We have 2 ASA5510 and 2 ASA5525. Got a very weird error; up to release 8.4 eigrp works fine, after upgrading to 8.6 eigrp stops working.Can't see any neighbors; but same command from another asa on same network but with release 8.4: [code] I want to put the 5525 on production but would like to do it with latest release; could this be a bug on 8.6?
View 12 Replies
We have an ASA 5540 running 8.4(1) on the inside of dual Internet-facing border routers. The routers run BGP facing out and EIGRP facing in, with the ASA also running EIGRP for the same AS. Both routers redistribute a default route into EIGRP. It was my understanding and expectation that the ASA would learn both of these, as they are equal cost, and load-balance the outbound traffic over the two links. This does not appear to be the case.
The routers both have:
router eigrp 100
network nn.nn.nn.nn 0.0.0.0
redistribute static
[Code].....
I configured ASA 5510 with IOS 8.4.2 version. I configured SSH to outside and backup interface with any any permission.
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 backup
configured password with command
passwd < Password>
While connecting from outside through Putty i am not able to authenticate the password.
Aftter entering user name as pix its asking password. After entering its not authenticating.
I taken output by telnetting to inside after connecting to the firewall from outside and entering username as pix
PM-ASA-5510# sh ssh sessions
SID Client IP Version Mode Encryption Hmac State Username1 122.169.252.112 2.0 IN aes256-cbc sha1 KeysExchanged pix OUT aes256-cbc sha1 KeysExchanged pixSPM-ASA-5510#
Our NOC is trying to configure a site to site tunnel to one of our customers. The tunnel is up and operational, however we can't get our NAT rules to match what we want.
We are running ASA version 8.4(3)
The traffic is sourced from 172.16.1.50 (inside1) and destined to192.168.2.9 (outside), the nat configuration is posted below:
NOC-ASA5510-01# show run nat
nat (inside1,inside2) source static ng-noc-networks ng-noc-networks destination static ng-inside2-networks ng-inside2-networks
nat (inside1,outside) source static test test-EXT destination static otherside otherside
object network obj_any
nat (inside1,outside) dynamic interface dns
object network servers-noc
nat (inside1,outside) static 192.168.1.68
Here is the output from the show nat detailed:
NOC-ASA5510-01# show nat detail
Manual NAT Policies (Section 1)
I left off entry 1 but it doesnt have any translated hits either
2 (inside1) to (outside) source static test test-EXT destination static otherside otherside
translate_hits = 0, untranslate_hits = 624
Source - Origin: 172.16.1.50/32, Translated: 192.168.1.67/32
Destination - Origin:192.168.2.9/32, Translated:192.168.2.9/32
Auto NAT Policies (Section 2)
1 (inside1) to (outside) source static servers-noc 192.168.1.68
translate_hits = 0, untranslate_hits = 187
Source - Origin: 172.16.1.101/32, Translated: 192.168.1.68/32
2 (inside1) to (outside) source dynamic obj_any interface dns
translate_hits = 58417, untranslate_hits = 1511
Source - Origin: 0.0.0.0/0, Translated: 192.168.1.66/29
Here are the network objects:
object network test
host 172.16.1.50
object network test-EXT
host 192.168.1.67
[Code]...
We have 2x 3750G L3 switches and I am trying to set them up to use EIGRP but for some reason it’s not working, I created 2 routed ports on each switch and I want to route vlan10 traffic to vlan20 to S2. I also enable EIGRP as the routing protocol but I still cannot ping between VLAN 10 and VLAN20 , here are the configs for both switches. What am I doing wrong?
Current configuration : 1943 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
[Code]...
I've got an ASA 5510 running 8.4.I have a host on an inside interface, with a static NAT configured on the ASA. The inbound/return half of the NAT doesn't appear to be working. [code] I run a ping from the host (192.168.100.98) to something on the outside (1.2.3.4)Running captures, I can see the outbound ping leaving, having been NATed OK. I can see the reply coming back in to the outside interface with the correct IP address, but I never get the final NATed packet appear on the inside interface. The packet just disappears inside the ASA.
View 2 Replies View RelatedI implemented a ASA5510 with latest software version. I configured outside interface, default route, PAT to the outside interface. I am able to ping and telnet to the inside interface of the ASA.But internet is not working.Did i miss any configuration?i enabled icmp to outside,. i did a ping to the next hop from ASA. but it is not working.
View 6 Replies View RelatedI find are steps to turn on SSH access. I have quite a few customers with ASA5510's installed. SSH is set up and working fine on every one. After a period of time, you are no longer able to SSH into the firewall. Using Putty, it just sits there on a blank screen without giving a "denied access" message or a login prompt. Rebooting the firewall will solve the issue and SSH access works again. Today, I had a customer with and active/standby configuration where I had to reboot both of them to be able to log in. Most of my customers are on 8.2.software as most don't want to reconfigure for the new NAT, etc.
I'm sure others have seen this before since it appears to be occuring on almost every ASA that I have access to. Is there any fix to eliminate this or is there something that can be run from the ASDM that will grant SSH access again without just doing a reboot?
we recently upgraded our ASA 5510 active/standby cluster from ASA Version 8.3.2 to 8.4.1(11). Unfortunately the standby ASA is now crashing a few seconds after the configuration was synchronized from the active ASA.
Also completely disabling HA, bringing the default config to standby ASA again and activating HA afterwards did not work. Also tried through the Wizard provided by ASDM to be sure to have no errors with requirements.
How to solve this without doing a downgrade back to 8.3.2. ?
I have an ASA 5510 and I am building a site-to-site vpn tunnel, peer on the other end is a sonicwall. I can initiate the tunnel from my end, but when he tries from his end it fails on phase 2 with this error in the logs:
"Rejecting IPSec tunnel: no matching crypto map entry for remote proxy"
Obviously our crypto map's don't match, i have it restricted to specific ports on my end and he had it wide open on his end, but said he is not sure how to restrict it down to specific ports. My question is why would I be able to bring the tunnel up on my end if the crypto map's don't match and he can't bring it up?
I have an ASA 5510 and I am building a site-to-site vpn tunnel, peer on the other end is a sonicwall. I can initiate the tunnel from my end, but when he tries from his end it fails on phase 2 with this error in the logs:
"Rejecting IPSec tunnel: no matching crypto map entry for remote proxy"
Obviously our crypto map's don't match, i have it restricted to specific ports on my end and he had it wide open on his end, but said he is not sure how to restrict it down to specific ports. My question is why would I be able to bring the tunnel up on my end if the crypto map's don't match and he can't bring it up?
I have an ASA with an outside ACL that is configured to allow 208.84.248.95 SIP/5060 to 1x.x.x.46. I show no hits. I added an ACL to do a packet capture, it sees the packet coming into the ASA but not going to the Serv Prov interface. I see hits on the vuong ACL but not the production acl_out ACL.. What is up?
NOTE:ACL_out is the ACL we use to allow outside traffic to enter our network.
FW1(config)# sh access-list | i 1.x.x.46
access-list acl_out line 1 extended permit ip host 63.x.x.140 host 1x.x.x.46 (hitcnt=0) 0xc09a9387 (*NO HITS)
access-list acl_out line 658 extended permit udp host 208.84.248.95 host 1x.x.x.46 eq sip (hitcnt=0) 0x0f327179 (NO HITS)
[code]...
It was tested and verified from the inside network to make sure the server is listening on that port. Below we created an ACL to allow all IP from another test PC to the Server IP 1x.x.x.46. We did a telnet to port 5060 and it showed hits but not on the acl_out ACL.
ccess-list vuong line 1 extended permit ip host 63.x.x.140 host 1x.x.x.46 (hitcnt=0) 0x2759fa92
FW1(config)# q
FW1# capture capture1 access-list vuong interface outside
[code]...
Below we applied the same ACL to the ServProv interface to see if traffic was going where it was supposed to . By trying to telnet to the 1x.x.x46 IP from 63.x.x.140 IP. Looking below, no traffic appeared on the capture2.
FW1# capture capture2 access-list vuong interface ServProv
FW1# sh capture capture2
0 packet captured
0 packet shown
[code]...
Capture 1 above shows the last 3 incoming messages initiated from 63.x.x.140 to the 1x.x.x.46! Vuong ACL belows shows 3 more hits.....nothing on the acl_out ACL???
FW1# sh access-list vuong
access-list vuong; 1 elements; name hash: 0x29df3e90
access-list vuong line 1 extended permit ip host 63.x.x.140 host 1x.x.x.46 (hitcnt=6) 0x2759fa92
[code]...
I've got an ASA 5510 that has been working like a charm for some time now. Until now we've not had to nat any resources to the outside. I created network objects for an internal host and an external host. The internal host has to respond to requests on tcp/2001.
The internal host has no problem accessing the internet, but when I attempt to access the internal host from the outside, I get the following:
4 Sep 20 2011 16:20:33 fw_outside_ip 62678 outside_host 2001 Deny tcp src outside:outside_host_ip/62678 dst inside_host:inside_host_ip/2001 by access-group "outside_access_in" [0x0, 0x0]
When I try to use the packet tracer to simulate the outside traffic, I get the following
5 Sep 20 2011 16:17:41 inside_host 2001 Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:outside_host/1065 dst inside_int:inside_host/2001 denied due to NAT reverse path failure
I've got over my NAT statement and access rule and can't find anything wrong with either.
Here are the pertinent NAT and access rule...
static (inside_int,outside) tcp interface 2001 inside_host 2001 netmask 255.255.255.255
access-list outside_access_in extended permit tcp host outside_host host inside_host eq 2001
i have here a ASA 5510 sec k9.
I build a Config with a DMZ,INSIDE and OUTSIDE Interface. My Plan is to use the IP-Address of the OUTSIDE Interface with PORT to setup a HTTP Server In the DMZ
But my Config doesn't work. And I have no Plan why .....
The Inside Interface have to work normal. The Traffic to the Internet is TRiggert from Inside with Dynamic PAT
ciscoasa(config)# exit
ciscoasa# show run
: Saved
:
ASA Version 8.4(1)
[Code].....
I have ASA 5510 connected as shown in attached diagram.Ideally when ASA 1 is active and if I boot Switch-1, ASA-2 shood take over. But that is not happening.When I boot SW1 , ASA-2 shows "Failover LAN Interface: failover Ethernet0/0 (Failed - No Switchover)" and remains standby.Fail over works properly If ASA-1 boots.
View 7 Replies View RelatedI have an ASA 5510 and have just started using object-groups which are super handy in theory, but not working in reality. I have a service object-group with a mix of tcp, icmp, and udp ports. Let's call it Sample_Port_Group. I'm trying to apply it to my dmz_access_in ACL. Here's the line giving me problems:
access-list dmz_access_in extended permit object-group Sample_Port_Group 192.168.1.1 any
The asa throws up an error between 192.168.1.1 and any. When I put up a ? after Sample_Port_Group, it gives me the option of putting in an IP address, any, etc. When I put in a ? after 192.168.1.1, it only gives me the option of putting in an IP address.URL
Those posts gave me the impression my line was possible, especially the "access-list outsideacl extended permit object-group myaclog interface inside any" line, which is at the end of the 2nd article linked.
We are deploying a new office in the building next to our main office. The main office has a Cisco ASA 5510 behind that is a Cisco 3750 stack. In the new office we are deploying a new Cisco 3750, they will be connected via fiber cable. I have sliced off VLAN 800 as a transit link /30 with an address space of 10.249.249.1-4. The new 3750 only has two VLAN's 800 and 112 (10.112.0.0/24). VLAN 112 routes are advertised to the neighboring 3750 properly as seen in the routing tables of the 3750 stack:
D 10.112.0.0/24 [90/3072] via 10.249.249.2, 00:22:24, Vlan800
Traffic passes between all local VLANS with no issue. I found in order to get packets to pass between the ASA and the new 3750 I had to add a static route to the ASA:
S 10.112.0.0 255.255.255.0 [1/0] via 10.100.0.1, inside
My question is why is EIGRP not advertising the 10.112.0.0 network to the ASA. Here are EIGRP configs on the switches
Existing 3750 Stack
router eigrp 100
network 10.0.0.0
redistribute static
[code]....
I have an ASA 5510 attached to 2 internal networks. Everything is working except communications between the 2 internal interfaces.I can ping the FW from either interface and I can ping hosts on both networks from the CLI but can't get any traffic to pass.I'd like to open the connection to all traffic. [code]
View 33 Replies View RelatedI know that I've run into this before but I can't remember the fix. I have a 5510. The 3 interfaces involved are INSIDE, OUTSIDE, and GUEST. Corporate users are allowed to put their iPhones on the Guest network, but the problem is that their Exchange ActiveSync stops working. It is tied to the external DNS name of the OWA server (we'll say webmail.abc.com). So the users are funneled out one public IP on the OUTSIDE interface and are trying to communicate with the outside of the OWA server, which is NATed to another public IP on the same outside interface. What do I need to do on the ASA to allow users on the guest network (behind the GUEST interface) to access the mail server using its public IP (behind the INSIDE interface)
View 1 Replies View RelatedAfter I have upgraded our ASA 5510 to 8.4.2 I have problem with the management interface.Our former firmware 8.2.3 had no problem using the management interface as a DMZ zone, but after we upgraded to 8.4.2 we can't make it work.The interface and the protocol is up, when I type: show interface.But when I ping the interface from a computer connectet to the interface, nothing happens.
Even the logging shows nothing.
I have an ASA- 5585X (v.8.2.4) directly connected to an upstream 6509, which is running EIGRP. I configured the ASA for EIGRP with same AS# and network numbers and no auto-summary. Here are the log messages I got:
Mar 8 15:11:08: %PIM-5-NBRCHG: neighbor 164.72.178.28 UP on interface Vlan150 (vrf default) Mar 8 15:11:08: %PIM-5-DRCHG: DR change from neighbor 0.0.0.0 to 164.72.178.28 on interface Vlan150 (vrf default)
Mar 8 15:11:11: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 164.72.178.28 (Vlan150) isup: new adjacencyMar 8 16:16:08: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 164.72.178.25 (Vlan150) isup: new adjacency
Mar 8 16:18:54: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 164.72.178.25 (Vlan150) is down: K-value mismatch
I lost my SSH connection to the upstream 6509 and couldn't get it back. Luckily I didn't lose my ASDM connection to the ASA, so I disabled EIGRP and went to look at the logs on the 6509.
What causes a K-value mismatch, and how to I rectify the situation?
I have two 2911 routers running 15.0(1)M4 in a redundant topology connected to an ASA 5520 firewall running 8.4 version. All gears are running EIGRP. In order to distribute the incoming traffic between the two 2911 routers, I am using 'offset-list out' on them, but in the ASA's routing table I see updates from both 2911 with the same metric, i.e. the offset-list is not working. What are the default metric weights on ASA? How can I change them? I couldn't find any known bug.
View 14 Replies View RelatedI have been able to get EIGRP working successfully in the lab like I want.
Attached is the network overview:
We have a Data Center and Corporate office connected via Point to Point Fiber link, eventually we will have two of theseTwo 4948E switches in the Data center acting as cores setup with GLBPCorporate Office has a 3750X acting as a coreCurrently two 4948E's are connected to each other via Port Channel and a L2 trunkTwo set of ASA 5520's one acting as a firewall and for Cisco Any Connect and second for site to site VPN
What is the best way/pratice that I can distribute this DMZ via EIGRP? Should I just leave it static on the core like this?
we are looking at adding our ASA's to our EIGRP autonomus system. .is it possible to redistribute "routes" which are accessible only from a site to site VPN? I put "routes" in quote marks because the remote networks do not appear in the routing table.BTW the firewalls are running ASA 8.4(2)
View 2 Replies View RelatedI'm working on setting up a site-to-site VPN connection that requires us to NAT an internal address. Typically, this would be no big deal, but for some reason, it's not working for us. The remote site is reporting that they are seeing the original IP address and not the mapped address coming across. I've monitored the connection and base on our ASA logs, I too see the un-mapped address.
Is there a quick and easy way of verifying that NAT is working? Logs, etc.?
Unfortunately I don't currently have the remote side's configuration, as they are an external business, but I can provide ours: [code]
Based on the above, it sounds as if our configs aren't jibing, which I would think could be caused by the NAT configuration not working, right? I mean if the VPN applicance on the remote end is expecting a NAT-ed address of 12.131.67.247 and they are receiving 12.10.127.108, that could cause this issue, couldn't it?
I recently setup a site to site vpn between a asa 5510 and router 1921. It was working great all night and this morning. When traffic stopped rolling through for a few hours the tunnel shutdown. I checked the router using cisco configuration and tells me the tunnel is up. When I check the asa it does not show up in the active tunnels. Any know what would cuase it to drop? and if so what can I do to avoid it.
View 6 Replies View Relatedi've an Cisco ASA 5510 with Security Appliance Software Version 8.0(2), in this ASA i've many L2L tunnels to this ASA, anda sometims new tunnels can't connect, the older tunnels still ok and working, yesterday this situation occured again and i've tried to clear all ipsec tunnels and try to reconnect again no one cames up again. At the time of this situation memory usage was about 78% and CPU is was around 5%. I've made a reload without changes and the situation returns to the normality.
At the time of the fail i've collect the outpu from debug crypto isakmp 255, the outpu was in the annexed file.
I have a an issue with one particular VPN user. They are using the built in Windows Vista client to connect to my ASA 5510.
All other users do not have an issue and i receive the following error at roughly the same time of day when the drop happens. Authentication is done by my AD Server which handles all logins.
[code]...
I have the ASA 5510, I just upgraded to Windows 7 and installed the ASDM software. The installation went smoothly but when I launch ASDM all that comes up is the top right of a window, here is a screenshot of what happens.
View 15 Replies View RelatedCurrently I want to add a second lan (vlan) in a customers network. The new network will be for a wireless infrastructure.There is also VPN Configured on the ASA - One with L2TP for Windows Clients and an IPsec for Cisco Clients.Former we only had one outside (Eth0/0) and one inside interface (Eth0/1) on the ASA.Now I want to use the Eth0/2 with subinterfaces, so that we will be flexible for future, when deploying more vlans.But now, when i turn the first subinterface Eth0/2.2 to no-shut the VPN Connections does not work any more.Bulding up the VPN connection works, but it seems that the traffic is not tunneled. (I checked this, because tracert to an internal adress goes to the internet)Below there is my config, i don't know whats wrong. I think split-tunnel is configured correctly (because it works when i delete eth0/2.2) TREV is the network of this location.Company1,2,3 are remote locations.
: Saved
:
ASA Version 8.2(5)
!
hostname XXXXXXX
domain-name domain.lan
enable password XXXXXXXXXXX encrypted
passwd XXXXXXXXXX encrypted
[code]....
We have a 5510 ASA that was running 8.0 and were using it for clientless VPN access. Through this, we published bookmarks that linked to an internal Microsoft 2008R2 RemoteApps server, which users logged on to and then launched RemoteApps (basically being RDP sessions to apps on the server).All worked fine until we upgraded to 8.4 over the weekend and we now can't launch the RemoteApps. We can still login through the ASA, still click a bookmark to take us to the RemoteApps server's webpage, still then authenticate against the domain fine and still see the published apps. The problem now is when we launch the apps we get "this computer can't connect to the remote computer" messages and the app fails to launch. Nothing has changed on the RemoteApp server side, only the upgrade to 8.4.
View 2 Replies View RelatedI have a Cisco ASA 5510 (with an AnyConnect Mobile License enabled) I used to be able to connect to the VPN using the AnyConnect app for Android form the Google App store (the phone is a Samsung Galaxy S II LTE, if that matters). Like I said everything used to work fine until a few weeks ago, the only change I made to the router was giving it a different external IP address (I changed ISP), I'm pretty sure it worked after that. But now when I try to connect with my Android I get this error: "Clientless (browser) SSL VPN access is not allowed".
View 1 Replies View RelatedWe have a Service Policy rule setup on our 5510 for SMTP traffic.
Problem is, this week someone sent a larger email 20+mb to dozens of recipeints and the outside interface was hitting 10mb, which is not what I would have expected with this rule in place, so I'm questioning the configuration. We know it was email because I disabled the server that receices our outbound mail to apply a signature and the traffic dropped immediately.
