I was wondering if it is needed to license the IPsec VPN clients in the ASA5500 firewalls...I know that you have license the SSL VPN peers (AnyConnect). I am almost sure that for the IPsec you don't have to.
View 1 RepliesWe have ASA5500's deployed for remote access concentration.We use Cisco IPsec vpn client with a group policy the chacks for Network ICE BlackIce ersonal firewall.The powers-that-be wish to change to McAfee presonal Firewall ok..Now the Group Policy allows you to check for several pre- configured Firewalls, Cisco Integrated, Sygate, Zone Labs etc.So as McAfee are no listed then I am to assume we go for "Custom Firewall" and this is where I am struggling.To configure checking for a Custom Firewall I must have the Vendor ID and the Product ID.McAfee haven't the faintest idea what we're talking about when we ask them for these details.Or is there a way to extract them from the registry of a machine with the McAfee product installed?
View 3 Replies View RelatedA customer has a 5505. According to the datasheet the limit of IPSEC sessions is 25 and the limit of anyconnect sessions is 25. Does that mean I can have 25 IPSEC tunnels and 25 Anyconnect tunnels at the same time? The customer needs at least 50 concurrent tunnels on his ASA. Am I understanding it correctly?
I was thinking the customer could pay for the anyconnect essentials license and connect his anyconnect clients to the ASA. Is that a good option to get the 50 concurrent clients connected?
I am just getting more confused the more I try to work it out. Not sure if this goes in the IP Telephony section or here. We have an ASA 5510 with the base license. We are needing to install IP Phones at remote workers homes, and I understand there are Cisco IP phones which have VPN clients built in to allow a tunnel to the central private network. IT appears that you can only use Any connect VPN for this, ans I am trying to work out what licensing upgrade we need to apply to the ASA, as the two Any connect licenses you get free on the ASA is not enough.
This is the phone we are looking to get; {URL} . What I want to know is will the Any connect Essentials license work with these IP phones? When I do a show version,
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 50
Inside Hosts : Unlimited
Failover : Disabled
[code].....
This platform has a Base license. It shows "Any Connect for Linksys phone : Disabled", is this the same for Cisco IP Phones? Is this the specific licensing type I should be looking to get for Any connect on IP phones or will Essentials do?
Prior to version 8.4(1) Cisco called their licensing name for SSL/VPN users AnyConnect Premium SSL VPN and currently the new name of the licensing is simply AnyConnect Premium. Also, the IOS display name for the amount of SSL/VPN users enabled via your licensing (ex. 2, 10, 25, 50, ...) by running a 'show activation-key' was changed from SSL VPN Peers to AnyConnect Premium Peers.With that said, my question is if the license for upgrading 10 users to 25 users (L-ASA-SSL-10-25= - ASA 5500 SSL VPN 10 to 25 Premium User Upgrade License) on an ASA prior to 8.4(1) and an ASA with 8.4(1) is still valid and the correct part number to peform these upgrades for both ASAs. The description of this part number is throwing me off because it says SSL VPN to Premium User, which was the name prior to 8.4(1). I could not locate any documentation regarding this part number or upgrading 10 users to 25 users for both ASAs.
View 4 Replies View RelatedI am setting up an ASA5505 to allow a VPN with certificate from AnyConnect Secure Mobility Client (iPad)However I get a "No License" message back from the ASA, on the iPad - Anyconnect.I remember reading the ASA5505 came with two licenses.
View 8 Replies View RelatedI am purchasing 2 5512x ASAs to be configured as an Active/Passive pair as a VPN device. Do I need to purchase anyconnect licenses for both devices?
View 2 Replies View RelatedWe have problems on central firewall with restricting traffic coming from remote office from IPsec. (The network sheme is attached) All branch offices are connected to central asa though IPsec. The main aim is to rule access from branch offices only on the central firewall, NOT on each IPsec tunnel According to the sheme:172.16.1.0/24 is on of the branch office LANs10.1.1.0/24 and 10.2.2.0/24 are central office LANThe crypto ACL looks like permit ip 172.16.1.0/24 10.0.0.0/8 the aim is to restrict access from 172.16.1.0/24 to 10.1.1.0/24 When packets are generated from host 10.1.1.10 to 172.16.1.0/24 all is ok - they are dropped by acl2 When packets are generated from 172.16.1.0/24 to 10.1.1.10 they are not dropped by any ACL - the reason is stateful firewall - traffic bypasses all access lists on a back path I thought that TCP State Bypass feature can solve this problem and disable stateful firewall inspection for traffic coming from 172.16.1.0/24 to 10.1.1.0/24, but it didn't work.The central asa 5500 is configured according to cisco doc [URL]
access-list tcp_bypass_acl extended permit tcp 172.16.1.0 255.255.255.0 10.1.1.0 255.255.255.0
!
class-map tcp_bypass_map
description "TCP traffic that bypasses stateful firewall"
match access-list tcp_bypass_acl
[code].....
I am designing wireless controller solution for one of our customer network with Cisco 5500 series controller, wireless client authentication part.
1. There are 25 departments around the campus, each will be given one or two access points.
2. One Cisco AIR-CT5508-50-K9 Controller shall be used.
3. Single SSID/ VLAN shall be used for entire campus.
4. Wireless Authentication credentials used by one department shouldn’t work for other department
I have configured Remote Access VPN on an ASA5500 Firewall. I am able to login normally and Ping Internal servers on the LAN. However, The servers cannot ping my IP address that i am taking from the RAVPN Pool. So it is a one way communication.
View 2 Replies View RelatedWe have 2 ASA 5510's running in a Active/Standby configuration. It appears that most of the changes we make on the active unit are replicated to the standby unit. However, there are 3 AnyConnect Client Profiles on the active unit and none of them show up on the standby, the standby has no AnyConnect Profiles. We also have 1 OnConnect script on the active unit and it does not appear on the standby unit either.
I was under the assumption that all config items on the active unit would replicate to the standby. Is this not correct? Do I need to do something extra to get everything replicated? Are there other items that do not replicate?
I ve configures an asa 5505 for remote vpn with anyconnect. it works just fíne - from remote i can ping the Clients and Server inside, i can do RDP or Connect via SSH to any machine, map some volumes local and so on but: I can not connect microsoft sql server. It uses port 1433 for the first connect and establishes then a dynamic connection. So i am a Newbie - what rules or configs do i miss?
View 3 Replies View RelatedSo, I've set up Anyconnect client access to an ASA-5510.
I've got a handful of interfaces, which contain hosts that should be accesible to anyconnect clients. I'm unable to reach addresses on a specific network, due to what packet-tracer claims is an implicit deny, though I'm unsure where to apply an access-list in this case.
fw1# show nameif
Interface Name Security
Ethernet0/0.205 SECURE 90
[Code].....
I have a XP workstation behind my ASA that can not connect to a client's network via Cisco VPN Client using IPSec...
In the logs it shows the translation is working on 500 but the VPN Client has the error 412, that the client is not responding.
Config below
ASA Version 8.2(1)!hostname RWFW1enable password encryptedpasswd encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address x.x.x.x
[Code].....
I am trying to implement IPSec Authenticated Firewall Bypass on windows vista clients within my microsoft domain to avoid implementing numerous windows firewall port exceptions for each client.
This is working internally on our network, between services servers (i.e AV server), and desktop clients. However i am having a problem when the clients are remotly accessing the domain via the VPN client.I have open traffic ports (IKE-UDP500, ESP - IP Prot 50, AH - IP Prot 51) bidirectionally between the remote vpn clients subnet and the services servers, however when the endpoints initiate traffic to the services server, the IKE traffic is unencrypted?
ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src outside:192.168.13.50 dst DMZ2:192.168.13.15 (type 8, code 0) denied due to NAT reverse path failure
Cant seem to get around this one yet. I have a remote ASA that I can VPN into. It has 2 dmz's, outside and inside interface configured.
Inside subnet is 192.168.11.0 / 24
DMZ2 is 192.168.13.0 / 24
VPN client pool is 192.168.15.0 /24
I login in fine. But have no access to the DMZ2 subnet. I get the failure listed above.
We are using an ASA 5510 and remote access (SSL VPN) using the AnyConnect client.
Is it possible to display a user message when a user connects using the AnyConnect client, matching a specific dynamic access policy? Can the message be displayed when the action is "Continue" rather than "Terminate"? I can't seem to get this to work and wondered if there was a LUA function to do this.
We have a DAP which gives a restricted ACL when the user's anti-virus is out of date, and I wanted to notify the user to update their anti-virus and reconnect.
Does any one advise the current ASA 5510 is going to EOS ?
View 1 Replies View RelatedUsing any computer and AnyConnect, I can connect to our network via ASA5500. But when I use Cius or iPAD, I always get a No License error message.
View 3 Replies View RelatedASA-5510, inside, outside, and some DMZ.Some services published with Static NAT - no problem.Now we need to add a second outside connection, with a second provider.Internet navigation only through the first provider (default gateway to the provider router "A").I need to publish some services ALSO through the second provider, ensuring the accessibility of both public IP addresses.I can set up the second NAT on the second interface, but the answer is ONLY to the first IP (the ISP "A", where I have the default gateway).By Cisco manual, it seems that there is a "lookup route" automatic with the return route of NAT, but it does not work.
View 6 Replies View RelatedShould we active IPS feature in ASA 5500-x by useing license?in the 5500-x ordering guide:IPS is only sold as ASA-IPS combo SKUs i.e., one cannot add IPS service as an option on top of ASA SKU. For example, if IPS service is desired on ASA 5515-X appliance, the relevant SKU is ASA5515-IPS-K8 or ASA5515-IPS-K9.But my customer has actived it by using the ASA5525-IPS-SSP on ASA5525-K9.
View 2 Replies View RelatedI'm working on a BoM for a customer and i need to offer an ASA5525-X pair in HA with AVC and WSE subscritption, I've two question:
1) In order to use AVC and WSE I need the ASA bundle that includes the SSD HD right? (ASA5525-SSD120-K9)
2) In order to have both ASA's in HA, do i need to order two Suscriptions (ASA5525-AW3Y-PR) or only one that is "shared" in the cluster?
Recently i have configured ASA5550 with 2 Contexts in Transparent mode. Traffic can pass through a single Firewall context but through both contexts it couldn't.
View 0 Replies View RelatedI would like to schedule automatic backups of our ASA5500's OoO-hours:
1. SSH from secure server and create _FULL_ backup - what would be the CLI command(s) ?
2. SCP from secure server and retreive file(s) - what is the location of the file(s) ?
It's a problem about access ASA5500 Firewall mangement port. The customer request access ASA5500 by entering the default IP address https://192.168.1.1 to monitor data tracffic in Windows 7. But after entering the default IP in IE, no any page appear.
But that way can access ASA5500 magement port successfully in Windows XP. What the different between Windows 7 and Windows XP? Is there any way or any patch can access ASA5500 manemeng port in Windows 7?
I have a Cisco ASA5520 with Software Version 8.2(5) in place, most my users are Mac Users and I am currently looking into Cisco AnyConnect in comparison to using VPN client.
I have a couple of questions
1) Does Cisco AnyConnect make use of IPsec or is it soley SSL VPN based?
2) From the license information I have below in my ASA I understand that I can have max 750 vpn peers however am I right in saying that this does not apply to Cisco AnyConnect peers? and that with Cisco AnyConnect I can only have 2 peers? Also what are the disabled anyconnect options for?
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 150
[Code]....
3) When trying to set up Cisco Anyconnect on the ASA using ASDM, I noticed I needed to upload AnyConnect client images however when I did this by uploading the .dmg file for mac machines I got the error message "not a valid SVC image". Is this because I am running 8.2?
I have a large quantity of ASA5520's and ASA5540's that need to be quickly assessed and RTV'd (if need be) if they are found to be upgraded ASA5510's.
My concern is because of this recent release-note by Cisco: [URL]
Is there a way to check the amount of DIMM slots on a unit through console or do I have to physically check each and every one?
I am attempting to port-forward on an ASA 5500 to internal host .100. The outside interface recieves its IP via DHCP. Packets are being denied so I ran packet-tracer and get the following error from outside to ssh port on internal host.
#packet-tracer input outside tcp 79.x.x.x 1025 71.x.x.x ssh
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
[Code]...
When I try to add CAS to CAM a cannot choose a OOB Virtual Gateway or OOB Real-IP Gateway, because these operation modes are absent in Type list.What can be reason it?
View 5 Replies View RelatedI'm trying to connect two ASA 5505s for a IPSec L2L VPN. They can connect, but not pass traffic from the AnyConnect subnet. I've added the config from ASA-2, with the LAN subnet of 192.168.138.0 and a subnet of 192.168.238.0 for AnyConnect client.
I'm trying to get the AnyConnect Clients access to the 192.168.137.0 LAN behind ASA-1 at 1.1.1.1. Having both 192.168.238.0 and 192.168.138.0 both access 192.168.137.0 is acceptable.
There's probably a lot of cruft in this config, as I've been reading all over forums and docs without much success.
:
ASA Version 8.2(1)
!
hostname asa-wal
names
name 192.168.238.0 anyconnect-vpn
!
interface Vlan1
nameif inside
[code]....
I would like to know about asa 5500-x. Does it supports application visibility and granular control for different applications. Moreover bandwidth control based on different users and different applications
View 1 Replies View RelatedI bought a Cisco ASA 5510 (P/N: ASA5510-BUN-K9) and i would like to know if i have to buy some license,What i mean is, for the basics, it still being necessary aquire some license?
View 3 Replies View Relatedwe have a customer with 2 x ASA5510-SEC-BUN-K9 running in an active/active HA mode. On the primary ASA he has 25 SSL premium licenses, but on the secondary ASA he has only 10 SSL licenses. Is there a need that both ASA´s has the same kind of licenses?
View 5 Replies View Related