Cisco Firewall :: ASA 5550 - Source IP Connection Limits?

Jul 1, 2012

I am running a Cisco ASA 5550 in active/standby mode.  We are currently running ASA OS v8.2(3)5.  I am wondering if there is a way I could limit source IP concurrent connections coming in my outside interface.  Does the ASA have a feature/ACL syntax that supports this?

View 2 Replies


Cisco Firewall :: ASA 5550 Flags E Connection

May 2, 2012

I have an issue were thousands of connections on the ASA are marked with flags E, below is a visual of the connection. Any ideas what could cause this marking? Also, I can't grasp what the meaing of an outside back connection (ie flags E).
TCP DMZ:X.X.X.X/139 Inside:X.X.X.X/1828,    flags E, idle 9h37m, uptime 9h37m, timeout 15s, bytes 0

View 0 Replies View Related

Cisco Firewall :: ASA 5550 LU Allocate Connection Failed 8.2.5

Feb 17, 2013

Customer is running ASA 5550 with software 8.2.5 version.
They continously get the below messages
%ASA-3-210005: LU allocate connection failed
%ASA-3-210007: LU allocate xlate failed
I have already searched in the forums and also BUG toolkit, These issue has either been resolved in prior relases or in 8.4 .x train. I didnt find any bug which says that it has been found in 8.2.5 release.
I have also run "show conn count" and "show xlate count" I see these is difference in count output.
From Standby
COGINBLRMBPB1INTF1# show conn count
6097 in use, 17220 most used
COGINBLRMBPB1INTF1# sh xlate count


View 2 Replies View Related

Apartment Complex Limits Each Connection / How To Combine Them

May 6, 2012

My apartment complex limits each connection to 200KBps but each connection has the same IP so I thought there has to be an easy way to combine the connections. Is there a way to connect the wired network i'm connected to with the wireless one?

View 3 Replies View Related

Cisco Firewall :: 5550 Firewall Set Up For Redundant Purpose

Mar 3, 2011

i two 5550 firewall set up for redundance purpose . in failover we define two different ip add one for primary and one for secondary .interface Ethernet0/0 nameif outside security-level 0 ip address xxxx. standby xxxx.0.0.2!interface Ethernet1/0 nameif inside security-level 100 ip address standby gateway for host will be (primary fw address) however in case of failover , the secondary fw will be up with ip address that was assigned for primary .in this case the secondary ip add is actually nerver used? similarly do i need to have two public ip address for outside (one for primary and one for secondary )   ? or in case if primary fails the secondary comes onlie and take the ip of primary fw . hence i only need to purchase just one ip address.

View 6 Replies View Related

Cisco Firewall :: 5550 Firewall Syslog Message

Feb 22, 2013

I have cisco 5550 Firewall, one messages appear in syslog server from Firewall, (warning) i want to stop this message from appearing syslog traps.

View 2 Replies View Related

Cisco Firewall :: Secondary ASA 5550 Firewall Getting Down Automatically?

Apr 17, 2011

I am having two ASA 5550 firewall running in active/standby mode. With in last two months our secondary firewall got down automatically 3 times. Firewall is running with IOS version 7.1.2. how to proceed further troubleshooting because there are not any logs on firewall.

View 3 Replies View Related

Cisco Firewall :: How To Translate Both Source And Destination In ASA 8.2

Apr 16, 2012

I have a internal subnet sitting behind an ASA firewal 8.2 and would behind accessing to web server which sits behind the outside interface of the ASA firewall.The access would be like this:
1) will be accesing to the web server
2) We would like to translate the source to the firewall outside IP address
3) We would like to translate the destination web server to as well

How to perform this simultaneous source and destnation address translation in ASA firewall 8.2? Could this be done in ASA firewall 8.2?

View 1 Replies View Related

Cisco Firewall :: ASA 8.4.3 - Does It Check DNS Source IP Address

Oct 29, 2012

Does ASA 8.4.3 check the source IP address of  a DNS reply and drop it if the reply address is different to that in the query?
Customers DNS server does this due to a recent change, their server now has a virtual address, but replies are sent from its physcial address. This is temporary. Their PIX is happy with this.
Replace the PIX with the ASA, DNS fails, the only reason I can see is due to the way their internal DNS operates.

View 1 Replies View Related

Cisco Firewall :: Source-PAT Outside Traffic Through PIX525?

Feb 22, 2013

I have been tasked with building a vpn tunnel with a partner company between our company's PIX firewall and the other company's ASA's firewall.  The traffic flow will be Partner A company users will be accessing my company's Citrix server.  I want to source-pat the partner company user traffic to my company's PIX inside interface as it enters my LAN to access my company's Citrix server.  The partner company will be PAT'ing their user traffic to a single ip address - let's say for discussion purpose it is  So there will be site-to-site vpn configuration and nat configuration required to be performed to enable this traffic flow according to the above requirements.  I am comfortable with the site-to-site vpn configuration tunnel so I don't think it is necessary to post this portion of the configuration to be reviewed by this form.  What I do need is NAT portion of the configuration.
{My Company's Citrix Server} ---------<inside ifc>-[PIX525]-<outside ifc>--------(internet)------{Partner Company A host PC's}                                                                                    
My proposed configuration to enable nat'ing (or pat'ing) Partner A user traffic to my PIX firewall's inside interface is the following:
global (inside) 9 interface
nat (outside) 9 access-list PartnerA_source_nat
access-list extended PartnerA_source_nat permit host host

View 3 Replies View Related

Cisco Firewall :: ASA 8.4 With NAT Source Address Translation?

Dec 5, 2012

I have a server in a DMZ of my 8.4 ASA with nat:
object network FTP-SERVER
nat (dmz,outside) static interface tcp ftp ftp
And that's working well. However, I now need to translate the source address of connections from the outside to the FTP server as well. The aim is that the source address of packets when they reach the FTP server is an address on the DMZ subnet (as the default route for the FTP server now needs to be something else, not the ASA) as well as this outside-dmz NAT. I thought overloading the DMZ interface of the ASA? Or another IP in that range?

View 2 Replies View Related

Cisco Switches :: To Make Internet Connection The Source For SG300

Apr 11, 2013

First of all, is there a document on the SG300 that explains everything in plain english?Here is what I am trying to do...I have a Charter Communications connection to the internet through their modem.This modem has a static IP.I would like to make this internet connection the source for the SG300 and all the other ports be DHCP.I was told when I purchased it that being a layer 3 device.

View 3 Replies View Related

Cisco Firewall :: ASA 5550 Two ACL From Outside To Inside

May 13, 2011

I have  ASA5550 ruuning Version 8.3(1) with inside and outside interfaces as below [code] On the inside : I have a server ( that need to be accessed from an outside host (Y.Y.131.34) , so I have the below NAT/ACL  rules. [code] is it right that I have to add two ACL entry for outside host to the NATed IP of the inside server , then again add another ACL entry from the same outside host to the private IP of my inside server o get this communication done?

View 7 Replies View Related

Cisco Firewall :: ASA 5550 With IOS 8.0(2) Crashes

Jan 31, 2012

we had just installed our ASA 5550 with IOS 8.0(2) a couple of week ago.
2 interfaces from each slot are being used ie 0/0 for Branch users comming via MPLS cloud ,  0/1 for internal LAN users comming form Core Switch  & 1/0 for Server farm LAN   , 1/1  for Internet (outside)
the first 3 interface are considered inside with sec set at 100   while the 1/1 is outside with sec at 0.
Last night it suddenly started dropping all connections without any warning  or any noticible log form the ASDM logging.
the connection drop would happen for 2 - 3 minutes and would work fine for the next 15 minutes or so..
after conencting the console , we found out that the IOS would suddelny go abrupt and show this display ...
TP-ASA(config)# TP-ASA(config)# TP-ASA(config)# Thread Name: Dispatch UnitPage fault: Address not mapped    vector 0x0000000e       edi 0x24d184b0       esi 0x0000000d       ebp 0x1c6ceaf8       esp 0x1c6ceae0       ebx 0x09e965e0       edx


View 2 Replies View Related

Cisco Firewall :: 5550 - How To Do NAT Exemption With V8.4

Oct 4, 2011

I have looked in the books I have (Cisco ASA, PIX and FWSM; ASA 8.0) and googled a good bit but can't seem to find any specific mention of how to do NAT exemption with v8.4. It seems NAT exemption (NAT 0 access-list) was deprecated. Using ASDM, there's no corresponding menu item for this that is obvious.
We have public addresses inside the ASA and want to allow in/outbound connections using these IP's without NAT. The ASA is a 5550.

View 7 Replies View Related

Cisco Firewall :: Log Shows Wrong Source / Destination ASA 8.3

May 25, 2011

The Cisco ASDM or the event manager show wrong source/destination for teardown tcp messages:In this example the communication is an ssh session;from -> ssh and the connection is reseted by
The message build outbound is correct, i.e. source is (message id is 302013)
But the teardown is incorrect, i.e. source for the connection is which is definitely not true (message id is 302014)
Also there seems to be a documentation bug in syslog messages for ASA 8.4 since the message for the teardown 302014 is gone!

View 3 Replies View Related

Cisco Firewall :: 2911 - NAT Any Source Address From Internet

Mar 21, 2011

I'm using a 2911 as our Public Internet Edge Router. I have 2 public sub net blocks from Sprint, we are in the process of migrating. What i need to do is NAT any source address from the Internet from an address on one of our public blocks to the other.
Source Address ==> Destination (nat this to inbound.
So if from the internet tries to hit we want to nat that to both of which sit on our public space.

View 1 Replies View Related

Cisco Firewall :: 5512 - NAT Random Source Address

Jul 4, 2012

I have a problem with random host's geting the wrong source address on a ASA 5512-X  8.6(1). Right now there is a host,, showing up with (fake) on, should be like the rest of In the xlate tabel  I cant find anything wrong. Same yesterday with two host, that are using the right NAT address today.
nat (any,outside) dynamic interface.     (
object network H-
nat (inside,outside) static H-

View 1 Replies View Related

Cisco Firewall :: ASA 5550 IPv6 Compatibility?

May 21, 2013

I need to understand if ASA 5550 ver 8.2(1) is comptible with IPv6, if not what is the upgrade path to make it IPv6 compatible. The requirement is dual stack of IPv4 and IPv6 should run in the same HA cluster and later will shift IPv6 completely.
The existing infrastructure is equipped with ASA with HA Active/Active mode. The command output for required details are attached here in txt mode.

View 2 Replies View Related

Cisco Firewall :: High CPU Utilization On ASA 5550?

Mar 10, 2013

I have Active Standby ASA5550 setup with VPN premium license. A few days back we had a requirement of SSL VPN connection for and we got a temporary from Cisco for same, this license expired and the ASA reverted to it's original license. 3 4 days after this we saw a sudden increase in CPU utilization (upto 90% + -5%) on the ASA during production hours but were not able to figure out the reason, in order to restore the services we failovered the firewall to secondary and everything worked fine. We were suspecting one of the following but there were no logs for any of this
1. The ASA hardware was haivng problem

2. Some client was doing a DoS attack to bring down the ASA (no logs for this as well).
We took a downtime to look further by failovering the ASA back to primary and it worked fine without any issues ruling out the 1st option. We also came across a licesing doc [URL]
Downgrading any license (for example, going from 10 contexts to 2 contexts).
# Note If  a temporary license expires, and the permanent license is a downgrade,  then you do not need to immediately reload the security appliance; the  next time you reload, the permanent license is restored.
As per this doc, sooner or later a restart was required on the ASA. We restarted secondary ASA and everthing was fine but when we restarted the primary ASA by swtiching over to secondary some of the server (not all) in the DMZ stopped working (even ICMP unreachable) and only came back to normal when the primary ASA was restored and working fine (with failover).
The reboot was done by shuting down the physical link between the Core switch and ASA inside individually.
I am not sure what could be the issue that the servers in the DMZ wen unreachable.

View 0 Replies View Related

Cisco Firewall :: ASA 5550 - Two Different Syslogs Servers?

Aug 9, 2010

In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it?

View 6 Replies View Related

Cisco Firewall :: ASA 5550 Active / Standby With SSL VPN

Jun 12, 2011

I would like to work with two ASA's 5550 in HA (Acitve-Standby)  like perimetral firewalls and also work with another ASA 5540 but like a SSL VPN Remote Access to end users.Which will be the best topology to this scenary?. Perhaps i need to put the ASA 5540 SSL VPN together with the ASA's in HA directly in a port.

View 1 Replies View Related

Cisco Firewall :: How Many Outside Interfaces Are Allowed On ASA 5550

Apr 26, 2011

I am using an ASA5550 for a complex secure network that has at least six "outside" networks.  Each "outside" network is assigned to a specific port each set at level "0".  I also have a DMZ, set to level "50".  I am having difficulty with passing traffic from a host in the DMZ to all but one of the "outside" networks.  Is there a limit to the number of "outside" interfaces?  I will provide a redacted config file as soon as possible.

View 3 Replies View Related

Cisco Firewall :: ASA 5550 - URL Filtering Using Web Sense?

May 10, 2013

i have Cisco ASA 5550 and i want to do URL filtering using Web sense,can i use Micorsoft Forefront TMG2010 as websense server to do that?
the idea is to filter the HTTP & HTTPS URLs,if the  Micorsoft Forefront TMG2010 is not suitable,refer to suitable Websense URL filtering server?

View 2 Replies View Related

Cisco Firewall :: ASA 5550 Sending Reset With TTL Of 255

Oct 3, 2011

I have the following problem, right now we have an ASA 5550 connected to the client´s side. A reset is being received on the client´s side, but when we run the sniffers on both extremes of the network, we can see that the reset is not being sent by the server´s side.
We have narrowed it down to the 5550 ASA, but have found no bug that matches the description.
The characateristics of the reset packet are the following:
- It is the only packet with a TTL of 255.

- Both server and client have very different window sizes, and the reset packet even though has the server´s ip and port as source of the packet, it has the client´s window size.

- It has a correct ack number.

-Before the reset is received, there are a couple of retransmissions of the last packet sent.

- We´re handling a VPN tunnel between both servers.

View 1 Replies View Related

Cisco Firewall :: Does 5550 Contains Built In CSC / IPS Modules

Feb 7, 2011

i m looking for asa 5550 product.Part # ASA5550-BUN-K9 - Cisco ASA 5550 Appliance with SW, HA, 8GE+1FE, 3DES/AES
1) does 5550 contains built in CSC / IPS modules.? why i  m asking because the "quick refrence guide " indicates that expansion slots are not available.
2) can asa 5550 natively protects natively against networks attacks against virus / worms  etc with out CSC OR IPS MODULE.?

View 9 Replies View Related

Cisco Firewall :: ASA 5550 To ASA 5555-X Migration

Apr 23, 2013

I am about to carry out a migration from ASA 5550 to ASA 5555-X, however I cannot find any detailed document or reliable tool for this migration.

View 4 Replies View Related

Cisco Firewall :: ASA 5550 Cannot Logon With ADSM

May 22, 2012

I cannot logon with adsm anymore.when I run adsm, I type in my pw, and the screen keeps displaying "contacting the device". No timeout, just stays this way.I've updated the java version, no luck.I can connect with SSH with no problem. device = asa5550, 8.2(1) asdm 6.2(1) [code]

notice that there is no "with cookie-based authentication" here -- is this relevant?
Rebooting the device is not really an option.

View 7 Replies View Related

Cisco Firewall :: Link Aggregation On ASA 5550?

Jan 10, 2011

i'm installing a Firewall Cisco ASA 5550 with 8 Gigabit interfaces.
I have installed firmware 8.2.3.
Is it possible to make link aggregation on ASA to have more bandwith?

View 7 Replies View Related

Cisco Firewall :: ASA 5520 / 5550 - Cannot Upgrade To 8.3

Aug 7, 2011

I have a couple of ASA5520 and ASA5550, and I wanted to know if it is worth it to upgrade the software from 8.2(4) to 8.2(5)?  Because of the RAM I cannot upgrade to 8.3 for now.

View 1 Replies View Related

Cisco Firewall :: ASA 5550 - Cannot Copy IOS From Flash To PC

Jan 8, 2013

I just got a brand new ASA 5550, i configured the port g0/0  on asa with an ip address then configure my computer with ip and default gateway is I'm able to ping the asa from my computer. I remote to ASA thru the console port  and try to copy iOS from flash to my pc but it doesn't work.
Cisco asa# copy flash tftp://
Source file name []? asa804-k8.bin
Address or name of remote host []?
Destination file name [asa804-k8.bin]?
 Writing file tftp://
!%Error writing tftp:// (Timed out attempting to connect)
Cisco asa#

View 3 Replies View Related

Cisco Firewall :: How To Compress Data On ASA 5550

Apr 6, 2011

I have two box cisco asa 5550 in multiple context mode and failover.
My network topology is:
                                Outside Network
DMZ2 Network • • • • (CISCO ASA 5550) • • • • DMZ1 Network
                                Inside Netowork
My interface "Inside Network" is full(I think).I can't diagnose this, based on command "sh interface gigabitEthernet"
109042974565 packets input, 100691006385765 bytes 
94097614769 packets output, 59002295942465 bytes
999339444 packets dropped
My interface is 1GB, based on the above command, it is full?If interface is full, i have a problem! All the ports on asa firewall are using, how do resolve this? I can compress all data on this interface with class maps and policy maps?

View 4 Replies View Related

Cisco Firewall :: Not Able To Access ASA 5550 Through ASDM

Apr 22, 2013

We are having Cisco ASA 5550 appliance. from some days i am not able to access this ASA using ASDM. I am able to access ASA using SSH.[code]
At the same time standby firewall works perfectly fine with ASDM. I have tried by reloding the firewall, then it worked for 2 days & again stopped working.

View 6 Replies View Related

Copyrights 2005-15, All rights reserved