Cisco Firewall :: ASA5510 - Implementing Security Context

Oct 29, 2012

I have a ASA 5510 and planning to implement multiple context in a 2  tier security level and vrf-lite. meaning I have 2xASA facing the  internet and below that a 2x3560 switch for our extranet and below that  is another 2xASA for intranet. See diagram below. In this kind of  network I want to know how it would impact the total throughput and  resources of the ASA using multiple context?
 
 
      INTERNET
        |          |
        |          |
2811A         2811B
    |                  |
    |                  |     (OUTSIDE)
ASA_A-------ASA_B
    |                  |     (INSIDE)
    |                  |   
3560A---------3560B
    |                  |    
    |                  |    (INSIDE)
ASA_C--------ASA_D
    |                  |
    |                  |    (OUTSIDE)
3560C----------3560B
    |                  |
INTERNAL NETWORK

View 3 Replies


ADVERTISEMENT

Cisco Firewall :: ASA5510 Security Context License Transfer To Another Device

Apr 30, 2012

Is it possivble to have 10 security licenses, license to a Cisco 5510 and have them transfeered to a Cisco5520?    

View 1 Replies View Related

Cisco Firewall :: Implementing ASA5510 To Network?

Aug 12, 2012

Existing nework New Network

I have attached some diagram here, 2911 Router configured as a zone based firewall and it works fine. I need to put ASA 5510 as an internal Firewall in to the existing network. So I need to hand-over the NATing configuration from IOS FW to ASA 5510 , are there any special configs here? I have done this but it's not working, If i bypass IOS ZB FW and ASA directly connect to internet Its works fine, If NAT configurations keep in IOS ZB FW then it works fine.
 
I have attached IOS ZB FW current config file below.

View 2 Replies View Related

Cisco Firewall :: ASA5510 With Multiple Context Mode / Does It Support Remote Access VPN

Jul 17, 2012

I have 2xASA5510 with securityPlus license.i have configured 3 context and Active/Active Failover.Everything works fine. But also want to use rometeAccessVPN but couldn't fine anything for VPN. does it support VPN in multiple mode?

View 3 Replies View Related

Cisco Firewall :: ASA OS 8.5 And VPN On Security Context

Oct 25, 2011

What are the new features added or going to be available on the 8.5 release on the ASA. Would this release "finally" support VPN on multi security context mode.
 
By the sounds of things looks like every other major vendor supports this feature except Cisco.

View 2 Replies View Related

Cisco Firewall :: Security Context License On 5550

Dec 9, 2012

 I need your support for upgrading the Security context license on 5550, at present we have 5 Security context license installed in ASA but we want it to increased till 10 conctexts. I want to understand if we need to get addtional 5 Security context license or 10.     

View 5 Replies View Related

Cisco Firewall :: ASA 5585x Security Context In HA Cluster

Jun 6, 2012

I have a active-active setup with 2 cisco asa 5585x running 8.4 - the boxes ahve each 2 sec context's build-in - which gives 4 sec context in the cluster. I have 2 x 5 extra licenses (2 x ASA5500-SC-5)  which I haven't applied yet - will this give me a total of 10 or 14 security contextes? I am a bit in doubt because if I only get 10 sec contextes in this cluster then could I instead get a single 10 security context license (1 x ASA5500-SC-10) and add this - hereby I would get 12 then. 

View 1 Replies View Related

Cisco Firewall :: Security Context License Requirement - ASA5520

Jan 14, 2013

A simple question - I have ASA 5520s and was wondering what license is required to create multiple (more than default 2) security contexts.

The ASA already have ASA 5520 VPN Plus license.
 
Software Version 8.4(1)

View 2 Replies View Related

Cisco Firewall :: 6513 - FWSM Multiple Security Zones On Single Context

Nov 7, 2012

My corporate internal network is currently fire walled by an FWSM module on a 6513 switch.  We have each security zone (we have eight) assigned to a FWSM context and have ACLs set up between the contexts and the enterprise LAN/WAN.  Is it possible to support fire walling between these zones within a single security context?  The reason I am asking is that we would like to purchase a second FWSM for use as a standby, but do not want to cough up the ~ $12K for the context license.  We will ultimately be transitioning to ASAs for internal security, so do not want to spend more than we need to.

View 3 Replies View Related

Cisco Firewall :: ASA5510 Single Mode / Move To Multi Context Mode

Sep 16, 2012

I got an ASA 5510 system currently in single context mode, with CSC SSM installed. Single ISP uplink to internet, no VPN. And now customer would like add another ISP uplink, without invest another box for HA.What come across my mind is make the current box into multi context. There's some area i need to concern and also need yours perspective on it.
 
Question 1: For making the firewall into multi context, am i need to do it from scratch, issue mode multiple command. Then rebuilt the current production config into one of the context, then another context meant for the new IPS uplink, and one admin context?
 
Question 2: For CSC -SSM licensing requirement, model ASA 5510 with security plus license is able to support 2 context. So if i split my firewall like what i mention in question, what exactly number of context do i own (admin, context A, context B)?
 
Question 3: For CSC-SSM module in multi context mode, so the management port of CSC SSM must attach at admin context?
 
Question 4: After configured all the policy and traffic to scan, how exactly i should do in order apply this policy to the interface?  Should i only enable at admin context, then firewall service-policy rules, and apply it global, OR should i also do the same action on context A and Context B?

View 3 Replies View Related

Cisco Firewall :: ASA 7.2 Adding A Context In A Multiple Context Environment

Jul 1, 2012

On my production environment I have a firewall with already two contexts defined (15% of CPU used) and I want to add a new one.
 
This context is going to use the same interfaces as the others contexts. When I will enable the context, can I have some sort of repercussion on these two context ?

View 3 Replies View Related

Cisco Firewall :: ASA 8.4 In Multiple Context Mode With Different Amounts Of Context

Jan 13, 2013

I have two ASA 5510 in an Active/Active failover configuration; On the first ASA I have a license for five security contexts, on the second one I have the default two. On the pair I configured seven security contexts and everything works as expected; so far so good. Let's suppose now that the first ASA (the one with the license for 5 contexts) goes up in smoke; all the contexts migrate to the surviving firewall and life is still good. But what happens if, for some reason, I need to reboot the second ASA before the first one is repaired? My guess is that it will come up with just its own license for two contexts and that I will not be able to operate all my virtual firewalls.

View 2 Replies View Related

Cisco Security :: How Many Default Context In ASA 5510 Security Plus Edition

Aug 8, 2006

ASA 5510 security plus edition will it support active/active failover. and does it support context with securiyt plsu edition. and how many default context do we get with asa 5510 security plus edition.

View 3 Replies View Related

Cisco Firewall :: Have Both IPS And Content Security On ASA5510?

Aug 14, 2012

We want to have a ASA5510 with both IPS function and Content Security feature, while I checked on Cisco website, looks like ASA5510 or 5520 only have one SSM slot, so I can only use either AIP module or CSC module, does it mean I can not get both features at the same time.
 
Right now I want to have IPS function and anti-spam, anti-virus, antiphishing, content filtering, URL blocking such feature, so what do I need to buy to have all of these function in one device?

View 2 Replies View Related

Cisco Firewall :: ASA5510 Possible To Have Security Plus And AnyConnect Essentials

Dec 21, 2011

Recently upgraded a 5510 to Anyconnect Essentials and Anyconnect Mobile, the device was Security Plus and is now Base. Is it supposed to work this way? I lost my Gigabit interfaces. Is it possible to have Security Plus + Anyconnect Essentials?

View 1 Replies View Related

Cisco Firewall :: ASA5510 - Adaptive Security Appliance

Mar 20, 2011

I m getting mention error when try to open subjected web link.
 
Deny TCP (no connection) from Outside:180.87.10.44/2443 (180.87.10.44/2443) to DMZ-1:a.b.c.d/1594 (w.x.y.z/17964) with follow explanations.
 
"The adaptive security appliance discarded a TCP packet that has no associated connection in the adaptive security appliance connection table. The adaptive security appliance looks for a SYN flag in the packet, which indicates a request to establish a new connection. If the SYN flag is not set, and there is not an existing connection, the adaptive security appliance discards the packet."
 
Where, a.b.c.d = our private ip address (Natted) w.x.y.z  = Public Ip address.

View 1 Replies View Related

Cisco Firewall :: ASA5510 - Same Security Level VLan Routing?

Jun 25, 2011

I'm facing a problem with two vlans. Each vlan has internet access by NAT.
 
In each vlan there is at least one server, who should be accessible from the other vlan and vice versa.
 
The function "same-security-traffic permit inter-interface" doesn't work, because NAT control is in place - so an expert.
 
Some experts told me it's not possible to route back out the same interface, and also not route back out the seperate subinterfaces as well.

View 12 Replies View Related

Cisco Firewall :: Adding Content Security To ASA5510-BUN-K9 Edition

Sep 27, 2012

I have an ASA5510-BUN-K9 in this version:

###
Cisco Adaptive Security Appliance Software Version 8.0(3)6
Device Manager Version 6.0(2)
Compiled on Thu 17-Jan-08 17:42 by builders
System image file is "disk0:/asa803-6-k8.bin"
Hardware:   ASA5510, 202 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB
###

The question is what i need to add the CSC10 SSM with content filtering and url filtering to this version of ASA? Do I need more ram? Do I need more flash? Is this version compatible with the CSCSSM hardware? What licenses i need for 100 users?

View 2 Replies View Related

Cisco VPN :: 5510 IPSec VPN In Security Context / Shared Interface Or Not

Feb 17, 2013

I have at the moment an ASA5510 pair in Multiple Context configured. Everything is ok, but we use til now only ACL features.Now I would be interested in configuring 2 contexts, with IPSec VPNs. One VPN per context. But I cannot find any information if it would be possible to use a shared interface for both contexts. My wish would only be to spare public IPs.If I have to configure 100 VPNs in 100 contexts, do I need 100 public IPs ?

View 5 Replies View Related

Cisco Firewall :: ASA 8.4 - Implementing NAT (Connection Not Working)

Apr 14, 2013

I am facing problem in implementing NAT on Cisco 8.4 . the scenario is
 
Inside interface network 10.10.10.0/24 and 10.118.0.0/16 is also routed towards inside network
 
Other network 192.168.10.0/24 is routed via outside interface.
 
My requirement is to NAT the 192.168.10.2(real IP) to 10.10.10.2(mapped ip) so that when users from inside network (10.118.0.0/16)  will come they will access the 10.10.10.2 instead of the real Ip(192.168.10.2)

So I used nat (inside,Extra net) source static obj-10.118.0.0 obj-10.118.0.0 destination static obj-10.10.10.2 obj-192.168.10.2 but the connection is not working but with show nat I am getting hits on the NAT statement.

cap test Ethernet-type arp interface inside real-time 
1: 23:29:05.684199 arp who-has 10.10.10.2 tell 10.10.10.1
2: 23:29:09.687998 arp who-has 10.10.10.2 tell 10.10.10.1
 
I have also enabled the proxy arp on the inside interface but still the connection was not working.

Packet tracer output
[Code] .........

View 11 Replies View Related

Cisco Application :: ACE 4710 Possible To Create A Context Within Same Vlan As Admin Context

May 7, 2013

Is it possible to use 1 or 2 of the 4 gigabit ethernet ports from one ACE straight into the other ACE for redundancy? So ACE_01 gig0/4 to ACE_02 gig0/4.If so, is it a case of just having the layer 3 config instead of trunking etc..Also - is it possible to create a context within the same vlan as the Admin context?

View 4 Replies View Related

Cisco Firewall :: Difference ASA5510-BUN-K9 And ASA5510-Sec-Bun-K9

Jun 6, 2012

ASA 5510 have two model Bun-K9 and Sec-Bun-K9 from the datasheet find out difference Port related and Redundancy. My questions is : Have any major difference for Security service between two model ?

View 3 Replies View Related

Cisco Firewall :: CPU Usage Per Context On ASA 5585?

Jul 3, 2012

I am currently working with ASA 5585 with several contexts. What is the percentage of the CPU used per context. I already have the opportunity to do it for the whole ASA (context admin) using the SNMP mib CISCO-PROCES but, unfortunalty, this mib doesn't allow us to know the percentage of used CPU per context.
 
I was able to know the number of core used per context but not the percentage of the CPU used.

View 6 Replies View Related

Cisco Firewall :: Asa 5520 Context Mode

Jan 14, 2013

We have a pair of cisco Asa 5520 currently running multiple context mode. We wish to change to single context mode for following reasonWe will migrate infrastructure to hosted vendor . I was thinking of configuring site to site . Current Asa we pal to kee since wireless sits in our DMz and we have net screen that hosts tunnel for erp1. Is context change required for running site to site2. Is it a good idea for creating site to site on to make sure wireless network and oracle traffic goes through managed firewall ?

View 22 Replies View Related

Cisco Firewall :: ASA 5585 Multiple Context Licensing

Apr 27, 2011

I am looking to deploy a cloud/borderless network solution and cannot get my head around how the licenses (AnyConnect Mobile and essentials) will be applied in a multiple context deployment. Any correct documentation.

View 1 Replies View Related

Cisco Firewall :: Fail Context From One FWSM Over To Other 6500

Oct 23, 2012

Firstly is this the right forum to post threads about FWSM's. We have 2 FWSM's in two seperate 6500 switches. There are a number of contexts on each FWSM.I want to fail a context from one FWSM over to the other 6500 and FWSM. Can you tell me how I can do that? Do I need to do it in the admin context and do I need to do it on the admin context of each 6500?

View 7 Replies View Related

Cisco Firewall :: 6500 Admin Context On FWSM

Dec 3, 2012

I have just joined a networks team and will be working on two fwsm versions 4.0(8) in two 6500 routers. Now the fwsms seem to be virtualised with multiple contexts. The server team want a new context setup for a group of servers behind a vlan. [code]
 
This context just seems to have  two Vlans and a BVI interface. What is the function of this context and why we have 2 admin contexts?
 
Also another important question is on which 6500 do I create the new context? Is the admin context active on one 6500 just like other contexts and will sync across or do I have to create the new context on both 6500s.

View 7 Replies View Related

Cisco Firewall :: ASA 5550 - How To Change The Context Size

Nov 6, 2011

I'm having a problem with a context, I have two CISCO ASA 5550 (failover) and also we have the CISCO CSM to monitoring it, but since some weeks is showing a memory usage of 100% but then it drops until reach zero and then again the graphic goes up. This is the second time that the graphic shows this
  
I also check this on the CLI and i'ts fine because is showing the real percent, so my question here is why is showing this kind of behavior, I mean it was working fine before.
 
In the other hand I checked the secondary device and this is showing a 99% of used memory, but as the other one this graphic doesn't drop
  
I also checked via CLI and it says that it had the 99% memory used , Is there a way that i can put more memory on the context or what do you suggest that I can check on my firewalls.

View 1 Replies View Related

Cisco Firewall :: Multi Context Configuration On ASA 5520

Jan 29, 2012

I am trying to configure multi context on the 5520 ASA , how can i configure 1 outside and 1 inside for the 2 context or how to configure both outside from the same subnet and insides also from the same subnet , i did the below configuration but didn't work . [code]

View 4 Replies View Related

Cisco Firewall :: SSLVPN 9.0 / Web Vpn In Multiple Context Mode?

Mar 11, 2013

We already know that ASA 9.0 supports site-to-site VPN in multiple context mode. But remote access VPN isn't supported. Obviously, SSL-VPN is a very important feature for most multi-tenant deployment scenarios where each context acts as a border firewall towards the Internet for each tenant. The alternative to terminate all tenant remote-access VPNs in one context means that each tenant would have to be routable from the ASA, which of course isn't a reasonable requirement in most cases.
 
So, what I'd like to do is to deploy an ASA cluster, and provide remote access VPNs for each tenant, where the connectivity for each remote access group can be addressed with whatever IP address space, and that goes into it's own VRF in the back-end.
 
As far as I can tell, this isn't doable with the ASA, since multiple context mode prohibits the use of remote access VPN, and I can't think of any other work-around than either having individual firewalls running in single context mode for each tenant, or demand that all tenants are interoperable routing-wise and configure a separate ip address pool in a single context mode for each tenant.
 
Essentially, there's no good way to implement this with multiple virtual firewalls, using cisco firewalls?

View 1 Replies View Related

Cisco Firewall :: Upgrading License For More Context ASA 5580?

Sep 13, 2011

This is the situation I got to firewalls with failover and I need to upgrade the license so I can get more context (right now I have 5 context and I need 10) so I was looking at the procedure and I'm not sure If I need to restart the device or not. I was looking at this procedure:
 
Upgrading the License for a Failover using ASDM (No Reload Required) Use the following procedure using ASDM if your new license does not require you to reload. This procedure ensures that there is no downtime.

•1.       On the active unit, choose Configuration > Device Management > High Availability > Failover > Setup, and uncheck the Enable Failover check box. Now click Apply. The standby unit remains in a pseudo-standby state. Deactivating failover on the active unit prevents the standby unit from attempting to become active during the period when the licenses do not match. •

2.       Choose Configuration > Device Management > Licensing > Activation Key, and enter the new activation key that you obtained with the active unit serial number. Now click Update Activation Key.•

3.       Log into the standby unit by double-clicking its address in the Device List. If the device is not in the Device List, click Add to add the device. You might be prompted for credentials to log in.

4.       Choose Configuration > Device Management > Licensing > Activation Key, and enter the new activation key that you obtained with the standby unit serial number. Now click Update Activation Key.

5.       Log into the active unit again by double-clicking its address in the Device List. Choose Configuration > Device Management > High Availability > Failover > Setup, and re-check the Enable Failover check box.

6.       Click Apply. This completes the procedure.link: [URL]
 
But then I checked on the cisco web page that there are some license that need to reload I see this:
 
All models

#Downgrading any license (for example, going from 10 contexts to 2 contexts).#Note If a temporary license expires, and the permanent license is a downgrade, then you do not need to immediately reload the security appliance; the next time you reload, the permanent license is restored.
 
[URL]
 
So I just want to know if I'm UPGRADING from 5 to 10 context the reload applies to my situation or not?

View 1 Replies View Related

Cisco Firewall :: ASA5585-X Multi Context Throughput

Apr 25, 2013

How do i measure the total throughput going via 5585-X.It has the firewall througput of 5Gbps. Looking at aggregate of all the interfaces traffic going through it seems about 4gbps is going through.
 
I use show traffic command and add up the trasmit and receive traffic on each live interface.Is that correct method and are there any more commands?

View 1 Replies View Related

Cisco Firewall :: 6500 - Upgrade Context License

May 3, 2011

I have a firewall module in a Switch Catalyst 6500. I wan to  upgrade its context capacity to a greater capacity. When I looked it in the Dynamic configuration, it send me following number parts:
 
FR-SVC-FWM-VC-T1=
FR-SVC-FWM-UPGR1=
 
The first one is the license to have 20 context and the next one is upgrade from 20 context to 50 context. My problem is that I haven't could find a service support contract associate them.I want to know if they have or not service contract, because I can´t find them.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved