Cisco Firewall :: ASA5505-UL-BUN-K9 / By Default Device Comes With Which IOS Version
Apr 20, 2011I am ordering ASA5505-UL-BUN-K9. By default device comes with which IOS version?
View 3 Replies
ADVERTISEMENT
Cisco Firewall :: Upgrade Path ASA5505 From Version 7.2 To 8.4?
May 9, 2013what the upgrade path is for 5505 ASA . I have one which is version 7.2 and need to upgrade it to 8.4(5). I have read that it needs to upgraded btwn major release versions.Not sure if I need to upgrade from 7.2 - 8.0 , then form 8.0 - 8.2, then from 8.2 - 8.3 and finally 8.3 to 8.4 or can I just upgrade from 7.2 - 8.2 and then from 8.2 - 8.4 .Also what is the minimum memory requirements for vers 8.4 .my ASA running on vers 7.2 currently has 256Mb Memory and I will be upgrading this to 512MB before I do the upgrade the image above?
View 4 Replies View RelatedCisco Firewall :: Restore Configuration To New ASA5505 On Different ASDM Version
May 27, 2013so we have been using our current ASA5505 for a long time. Since it only support up to 10 VPN licenses, so we buy a new ASA5505-SEC-BUN-K9(support up to 25 users).
the old ASA are running: 8.0.3 and ASDM 6.0.3
the new ASA are running: 8.2.5 and ASDM 6.4.5
I thought it would be simple as export and import the config file, but when i tried to restore, the new one is looking for a zip file but the old one doesn;t backup file in ZIP. It looks like i need to update the ASA version or/and ASDM?
I am pretty new to this and never upgrade any of these versions since I am aware of the upgrade may mess things up. So do I need to upgrade both the ASA version and the ASDM in order to restore my config? any effect if i do the upgrade? I also read some articles, we need to upgrade on the version one by one, like 8.0 to 8.1 then 8.2?
Cisco Firewall :: Possible To Convert Pix 501 Configuration Running Version 6.3(5) To New ASA5505
Jan 9, 2012I am wondering if it's possible to convert a Pix 501 configuration running version 6.3(5) to a new ASA5505 which we just purchased? We have site to site VPN on this device and i am just trying to save some time. I believe Cisco TAC might have a tool to do this but i am not sure.
View 4 Replies View RelatedCisco Firewall :: Basic Port Forwarding ASA5505 Version 8.4 ASDM 6.4?
Nov 24, 2012configuring the ASA particulary after the change to how NAT is implemented. What I am trying to accomplish logically seems fairly simple, yet I cannot get it to work. I have a Synology NAS at home that I am trying to reach via the internet. Prior to using my ASA, I had Verizon's FIOS router as my gateway and everything forwarded with no issues. The ports I need forwarded or reachable via the internet are TCP port 80 and 5000.I can also configure it via command line if that's the easier/preferred method.
View 11 Replies View RelatedCisco Firewall :: ASA5505 Can't Ping Device
May 22, 2012I have interited an ASA5505 problem. We're trying to manage the ASA remotely - we can connect to the device remotely via IPSec, we can ping other devices on the LAN network, but cannot ping the inside interface of the ASA - nor can we telnet/ssh/http to it. We can, however, connect to another router that's on the LAN and then SSH into the ASA's inside interface.
My IP via VPN: 10.133.20.8
The ASA interface we're trying to connect to via SSH or ASDM: 10.4.209.254
A router on the LAN we can connect to 10.4.209.250
We can ping other LAN devices such as 10.4.209.75, .90, .150 - so it's not a NAT/Route/Split Tunnel issue.I've attached the ASA config.
hostname ASA5505
enable password XXXXXXXXXXX encrypted
passwd XXXXXXXXXX encrypted
names
name 10.4.209.248 rpm_router
[code]....
Cisco Firewall :: ASA5505 - SSH Timeout / Unable To Access Device From Host
Jul 19, 2007I have an ASA5505 running ver 8.0(2). I have configured the ssh timeout, ssh host commands and did the crypt o key gen. I am unable to access the device from the host I am allowing. Is there like ca save all command required? I am trying to use the default pix and telnet password. Do those still work?
View 3 Replies View RelatedCisco Firewall :: ASA5505 - Remote Device Or Resource Won't Accept Connection
Dec 21, 2012I installed a CISCO ASA5505 with 50 user license to my network as the gateway firewall. So ASA is acting as the gaeway router which is connected to a fibre circuit and also it gives DHCP to the network. The strange thing is that except for two computers rest does not have internet. I also have an asterisk phone system which works fine..
I tried everything.... static IP's DHCP, DNS nothing worked. But strange enough two computers works fine and have internet.. but are no special computers. One is Win XP and the other one is Win7. When I troubleshoot the problem in win 7 on one of the computers it says
"The remote device or resource won't accept the connection"
Cisco Firewall :: ASA 5505 Portforwarding To Device With Different Default Gateway
Feb 27, 2012A customer got a new VoIP PBX, and now I have to forward port 443 on the ASA to the PBX for remote administration purposes. The LAN-interface of the PBX is in the same subnet as the ASA but has an external VoIP-router as default gateway and not our ASA. Is it even possible to forward the port to the PBX when there is no route of any sort to our ASA on it?
View 2 Replies View RelatedCisco WAN :: Can't Use ASA5505 As Default Gateway For LAN
Mar 16, 2011We have a network consisting of a central site and a few remote offices. The sites are all connected via MPLS and also have VPNs over ADSL / internet connections as a backup. The remote offices have Cisco 837 routers for the ADSL connections which we can manage but the MPLS routers are managed by the service provider providing the MPLS connections. At the central site we have a Cisco 891 for the the MPLS connection (which we manage) and a Cisco ASA5505 for the backup VPNs.
In order to implement failover from MPLS to VPN in the event of any MPLS line going down I have tried to use ip sla monitors and tracked objects on the 891 as per Cisco's documentation. The problem that I am finding is that I can't set the number of ICMP echo failures required before the tracked route is dropped. Whenever the ip sla monitor fails to get a response the tracked route is dropped immediately. This is too sensitive as packets are occasionally dropped which results in the routes bouncing back and forth between MPLS and VPN too frequently (disconnecting users in the process).
I have tried different threshold types and values, tried configuring ip sla monitor reaction-triggers (although I don't understand what little documentation that I can find on this) and have even looked at event manager. I have been working on this for a few weeks now and am getting nowhere.
The Cisco ASA5505's implementation of ip sla monitor is much better in that it is possible to specify the number of packets but unfortunately we can't use the ASA as the default gateway for the LAN as the asymmetrical routing that occurs does not work with the firewall function of the ASA.
Any issue with ip sla monitor on IOS and managed to get it working?
Cisco Firewall :: Software Upgrade For ASA 5520 Version 7.0(1) To Version 8.4?
Apr 3, 2012provide me with the important links which can show me how to do the software upgrade for my ASA 5520 ver 7.0(1) to ver 8.4 ? as well as the ASDM
View 10 Replies View RelatedCisco Firewall :: How To Upgrade ASA 5510 Version 8.0(4) To Version 8.3
May 10, 2011i am using Cisco ASA 5510 with ASA Version 8.0(4) and memory 256MB. me to Upgrade it to 8.3
View 6 Replies View RelatedCisco VPN :: ASA5505 - Bad Cryptochecksum Ignored And Setting Default Startup Configuration
Jan 9, 2012There are two issues which are testing my resolve.
1) Bad Cryptochecksum Ignored error
2) Unable to boot to a save startup-config file.
I want to take the configuration from one ASA 5505 and move it to another ASA 5505. I copied the startup-config file from an ASA 5505 running asa821-k8.bin to an ASA running 8.222-k8 to flash using tftp. I set the boot config parameter on the new asa to flash:/startup-config which is the location of the startup file. If I use copy run start command, I over write the startup file. When I copy the startup configuration to the running configuration I get a Bad Cryptochecksum Ignored error and the startup file does not copy over to the running file. How can I resolve this issue?
Cisco :: Verify Default FWSM Boot Partition On 6500 Version 12.2(17r)?
Mar 12, 2013The network gods recently updated our 6500 and upon reboot, the FWSM booted to CF:1 maintence partition,which caused an immediate outage. On the router, I ran the following command to set the default FWSM boot partition to the configuration with:Router#boot device module 4 cf:5 However, it appears the "show boot device" command has been replaced with "show bootvar" which doesn't show me which partition the router will boot the FWSM to. Is there a command I can run from the Router that will actually confirm the boot partition for the FWSM if the router reloads.
View 1 Replies View RelatedLinksys Wireless Router :: WRT54G Version 2 Weird Default Gateway
Nov 21, 2012We were hit by hurricane Sandy a couple weeks ago and lost power for a week and a half. Now that our cable has been restored I noticed that the wireless internet wasn't working. The wired internet works fine to this computer but no Wi-fi.I think the problem is the routers default gateway. It's supposed to be 192.168.1.1 but right now it's 24.191.112.1 .So far I have tried:
-Powercycling everything
-ipconfig/ flush DNS
-ipconfig/ release and ipconfig/renew
-Checking all the wires are pugged in fine (They are).
Cisco VPN :: Resetting Enable Password On ASA5505 Device
Jul 9, 2012resetting the disable password on an ASA5505 device
View 9 Replies View RelatedCisco IOS On 877s - How To NAT To A Device That Doesn't Have A Default Gateway
Aug 4, 2012I'm trying to NAT to a device that doesn't have a default gateway; effectivley we want to talk to the device as if we're on the same LAN but using only port 80.Here's the setup:
Remote Device on LAN A <-> RA <-> Remote router WAN A <-> ISP <->--
--<->ISP <-> Remote router WAN B <-> RB <-> Remote Device LAN B (no default gateway)
We're using Cisco IOS on 877s and I'm sure this can be done
Cisco WAN :: 4948 - BGP Breaks When Device Connects To Default VLAN
Dec 26, 2011Currently, I have a Cisco 4948 in office that connects to a remote site via BGP. From what I am seeing, when connecting a new device to this switchport (we connect devices to this switch for a multicast VLAN that is set up), the BGP link fails after roughly 20-30 seconds. The switchport is not tagged with a VLAN, or any other config. Just a plain old port. This outage continues until the port is added to the mutlicast VLAN.
View 1 Replies View RelatedCisco WAN :: Does IP Default-gateway Have Any Effect On L3 Device Such As 2811 Router
May 21, 2013Does ip default-gateway have any effect on a L3 device such as a 2811 router? I always thought that on a L3 device the default route would supersede any such command assuming it is accepted.
We have a client device that cannot be reached for managment directly and wanted to add that statment only if it might work.
Cisco AAA/Identity/Nac :: ACS1113 Version 4.2 Ssh Version 1 / Specify Only Version 2 Or Turn Off SSH?
Sep 14, 2009McAffee scan of acs 1113 appliance running the 4.2 build 124 patch 12 version reports that a medium vulnerability exists because the system has SSH version 1. Any way to specify only version 2 or turn off SSH?
View 9 Replies View RelatedCisco VPN :: ASA5505 Site-to-Site VPN And AnyConnect On Same Device Using IKEv2
Jul 10, 2012I have 2 ASA5505's connected through a site-to-site using IKEv1 and IKEv2.Recently, I ran through the wizard to configure the AnyConnect software. [code]Now, my site-to-site connection will only come up using IKEv1.Is there a way to have both the Site-to-Site and the AnyConnect VPN connections use IKEv2?
View 1 Replies View RelatedCisco VPN :: ASA5505 Site-To-Site And Remote Access On Same Device
Jun 3, 2012I'm attempting to configure an for both site-to-site and remote access VPNs. The site-to-site is working fine, however when I connect using the Cisco client, after initial connection and password prompt I get a "not connected" status. The log states that a policy map match could not be found. I have successfully set the unit up for remote access with no site-to-site and ran into another host of issues when adding the site-to-site to the working remote access config, so I started over setting up site-to-site first. I've attempted this through ADSM (hate it) - the current configuration is via CLI. I'm certain I'm just missing a piece or two.
View 2 Replies View RelatedCisco Firewall :: Users Behind ASA5505 Firewall Are Unable To Access Internet
Feb 24, 2011I have a normal setup of ASA5505 (without security license) connected behind an internet router. From the ASA5505 console I can ping the Internet. However, users behind the Firewall on the internal LAN, cannot ping the Internet even though NATing is configured. The users can ping the Inside interface of the Firewall so there is no internal reachability problem. In addition, I noticed that the NAT inside access list is not having any hit counts at all when users are trying to reach the internet.
When i replace the ASA5505 with a router with NAT overload configuration on it, the setup works normally and users are able to browse the internet.
The ASA5505 configuration is shown below.
hostname Firewall
interface Ethernet0/0
description Connected To Internet Router
switchport access vlan 10
[Code].....
Cisco Firewall :: ASA5505 Lose Configuration If Upgrade Firewall
May 17, 2011i have asa 5505 with the asdm v5.2 (4), and the asa v7.2(4). This platform has a base license. if i upgrade adsm and asa on v6.2(1) and v8.2(2) if I lose my license and that you need to activate them? i configured site to site vpn (this firewall and the another) that i lose my configuration if i upgrade my firewall.
View 2 Replies View RelatedCisco Firewall :: ASA5505 Can't Ping New Firewall On Inside Interface
Jul 14, 2011I've recently upgraded my old firewall from a PIX to an ASA5505 and have been trying to match up the configuration settings to no avail. I have is that I can't ping the new firewall on it's inside interface, despite having "icmp permit any inside" in the running config. Secondly, the server I have on there ("Sar") can't connect out to the internet.I've included the ASA's running config incase anybody can see if something stands out. I have a feeling it's either not letting anything onto the inside interface, or there is no nat going on. Lastly (and possibly relevant), the firewall is actually going at the end of a vlan, which is different to the firewall's inside vlan number. I don't know if this is actually the problem because the server can't connect out even if connected directly into the firewall.
View 32 Replies View RelatedCisco Firewall :: Unable To Ping Internet IPs From ASA5505 Firewall
Jan 9, 2013Internet ISP -> Juniper SRX 210 Ge-0/0/0
Juniper fe0/0/2 -> Cisco ASA 5505
Cisco ASA 5505 - >Inernal LAN switch.
1. Internet is connected to Juniper Ge0/0/0 via /30 IP.
2. Juniper fe0/0/2 port is configured as inet port and configured the Internal public LAN pool provided by the ISP. And this port is directly connected to Cisco ASA 5505 E0/0. Its a /28 pool IP address. This interface is configured as outside and security level set to 0.
From Juniper SRX, am able to ping public Internet IPs (8.8.8.8).
Issue:
1. From ASA am unable to ping public ip configured on Juniper G0/0/0 port.(/30)
2. From ASA no other Public internet IP is pinging.
Troubleshooting Done so far.
1, Configured icmp inspection on ASA.
2. Used the packet tracer in ASA, it shows the packet is flowing outside without a drop.
3. Allowed all services in untrust zone in bound traffic in Juniper SRX.
4. Viewed the logs when I was trying the ping 8.8.8.8 in ASA. It says "Tear down ICMP connection for faddrr **** gaddr **
Cisco Firewall :: Migrating Netscreen Firewall To ASA 5515 Version 8.6?
Mar 5, 2013I am currently migrating a netscreen firewall to a asa 5515 version 8.6 The issue is setting up the management connectivity.
basically the management IP of the cisco asa is not advertised. But, we want to route a management IP through the management interface to interface Gi0/2.
so IP of management interface is say - 216.10.100.10. and the IP of the inside interface is say - 198.1.1.10/24 on our router we have a static route sending 198.1.1.0/24 to next hop of 216.10.100.10 (management interface of cisco asa).
On the Cisco ASA can I send the traffic to the inside interface and manage the firewall via ssh that way?
Cisco Firewall :: 5510 - Transparent Firewall Installation Using ASA Version 8.4(3)9
May 14, 2012 I'm trying to install an ASA 5510 transparent firewall using ASA version 8.4(3)9 but I don't understand how traffic will ever pass through my firewall if both interfaces are on the same sub net(V lan) as the host and it's default gateway? The reason I'm doing this is were installing UAG (or Direct Access) and the UAG appliance need to have public IP's but still be behind a firewall (see attached diagram).
Looking at the documentation (which all seems to be for 5505's running 8.2) it almost seems like i need to have the transparent firewall 'in-line' to the ISP router?, but this router services another IP address range on another v lan for other (routed) firewalls (not shown on diagram) so putting it 'in-line' is not possible. Surely this can't be the case can it? If not how is it supposed to be cabled up and configured so packets go through the firewall?
Cisco Firewall :: ASA5505 Firewall Rule Not Blocking
Apr 1, 2013I'm trying to troubleshoot an ASA5505.
The original goal was to block "Mumble/Murmur" (a voip app) traffic, which runs on TCP/UDP 64738, both inbound and outbound, except to a certain host (63.223.117.170).
However, when nothing I tried seemed to make a difference, just to troubleshoot, I decided to try blocking all inbound traffic. I first disconnected ethernet port 0/0 to ensure that it was cabled correctly and the outside interface went down when I did. That worked as expected, so I confirmed I had the right interface and it was cabled correctly.
I then applied a "any any deny ip" rule as the first element in the outside interface access_list, as you can see below. However, it appears to have had no real effect and the hit count is very low (it should be astronomical).
show ver
Cisco Adaptive Security Appliance Software Version 9.0(2)
Device Manager Version 7.1(2)
Compiled on Thu 21-Feb-13 13:10 by builders
System image file is "disk0:/asa902-k8.bin"
[Code].....
Cisco Firewall :: ASA 5540 - Version Change In Firewall?
Mar 15, 2012How are asa5540 in high availability mode upgraded for their versions.
View 1 Replies View RelatedCisco Firewall :: ASA Version 9.0(1) / Configuring NAT On Intranet Firewall?
Dec 26, 2012configuring NAT on intranet firewall. here is the my topology:
DMZ Network - - - - - - - - - External Firewall - - - - - - - - - Internet
|
|
|
Internal Network - - - - - - - - - Internal Firewall
1) I can Ping the intneral host from external firewall, internet firewall and DMZ network
2) Both ASA's are running OS Version 9.0(1)
3) ACL used permit IP any any, on both (i.e inside and outside)
NAT configuration on Internal Firewall (Identity NAT)
object network MGMT-SRV-INSIDE subnet 10.10.10.0 255.255.255.192
object network MGMT-SRV-identity
subnet10.10.10.0 255.255.255.192
object network MGMT-SRV-INSIDE nat (Inside,Outside) static MGMT-SRV-identity
[code]....
Cisco Firewall :: Block Ip Address From CLI At PIX Firewall Version 6.3(4)?
Oct 11, 2011I would like to know how can I block a ip address from the CLI at the Cisco PIX Firewall Version 6.3(4)
View 4 Replies View RelatedCisco Firewall :: Using IP Aliases On ASA5505
Nov 29, 2011Is it possible to use IP "aliases" on an ASA5505 to use as static NAT public IPs to private IPs? For example, I have int e0/0 connected to my ISP using a /30 subnet and I have my private LAN connected to e0/1 with a /24 subnet. At the moment I can use the one usable IP from the /30 to NAT to the private LAN. The ISP is also routing a /28 subnet to the one public IP of the ASA. I would like to use some of the /28 IPs for NAT also. Can it be as easy as just adding the NAT commands? I figure I would have to add that subnet to the ASA somehow, no? In other devices (including the SA520) they use a concept called IP aliases whereby you define what additional IPs the device can use in its NAT config. Does the ASA support aliases? Maybe I have to do something with VLANs?
View 2 Replies View Related