Cisco Firewall :: ASA5510 Can't Be Accessed For Management
Mar 13, 2013
I am trying to get an ASA5510 working in transparent mode, multi-context. I am on revision 8.2.5, so there are no bridge groups (those are enabled in 8.4). I first set it to transparent mode, then set it to multi-context mode. I am doing trunking through the Ethernet0/0 to Ethernet0/1, and have two vlans on subinterfaces of each interface. These interfaces are in the 2nd and 3rd contexts, and all trunking between vlans is working correctly in transparent mode.
But I can't telnet or ssh to the ASA itself.
I have an IP address on the inside vlan interface in
We have several pairs of ASA5510s in failover A/P mode, some running 8.3(2) and others running 8.4(1).
e0/0 = outside e0/1 = inside m0/0 = management
The problem we're having is we can't get anything to route out of the management interface unless we put in a static route at least to the subnet level. For example, we want syslog traffic to exit out m0/0 to our syslog server 10.71.211.79. Our 'gateway of last resort' points to the next hop out e0/0, and a second static route with a higher metric and a more distinct network space is for m0/0 as in:
This doesn't work, and ASDM loggin gives this error: ".....Routing failed to locate next hop for udp from NP Identity Ifc:10.72.232.89/514 to management:10.72.211.79/514"
If I put in a more granular subnet route, or a host route of the syslog server it works, such as:
route management 10.72.211.0 255.255.255.0 10.72.232.94 10 <------------- this works
route management 10.72.211.79 255.255.255.255 10.72.232.94 10 <------------- this works too
Why won't a static route for 10.71.0.0 255.255.0.0 work in this case?
We are going to have numerous hosts access and be sent messages though the management interface of these ASAs, and it would be very burdonsome to have to add a host, or even a subnet, route for every one. I've removed all static routes and tried to rely on EIGRP, but that doesn't work. I also had to put 'passive-interface management' under the EIGRP for this to work.
Here is the pertinant ASA config concerning syslog, routing, and interfaces:
I'm trying to setup a SSLVPN Portal for our customer which will authenticate against Active Directory using LDAP over SSL and with the portal have the ability to change password if it has expired. I have managed to setup everything now except for the password reset which is giving me a headache. This is the message that's presented by the portal when i try to change the password even though the same password works when i change it on a PC instead of using the portal.
"Cannot complete password change because the password does not meet the password policy requirements. Check the minimum password length, password complexity, and password history requirements."
And below is the output of ldap debug on the ASA5510 the Portal is running on.
 Session Start  New request Session, context 0xadbe760c, reqType = Modify Password  Fiber started  Creating LDAP context with uri=ldaps://x.x.x.x:3269  Connect to LDAP server: ldaps://x.x.x.x:3269, status = Successful  supportedLDAPVersion: value = 3
we are having a firewall asa 5520 .we have connected the management port and inside port to internal network and dmz port to dmz network.now we need to configure tacacs and other management tool on dmz devices through management port. The problem is the management devices tacacs and other are placed in internal network.
I have two ASA5510's set up in failover, and the secondary keeps crashing after doing the interface checks when bringing failover up. This only happens if I try to upgrade the image on the secondary to anything newer than 8.4.1 (I've tried with 8.4.1-11 and 8.4.2). The primary one run just fine with new images.
I don't have the exact error right now, as I need to do a screen capture from console. It's just a huge crash dump.Are there anything I might have missed during the upgrade? Should I cold-boot both the firewalls in the correct order?
I'm slightly concerned about my Cisco SRP-547W... there are times when it will cease to allow certain websites to be accessed and for a SONOS system to access Napster/Spotify. When i look in the administration part, the CPU usage shows 100%. I then have to restart the router, where it will settle back down to between 20% and 40% CPU load.Whats odd is it's not something that happens once every hour, it can be fine for days and then suddely go.
i have a ASA5510 in the office, that already configured 3 context, namely, admin, user, server.in the server context, the last running config was not saved, and there was a power trip last friday night. 1 of the sub interface was affected, and i need to recreate that interface.I am getting the below error, it only allow me to do changes those pre-defined interface.how to I create extra sub interface?
I've got 3 identical PC's that were bought and configured at the same time, all running Windows 7 off a Netgear router. Though all 3 machines can successfully ping each other, one machine can't be accessed by the other two through windows explorer meaning it can't participate in LAN games or share files with the other 2 machines.
I also seem unable to register my copy of Starcraft II because it doesn't recognise any return data from the Starcraft servers, though it works fine on another machine (not sure if this is related). I've disabled the firewall on the unaccessible machine and believe file sharing is activated but it hasn't worked.
I have cisco 3825 router with two interface one with public ip 126.96.36.199 and the other with private ip 192.168.1.1 and the DNS is 188.8.131.52, I configured NAT overload on it to access internet I can ping public ip nad default gateway but cannot ping dns and neither internet can be accesed. following are the configurations. [code]
I have a cisco asa 5510 with security plus license in Live enviroment . I need to add a secondary firewall . I was planning to do in active /standby mode for failover .But i have a doubt , when i do "show version " on live asa output says Active /active failover , does this means that i can only configure failover in active/active mode not in active/standby (which i want to do )?
i am using Cisco ASA5510 Firewall in my Network in the distrubition Layer .Private Range of Network Address use in the Network and PAT at the FW for address translation.presently encountering an issue the users behind the FW in my network unable to RDP at port 2000 presented at the Client Network.Able to Telnet on port2000 but not RDP . any changes needed at the FW end to get the RDP Access.
I have recently installed a new router (DLink Dir-615) and it seems that certain sites will not render for me. They simply show up as blank pages, or they will attempt to load, flash a few times and end in a the site cannot be reached. However, if I am running Fiddler, all of the sites work. The issue also occurs with various components on certain sites, i.e., video. The videos either do not play or will continuously skip to the next clip when Fiddler is not running.
I am completely baffled as to why this is happening and is there some setting on my new router that I need to enable?
Bought DIR-655 from Amazon. Rev. B. Come with 2.00NA firmware. Updated to latest one, and there are a lot of problems, to most of them, I was not able find any solution. Here they start:
1. WIFI SPEED PROBLEMS.No matter what speed, parameters, channel, mode, etc I select, router keeps working on 20mhz channel width. So I never get speeds above 65 mbit. In absolutely same conditions, my DIR-300 B1 (with DD-WRT firmware) gives me stable 150mbit. SO I KINDLY ASK, MAYBE THERE IS A WAY TO FORCE "40 MHZ ONLY" OPTION?
2. PASSWORD PROBLEMS.Router came with no admin password, I enter new password, hit "update" it says - wait 20 sec, after that, login page is displayed, but, new pasword does not works! since it asks again for empty password!
3. FILTERING PROBLEMS.I need to block certain IP address to be accesed by all my computers. Say this is 184.108.40.206 . So I added inbound filter rule, to block access to that IP. It does not works - IP is still accesible.
4. MORE FILTERING PROBLEMS.Since above mentioned method does not works, I have to use "ACCESS CONTROL" feature. It does works, but it causes another problem, with access control enabled, all webpages with form submit stop to work. For example, if I'll have that feature enabled, when I press "post" on this webpage, it instantly will go to "this page cannot be displayed".
I bought this router solely for one purpose - I was happy with speed of my DIR-300, but I needed gigabit for my computers. So I thought, instead of buying separate switch, I'd better buy a router with gigabit. I was suggested to get TP-LINK 1043, since it's quite popular, alternate firmwares available and so on, but I refused to buy it, since I thought that some chinese company does not worth my attention. So I bought this D-Link (for almost 2x price of TP-Link) and having huge problems as you can see.
I have a WRT54GC v2.0, that was working perfectly till yesterday.I cannot access the router no more, either thru cable nor wireless, all lights are flashing.I thought it would be the power source but i have measured it with my fluke multimeter and there is 3.5v, it is probably working well.
I have 20 mbps internet link and I have ASA 5505 . I have to divide this bandwidth 10-10 mbps each for Voice and Data . So that both can work properly. because when I am using it for both on same interface, I am getting Voice disturbance..
I have password management configured on our 5520 for VPN users, and it is prompting and allowing me to change passwords.... however it seems the password change seems to not be replicating to AD. I am able to access network resources using the old and new password.
Or, does the data only go over the WAN connection when the camera is accessed via myDlink? I ask because I have this camera installed in my mountain home and the WAN connection is a 5GB/month Verizon USB modem. It seems to be chewing up a LOT of data.
I'm attempting to configure remote management (and, sometime soon, SNMP) for a newly-deployed WRVS4400N v.2.At the Basic Settings page, I enabled Remote Management, and left the port # at the default. Remotely I entered the public (static) IP for the router in the address bar of IE8 similar to this: 67.203.???.??:8080. IE8's response is, "The webpage cannot be displayed." I'm using a public wi-fi access point, and don't know how the local router is configured, so it's possible that the local router has a blocking rule in the firewall.I'll try again using another remote router that I manage.
Currently have an ASA5520, management port is set to management only connected to a management vlan, inside, outside and dmz ports also in use for respective traffic, all is working well, the issue i have is that the ITsupport staff on there user vlan have to have access to manage the ASA with ASDM at all times, this all works fine as i have added a route for management to there subnet, problem is that from this vlan they can no longer ping the remote sites which connect via site to site vpn. For troubleshooting and management purposes this is required, is there any way around this?, if we make the management port not management-only how will this effect other traffic or routing?
I have a remote ASA5505 running 8.4(3) with a working site 2 site VPN tunnel to my main office. (The main office is running an ASA 5510 with OS 8.4.3 as well). The encryption domain is all private IP on main site vs. 172.16.10.0/23 on remote site.
Relevant config of the remote ASA:
interface Vlan1 nameif inside security-level 100
I can manage the ASA on the outside interface (outside of the site 2 site VPN) using the TACACS credentials I can also ping my management station from the ASA using the inside interface, but as stated, the other way around does not work. I have not yet tested if management from the local 172.16.10.0/23 subnet works, but I will try this next.
I have a brand new ASA5512-X running 8.6.1, and am trying to do an initial setup using the Quick Start Guide that came with it. However, the Management Interface is not working. I have a PC connected and set to use DHCP, but the port is not active. I connected a console cable and can see in the config that the interface is shutdown. So I set it to active, and the port is now active, but is not giving out a DHCP address as the guide says it should.I would like to use the ASDM Startup Wizard to configure this device, so how do I get it to work the way the instructions say it should?