Cisco Firewall :: ASA 5585x Security Context In HA Cluster

Jun 6, 2012

I have a active-active setup with 2 cisco asa 5585x running 8.4 - the boxes ahve each 2 sec context's build-in - which gives 4 sec context in the cluster. I have 2 x 5 extra licenses (2 x ASA5500-SC-5)  which I haven't applied yet - will this give me a total of 10 or 14 security contextes? I am a bit in doubt because if I only get 10 sec contextes in this cluster then could I instead get a single 10 security context license (1 x ASA5500-SC-10) and add this - hereby I would get 12 then. 

View 1 Replies


Cisco Firewall :: 5585x - Threat Detection Log Entries In Multi Context Mode

Dec 29, 2012

We have a 5585X running in multi context mode, and we are getting log entries for scanning threat detection, such as:
%ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 2 per second, max configured rate is 10; Current average rate is 5 per second, max configured rate is 5; Cumulative total count is 3116
Threat detection is not supported in multi context mode so I cannot tune the thresholds, is there any way that I can get rid of this outside of messing about with logging levels/message IDs?

View 2 Replies View Related

Cisco Firewall :: Migrate To Multiple Context Mode On ASA 5520s Cluster?

Jun 4, 2012

I have a pair of ASA 5520s in active/standby failover mode, single context.  I'll be migrating to multiple context mode later this week.  Do I need to break failover first?  Or if I don't need to, should I?  Or can I do this while maintaining failover?  Can either of these scenarios will work (or fail).  I'll be remote, doing my work via SSH, but have somebody local who can console in if needed.
Migration option #1
Log into active/primary ASA
Configure Multiple Context mode
Reboot both devices
Login to active/primary ASA


View 1 Replies View Related

Cisco Firewall :: ASA 5585X - Possible To Have Content And Control Security?

Aug 10, 2011

Is it possible have Content Security and Control Security in a ASA 5585-X? I´m asking because the CSC-SSM is only supported in ASA 5540, 5520 and 5510 and I dont know how it feature ca be supported on a new ASA 5585-X.

View 2 Replies View Related

Cisco Firewall :: ASA OS 8.5 And VPN On Security Context

Oct 25, 2011

What are the new features added or going to be available on the 8.5 release on the ASA. Would this release "finally" support VPN on multi security context mode.
By the sounds of things looks like every other major vendor supports this feature except Cisco.

View 2 Replies View Related

Cisco Firewall :: ASA5510 - Implementing Security Context

Oct 29, 2012

I have a ASA 5510 and planning to implement multiple context in a 2  tier security level and vrf-lite. meaning I have 2xASA facing the  internet and below that a 2x3560 switch for our extranet and below that  is another 2xASA for intranet. See diagram below. In this kind of  network I want to know how it would impact the total throughput and  resources of the ASA using multiple context?
        |          |
        |          |
2811A         2811B
    |                  |
    |                  |     (OUTSIDE)
    |                  |     (INSIDE)
    |                  |   
    |                  |    
    |                  |    (INSIDE)
    |                  |
    |                  |    (OUTSIDE)
    |                  |

View 3 Replies View Related

Cisco Firewall :: Security Context License On 5550

Dec 9, 2012

 I need your support for upgrading the Security context license on 5550, at present we have 5 Security context license installed in ASA but we want it to increased till 10 conctexts. I want to understand if we need to get addtional 5 Security context license or 10.     

View 5 Replies View Related

Cisco Firewall :: Security Context License Requirement - ASA5520

Jan 14, 2013

A simple question - I have ASA 5520s and was wondering what license is required to create multiple (more than default 2) security contexts.

The ASA already have ASA 5520 VPN Plus license.
Software Version 8.4(1)

View 2 Replies View Related

Cisco Firewall :: ASA5510 Security Context License Transfer To Another Device

Apr 30, 2012

Is it possivble to have 10 security licenses, license to a Cisco 5510 and have them transfeered to a Cisco5520?    

View 1 Replies View Related

Cisco Firewall :: 6513 - FWSM Multiple Security Zones On Single Context

Nov 7, 2012

My corporate internal network is currently fire walled by an FWSM module on a 6513 switch.  We have each security zone (we have eight) assigned to a FWSM context and have ACLs set up between the contexts and the enterprise LAN/WAN.  Is it possible to support fire walling between these zones within a single security context?  The reason I am asking is that we would like to purchase a second FWSM for use as a standby, but do not want to cough up the ~ $12K for the context license.  We will ultimately be transitioning to ASAs for internal security, so do not want to spend more than we need to.

View 3 Replies View Related

Cisco Firewall :: ASA 7.2 Adding A Context In A Multiple Context Environment

Jul 1, 2012

On my production environment I have a firewall with already two contexts defined (15% of CPU used) and I want to add a new one.
This context is going to use the same interfaces as the others contexts. When I will enable the context, can I have some sort of repercussion on these two context ?

View 3 Replies View Related

Cisco Firewall :: ASA 8.4 In Multiple Context Mode With Different Amounts Of Context

Jan 13, 2013

I have two ASA 5510 in an Active/Active failover configuration; On the first ASA I have a license for five security contexts, on the second one I have the default two. On the pair I configured seven security contexts and everything works as expected; so far so good. Let's suppose now that the first ASA (the one with the license for 5 contexts) goes up in smoke; all the contexts migrate to the surviving firewall and life is still good. But what happens if, for some reason, I need to reboot the second ASA before the first one is repaired? My guess is that it will come up with just its own license for two contexts and that I will not be able to operate all my virtual firewalls.

View 2 Replies View Related

Cisco Security :: How Many Default Context In ASA 5510 Security Plus Edition

Aug 8, 2006

ASA 5510 security plus edition will it support active/active failover. and does it support context with securiyt plsu edition. and how many default context do we get with asa 5510 security plus edition.

View 3 Replies View Related

Cisco Firewall :: Recommended Stable Code For 5585x Firewall?

Mar 20, 2013

Looking for a recommended code on the ASA 5585x firewall. We ran into a bug (CSCtr24705) on version 8.4.2 where it rebooted the primary firewall. The bug has to do with modifying an existing ACL that's part of a custom policy-map inside a service-policy. If we upgrade to 8.4.5 (which has the previous bug fix in it), there is another major bug (CSCud70273) where if you use the packet-tracer input command on an inside interface it causes problems too.
I don't understand why packet-tracer input would have a bug associated with it when it's been around for a long time and we use it on a daily basis for troubleshooting. Is there stable code for the 5585x to upgrade to without running into possibly a major bug? This is our core firewall so there are no VPN tunnels on it. It's setup in active/standby failover in routed mode.

View 1 Replies View Related

Cisco Security :: Adding 3 Node ASA5510 / Active / Passive Cluster

Jul 25, 2012

we operate an active/passive cluster with 2 ASA5510 in Routed Mode. Is it possible to add another node, so that we have one active and two standby nodes in the cluster? Unfortunately, I have found no documentation on this .... The data sheet say only up to 10 nodes can be mentioned as a VPN load balancing cluster.

View 1 Replies View Related

Cisco Security :: Implement Active / Standby Cluster With A Pair Of 5550 ASAs?

Aug 19, 2012

I want to implement Active/Standby cluster with a pair of 5550 ASAs and I have a licensing question. Here is the "sh activation-key detail" output from both devices...
sh activation-key detail:
 Serial Number:  XXXXX
No active temporary key.

This platform has an ASA 5550 VPN Premium license.The flash activation key is the SAME as the running key.So it looks obvious that I'll have to upgrade the first ASA to support 25 SSL VPN Peers in order to build HA cluster, right?Now I want to know do I need the "ASA5505-SSL25-K9" license or something else.

View 12 Replies View Related

Cisco Firewall :: What Is Latency Value For ASA 5585X And 5555X

Apr 16, 2013

I am wondering what is Latency value for Cisco ASA 5585X and 5555X . I can see on websites that it says "low latency firewall" but I dont see any value.

View 1 Replies View Related

Cisco Firewall :: Way To Configure Pim-ssm On Asa 5585x-ssm20

Aug 6, 2012

if there is a way to configure pim-ssm on asa 5585x-ssm20.

View 1 Replies View Related

Cisco Firewall :: 5585x - Multiple ISPs Plus WAN And DMZ

Aug 17, 2011

Looking to replace an "all-in-one" type firewall (UTM/Firewall, SSL VPN) with a cisco product - the issue i'm running into is that we have multiple ISPs plus WAN and DMZ - overall more than 5 ports on mid-range ASA devices - and from what i read, adding 4-port module precludes me from adding CSC module.
Is there an solution to that other than going for 5585-x model? (kind of over our budget, granted we need 2 for failover)

View 2 Replies View Related

Cisco Firewall :: ASA 5585x - Create The Outside Interface On A Subinterface?

Oct 31, 2012

I have a circuit that will be delivered to a client next week and we are installing an ASA 5585x for them. They will have a circuit coming in with a few VLANs configured on it. One VLAN for the Internet and one for connectivity to another client.
So does the ASA allow you to create the "outside" interface on a subinterface?

View 2 Replies View Related

Cisco Firewall :: ASA 5585x Running 8.4 - Applying ACL Globally

May 4, 2011

I will be supporting a new ASA 5585X running 8.4 and I was wondering if it's possible to apply an ACL globally instead of it as an access group that is applied to a specific interface as in or out ... below are the interfaces and ACl.

View 2 Replies View Related

Cisco Firewall :: ASA 5585X URL Filtering / Unable To Support CSC Module?

Aug 22, 2011

Because ASA5585X doesn't support CSC module, how can do URL filtering on ASA5585X

View 1 Replies View Related

Cisco Firewall :: ASA 5585X Nexus Switches Utilizing VPC Technology

Jul 17, 2012

I want to configure 5585x Active/Standby with 2 nexus switches utilizing VPC technology. New ASA 8.4  supports etherchannel so I want to plugin 2 cables from ASA1  to sw1 and sw2 and 2 cables from ASA2 to sw1 and sw2? Is this a valid design?  how would I configure that? Any design document on that?

View 1 Replies View Related

Cisco Firewall :: ASA 5585x Working Fine But No Console Access

Feb 9, 2012

I have an asa 5585x cluster. I get ssh access but no console access on the standby unit.
On the active unit, when I try console access, ASA ask for a password. I have tried all the one that I have configured, but without success.

View 5 Replies View Related

Cisco VPN :: 5510 IPSec VPN In Security Context / Shared Interface Or Not

Feb 17, 2013

I have at the moment an ASA5510 pair in Multiple Context configured. Everything is ok, but we use til now only ACL features.Now I would be interested in configuring 2 contexts, with IPSec VPNs. One VPN per context. But I cannot find any information if it would be possible to use a shared interface for both contexts. My wish would only be to spare public IPs.If I have to configure 100 VPNs in 100 contexts, do I need 100 public IPs ?

View 5 Replies View Related

Cisco Firewall :: ASA 5500X - Next Generation Firewall - Cluster Licensing

Apr 26, 2013

I'm working on a BoM for a customer and i need to offer an ASA5525-X pair in HA with AVC and WSE subscritption, I've two question:
1) In order to use AVC and WSE I need the ASA bundle that includes the SSD HD right? (ASA5525-SSD120-K9)

2) In order to have both ASA's in HA, do i need to order two Suscriptions (ASA5525-AW3Y-PR) or only one that is "shared" in the cluster?

View 1 Replies View Related

Cisco Firewall :: PIX 525 Cluster

Mar 15, 2012

We currently had to RMA both PIX 525s due to increasing crc errors. After swapping the old ones with the new we are still seeing crc errors on all gig interfaces. We have swapped the gig nic's and the sfp's and the fiber patch cables, yet still the crc errors continue to climb.

Another thing that's interesting is that when we disconnect the secondary we see an increase in throughput.

View 2 Replies View Related

Cisco Firewall :: Pix 525 Cluster Failover?

May 23, 2011

a customer have 2 pix 525 with ver 7.0.1 in a failover configuration with serial cable and 2 sc fiber interface and 2 fastethernet 1 used for failover. the strange behaviour is that when i try to do traffic from inside to dmz or dmz to inside the maximum transfer is 862Kb/s to 1MB/s not more.... i don't understand what's happened. the show mem and show cpu are normal 7% mem used and 1-2% cpu used. attached you will find the configuration.

View 5 Replies View Related

Cisco Application :: ACE 4710 Possible To Create A Context Within Same Vlan As Admin Context

May 7, 2013

Is it possible to use 1 or 2 of the 4 gigabit ethernet ports from one ACE straight into the other ACE for redundancy? So ACE_01 gig0/4 to ACE_02 gig0/4.If so, is it a case of just having the layer 3 config instead of trunking etc..Also - is it possible to create a context within the same vlan as the Admin context?

View 4 Replies View Related

Cisco Firewall :: Upgrading ASA 5580 Cluster From 7.2 To 8.2

Aug 19, 2012

we are going to upgrade our 5580 ASA Cluster from 7.2 to 8.2 and want to do it like this way ( which worked for all 7.x upgrades ) :download asa8.2 Image to primary + secondary Firewallreboot primary ( message come up " mate version ...)reboot secondary.Does it works any experience? Does it work if both firewall can see each other during the boot process ?
Do I have to bring the secondary into the monitor mode so the fw is not visible for the primary ?

View 2 Replies View Related

Cisco Firewall :: PIX 515e Reason To Upgrade To ASA Cluster

Feb 24, 2011

Just looking for some good reasons why I should upgrade a Cisco PIX 515e cluster to an ASA Cluster to present to the business.

View 1 Replies View Related

Cisco Firewall :: ASA Version 8.6.1 NAT To Exchange 2010 Cluster?

Feb 26, 2013

We have the following setup on our Cisco ASA version 8.6.1 One to one NAT rule from outside to our Exchange 2010 cluster IP address (DAG group). This is working fine for clients on the internet accessing their emails via Exchange using their phones. The ASA has the MAC address of the active node from the cluster but when the cluster failover it cache the IP address and are not updating the new MAC when the cluster failover. So users from the outside are unable to connect to the new node from outside the ASA as the MAC address from the passive node is in the MAC table. The MAC address on all the switches update within 2 seconds on the internal network and users don't notice any outage.

View 4 Replies View Related

Cisco Firewall :: 5540 Changing Host-name In Asa Cluster

Feb 11, 2013

I have 2 cisco asa 5540's configured in active/standby mode. I need to change the hostname and domain name as per our standards. Does changing the hostname has any impact on the traffic flow?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved