Cisco Firewall :: ASA 5585 Number Of Licenses Used By Multiple Security Contexts

Feb 5, 2012

We are going to deploy a active/active setup of 2 ASA 5585's. Here we will implement a concept of security zones through context's where different services will be firewall through a separate firewall context. will a security context consume 1 or 2 licenses because we are running in a Active/active setup?  Right now I got completely confused when my manager asked me that question.I would say that we only use on security context license - but since we are running in a active/active setup - even though the other instance is standby - will it consume a context license? We are using ASA OS 8.4.x.

View 5 Replies


Cisco Firewall :: ASA 5585 Transparent Mode With Multiple Contexts

May 6, 2013

We are deploying the Cisco ASA 5585 in transparent mode with multiple contexts, the port-channel was configured to connect to the core switches using  dot1q trunk. We are experiencing an issue which is the core switches are configured loop guard globally, therefore the port-channel connected to the firewalls will be put into inconsistent state when the failover happen, and the two firewalls' failover can not fulfill the failover at last.
I have two queries below: 

1. Does the firewall allow the BPDU passing through when it is in standby mode, for example, secondary firewall is active for group 2 and standby for  group 1.  does the secondary firewall block the BPDU from the vlans under group1 ?   
2. Can we disable the loop guard feature on the switch port-channel or is there any other way to solve this issue ?

View 1 Replies View Related

Cisco Firewall :: 5585 - ASA Shared Licenses With 8.3?

May 2, 2011

Shared licensing of ASA?I have 2 ASA 5585 in cluster and I have to Implement SSL / VPN license  My question:Since I have a cluster in 8.3 version, can I use only one license VPN / SSL for two, without necessarily implement the Shared Server licenses and participant.

View 4 Replies View Related

Cisco Firewall :: ASA5520 - Active / Active Failover In Multiple Security Contexts With Dual ISP?

Jun 1, 2011

I have an ASA5520 in location A with an ISP connection and a matching ASA5520 in location B with a separate ISP connection. We have fiber connecting the two locations and vlans passing back and forth so I will be able to configure the failover via a vlan as well as extend the ISP's to each location via vlans. The Active/Active configuration with the multiple security contexts does not seem to be an issue but how is a redundant ISP configured in this mode?We want to have context A using the ASA in location A with ISP1 as the primary and failing over to ISP 2 in locaiton B We also want to have context B using the ASA in location B with ISP 2 as the primary and failing over to ISP1 in location A Would route tracking provide the desired result? Is there a better option?

View 1 Replies View Related

Cisco Firewall :: ASA 5512-X Version 9.1 Multiple Contexts Supported?

Apr 3, 2013

if on the ASA 5512-X virtual contexts are supported with version 9.1 ?
I found different information on the Cisco web,  the ASA datasheet says it is supported but in the configuration guide I found exactly the opposite information.
Cisco ASA Series General Operations CLI Configuration Guide 9.1 and 8.6 [URL]
Cisco ASA 5500 and ASA 5500-X Series Next- Generation Firewalls for Small Offices and Branch Locations Data Sheet (Updated) [URL]

View 7 Replies View Related

Cisco Firewall :: Connection Failure In ASA 5520 Security Contexts

Mar 27, 2011

Ive got a virtualised firewall running 3 security contexts in routed mode. What am experiencing is that i cannot connect to an OUTSIDE host through the security contexts. From the firewall itself i cannot ping the directly attached host on the OUTSIDE interface but i can ping the directly attached host on the INSIDE interface. When i reload the firewall box, the first ping to the OUTSIDE host would be successful but subsequent pings fail and thus total connectivity is lost.
I even tried upgrading to ASA version 8.4(1) but still the same.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 With Security Plus License Lost Contexts

Jan 28, 2013

I have a ASA 5510 with Security Plus License and when I looked at the devices a few days ago I had 2 contexts, however after configuring the Mgm port as a regular port the contexts show 0, why?  I can not find any post on the internet where this issue has happen:  here is the output from show ver:

Cisco Adaptive Security Appliance Software Version 7.0(8)
Compiled on Sat 31-May-08 23:48 by builders
System image file is "disk0:/asa708-k8.bin"


View 3 Replies View Related

Cisco Firewall :: ASA 5585 Multiple Context Licensing

Apr 27, 2011

I am looking to deploy a cloud/borderless network solution and cannot get my head around how the licenses (AnyConnect Mobile and essentials) will be applied in a multiple context deployment. Any correct documentation.

View 1 Replies View Related

Cisco Firewall :: 5515-X Management Access To Transparent Multi-mode Security Contexts

Jan 23, 2013

I have setup a 5515-X in transparent multi-mode and setup 5 security contexts with inside and outside ports, one admin and 4 others. The problem I have run into is setting up a management IP for each context. On one of my other transparent firewalls in production we were able to apply an IP to the security context (not interface) however the new firewall is running the latest software and this same functionality is not available. The only options for IP in context mode is IP AUDIT. So my next plan was to create sub-interfaces of the management interface and assign one to each context however the 5515-x does not allow sub-interfaces on the management interface. How I setup a management IP on each context?
Another interesting thing i read is that the managment IP assigned to a context  (if i could figure out how to set it up), has to be in the same subnet as the data interface which if fine but it also says that the management interface should not be connected to the same switch as the data interface because of MAC address table update issues, meaning that i could not use a sub-interface of one of the already configured context ports.

View 3 Replies View Related

Cisco Firewall :: ASA 5585 - Advantage / Disadvantage For Using Multiple DMZs

Oct 16, 2011

we are planning to use multiple DMZ's in our organization, we are using cisco asa 5585, what is the advantage and disadvantage for using multiple DMZ's?. and which better to use one or two DMZ's or split every service in different DMZ ?

View 7 Replies View Related

Cisco Firewall :: ASA 5505 Security Plus Licenses - HA Pair Using Active / Standby

Apr 24, 2012

I have two ASA 5505's with Security Plus licenses on both.I am trying to force them to becoming an HA pair using active/standby.When I enable failover I get this message:
Mate's license (Licensed Cores ) is not compatible with my license (Licensed Cores ). Failover will be disabled.Do I need to apply new licenses to the ASA's?
Device licence details (same on both):Cisco Adaptive Security Appliance Software Version 8.2(1) [code] This platform has an ASA 5505 Security Plus license.

View 1 Replies View Related

Cisco Firewall :: ASA 5585 - Enable Same Security Level Interfaces To Communicate

Jul 14, 2012

I have ASA 5585 with SSP20. I want to enable same security level subinterfaces (routed mode) to communicate with each other. 
I have put below command at global level but somehow it is not happening.
hostname(config)# same-security-traffic permit inter-interface
Do I also need to check for NATing or some other things apart from above command?

View 2 Replies View Related

Cisco Firewall :: ASA 5585-X CX20 Prime Security Manager Appears Undefined

Apr 2, 2013

I'm trying to add our two 5585-X + CX20 units to Cisco Prime Security Manager. The ASAs seem to add correctly but the CX20s appear "undefined" for software version and model. Clicking on "Device Configuration" I get the error "Message From Server: SyntaxError: Unexpected token .

View 0 Replies View Related

Cisco VPN :: ASA 5520 - Number Of Licenses That Are Available?

Mar 6, 2011

Need to know the number of VPN licenses that is available,

1)  I have site to site vpn connections.
2) SSL VPn (browser)
3) IPsec  client vpn.

How many vpn connections are allowed? can multiple connections be made using the same username for IPsec VPn clients.?

View 2 Replies View Related

Cisco Switching/Routing :: Maximum Number Of Licenses For Connections To A 877?

Jan 11, 2012

Is there a maximum number of licenses for connections to a 877?The reason I ask is that our routers are managed by a datacentre and when I asked for the login details I was told that I couldnt have them due to licensing reasons with no other explanation.

View 1 Replies View Related

Cisco WAN :: Multiple VRF Communication On 5585 Switch With ASA

Jan 18, 2013

I have three different VRF on Nexus 7k, and we want those should be extend to Cisco ASA  5585 IOS 8.4.5.We had used the trunk port on Nexus 7k to ASA connectivity... and Dynamic protocl OSPF is running , both are in same area of OSPF,We are making subinterface on firewall for each VLAN.... in this scnerio only one VRF connectivity is working.. but other VRF are not pingable from ASA.

View 1 Replies View Related

Cisco WAN :: Install Security Licenses On 2911 Router?

May 27, 2013

i'm trying to install the security licenses on a 2911 router and is giving the error shown in the attached file

View 4 Replies View Related

Cisco Firewall :: ASA 8.3 Routing Between Contexts

Feb 21, 2011

Is it possible to route among contexts (I have 5 contexts) in the ASA without sending traffic to a fusion router (external router) to be routed.  I am running ASA 8.3.

View 2 Replies View Related

Cisco Firewall :: 5520 As ISP Causes VPN To Be Disabled When Using Contexts

Jan 31, 2012

In the latest code, is VPN still disabled when using contexts? If you use a 5520 as an ISP based firewall for customers, then what would be used for VPN access?  Also how many contexts does a 5520 support, and would putting 2 interfaces into an etherchannel for inside, and 2 for outside work?  Reason I ask about that, the inside and outside would connect to 2 different core routers.  I would be for an MPLS setup.

View 5 Replies View Related

Cisco Firewall :: ASA 5515X Max Contexts In HA Mode

Jun 4, 2013

What is the maximum number of contexts a pair of 5515Xs in HA mode can support?
I know each 5515X can have a max of 5 contexts, but does that mean in HA mode a pair can support 10 with license pooling? 

View 8 Replies View Related

Cisco Firewall :: Getting ASA 5540 Default Contexts?

Apr 19, 2011

Q1. I would like to confirm like how many total of contexts do I have by default when I purchase the ASA 5540 ? are they two contexts aside from the admin context or two contexts including the admin context?
Q2. can I configure the default box with High Availability using the default contexts?

View 3 Replies View Related

Cisco Firewall :: 6513 - FWSM Multiple Security Zones On Single Context

Nov 7, 2012

My corporate internal network is currently fire walled by an FWSM module on a 6513 switch.  We have each security zone (we have eight) assigned to a FWSM context and have ACLs set up between the contexts and the enterprise LAN/WAN.  Is it possible to support fire walling between these zones within a single security context?  The reason I am asking is that we would like to purchase a second FWSM for use as a standby, but do not want to cough up the ~ $12K for the context license.  We will ultimately be transitioning to ASAs for internal security, so do not want to spend more than we need to.

View 3 Replies View Related

Cisco Firewall :: 7609 / FWSM - Duplicated MAC Addresses Across Contexts

Feb 27, 2012

I have two 7609S routers each with a FWSM running 4.0( 8). I am licensed for 20 contexts.

Recently, I added a context for a new application and required access to a VLAN that already had an interface in another context.

The MAC address assigned to the interface in the new context was assigned the same MAC address as the interface in the previous context. This caused an application running through the first context to fail.

I know that on the FWSM I cannot hard code a MAC address to an interface in a context so how do I get around this problem caused by the duplicate MAC addresses?

View 1 Replies View Related

Cisco Firewall :: 6500 - Passive FTP Through 2 FWSM Contexts Via VRF Instance

Mar 26, 2012

I'm having problems getting FTP to work through two FWSM virtual contexts which are connected via a vrf. All this is configured on a 6500 switch with the FWSM running 3.1(4)
At the moment we can make the control connection but when we issue commands the connection times out.
Looking at the logs we can see the initial connection made to the server on port 21 from the client, this is also seen on the second firewall context (nearest the FTP server). The data channel is then seen on the first context, made using high src & dst port numbers and initiated from the client, successfully passing the ACL/Inspection, then on the second context we see the connection being denied by the incoming ACL on the second contexts interface connected to the VRF instance.
The rules are identical on the contexts and have been made by copying and paste the rule using CSM, we are using the predefined service group 'FTP-Group' which contains both tcp 20 & 21. FTP inspection is at default on both contexts.
We have tested with Win XP (capable of Active FTP only) & Firefox 3.6.12 which is the connections we are seeing in the logs trying to do Passive FTP.
Is this a problem with teh contexts randomizing sequence numbers or TCP Normalization? Or do we just have a problem with the Inspection engine on one of the contexts (I would have expected to see this on both contexts if it was a bug).

View 1 Replies View Related

Cisco Firewall :: 6500 / Static NATS For FWSM Contexts?

Jun 28, 2011

I am just designing a solution where a FWSM consists of 2 contexts initially and has a shared outside interface pointing to the 6500 switch. There are 3 subnets connected to each of the FWSM contexts. So if anyone wants to access these 6 subnets then a route would be needed pointing to the interface vlan of the shared interface on the switch. But that would not be enough to access the subnets.. I am sure we have to define static NATS to point them to the right context where these subnets reside.
The FWSM is running version 3.x code So say,, and reside in Context 1 and,, and reside in Context 2 in each of the context we would have to make three static NATS
static(inside1,shared) netmask
static(inside2,shared) netmask
static(inside3,shared) netmask
The same would go for context 2 as well
static(dmz1,shared) netmask
static(dmz2,shared) netmask
static(dmz3,shared) netmask
By creating these NAT statements, would the outside users be able to access the subnets residing in the context?

View 1 Replies View Related

Cisco Firewall :: ASA 9.X Routed - Inspect Traffic For All L3 And Transparent Contexts

May 12, 2013

We are currently looking at design models for a Multi-Tenancy solution.The firewall layer will be 2 X ASA's running 9.X to take advantage of VPN's in multiple context mode and mixed L3 and L2 contexts.
We will be delivering services through multiple L3 contexts (between 2 and 5 L3 contexts for services) and 1 transparent context for customers infrastructure  who will then have virtual firewalls for NAT's and VPN's etc withing their own environment.
I am not very experienced with IPS so my query is; if we were to get an IPS license for both ASA's how would the IPS fit in, can we use it to inspect traffic for all the L3 contexts and the transparent context?

View 4 Replies View Related

Cisco Firewall :: ASA 5585 / Identity Firewall With Single Forest / Multi-Domain

Dec 28, 2011

I have a question with regard to setting up the ID firewall on the ASA 5585 in a single forest, multiple domain windows network.Currently I have a semi-operational IDF at the top level but can't find users on the lower other domains, here is the setup:I have 3 domains.

Both domains have a two way parent-child trust and I can look for users in AD Users/Computer on both domains.  I initially setup the ASA to look at using an LDAP aaa-server per the IDF instructions, and then proceeded to configure the ad-agent.  I installed the adagent on the domain controller configured the settings on that system and had no problem adding users to the firewall and getting functionality within domain1.  I looked to see if I could see domain 2 and domain 3 users and found none.  I went ahead and added the domain2 system to the adagent on the DC and the system says that it is up, but when I search for users is not pulling them from domain2.  Instead, it shows domain1 users as domain2user1.  I also configured another adserver in the ASA to search ldap on domain 2 to no avail.The cisco documentation states the following:•Before you configure even a single domain controller machine using the adacfg dc create command, ensure that the AD Agent machine is first joined to a domain (for example, domain J) that has a trust relationship with each and every domain (for example, domain D[i]) that it will monitor for user authentications (through the domain controller machines that you will be configuring on the AD Agent machine). Single Forest, Multiple Domains—All the domains in a single forest already have an inherent two-way trust relationship with each other. Thus, the AD Agent must first be joined to one of the domains, J, in this forest, with this domain J not necessarily being identical to any of the domains D[i] corresponding to the domain controller machines. Because of the inherent trust relationship between domain J and each of the domains D[i], there is no need to explicitly configure any trust relationships.Reading that it sounds like it should just work.  I had everything properly configured before I installed the adagent, but I'm guessing that there is a chance that you can't have the adagent on the top level DC and get to communicate with the lower level domains. 

View 1 Replies View Related

Cisco Firewall :: 5585 - CSC And AIP

Oct 7, 2011

Does the 5585X supports BGP ? What if someone wants to use Antivirus + IPS feature in that . I have seen IPS modules for 5585X but looks like the antivirus module is not avaliable for 5585X

View 1 Replies View Related

Cisco Firewall :: ASA5505 - Understanding ASA Bundles And Licenses?

Oct 10, 2011

Any document which expalins what you need to know when looking at purchasing an ASA5505.  Which clearly describes the verious permitations and combinations of these lovely little boxes?
I recently purchased a basic: ASA5505-BUN-K9
I realise now this comes with 10 internal users, 2 ssl and no anyconnect mobility.   All these can be purchased as additional licenses.
Its my understanding that to support unlimmited Internal/Inside hosts - I need to purchase the L-ASA5505-SEC-PL (Security Plus License)
1) What is the model I should go for if I want to support unlimmited interneal.  Can a 5505 be purchased with with security plus?

View 10 Replies View Related

Cisco Firewall :: ASA 5520 Failover Unit Anyconnect Licenses

Jan 2, 2012

So i setup a failover active / passive with 2 ASA5520's
Primary asa has 750 Anyconnect vpn licensing and the secondary asa has 2 Anyconnect licenses     
I haven't setup the second asa with the new 750 licenses i purchased but when i do a show version it shows that the failover licensed features shows 750...
Does this mean i do not have to install the secondary anyconnect licenses on the standby ASA unit?
output of secondary asa
Licensed features for this platform:Maximum Physical Interfaces       : Unlimited      perpetualMaximum VLANs                     : 150            perpetualInside Hosts                      : Unlimited      perpetualFailover                          : Active/Active 


View 1 Replies View Related

Cisco Firewall :: QOS Configuration On ASA 5585?

Nov 29, 2011

I want to configure Qos for 2 diffrent Vlan 2 , each vlan for 2 mbps bandwidth .(VLAN details VLAN 10 (10.10.x.x /24) and vlan 20(20.20.x.x/24) Is any difference regarding initials configuration B/w ASA 5520 and 5585

View 9 Replies View Related

Cisco Firewall :: Setup ASA 5585 Out Of The Box?

Jan 29, 2012

Am not conversant with Firewalling. however i have need to set up CISCO ASA 5585 out of the box.

View 3 Replies View Related

Cisco Firewall :: Upgrading PIX 525 With ASA 5585-X / SSP-10

Jun 24, 2012

We are working for a client move from PIX 525 to ASA 5585-X, SSP10. This is a production environment and very critical migration. What are the gotchas which we should be aware off?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved