Cisco Firewall :: ASA 5512 To 5510 Replacement Benefit
Apr 8, 2013What is the benefit of replacing 5512 for 5510.
View 1 Replies
ADVERTISEMENT
Cisco Firewall :: QOS By Protocol On ASA 5512-X
Apr 18, 2013I'm looking to make a possible configuration for a customer. They need a device to provide :- firewalling- bandwidth limiting based on protocols, IP, users- web content filtering- good reporting to see which device/users are consuming most of the bandwidth.I used to use cisco ASA as firewall but it's a while I last installed on and I'm nt uptodate which current state.So I thought of using an ASA 5512-X but I'd like to know if it comply with all the requirements .Most important being the reporting and bandwidth limiting capability. It would be great to have some configuration example regarding bandwidth management.
View 1 Replies View RelatedCisco Firewall :: ASA 5512 - SSL VPN Not Working
Nov 10, 2012I have a windows 2003 server and an ASA 5512
I'm trying to use SSLVPN and it was all working, and I don't believe any configs on either box have been changed.
On Friday people were connecting, but now I get a message "Login Error" in the browser. In the ASDM home 'latest ADSM Syslog Messsages' I get "AAA authentication server not accessible", followed by two messsages AAA Marking LDAP server in group as FAILED AAA Marking LDAP server in group as ACTIVE
When I go to configuration --> Remote Access VPN --> AAA/Local Users AAA server groups and click on my RADIUS server and click Test, it takes a while and says ERROR: AD agent Server not responding: No error
If I stop my IAS server on my Windows box i get the same error but much more quickly.
I have a sonciwall set up doing the same thing, and RADIUS seems to work happily, so I don't think it's the server config...
Cisco Firewall :: ASA 5512-X 8.6(1)2 NAT Overload
Feb 18, 2013My collegue and I have been trying to figure out why we are unable to get this ASA to NAT Overload correctly. I'm sure it is something stupid, and the config may have gotten a little dirty as we tried to change options and make it work. FYI, we can ssh from the WAN into the device to configure it. It is communicating externally, but it isn't natting.
ASA Version 8.6(1)2
!
hostname ASA5512-X-Remote
enable password ********** encrypted
passwd ********** encrypted
names(code)
Cisco Firewall :: Configuration Of ASA 5512-X?
May 21, 2013I have a customer who needs a 5512-X set up with two ports on the "Outside" interface and act like a switch on the outside. This is very easy to do with the way the ASA 5505 works just by creating vlans and treating the ports as members of the vlan.
View 3 Replies View RelatedCisco Firewall :: ASA 5512-X Getting Documentation
May 14, 2013I am having soem difficulty getting documentation and setup procedures for the new ASA 5512-X (or X models in general) firewalls.I know the IPS sensor is a software-based one, but I'm not sure how much different the setup in than with a 5510 and IPS module.
Also, is the IOS upgrade procedure different?
Cisco Firewall :: ASA 5512-X Can't Connect To Console
Apr 10, 2013I'm trying to access our ASA 5512-X via the Management port, but the address https://192.168.1.1/admin can't be displayed.
View 35 Replies View RelatedCisco Firewall :: ASA 5512 8.6(1) Failover Via Management
Jun 9, 2013I am configuring a brand new pair of ASA 5512s running 8.6(1). Traditionally we hae been using the Management port as the dedicated failover link, but that seems to not be possible on the 5512s.
ASA (config-if)# no management-only ERROR: It is not allowed to make changes to this option for management interface on this platform.
I have not been able to find anything in the official documentation mentioning this restriction.
Cisco Firewall :: ASA 5512-X DHCP Backup ISP?
Jun 3, 2012I installed a new ASA 5512-X over the weekend for a client. Their backup ISP connection is DHCP based. I need to use the 'dhcp client route track' command on the interface, but it is not available. However according the all the documentation I am looking at and even the ASDM says it should be available.
This is the version of ASA and ASDM they are running:
Cisco Adaptive Security Appliance Software Version 8.6(1)1
Device Manager Version 6.6(1)
I did upgrade to the latest ASA software, so has this command been removed? If I do a '?' in the interface, there isn't a 'dchp' option.
Cisco Firewall :: ASA 5512 - Best Way To Setup Identity NAT
May 2, 2013I'm porting our configuration from a Pix 515 firewall to an ASA 5512x. What's vexing me right now is with the deprecation of the "static" command, I can't quite figure out the best way to Identity NAT my inside sub nets (multiple) to the DMZ sub net
So on the pix I have my identiy NATs as an example:
static (inside,dmz) <IntSubA> <IntSubA> netmask 255.255.255.0
static (inside,dmz) <IntSubB> <IntSubB> netmask 255.255.255.0
static (inside,dmz) <IntSubC> <IntSubC> netmask 255.255.255.0
Cisco's migration guide seems to do them one object at a time, which I guess is straightforward enough to do:
object network SubA
subnet <IntSubA> 255.255.255.0
[code]...
I'm thinking that there must be an easier way (aka less lines) to implement this for all the sub nets I want to Identity NAT to the DMZ.
1) Can I do this creating objects using a sub net with a net mask of 255.255.0.0 - one object to cover multiple internal sub nets?
2) Can I do this using object groups and trim this down to: (assuming I have to commands right)
Object-group network Inside_Subs
network-object <IntSubA> 255.255.255.0
network-object <intSubB> 255.255.255.0
network-object <intsubC> 255.255.255.0
nat (inside,dmz) source static Inside_Subs Inside_Subs no-proxy-ARP route-enabled. What would be the best way to translate my Identity NATs?
Cisco Firewall :: Does The ASA 5512-X Require A Separate HA License
Mar 25, 2013If you look at the data sheet for the 5512-X the High Availability section states "Not Supported; ActiveActive or ActiveStandby" while the ASA 5515-X states "ActiveActive or ActiveStandby". What does "Not Supported" mean for the ASA 5512-X? Does this mean HA does not work, or that I need to purchase an additional license to use the HA feature?
[URL]
Cisco Firewall :: ASA 5512 X 2 Outside And 2 Inside Interface / How To Configure
Jun 7, 2013I have a Cisco 5512 x Firewall connected with Cisco Layer 3 switch 3750.I have two different WAN connections, one for Data and one for voice. Cisco Layer 3 switch is configured with 2 different VLAN's one for data & other is Voice Vlan. Switch is providing DHCP to computers and IP phones. Voice Pool 192.168.10.0/24 Vlan10 and Data pool 192.168.20.0/24 Vlan20.I need to route my data & voice traffic separately. Cisco ASA is connected with two different ISP's. So, how can I do this configuration so that Voice and Data traffic will route separately.
View 7 Replies View RelatedCisco Firewall :: ASA 5512 - Cannot Connect To VPN After License Upgrade
May 1, 2013I am having an issue where I can't connect to VPN after upgrading the license. The license upgraded is related to AnyConnect VPN. I noticed from the newly upgraded license, the Encryption-3DES-AES is disabled whereas previously it was enabled.
ASA 5512-K9
Version 8.6(1)2
Cisco Firewall :: ASA 5512 WCCP Configuration With Web Filter
Oct 31, 2012I am currently trying to enable WCCP between a Cisco ASA 5512 firewall and Barraccuda Webfilter 410 Vx applicance. The ASA firewall is running IOS version 8.6(1)2 and the Barracuda is funning firemware 6.0.0.013. Both the ASA and Barracuda are in the same network and can ping eachother. The ASA has several interfaces, outside, inside, data and dmz. The PCs and barracuda appliance are behind the data interface. ASA data IP 172.16.18.1 Barracuda IP 172.16.18.40 All PCs in the 172.16.18.0/24 subnet use the ASA as the default gateway and should have web requests redirected to the Barracuda.
Below are the respecive bits of my ASA config
interface GigabitEthernet0/0
description Management
speed 1000
[Code].....
I suspect my issue is that the ASA is generating a Router Identifier of 172.21.20.1 which is my inside network and the barracuda cannot communicate with it. how I can get this working ?
Cisco Firewall :: 5512 Policy Routing Alternative?
Apr 7, 2013From what I can find the ASA does not support policy routing.
I have two VLANS that need to go to the same destination but different routes. Anyway to accomplish this on the ASA?
Cisco Firewall :: InterVLan Routing Not Working With ASA 5512 V8.6
Jan 11, 2013Configuration of inter-vlan routing on ASA 5512 ver 8.6? I have everything configured (un-nat, access-list, etc.) but still not working. When i do a packet capture, it says the traffic is denied by the implicit acl. Here is my config:
interface GigabitEthernet0/0.100
vlan 100
nameif data
security-level 100
[Code]...
Cisco Firewall :: Detailed Documentation On ASA 5512-x And 5515-x?
Aug 7, 2012where I can find detailed documentation on these two products. Particularly, I am looking for high availability capabilities and any license requirements.
View 1 Replies View RelatedCisco Firewall :: 5512 - NAT Random Source Address
Jul 4, 2012I have a problem with random host's geting the wrong source address on a ASA 5512-X 8.6(1). Right now there is a host, 192.168.25.108, showing up with 6.6.6.6 (fake) on whatsmyip.org, should be 5.5.5.5 like the rest of 192.168.25.0/24. In the xlate tabel I cant find anything wrong. Same yesterday with two host, that are using the right NAT address today.
nat (any,outside) dynamic interface. (5.5.5.5)
object network H-192.168.25.10
nat (inside,outside) static H-6.6.6.6X(code)
Cisco Firewall :: Unable To Open SMTP Session Through ASA 5512-X?
Sep 20, 2012Just doing some basic testing before we replace our ancient PIX 515E with a new 5512. I have a mini lab set up following the diagram below, although I am unable to telnet through to the mail server's netcat listener on port 25 TCP. I can ping all the way outbound from 192.168.101.1 to 10.0.0.2, and the 10.0.0.2 machine shows it is translated properly to 200.225.117.1.
NAT and access rules are as follows:
object network mail
host 192.168.101.1
description Mail relay
access-list inbound extended permit ip any host 200.225.117.1
[code]....
EDIT: Somehow the new global access rule is involved. When adding a permit any any in there I can get to the mail server no problem. When I remove it but leave in my permit ip any any on the outside interface, I am denied?
Cisco Firewall :: ASA 5512-X Version 9.1 Multiple Contexts Supported?
Apr 3, 2013if on the ASA 5512-X virtual contexts are supported with version 9.1 ?
I found different information on the Cisco web, the ASA datasheet says it is supported but in the configuration guide I found exactly the opposite information.
Cisco ASA Series General Operations CLI Configuration Guide 9.1 and 8.6 [URL]
Cisco ASA 5500 and ASA 5500-X Series Next- Generation Firewalls for Small Offices and Branch Locations Data Sheet (Updated) [URL]
Cisco Firewall :: 5512 Able To Be Field Upgraded To 5515 And Through 5555
Jan 10, 2013Is the 5512 able to be field upgraded to a 5515 and so on through 5555? I.E. Can I add ram and other hardware to make the boxes more powerful as my requirements increase? I was hoping this would have been a new feature with the ngen firewalls.
View 3 Replies View RelatedCisco Firewall :: 5512 - BGP Through ASA Versus Transparent Mode Deployment
Mar 8, 2013I've been asked to deploy an ASA in Transparent Mode because of concerns of putting another layer 3 hop between PE and CE routers running BGP.
Is there some problem with allowing BGP to flow freely through an ASA the is also terminating site to site and remote access vpn tunnels?
I just don't see the need for Transparent Mode here and you cannot have a standard DMZ setup with Transparent Mode: you have to use bridge groups to provide for multiple interfaces on the ASA and then have an external router route between those bridge groups.
what I'm missing here as to why Transparent Mode is needed (not needed)
ASA is 5512
Cisco Firewall :: Does ASA 5512-X Have Category-based Web Filter Built-in
Jun 26, 2012Does ASA 5512-X have a category-based webfilter build-in?
View 1 Replies View RelatedCisco Firewall :: Replacement Of Primary Unit Failed ASA5510
Sep 7, 2011I have an issue bringing up my RMA'd primary ASA unit.
So what happened so far:
1. primary unit failed
2. secondary took over and is now secondary - active (as per sh fail)
2. requested RMA at Cisco
3. got ASA and checked that Lic (SSL), OS (8.2.2) and ASDM are at the same level as the secondary
4. issued wr erase and reloaded
5. copied the following commands to the new (RMA) primary unit:
failover lan unit primary
failover lan interface Failover Ethernet3
failover interface ip Failover 172.x.x.9 255.255.255.248 standby 172.x.x.10
int eth3
no shut
failover
wr mem
6. installed primary unit into rack
7. plugged-in all cables (network, failover, console and power)
8. fired up the primary unit
9. expected that the unit shows:
Detected an Active mate
Beginning configuration replication from mate.
End configuration replication from mate.
10. but nothing happened on primary unit
What is a valid and viable approach in replacing a failed primary unit? Is there a missing step that hinders me to successfully replicate the secondary - active config to the primary - standby unit.
I was not able to find anything related to ASA55xx primary unit replacement with a clear guideline or step by step instructions.
Cisco Firewall :: ASA 5512-X / VPN Client Is Connected But Unable To Ping Internal Network
Mar 17, 2013I have created a VPN connection for ASA 5512-X by using the wizards and nothing seems to be wrong on the wizards's config.I am able to connect to the network by using the VPN but unable to ping internal network.Below is my config for your reference:
Result of the command: "sh run"
: Saved
:
ASA Version 8.6(1)2
!
hostname FAA-ASA-1
enable password crzcsirI44h2BHoz encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
[code].....
Windows Server 2008 R2 - Benefit Of Dual Ports
May 23, 2011I have a Dell Server on the way to me, a T110 to be specific. It will have win server 2008 R2 on it. I ordered it to come with Dual NIC cards. To be specific it is 1 card that has two rj-45 ports on it. My question is, what is the benefit of dual ports? I have heard of teaming but don't really know if that applies. I will be using this server for our company website and to facilitate local office backups as well as backing up our regional offices to it. I could see that it would benefit local LAN traffic speed, but outside of the LAN would it still benefit the speed of incoming connections from branch offices running backups?
View 6 Replies View RelatedLinksys Wireless Router :: How Does Upgrading To EA3500 Benefit Me
Feb 5, 2013I currently have an old Linksys WRT160n.How does upgrading to the EA3500 benefit me? How does this differ than my current router which is still wireless N? I know it is Dual band but does that really matter?If my ISP provides me with 10 Mbps does it really matter what router I go with? How exactly does it speed up gaming/netflix/etc?
View 9 Replies View RelatedDELL 2816 - Benefit Of Setting Up VLANs If Subnets Wired Separately
Jun 12, 2013I have 2 sub nets within my office: 172.16.1.0/24 and 172.16.2.0/24. All devices on each subnet are wired independently from each other into the server closet. Previously each sub net had it's own switch in the closet to connect to that sub nets servers. We are replacing the 2 switches with a single Dell 2816 managed switch.
Is there a benefit to setting up the switch with 2 VLANs over just letting everything pass through the switch in un managed mode?
My only security concern is this: 1 sub net has access to the internet while the other does not. Does setting up 2 VLANs provide additional security by preventing 1 subnet from accessing the other? In other words, if a computer with internet access gets hacked will it being on one side of a VLAN prevent the hacker from accessing the other subnet?
Cisco Firewall :: ASA 5512-X - Automatic Power-on After Power Failure?
Dec 5, 2012how can I enable an automatic power-on after a power failure on an ASA 5512-X?
View 5 Replies View RelatedLinksys Wireless Router :: E4200 / Benefit To Enable HTTPS Within GUI Instead Of Using Default HTTP?
Mar 16, 2013Any benefit to enable https with in the gui instead of using the default http?
View 1 Replies View RelatedCisco WAN :: AIM-ATM Replacement For ISR G2?
Jan 18, 2011Customer is using AIM-ATM AIM with a VWIC2-1MFT-T1/E1 card installed, and using the E1s in ATM mode.They have recently migrated to ISRG G2, but; ISR G2 (2911) dosen't support AIM Modules, and there is no relevant module for ATM.So is there anything we can do to accomplish same functionality on ISR G2 ?
View 1 Replies View RelatedCisco WAN :: ASA 5512 NAT With Outside Interface?
Feb 18, 2013I'm having an issue setting a static NAT
We have a block of 5 public ip's
66.x.x.34-38
IP 66.x.x.38 is assigned to the outside interface. I can set static nats to all the other ip's and they work fine yet a static NAT using the same address as the outside interface does nothing.
I've used
object network centralpark-http
host 192.168.1.227
nat (inside,outside) static interface service tcp http http
Cisco :: Replacement For Fortigate 100A
Jul 1, 2012I'm looking to upgrade our main router/firewall with something that has more throughput. This unit has 2 DMZ zones, internal switch and 2xWAN connections which is pretty handy as I'm utilizing all of them.How to resolve the issue of having a firewall and router in one device,What would be the replacement solution if I were to decide for Cisco solution? What is the best practice?
View 3 Replies View Related