Cisco Firewall :: ASA5510 VPN Bandwidth Calculations
Mar 14, 2012
Were running an ASA5510 with multiple IPSEC VPN clients over a 100Mb leased line. At the moment we have about 10 active clients however we are looking at gearing up to about 100 clients.Question is, is there a known method for calculating the required bandwidth for this number of clients or indeed obtaining metrics from already connected clients with this calculation. We have tried a few monitoring products, most notably Solar winds, however none of the products we have tried seems to be able to give us the throughput of the individual VPN connections to assist with our calcs....
View 1 Replies
ADVERTISEMENT
Nov 3, 2012
How to allocate bandwidth for a certain host or service in Cisco ASA 5510 Firewall using ASDM? For instance, I would like to dedicate 2MB for H323 service (Video Conference Call).
View 1 Replies
View Related
Feb 25, 2013
They have an ASA-5510 with version 8.2(5). They just upgraded their Internet bandwidth to 30 Mb both ways.If we do a speed test in front of the ASA, we get 28 Mb/s upload and download, with a ping of about 5 to 10 ms.If we go behind the ASA, the download is about the same, the upload is decreased to about 12 Mb/s and the ping goes to 260 ms The license is base, there are no additionnal function added to the firewall (no IPS). I've check the speed and duplex and everything is fine.There are no drops on the interfaces or rules of the firewall, no drops on the Interface of the ISP router either. All interfaces are configured at 100Mb full duplex.I saw a couple of discussions on this in the forums, but they don't seem to come up with anything and they look like they end in the middle of the whole story, like once the problem is solved, they don't update their discussion.
View 6 Replies
View Related
Mar 20, 2013
I have been assigned to find out the nature of the network's bandwidth utilazation. Is there a way to analyze traffic and breakdown the traffic on the ASA5510?
View 9 Replies
View Related
Feb 6, 2012
I have a Cisco ASA5510 with two Cisco Catalyst 3560G switches plugged into it. Then I have 2 Cisco1400 Aironet WAPs plugged into the switches.
My goal is to limit incoming bandwith for two specific vlans. So users who are plugged into the switch or connected to the wifi can't go bandwidth crazy.
The rule I currently have setup on the ASA5510 is limiting internal bandwidth, I know shame on me.
So how do I setup a rule on the ASA5510 that will limit users external traffic on vlans without limit internal lan traffic?
View 5 Replies
View Related
May 15, 2012
I have used EIGRP with the variance command for years. Recently we swapped out our 6513 for 2 Nexus 7K's and lost the variance command. So now I'm stuck running our two MPLS routers to a 3750 which then connects to the 7K's, so I can get the unequal load balancing back in operation.So because I can't play with it while it's in production I'm using dynamips to simulate the configs. The problem is I'm not able to get a traffic share count ratio that reflects the actual difference in bandwidth.
The two lines have 155 MB and 45 MB respectively, for a ratio of 3.4. Now you can't really send ".4" of a packet but the total packet ratios when dividing the traffic share count should be similar. I'd settle for 3. I was able to get 2.9 in the past but now on the simulator I can't even get that. I'm seeing traffic share counts like 120:89 and 120:71 depending on how I fudge the metrics when I inject the routes from BGP.
I found this link: [URL] a stellar article by the way, and this guy is doing calculations to arrive at a 5:1. BUT when I apply the same formula using specifics from my network and the desired ratio of 3:1 what I get is an AD so high that the route is no longer feasible. I simply cannot make a ratio fo 3:1 using the formula. How to be able to make anything other than a marginal ratio actually work or is this all just theoretical?
View 4 Replies
View Related
Dec 8, 2012
i am setting up a network between two houses. I have two Amped Wireless SR300 repeaters and currently I am getting so-so signal strength between the repeaters. To remedy this issue, I purchased two EnGenius EAG-2408 external antenna's.My question is how to calculate how high to mount the antenna. A formula is preferable because I do not know the exact distance off hand and I will have to go out there and measure. I am estimating approximately 75 to 100 yards for the distance. Its flat, with a few trees/brush.
Repeaters:[URL]
-Transmit Power: Up to 20 dBm
-Receiving Sensitivity: -93dBm
Antennas:[URL]
-Omni Directional Antenna
-18 degree vertical beamwidth
View 19 Replies
View Related
Jun 6, 2012
ASA 5510 have two model Bun-K9 and Sec-Bun-K9 from the datasheet find out difference Port related and Redundancy. My questions is : Have any major difference for Security service between two model ?
View 3 Replies
View Related
Jun 11, 2012
I am able to ping from Switch to firewall inside ip and user desktop ip but unable to ping from user desktop to FW Inside ip.. config is below for both switch and FW Cisco ASA5510....
TechCore-SW#ping 172.22.15.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.22.15.10, timeout is 2 seconds:
[Code].....
View 7 Replies
View Related
Jun 29, 2011
I have two ASA5510's set up in failover, and the secondary keeps crashing after doing the interface checks when bringing failover up. This only happens if I try to upgrade the image on the secondary to anything newer than 8.4.1 (I've tried with 8.4.1-11 and 8.4.2). The primary one run just fine with new images.
I don't have the exact error right now, as I need to do a screen capture from console. It's just a huge crash dump.Are there anything I might have missed during the upgrade? Should I cold-boot both the firewalls in the correct order?
View 7 Replies
View Related
Sep 10, 2012
i have a ASA5510 in the office, that already configured 3 context, namely, admin, user, server.in the server context, the last running config was not saved, and there was a power trip last friday night. 1 of the sub interface was affected, and i need to recreate that interface.I am getting the below error, it only allow me to do changes those pre-defined interface.how to I create extra sub interface?
View 3 Replies
View Related
Jul 21, 2011
I have a ASA5510 and I have a question about the speed the ports can handle, here is one port:
-interface Ethernet0/2
- speed 100
-shutdown
- no nameif
-no security-level
-no ip address
it's ethernet and not fastethernet so I figure it will only go to 10Mbps, but at the same time I can hard code the speed to 100.
View 2 Replies
View Related
Feb 22, 2012
i have cisco ASA 5510 Firewall using in my network, i have planning to upgrade the Flash memory from 256 mb to 512 mb and the RAM from 256 mb to 1GB.
View 1 Replies
View Related
May 4, 2012
I have a cisco asa 5510 with security plus license in Live enviroment . I need to add a secondary firewall . I was planning to do in active /standby mode for failover .But i have a doubt , when i do "show version " on live asa output says Active /active failover , does this means that i can only configure failover in active/active mode not in active/standby (which i want to do )?
Maximum Physical Interfaces : 8
VLANs : 20, DMZ Unrestricted
Inside Hosts : Unlimited
Failover : Active/Active
VPN-DES : Enabled
VPN-3DES-AES : Enabled
VPN Peers : 25
WebVPN Peers : 2
Dual ISPs : Enabled
VLAN Trunk Ports : 8
AnyConnect for Mobile : Disabled
AnyConnect for Linksys phone : Disabled
Advanced Endpoint Assessment : Disabled
UC Proxy Sessions : 2
This platform has an ASA 5505 Security Plus license...
View 4 Replies
View Related
Feb 12, 2012
i am using Cisco ASA5510 Firewall in my Network in the distrubition Layer .Private Range of Network Address use in the Network and PAT at the FW for address translation.presently encountering an issue the users behind the FW in my network unable to RDP at port 2000 presented at the Client Network.Able to Telnet on port2000 but not RDP . any changes needed at the FW end to get the RDP Access.
View 12 Replies
View Related
Mar 14, 2011
We have to use scp on all of our network devices. It worked quite well on our routers and switches but I can't seem to get it to work for the firewalls and IPS. I enabled scp on my ASA5510 using the command "ssh scopy enable". I also ensured that a rsa key was generated and that ssh ver 2 was enabled. But I can't seem to locate the commands to actually have my firewall either copy it's configuration to a server or reach out to a server to pull down a file. We are using IOS 8.2(1).
View 1 Replies
View Related
Mar 22, 2011
I have a customer who wants to prioritze rdp traffic throgh the firewall.I know that its port 3389, but outgoing traffic is a random port number.Any smart way to catch this traffic and get it in the LLQ ?
View 3 Replies
View Related
Sep 25, 2011
Is there a way I can generate bandwidth reports on Cisco PIX 535 ?
View 1 Replies
View Related
Sep 13, 2012
we have ASA 5510 which we need to upgrade from 8.0(3) to 8.2.5. can we directly switch to 8.2.5 from 8.0(3) , if not what all versions we need to go from.
What all point needs to check before that following is show flash output.
97 14635008
Jan 01 2003 14:12:16 asa803-k8.bin 98 4096
May 14 2008 21:22:10 tmp 2 4096
Apr 20 2008 02:21:46 log 6 4096
Apr 20 2008 02:22:16 crypto_archive 99 6851212
[Code] .....
View 4 Replies
View Related
Sep 18, 2011
My device has 3 interfaces configured: inside, outside, DMZ. Right now I can access the DMZ from the Internet and I can access the DMZ from the LAN using an exempt nat statement. I am having a few issues setting up DMZ > LAN access however. The servers running on the DMZ need to send information to my LAN such as syslog traffic for example. Will DMZ traffic be NATed or should this somehow be excluded? Bascially all LAN devices should get to the DMZ devices by their actual IP and vice versa. Are there any special statements I need to add to the ASA such as nat or ACLs to make this work? My LAN is 10.10.6.0/24 and DMZ is 192.168.254.0/24.
View 1 Replies
View Related
Oct 20, 2011
I have a ASA 5510 with asa8.4(2) and asdm6.4(5)205. Have a new basic config, nothing special at this time. I just cannot seem to get from the inside to the outside. From the outside interface I can ping, so I have a good Internet connection. [code]
View 3 Replies
View Related
Apr 24, 2012
WE have a DMZ on ASA5510 8.4, it can access anything internal interface but cannot get out to internet or outside interface. I try to ping from a host in the DMZ to 8.8.8.8 and get this in the log 6Apr 25 201208:24:431100038.8.8.80172.10.1.1501Routing failed to locate next hop for ICMP from outside:8.8.8.8/0 to inside:172.10.1.150/1. [code]
View 14 Replies
View Related
Apr 5, 2012
I am having ASA5510 firewall which has 1GB RAM currently. I want to upgrade to 2GB. When I opened the box, I can see only 1 slot to insert the RAM. I searched in Cisco website and I got to know that I need to use 2 x 1 GB RAM. So, I need to have 2 slots to do that. But, I am having only 1 slot in the box.
View 5 Replies
View Related
Mar 30, 2011
We have an ASA5510 with a backup ISP connection protecting our corporate network. I also have a mail server and I would like to route SMTP traffic over the backup network. I realize that the ASA5510 does not support PBR, but I also know that I can use static NAT rules as a workaround to direct specific types of traffic over a particular interface (e.g. "static (outside,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0" and "static (backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0"). is it possible to use something similar to force a particular host to use a specific interface? I have tried to make this work on my own without success. Is it even possible?
View 5 Replies
View Related
Dec 5, 2012
I bought a Cisco ASA 5510 (P/N: ASA5510-BUN-K9) and i would like to know if i have to buy some license,What i mean is, for the basics, it still being necessary aquire some license?
View 3 Replies
View Related
May 31, 2011
We are about to upgrade our ASA's from 7.04 to 8.2. Obviously I will be opening a TAC case to assist with the upgrade and I will also be upgrading ASDM software at the same time. These production firewalls are paired with an active --> failover scenario and not active --> active. I had previously engaged cisco regarding the upgrade and they have recommended an upgrade path to ensure success. Also, I have a pair of test ASA's that I've gone through the upgrade process with - documenting the changes in commands and any changes in my config (I didn't notice any).So, the reason for my post is this: What are the gotcha's that you may have run into when upgrading your ASA's?These are fairly high visibility ASA's and any downtime due to the upgrade needs to be mitaged as much as possible.
View 1 Replies
View Related
May 26, 2012
I have a 2811 ISR configured to provide the following services to my network:
Internet access to LAN users Cisco Call Manager ExpressSite-to-stie VPN to 3rd party networksVPN server to provide VPN access to remote usersSecurity Zone configurationsStatic NAT configurations Now I recently just got the ASA5510 device and I am not sure how to go about with the setup, whether to put the ASA in between the internet and the ISR (Internet - ASA - ISR - LAN), or put the ISR in between the internet and the ASA (Internet - ISR - ASA - LAN)?
While i know I can move most of the config unto the ASA, i know that the CME cannot be moved, hence I would like to do the setup such that users on the network still have access to CME.
View 5 Replies
View Related
Apr 24, 2012
We have an ASA5510 and I am getting absolutely no response from the console port. Not even a blip when I turn it on. If I leave the compact flash in the internal bay, I get Green Power, Amber Status, Amber Active and Green VPN when I start it up. The Flash LED flashes Green twice then goes out. If I move the compact flash to the external bay, all of the other lights remain the same as described above but the Flash LED goes to steady Green. How ever, there is still no response whatsoever from the console port. Have replaced the DIMM but that had no effect. This is a four (4) slot ASA5510 and I have just the one DIMM in slot P13 as described on a post I found. The power supply fan comes on as well as the two (2) fans that cool the heatsink. The other two (2) fans on the expansion module side do not come on.
View 1 Replies
View Related
Aug 17, 2011
We just switched to a 5510 from a PIX 515 last evening, and the only things that are not working are any services from the outside to the inside. Example: I am unable to connect to a RDP server on the inside from the outside. I've been looking at the config for the past five hours, but am unable to see my mistake. Running 8.2(1) People on the inside are able to get out.
domain-name aaaa.org
names
name 10.10.8.13 mailserver
name 10.10.8.12 video-conf
name 1.1.1.2 PubMail
name 1.1.1.3 VidCon
name 1.1.1.5 Ms-Aderson
!
[code] .......
View 6 Replies
View Related
May 15, 2013
Upgrade from firmware 8.21 5o 8.31? I am installing 1GB of memory in my ASA 5510 and in the process I have upgrade the firmware.
- Will the upgrade change my configuration or will I have to change this manually myself at some point
- What is the meaning of "Real IP" I am not sure what the means (reading up on it now)
- What else should I be concerned about during the upgrade?
View 2 Replies
View Related
Mar 29, 2011
i need to move from a pix 515e. V 6.3 to a asa v 8. From what ive read i can use the pix to asa tool to get the converted configuration file to the new asa. So far so good, however, the pix has conduits which i read must be converted via the occ tool. So i ran the pix to asa conversion then ran the occ tool on that output but i keep getting errors. It is not liking the nameif outside, inside, and dmz lines. If i manually edited them out before i run the occ tool it runs but warns there are no interfaces.
View 2 Replies
View Related
Jul 17, 2011
We have an ASA5510 which keeps resetting itself for no apparent reason. It does this several times a day and I cannot see any pattern to the times etc. I don't believe it is load related as it also happens overnight when very little is going through the device. When it happens the device just drops off the network (all interfaces) and then when it comes back a few minutes later we can see from the system uptime that it has in fact rebooted itself.
I initially thought it was faulty hardware, so I swapped the device for another 5510, but that does the same thing. I then added a third 5510 and configured it in with the second one as an Active/Passive failover pair. Both devices do the same as the first, the only differences now is that the passive device kicks in and takes over, so we have a little less service disruption each time.
View 3 Replies
View Related
Aug 25, 2012
We have network topology:
Inside Network (172.168.1.0/27) --- ASA5510----- Outside network (192.168.10.0/24)
ASA5510 have: Inside interface: 172.168.1.30/27; outside interface: 192.168.10.254
And we config:
# object network obj_inside
# subnet 172.168.1.0 255.255.255.224
# nat (inside,outside) dynamic interface
[code]...
So, we í in from outside, we can't access web at 192.168.10.10?
View 3 Replies
View Related
