Cisco Firewall :: 5510 Exporting Netflow Over A IPSEC VPN
Sep 2, 2012
we have a local Netflow collector working fine. We also have a centralised collector that we’d like to use to send the same Netflow data, but it is not being received. We need to send the data via an IPSEC VPN.
When I do a 'show flow-export counters' I can see the packets sent increasing. The local collector is receive netflow data. I am using the below config,
access-list global_mpc extended permit ip any any
!
!IP far end of VPN
[Code].....
View 3 Replies
ADVERTISEMENT
Nov 29, 2012
we have a Cisco ASA 5510 8.4, this device is reachable through a lan to lan IPsec vpn. We are able to activate the netflow export (we see flow export counters incrementing), but the flow is not passing through the vpn. Our netflow collector is on the other side of the IPsec tunnel so we define it linked to the internet interface.Is the export possible through the vpn? I read in a Solarwinds forum that it should not be possible.What ip address is choosen as source interface by ASA? Is there a way to force a source interface?
View 5 Replies
View Related
Dec 19, 2012
I am currently toying around with the new release and now I want to try out the netflow feature of the WLC. I have already setup the monitor as well as an exporter. I also used the default flow record, which is actually the only one.
When I now check the data in my netflow application I only see packets with no valid source and destination IP address and with protocol 0, HOPOPT.
Is there any way to 'decode' this traffic or telling the controller to send the TCP/UDP protocol?
View 1 Replies
View Related
Oct 29, 2012
I am trying to configure netflow/flexible netflow on some branch site 887 routers which have a IPSec tunnel back to the main office. It is my understanding that the router will not encrypt traffic that it generates itself so the standard netflow will not work. The workaround I have seen is to use flexible netflow rather than standard.
I have tried to configure flexible netflow with the following configuration;
flow exporter EXPORTER-1
destination 192.168.10.1
source Vlan1
transport udp 9996
[Code]...
View 2 Replies
View Related
Jun 11, 2012
I working on a security solution using ASA firewall. Is it possible to setup a IPSec tunnels on each subinterface of a physical interface on ASA 5510?
View 3 Replies
View Related
Feb 14, 2011
I'm trying to gather netflow data over an IPSEC VPN and through my research I've learned that I need to configure Flexible Netflow. However, I have a Cisco 2801 router with the latest ROMMON and IOS and the Flexible Netflow options aren't available.
For instance:
flow exporter dwtmonitor
destination 10.0.16.172
source Loopback0
transport udp 2055
output-features
When I type "flow exporter <name>" it only allows me to enter "flow <name>" and there's no "destination" options or anything else.
ROMMON: 12.4(13r)TIOS: 12.4(25d)
View 2 Replies
View Related
Dec 6, 2011
Our customer is using multicast in their internal network for their IP video deployemnt. Internallt on the network everything is working great.
We have two folks in management who want to be able to view the live multicast video feeds of the cameras remotely. I have tried to accomplish this using the Cisco VPN client. Although VPN connectivity is good (we can ping the individual cameras) they are unable to view the live multicast feeds. I enabled multicast globally on the ASA and the inside interface and get the same results.
Is there a way for the ASA to support the remote IPSec VPN client to view the multicast strams?
View 1 Replies
View Related
Dec 21, 2010
I'm trying to setup a L2TP VPN Connection on my ASA 5510 to connect with Android/Windows (Native Clients).I'm using the newest Releases:Cisco Adaptive Security Appliance Software Version 8.3(2) Device Manager Version 6.3(5)
My asa config just the interesting part:
crypto ipsec transform-set trans esp-3des esp-sha-hmac crypto ipsec transform-set trans mode transportcrypto ipsec security-association lifetime seconds 28800crypto ipsec security-association lifetime kilobytes 4608000crypto dynamic-map dyno 10 set transform-set transcrypto map vpn 20 ipsec-isakmp dynamic dynocrypto map vpn interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400no crypto isakmp nat-traversal
[code]....
If i try to connect with a Windows 7 Client (NOT behind NAT) I get the Error 691.
I see that Phase 1/2 are working with debug:
Dec 22 16:32:16 [IKEv1]: Group = DefaultRAGroup, IP = XXXXXX, PHASE 1 COMPLETED
Dec 22 16:51:25 [IKEv1]: Group = DefaultRAGroup, IP = XXXXXX, PHASE 2 COMPLETED (msgid=00000001)
Then I see this "Error":
Dec 22 16:51:26 [IKEv1]: Group = DefaultRAGroup, IP = XXXXX, Session is being torn down. Reason: L2TP initiated
I don't understand why it doens't work....I tried many templates from the net but nothings works.
View 5 Replies
View Related
Dec 4, 2012
Can ASA 5510 be configured as bridge mode and still send Netflow info to a collector?ie have a PIX connect internal network to internet. Because PIX does not support NetFlow, as a temporary solution, we were thinking of putting an ASA 5510 between the PIX and internet gateway, and configure it as a bridge so that there will be no routing issues, and the ASA can still send Netflow info to a collector.
View 2 Replies
View Related
Dec 4, 2012
Can ASA 5510 be configured as bridge mode and still send Netflow info to a collector?We have a PIX connect internal network to internet. Because PIX does not support NetFlow, as a temporary solution, we were thinking of putting an ASA 5510 between the PIX and internet gateway, and configure it as a bridge so that there will be no routing issues, and the ASA can still send Netflow info to a collector.
View 1 Replies
View Related
Mar 13, 2012
Any major difrrence between Netflow v/s Netflow-Lite?
I am trying to understand if Cisco 4948E can do the same job as Cisco 4500E or not and difference between Netflow v/s Netflow-Lite will work for me to select correct product.
View 2 Replies
View Related
Dec 19, 2012
I have a problem exporting the config from a 1112 appliance.It does not boot up properly. GUI logon and authentication is not possible.I can console and SSH to it but the only thing i get is the commands below and nothing else.Could not chdir to home directory /home/admin: No such file or directory
View 2 Replies
View Related
Aug 22, 2011
5505 ASA, 8.2(1) ,We can not get it to report Netflow to the collection agent at 192.168.1.34. Here is the commands I've entered:
asa# show run | i flow
access-list netflow-export extended permit ip any any
flow-export destination inside 192.168.1.34 2055
flow-export template timeout-rate 1
flow-export delay flow-create 60
class-map netflow-export-class
match access-list netflow-export
flow-export event-type all destination 192.168.1.34
policy-map netflow-export-policy
class netflow-export-class
flow-export event-type all destination 192.168.1.34
View 6 Replies
View Related
May 5, 2012
i have started managing a asa 5510 firewall which is already having 10 ipsec tunnels , the problem i am facing is they are configured as "ipsec vpn map"
i have attached sample config, i am finding it difficult to understand the parameters used in each tunnel as the configration seems bit complex to me, how it works .
View 9 Replies
View Related
Mar 21, 2013
I have three ASA5505, two firewalls connected to central VPN hub. the central inside network is 192.168.0.0/24,Network A is 192.168.1.0/24,Network B is 192.168.2.0/24,In one of this site (central), I have server with NetFlow collector.,I will collect the traffic information from all ASA at the my one serverCan I configure source IP address (or source interface - inside) for NetFlow packet, originate from ASA? (for example from site A)If it is not possible I think, I can rewrite my access lists and permit udp traffic from outside interface to server IP like this:access-list VPNACL permit udp host <Outside IP site A> host <Inside IP the Server> eq 9996,But I do not understand, what port I must be use in access list on Central site ASA. ,access-list VPNACL_A permit udp host <Inside IP the Server> host <Outside IP site A> eq 9996 ? or, in this place, must be source port in the udp netflow packet?
View 2 Replies
View Related
May 17, 2013
How can i enable Netflow for each Vlan Or interface indvidually in Cisco ASA? currently i have setup Netflow and only 2 interfaces are shwoing traffic for Netflow which are not even as my physical or Vlan interfaces . (see screen shot )
EscapeASA# sh interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
[Code].....
View 9 Replies
View Related
Dec 5, 2012
I am currently testing Netflow accuracy on my Solarwinds platform. So I have been transferring a large file across an ASA 5520, which is set up to send Netflow data to out Solarwinds server.
The problem is that the Netflow data does not show up on Solarwinds for about 2.5 hours. Once it gets there the size is correct, but the time stamp on Solarwinds is 2.5 hours behind when the transfer happened. For routers it is showing up within a few minutes.
ASA is running 8.2(5) and Solarwinds NTA 3.9.0. Firewall and Solarwinds times / timezones are the same.
View 8 Replies
View Related
Mar 10, 2011
I need to create a IPSec Site-Site VPN in the Single mode firewall. Is it possible to create the tunnel. I have ASA 5510 Security Plus with Ver 8.3
View 5 Replies
View Related
May 12, 2011
We're in the process of setting up an ASA 5510 as our main VPN appliance.
The Outside interface of the 5510 faces our DMZ, the Inside interface sits on our main network. The 5510 uses radius for authentication going to a server on the same subnet for the authentication. That works fine. VPN client can connect to the 5510 and successfully authenticate. Routes are pass through to the VPN client, no problem. PC with VPN client can access internet (which is by design, it should use it's own internet connection), but cannot ping/access/trace over the tunnel at all.
My hunch is that this is a nat issue - but I am confused as to how the NAT should be configured - I've tried several configurations with no luck.
The VPN client is set to pull an ip address from the pool - 192.168.56.10 - 100. The 5510 is sitting on a separate subnet (50.x/22). This seems to work on the Cisco 1700 that it will be replacing just fine. I mirrored routes and ACLs as well onto the new 5510. No luck. Client connects, authenticates, pulls an IP address and routes, but can't see anything on the inside of the 5510.
View 24 Replies
View Related
May 17, 2012
I have an ASA 5510 running 8.4(2) which has a site to site IPSec VPN to a 3rd party who run some form of Checkpoint. The VPN establishes and allows access to a server in our DMZ on all ports that we have tested (so far HTTP, SSL, RDP, FTP) except for SQL which doesn't even seem to reach the server. I've got Wireshark running on the DMZ server and if the 3rd party initiates a TCP conversation from their server on any of the working ports to the server I see all of the expected packets arrive with the correct IPs etc (no NAT takes place across the VPN) but when an ODBC client attempts to query the SQL server on our DMZ box the packets do not arrive at the server. What I can see is the RX byte count on the VPN increasing each time the query is run but definitely no SQL arriving at the server.
Also if I revert the ASA back to the old PIX it has replaced with the same VPN config but on version 7.x then it works just fine.
View 16 Replies
View Related
Aug 6, 2012
We have an ASA 5510 running 8.3 that we need to use to terminate a LAN to LAN IPSEC VPN.
Problem is we only have one public address available so have had to configure the link between the ASA and the Internet Router on private addresses.
Is it possible to NAT the public address to the inside or outside interface of the ASA and terminate the VPN on that interface?
View 7 Replies
View Related
Aug 31, 2011
I have been given the following details by a company for us to connec to their IPsec VPN.
IP Address 200.9.21.214
VPN Device Description Cisco ASA
VPN Device Version 5510
Encryption Domain 10.152.24.10
Authentication Method Pre Shared Key
Encryption Scheme IKE
[code]....
I was going to use VPNC with linux but the company said they do not use remote access. So I tried a draytek vigor 3300v, that as well did not work. Had very bad logging so i couldn't troubleshoot.In the end I have decided to buy the cheapest cisco device that will allow me to connect to this.
View 3 Replies
View Related
Nov 13, 2012
I have an ASA 5510 running ver 8.0(2) that has (4) Ipsec tunnels going from it to various other locations. I am having an issue with data transfer speed on only one of the Tunnels. This tunnel is between the 5510 and the 5555, on that link I am getting a dat transfer rate of a little over 120k a second, whereas if I pull the same set of files from another location I am seeing a transfer rate of 5m per second.
I have verified that it is not a capacity issue on the Internet bandwidth on both locations, and I can pull the same data from the same location to various other locations via Ipsec tunnels, I am only having an issue with a specific tunnel going from the 5510 to the 5555.
Since it is not affecting other tunnels on the 5510 nor is it affecting tunnels on the 5555 going to other locations, I am leaning toward a routing issue within the ISP? I will say the ISP is taking me a long way around to stay in the same Metropolitan area.
View 1 Replies
View Related
Jun 8, 2011
i've an Cisco ASA 5510 with Security Appliance Software Version 8.0(2), in this ASA i've many L2L tunnels to this ASA, anda sometims new tunnels can't connect, the older tunnels still ok and working, yesterday this situation occured again and i've tried to clear all ipsec tunnels and try to reconnect again no one cames up again. At the time of this situation memory usage was about 78% and CPU is was around 5%. I've made a reload without changes and the situation returns to the normality.
At the time of the fail i've collect the outpu from debug crypto isakmp 255, the outpu was in the annexed file.
View 1 Replies
View Related
Mar 28, 2013
I've got random connection issue when I try to connect to a VPN gateway through an ASA 5510 (IPSEC client ->ASA 5510->VPN Gateway).
When the tunnel is coming up, those two lines appears in the captured traffic on the internal interface :
<private internal IP>.500 > <destination IP>.500: udp 541
<public external IP>.500 > <destination IP>.500: udp 541
When it's not coming up, the port nuimber for the public IP is not 500
(private internal IP).500 > (destination IP).500: udp 541
(public external IP).442 > (destination IP).500: udp 541
I don't understand why sometimes the port for the public external IP is 500 and sometimes not.
View 1 Replies
View Related
Jul 16, 2012
We have built IPSEC VPN over MPLS P2P circuit between Head & Branch office using Cisco ASA 5510. Client systems at Branch office connects to Citrix app at Head office, but it gets disconnect intermittently for all user. if any recommendations/changes required for Citrix App whn passing over IPSEC VPN/ ASA.
View 2 Replies
View Related
May 22, 2013
I have a 5510 that i have configured for L2TP over IPSEC, not using AnyConnect. The first, and most prevelant being, VPN clients are unable to ping/access any of the hosts that are assigned a static NAT from the inside interface to the outside interface. I was able to circumvent this by adding another static NAT to the public interface for the incoming clients, but this caused intermittent connectivity issues with inside hosts. The second issue involves DNS. I have configured two DNS servers, both of which reside on the internal network and are in the split_tunnel ACL for VPN clients, but no clients are using this DNS. What is the workaround for using split tunneling AND internal DNS servers, if any?
i've had two different CCNA's look at this numerous times to no avail. A ping from a VPN client to any internal host works fine, unless it is one that is NAT'd. You can see in the config where i added the extra STATIC NAT to try and fix the issue. And this works perfectly across the tunnel but only intermittenly from the internal 10.1.4.x network. [code]
View 1 Replies
View Related
Oct 27, 2011
I have a 2811 that is my HQ router with a 10MB pipe. I was trying to configure a IPSEC tunnel to connect to my ASA that has access to our companies internal servers on the 10.33. and 172.16.31 network. I am having a problem getting phase 1 to even come up. I've looked over the configurations and unless i'm overlooking something I dont see what could be keeping it from at least completing phase 1
Below are the configs.
2811-CFG
crypto isakmp policy 10
encr 3des
hash md5
[Code] ....
View 6 Replies
View Related
Oct 11, 2011
I currently have an ASA 5510 setup with Dual homed ISP's and a remote access IPsec VPN setup to terminate at either interface. The first interface is named Outside and the second is simply called Outside-2. When outside the company(such as at home), the VPN client will connect on the Outside-2 interface and work normally. The problem is while testing on our DMZ, the VPN Client will not connect on the Outside-2 interface. It will try that interface fail to connect and then connect to the backup Outside interface. This isn't a huge concern because it still connects, but if we were ever to get rid of one of those connections, it would be nice to reliably test from our DMZ.
View 1 Replies
View Related
Jan 18, 2012
I am trying to pass Traffic thru the IPSEC tunnel but it does not work ([Cisco Router 892] <---> [Cisco ASA 5510] <---> [Cisco Router 892]) The Cisco ASA 5510 doesn't pass traffic UDP=500 & UDP=4500 ports...
View 1 Replies
View Related
Aug 17, 2011
Attached are the configuration files for the devices in question. I have a 5510 that belongs to my company and a 5505 that belongs to another company. The 5505 sits behind the 5510 and is able to connect to the Internet. My thought was that VPN access should be a trivial pursuit. I was planning on just giving the admin at the remote office the public IP address that's natted to the 5505 and all would be good.
View 7 Replies
View Related
Oct 11, 2009
WRVS4400N Version V2.0.0.7.I have been attempting for weeks to connect an IPSEC tunnel between a Cisco ASA 5510 Version 8.0(2) and a WRVS4400N . Phase one seems connect okay, where as phase two always give me the errors below. This as far as I have got, I tried disabling keep alive monitor, the device never attempted phase 2. I have read endless documentation on both devices and tried almost every combination of setting that I am aware of. The best case scenario answer would be detailed steps on how to setup the IPSEC VPN (linksys) & the site to site VPN (CISCO) as I cannot find any reference material for this combination .
View 6 Replies
View Related
Jun 23, 2011
Co-worker just got a Blackberry Playbook tablet and, try as I might, we cannot get the darn thing to successfully set up a working IPSEC/L2TP vpn tunnel to our ASA 5510, which acts as a multi-purpose VPN concentrator. Any luck setting up L2TP/IPSEC VPN to ASA from Blackberry Playbook?
View 0 Replies
View Related
