zero-downtime upgrade process?Can I power off the standby unit and upgrade it's memory first? Or will it cause a memory mismatch between the active and standby units when it is powered on?

View 2 Replies View Related

Cisco Firewall :: 5510 How To Configure Local LAN SMTP Traffic Sending Through New Leased Line

Jun 11, 2012

We have configured ASA 5510. We have configure Ethernet 0/0 ( Outside ) connected with ADSL line and Ethernet 0/1 ( Inside ) Local LAN. we have configured NAT and all the traffic is passing through outside interface. Now we have connected ethernet 0/3 ( leasedline ) interface with static public IP. Now we want to allow  SMTP traffic to pass through  from this interface.
 
How to configure it if we want our local lan SMTP traffic sending through new leased line ( Static Public IP ).

View 2 Replies View Related

Cisco Firewall :: Dual DSL Lines For 5510?

Jun 13, 2011

My remote office staff are stating it takes "forever" to open simple work/excel files.I think forever really means more than 5 seconds.My main office has a 5510.  I have a brand new server in place here that my remote offices vpn into.
Those remote offices have 5505.
 
Each office has a dsl connection.  Their download speeds range from 7mb to 10 mb and their upload speed are 0.5 mb to 0.8 mb.My first thought was to add a second dsl line to my main office.  Then have dsl line #1 serve my main office and office 2.Then have dsl line #2 serve offices 3, 4 and 5.
 
Would this speed up the opening speeds of my remote offices?If so how challenging is adding the second dsl line into my 5510?

View 1 Replies View Related

Cisco Firewall :: 5520 Why Does Dynamic Policy NAT Rule Apply

Jun 4, 2013

we have a nat exemption rule for 10.0.0.0/8 to w.x.y.z followed by some static nat rules and then dynamic policy nat rule for 10.0.0.0/8 to w.x.y.z natting to IP a.b.c.d.When I do a packet trace from 10.10.10.10 to w.x.y.z, it shows the packet first matching against the nat exemption rule, and then immediately afterwards it matches the dynamic policy NAT rule. The static nat rules are being successfully bypassed (which is what I want), but why does the dynamic policy nat rule apply if an exempt rule has been hit already? An actual test between the IPs above reflects the result of the packet tracer as well (IP a.b.c.d is seen on server w.x.y.z).We are running the following software on an ASA5520.

View 7 Replies View Related

Cisco Firewall :: 5550 - Apply New Startup Configuration To ASA Active Member?

Jun 17, 2012

I have pair of ASA 5550 and I am trying to copy a new config to my member1 (active) as the new configuration I want to use for the pair.  I want to copy this to start-up config on member1 and then reload member1 and have it copy the same config to member2 (stdby).  I guess I am trying to understand if I copy the configuration to member1 and reload it, member 2(stdby) will have become active and try to copy the old configuration to member1 which I do not want. 
 
get the commands straight that I need to execute to make sure the new startup config gets to both members without being overwritten?

View 1 Replies View Related

Cisco Firewall :: ASA5550 - Implement Traffic Shaping / Policing Primarily For P2P Traffic?

Mar 10, 2011

We are looking to implement traffic shaping/policing primarily for P2P traffic. As natively the ASA5550 is only capable of p2p inspection if the traffic is tunneled via port 80 is the AIP-SSM the way forward? We have 2 5550s in active/active failover config. As a side note we are also looking to implement an IDS/IPS system so could this module cover all?Is this module going to provide the desired outcome or is there another module/device out there better suited for this? I would prefer to use the ASA5550s as opposed to implementing another product if only that we can make use of the investment we already made on these devices.

View 1 Replies View Related

Cisco VPN :: L2L VPN Between ASAs 8.4(1) Dynamic To Static?

Feb 8, 2011

I've deployed L2L VPN between ASA's dynamic to static in a hub and spoke format.Everything works great if you are on a spoke ASA and you need to go to the hub but you can not go from the hub to spoke.
 
I'm using ASA code version 8.4(1) ... Below is what I have so far...
 
HUB
 
crypto ipsec ikev1 transform-set ts-dyna esp-aes-256 esp-sha-hmac crypto dynamic-map dm-dyna 65000 set ikev1 transform-set ts-dynacrypto dynamic-map dm-dyna 65000 set reverse-routecrypto map cr-vpn 65000 ipsec-isakmp dynamic dm-dynacrypto map cr-vpn interface outside
crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 lifetime 86400
tunnel-group DefaultL2LGroup ipsec-attributes ikev1 pre-shared-key *****

[code].....
 
Is there any way to apply a crypto map on the Hub side to encrypt the traffic to the spokes?

View 4 Replies View Related

Cisco WAN :: Policing On 7613 SVI?

Aug 4, 2011

We have built some policers to apply to vlan SVIs on our 7613 so that we can rate limit input and output traffic.  We followed the Cisco formula and got this.
 
policy-map vlan-shape-3meg
  class class-default
   police cir 3000000 bc 562500 be 1125000    conform-action transmit     exceed-action drop     violate-action drop
  
There have been some complaints about this not actually meeting the limit.  When I do a show policy-map interface xxx I get this.  Based on that it looks like the Be value is being change to match the Bc value. 
 
On a separate note, I noticed that every policer we built with the cisco formula actually ends up with a Tc greater than the max Tc of .125 seconds. It seems odd that a recommended formula would end up creating values outside the maximum allowed limits by the software.
 
I'm not a QoS expert so if any of this seems like basic stuff it's just because I'm a little slow on QoS.   
 
Vlan2
   Service-policy input: temp-remove
   class-map: class-default (match-any)
Match: any
police :

[code]....
 
One other thing...in order to apply policers input and output on an SVI does mls qos vlan-based have to be configured on the trunks tagged with the corresponding Vlan?

View 1 Replies View Related

Cisco VPN :: 5520 ASAs - IPSec VPN Clients Not Being Able To Connect

Aug 25, 2011

I am currently having some problems on our 5520 ASAs. The problem is the IPSec VPN clients not being able to connect. We have had an issue twice this week where this happened. Earlier in the week we had folks not able to sign in, but some folks who were connected already stayed connected. The ASAs had been up for 200+ days and no changes have been made to it recently. At that point I had to reload the ASAs so users could start signing back in to it. Today we had a similar issue, but I didn’t have to reload the ASAs. The issue‘resolved’ itself. The VPN clients are getting Error code: 433 and the ASAs are getting Reason: Peer Address Changed when this occurs.
 
ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz version 8.3.2.

View 5 Replies View Related

Cisco VPN :: 6513 / 7206 - Dual ISP Failover With Two ASAs That Are Not HA

Dec 4, 2012

I am having a hard time getting tunnel fail over working.  My setup is illustrated below:
 
I derive my default route on the border routers.  The 6513 peers with the 7206's using BGP to get the default route from each ISP into the core.   On the core I use BGP weighting to get my primary default to point to ISP1.  So far so good.  When I look at my core I see to defaults with ISP1 preferred.
 
Each ASA has an IP Sec tunnel to the head end site configured (Not shown).  The head end site has a crypto map entry with ISP1 and ISP2 defined (in that order) using the "set peer" command.
 
Fail over works great if an ISP drops the connection or my 7206 or ASA fails, but... While testing fail over I had an issue where both tunnels would be active and there were issues with traffic between sites. I could not determine the root cause.  I can only guess that some traffic was going out one tunnel and when trying to come back across the other tunnel was dropped from the firewall because there was no connection built for it.  After reading I found that in order to use multiple peers in the "set peer" statement, I needed to configure my head end as "originate-only".  I have not done this yet as I have concerns.  If the head end site is "originate-only" and the tunnel, for whatever reason drops, I cannot wait for interesting traffic at the head end site bound for this site to bring up the tunnel as most of the traffic originates at this site.
 
I have been reading about IKE keep alives and DPD but that doesn't sound like it will re-initiate the tunnel.  Is this correct? If so I'm looking for a way to make this work. 

View 10 Replies View Related

Cisco WAN :: QoS Policing / Shaping For ASA 5510

May 28, 2013

We are looking to implement a bandwidth policy for our Internet link.  What i would like to know is if we use a policing policy, will the exceeded dropped packets be resubmitted from the source?  Will the dropped packets be resubmitted?  Are there any differences besides this when using either policing or shaping policies?  Is one better than the other?
 
CISCO ASA 5510 IOS 8.2

View 3 Replies View Related

Cisco WAN :: Configuring QoS Policing In 2911?

Sep 27, 2012

I configuring QoS policing in a Cisco 2911 in a 128K/256/512 link, but when I apply the configuration in interface I receive the error below:
 
Configured Percent results in out of range kbps.Allowed range is 8-2000000. The present CIR value is 6. 
 
Current configuration : 191 bytes
!
interface GigabitEthernet0/1
description ***V-SAT***
bandwidth 128

[Code].....

View 7 Replies View Related

Cisco :: 2911 Connecting To A Leased Line?

Aug 3, 2012

I have a cisco 2911 set up at one of my sites and it is configured with sub-interfaces as this provides a default gateway to each of the offices.I have just had a 100mb leased line put in and i have a couple of questions regarding the config.let me start by telling you how it is set up .I have 3 HP Procurve switches connected together then that connects to the Cisco and the Cisco connects to a Zywall

HP Switches > Cisco 2911 > Zywall > Internet

We are wanting to remove the Zywall and connect the Cisco to the Leased line box

HP Switches > Cisco 2911 > Leased Line > Internet

The config of the cisco is

G0/0 - is up but no cable connected as this holds the sub-interfaces
G0/1 - Connects the Zywall - 192.168.1.1 (this has firewall rules to forward traffic through)
G0/2 - Leased Line

The way i have configured the sub interfaces is with its own DHCP pool and default router, some of the offices have there own ADSL router and hold there own Internet connection and the default gateway for that is 192.168.xxx.253 and the offices that use the Cisco use default gateway of 192.168.xxx.254

Now my question is how would I move everyone onto the Leased line and get rid of the Zywall ? Would it be as simple as giving the leased line an address and put in a static route to forward all traffic through that connection ? Or am i missing a trick or 2.

View 2 Replies View Related

IP Leased Time And Losing Connection

Oct 19, 2011

I have remote access as I work at home on a government laptop that has Entrust( for security). My IP lapse time is set for 1 hour and every hour I am losing full connection due to having to sign back into Entrust. I need to be able to lenghten my lapse time on my work computer. My other two personal computers are fine with 1 hour as there is no Entrust on either of those laptops.....is it possible for me to change the lapse time to say 12 hours, 1 weeks, whatever??

View 4 Replies View Related

What Are Additional IP Address In Leased Line

Mar 31, 2011

my company has a 4mbps leased line from TTSL . we are getting 2 WAN IP and 2 LAN IP. in Addition we are also getting 12 additional IPs .-what is additional IP, their uses?-how are the 2 wan ips configured? & how they are distributed in network? -is 1 IP from the ISP sufficient if i have a 1:1 internet bandwidth connection?

View 9 Replies View Related

Configuration Of Internet Leased Line?

Dec 28, 2011

I got following IP address from BSNL to configure Internet leased line.OFC cable was terminated at our premises. it has to connect Ethernet port.Say eg.Wan IP : 192.168.1.6 255.255.255.252Public address pool : 172.168.10.6 to 12if i configure one address on Ethernet port1 as nat outside 192.168.1.6 255.255.255.252.the ip address given for wan & pool are different.Then how can i configure pool and how to configure nat inside eg 185.168.10.1 to 255the above ip are not actual ips just given for example.

View 6 Replies View Related

Cisco VPN :: 5520 - Primary And Secondary ASAs / L2L Tunnels Not Responding?

Apr 12, 2011

I have a pair of ASA5520s in active/active failover - this works fine.  Both primary and secondary ASAs are running 8.2(2) code.I  have a 30-day temp 50 seat SSL license that I applied to the primary.  I then started having problems with L2L tunnels.
 
I noted that if the 'show crypto isakmp sa' state for an L2L was MM_STANDBY, then the remote protected net could not reach my side.  However, I could ping across to the other side at which time the state changed to MM_ACTIVE as I would expect and the remote could then reach my side.
 
I believe this results from the differences between the two licenses.  When I applied the 50 seat SSL lic. it disabled failover, but I was willing to risk that for a few days to do show my customer the benifits of SSL connectivity.  Note license differences.  Is this causing the MM_STANDBY IKE issue and if so can I overcome it and use the 50 SSL VPN Peers lic.

[code]...

View 3 Replies View Related

Cisco :: Policing In Multiple Context Mode?

Jan 4, 2012

I know most QoS capabilities aren't available in multiple context mode, but I need to do some really simple policing on one of my contexts. I just want to apply a hard 20Mbps cap on an interface. I've seen a few places that suggest that basic policing is possible in multiple context mode, but apparently not by the normal commands.

View 5 Replies View Related

Cisco WAN :: ASR1001 / Traffic Policing And Shaping

Feb 25, 2012

I want to take 100Mb incoming from a service provider and police it off into several VRFs for customers.One of these VRFs will be 30M.I further need to traffic shape this (30Mb) out to 40 x 0.75Mbps (burstable to 30M) customers.
 
I am using an ASR1001.

View 2 Replies View Related

Cisco WAN :: Leased Line Connection Through ONT To 1841 Router

Jul 29, 2012

How to configure leased line from the ONT connection on Cisco 1841 router . there have public IPs on the interfaces fa0/0 & fa0/1.

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved