Cisco Firewall :: ASA5585-X Get One Logical Firewall With Doubled Performance

Dec 19, 2011

I am interesting how ASA 5585-X with SSP-60 operates in dual firewall mode, if I install two SSP-60 modules in chassi, do I get one logical firewall with doubled performance of (SSP-60) ?

View 1 Replies


Cisco Firewall :: ASA 5505 PPPOE Traffic Statistic Doubled Between Inside And Outside

Mar 12, 2013

I've an ASA 5505  connecting to a vdsl modem. The ASA is doing the PPPoE encapsulation. I've noticed the traffic amount on the outside interface is always twice the bandwidth it receives on its inside interface. I can't believe the PPP encapsulation is taking that much. Only two interfaces (inside and outside)

View 4 Replies View Related

Cisco Firewall :: ASA5585 For Firewall To Support A HDD

Jan 22, 2012

I am responding to a tender where the client is asking for the firewall to support an onboard disk drive for logging purposes, which is a minimum of 500 GB in size.
The other requirements all point towards the top of the range ASA 5585-X Chas w/SSP60,IPS SSP60,12GE, 8 SFP+,2 AC,3DES/AES.
I note the 5585 when configured on DCT comes with HDD blanking plates, is there an HDD supported on this?

View 1 Replies View Related

Cisco Firewall :: ASA 8.4 / Nat Internal IPs With A Logical IP?

Feb 17, 2013

I have a query on natting on 8.4 ASA. We are going to configure IPsec tunnel with our client. Our client has provided a single ip( which would be the source at his end. Is it possible to Nat my end network( with logical ip ( which is not configured anywhere.

here are details.
my end internal network(inside) : (
logical ip to be natted my internal ip:  (
Client end network : (

View 5 Replies View Related

Cisco Firewall :: Terminate L2L VPN On ASA Logical Address?

Jun 14, 2011

I currently terminate my L2L VPN sessions on the "OUTSIDE" interface via the actual IP address assigned to that interface. Can I assign the OUTSIDE interface a second address (VIP, Logical, Virtual etc.) and then terminate my L2L VPN sessions on that second address?

View 3 Replies View Related

Cisco Firewall :: ASA5585 - Sub-interfaces On PO

May 17, 2012

I have put 2 physicl interfaces (te0/8 & 9) on the ASA-5585 into a PO and am assigning ips/vlans to the sub-interfaces. I have 2 issues: - Why am I not able to ping the other sub-interface from the ASA itself? (I can ping the 1st one), Secondly, why the IPs are not visible in "sh int ip brief" ?Although I can see them in "sh ip" ..
/actNoFailover(config-if)# int po17.100
/actNoFailover(config-subif)# vlan 100
/actNoFailover(config-subif)# ip add


View 2 Replies View Related

Cisco Firewall :: Zone Based Firewall Performance On ASR 1004

Sep 11, 2011

we are experiencing performance issues on ASR 1004 with ZBF as our campus edge router.Symptoms:

- sending small packets from inside zone to outside zone, for example UDP packets without payload
- this way I can generate up to 150.000 pps traffic (testing with packeth software, but we have had a real example with some kind of worm/virus)
- CPU load is about 1% (yes one!) to 2% all time !! (weird)
- ASR response to pings rises very quickly up to 5 seconds which makes box unusable dropping everything what goes through ZBF (so internet connection is gone)
- if I do the ping directly from box, it seems to work fine (no rules from self to outside zone in ZBF)
- if I remove interfaces from inside and outside zone (so disabling ZBF) and do the test again, ASR response goes from normal (0.2ms) up to 2ms (still sending 150.000 pps) and everything seems to work fine)
According to Cisco Datasheets: routing, Qos, Zbf ... on ASR 1000 with RP1, ESP10 should be done in hardware with up to 17.000.000 pps performance.

View 5 Replies View Related

Cisco Firewall :: 5520 Recreate Logical Interfaces For Each Physical Interface

Nov 29, 2012

We have to enable FIPS 140-2 on our ASA5520's for all our IPSEC VPN connections.   We currently have failover on our 5520's. I found a lot of information out there but some seems to conflict one another.What are the things I need to look out for - caveats? Does the clients that connect to the VPN had to use different clients once the FIPS was enabled.Do we need to recreate logical interfaces for each physical interface we have?

View 1 Replies View Related

Cisco Firewall :: Unable To Traceroute Through ASA5585-x 8.4.4(9)

Mar 12, 2013

I've read through netpro and found everyone points to this doc. 
However that still doesnt allow traceroute through for us.  We still see syslogs with deny's on high level random UDP ports to different Internet destinations. 

View 2 Replies View Related

Cisco Firewall :: Duplicate Rules On ASA5585

Oct 17, 2012

I got some issues with my CISCO ASA, the thing is that when I add a new rule on the device this rule duplicate and goes to the bottom. We already tried to delete the duplicate rule but it always show an error.
-Model 5585
-ASA Version: 8.2(5)
-ASDM version: 6.4(5)

View 5 Replies View Related

Cisco Firewall :: LU Allocate Connection Failed On ASA5585?

Jun 7, 2011

We saw this syslog on ASA5585 with version 8.4(1). I have two HA firewall pairs (contains 4 ASA5585, active/standby), and I saw this message on the standby ones.
Jun  7 07:36:26 last message repeated 4 times
Jun  7 07:36:26 :Jun 07 07:36:26 HKST: %ASA-ha-3-210005: LU allocate connection  failed


View 4 Replies View Related

Cisco Firewall :: How To Configure 6 To 4 Manual Tunnel On ASA5585

Jul 6, 2012

I have ASA5585 Firewall between my WAN Cloud and LAN Network. I plan to configure Layer 3 Vlan Interfaces inside FW and it would be Layer 3 gateway for some of Subnets. Layer 3 VLAN Interfaces are planned to be dual stack containing both IPv4 and IPv6 Address stack.
I plan to configure 6 to 4 Tunnel with my Hub Site where we have native Ipv6 awareness. One tunnel end point would be ASA and the other endpoint would be Hub site WAN Router/L3 Switch. So IPv6 traffic hitting to vlan interfaces on ASA  would be policy checked and routed over tunnel interface to Hub Site.
6to4 Tunnel manual tunnel configuration on ASA. I have configured such tunnel on L3 Switch or Router with following config.
Int tunnel xyz
  ipv6 address  <ipv6 address>
  ipv6 enable
  tunnel source <loopback address of my L3 Switch>
  tunnel destination <loopback address of my hus site L3 Switch/Router>
  tunnel mode ipv6ip
I need to implement something similar in ASA. How can I do that?

View 2 Replies View Related

Cisco Firewall :: ASA5585-X Multi Context Throughput

Apr 25, 2013

How do i measure the total throughput going via 5585-X.It has the firewall througput of 5Gbps. Looking at aggregate of all the interfaces traffic going through it seems about 4gbps is going through.
I use show traffic command and add up the trasmit and receive traffic on each live interface.Is that correct method and are there any more commands?

View 1 Replies View Related

Cisco Firewall :: ASA5585 Active And Shared Interface Design

Aug 18, 2011

use of a pair of ASA 5585's in active/active mode with a shared outside interface.Last time I did this was with FWSM, there was a restriction where all contexts that share an outside interface have to be in the same failover group.Does this apply also to the ASA? My thought is that it will, but I am unable to find that in any documentation.

View 1 Replies View Related

Cisco Firewall :: Cut Over ASA5585 Global PAT Address Without Connection Drops?

Oct 24, 2012

We're currently PATing everything from a particular subnet to the IP of an outside interface using our ASA5585 (dynamic PAT). We're experiencing pool exhaustion and therefore need to expand the global IP range. Any way of cutting over to the new range without dropping existing connections? For clarity, the current interface address is x.x.x.37/22 and the new PAT pool is x.x.x.114-6/22.

View 6 Replies View Related

Cisco Firewall :: ASA5585 State Link Supported Over MPLS?

Jun 29, 2011

Running ASA5585’s in active/standby across a local campus MPLS network. Supported design, leading practice etc. Specifically our design is that two ASA5585 are configured as active/standby through a local campus MPLS network over 10gig links through ASR9k etc. The ASA’s are providing inter-vrf routing capability only with p2p l2vpn circuits configured for each logical interface between the ASA over MPLS etc.The failover link is via a direct fibre and the state link will be through a p2p l2vpn (option for direct fibre also)Is this a supported design to begin with?

View 2 Replies View Related

Cisco Firewall :: ASA5585 WCCP-GRE Redirection To Websense Times Out?

Dec 9, 2012

I have a ASA5585 running 8.4 that is redirecting Internet http to a websense server via GRE.The integration is working fine, except when a user PC sends a large packet (~1500 bytes).With WCCP/GRE headers, the user packet is too large to be transmitted to websense, so the ASA fragments the packet in two and transmits both to websense.
A sniffer trace confirms that both fragments reach the websense server, but the TCP packet is never acknowledged.User-side TCP retransmits the large packet three times over 15 seconds, and eventually retransmits fine with smaller packets.  The 15 second delay is of course not acceptable.Users and Websense server are both on the Inside interface.
We are considering imposing browser proxy to websense (which works fine), but would prefer not, considering the increasing diversity of devices.

View 4 Replies View Related

Cisco Firewall :: ASA5585 - Debug Command Stops After Exiting

Oct 19, 2011

We are experiencing intermittent issues with the IPS on our ASA5585 vs 8.4(2). Probably something with the dataplane. So I want to keep debug cplane 255 activated and logged with log debug-trace setting to syslog server. But when session times out the debug command is cleared so the output stops. Since it is a intermittent issue I want to keep debug activated...Totally different behaviour then with routers which keeps it activated. how to keep debug activated on a ASA.

View 1 Replies View Related

Cisco Firewall :: Error Message When Failover From Standby To Active In ASA5585

Aug 14, 2011

I have two ASA in failover with Active/standby configuration. When I switch from standby to active from the standby ASA I get a lot (like 100) of error messages like these below: [code] The failover works fine and nothing seems to be wrong with the firewalls function.

-Hardware is ASA5585-SSP-10.
-Software version: ASA 8.2(5),

ASA is in multiple mode with 17 active context. Why these error messages appear and what they mean?

View 2 Replies View Related

Cisco Firewall :: ASA5585 Interfaces Not Connecting Palo Alto Failed Or Shutdown

Jun 9, 2012

We have pair of ASA5585 (ver 8.4(4) with IPS module configured with Active/Standby failover. There are total 09 interfaces are connecting to different zones in the firewall and out of which three(3) interfaces are connecting to Palo Alto 2nd layer firewall. When we test the failover whatever interfaces not connecting Palo Alto failed or shutdown, ASA triggers the failover to other unit, however the Palo Alto is not detecting this failover and it still keeps its previous Active Palo Alto to pass traffic, thereby failing passing traffic on Active firewall through Standby Palo Alto firewall.
But when there's a interface failed or shutdonw on the interfaces where PaloAlto also connected, then once the ASA failover triggers and the same time Palo Alto also trigger its  failover then both new active firewall and Palo Alto sending traffic through firewall.However we  we cant all the interfaces of ASA also to connect Palo Alto and let the Palo Alto to inspect all the interfaces, but we need our ASA to work in a situation where any of the interfaces failed, the failover to work smooth the pass the traffic via either Palo Alto device.I just need to know is there anything tricky that we can configure on our ASA in this failover senario, or to confirm if there's no any workable solution to this situation.
I have attached the senario that I explained above. Just to emphasis the issue again, if any interface of Gig0/0, Gig0/4 or Gig0/5 failed on active firewall, ASA switching to standby firewall and act as Active, but Palo Alto still remains his Active state and the new Active ASA is not passing traffic via standby PA as its not detecting any of its interfaces as failed or unreachable..?

View 1 Replies View Related

Cisco Firewall :: To Deploy ASA5585 In Between User Vlans And Server Vlans

Jun 1, 2012

WE have to deploy ASA5585 in between User vlans & server vlans. we have to find all the ports that needs to be opened on firewall. any tools to do same.

View 2 Replies View Related

Cisco Firewall :: ASA5585-X Active / Active Failover Using Etherchannel?

Dec 27, 2011

its possible to set up active/active failover using etherchannel on 5585s? 

View 1 Replies View Related

Cisco WAN :: Performance Of ASA 5505 - Firewall Throughput

Oct 3, 2011

What is the difference between IP throughput routing throughput and firewall throughput
the reason is i am trying to spec a router for a mate who is setting up an online server for an old game ultima online which will have around 300-400 people each pulling around 10kb/sec
I recommended an 880 service router but when he spoke to a guy at the shop they said this would only run at 25mb/sec and he is plugging in to a 100MB/sec line
But the current router that is a home dlink which cost at most 60 Euros on a speed tester can pull 95mb/secI just don’t get how a 60 Euros router can download quicker than a 300-400 Euro router
They said try a ASA5505 that can do 150MB/sec of firewall throughput

View 1 Replies View Related

Cisco Firewall :: ASA 5550 - Optimize Performance For Web Traffic?

Mar 14, 2011

We are suffering slow https traffic download. We have a CISCO ASA 5550, Cisco Adaptive Security Appliance Software Version 8.0(5)19. When we try to download some videos from an https server we have a data download rate of about 140 kbps, but if we bypass the firewall and put a laptop just after the border router, data rate increase up to 350-400 kbps.
We configured a new interface in the firewall and we connected a laptop directly to the port in the ASA 5550, with a new ACL permit ip any any, just for test purposes, but data rate is still the same, 140 kbps.

View 2 Replies View Related

Cisco Firewall :: PPTP Performance Through ASA5520 Very Poor?

Nov 13, 2011

We use MS RRAS services behind a Cisco ASA 5520. In testing the performance I have found that we can only get a little over 2MB of througput when connected to the VPN server over a broadband connection. I have verified that the issue is not the RRAS server itself as I can connect to VPN from the LAN and the througput tests at 300-400MB. I also connected to the LAN directly on the outside of the firewall and only get 4 or 5 MB from there which does not seem right. None of the switches are showing any errors. I believe that I have the passthrough stuff setup as I should. I even went through these steps as recommended by Cisco.
hostname(config)# class-map pptp-port
hostname(config-cmap)# match port tcp eq 1723
hostname(config-cmap)# exit
hostname(config)# policy-map pptp_policy
hostname(config-pmap)# class pptp-port
hostname(config-pmap-c)# inspect pptp
hostname(config-pmap-c)# exit
hostname(config)# service-policy pptp_policy interface outside

View 7 Replies View Related

Cisco Firewall :: 5520 Slow Performance Through Site To Site Vpn

Mar 12, 2012

I'm having slow performance thru a Site to Site VPN. I have an ASA 5520 in each site with the version 8.2(4) in both ASA's. I have a 20Mb internet service in one side and in the other side I have 50Mb. When I transfer a file from the Sita A to Site B I get a transfer rate of 130KB/S.

View 1 Replies View Related

Cisco :: ASA Monitoring Logical Interfaces

May 12, 2011

Does any know why the ASA will monitor physical interfaces by default, but monitoring of logical interfaces is disabled by default? Or better yet, is anybody doing a monitor-interface for a subint without issue? I'd imagine it isn't enabled by default for a reason.

View 2 Replies View Related

Logical Interface Approach

Oct 8, 2012

I have a node with one physical wireless interface and I need it to offer AP service to other nodes, connect to an existed AP, and connect to other nodes in ad hoc mode. If I create 3 logical wireless interfaces of that interface and configure each one respectively to the modes above, would this work? do they use the same MAC address or each needs to be configured a different one?

View 2 Replies View Related

Cisco LAN :: Two Logical Switches Within One Catalyst 3560

May 20, 2012

I have purchased two catalyst 3560 switches (with 24 interfaces) on Ebay to prepare for ccnp switch exam. It would be great if I have 4 switches. Is it any possibillity to create two logical switches from one? I mean, not by assigning interfaces to different vlans?

View 1 Replies View Related

Cisco Routers :: SRP527W - Logical Link Not Picking Up

Dec 27, 2011

I recently bought 2 SRP527W for  customer and i am trying to install them.  I have updated the firmware to the latest version.
Problem: It can detect BTs business ADSL but the Logical Link is not picking up.  I have checked and rechecked the setting with BT but no joy.  the original BT router works.

View 19 Replies View Related

Cisco WAN :: 2650xm / 2811 - Hierarchical QOS Over Two Logical Connection?

Nov 16, 2011

We have two logical connection which are connected via  1 physical Ethernet interface to 2 routers in central sites. Both connections are 2 Mb/s. How can i classify the output traffic in order to shape both direction to 2-2 Mb/s.
There are not suitable "match" command!!! ??The branch routers are 2650xm and 2811.

View 4 Replies View Related

Cisco Switching/Routing :: Logical SE/SVI Connection Between Brocade MLX And 4503

Jan 11, 2012

I am installing a connection between Brocade MLX and Cisco 4503 using SE and SVI's. Below is the config for each. Am I missing anything like MTU Ignore or something along that nature?
*** Cisco 4503 (v15.01) Config ***
name EOC_Gi1/2


View 3 Replies View Related

Cisco Switching/Routing :: Catalyst 2960 Logical Link Control

Feb 16, 2013

I have 2 devices which need to communicate through Logical Link Control.  Each device functions like this: they have a built in network switch that allows their internal components to communicate with TCP/IP which is then encapsulated inside LLC frames and sent out a special port.  The LLC frames from each device all come from a single source MAC address and are broadcast out the network.  The receiving deivce receives the LLC frames, unencapsulates the data and uses it directly.
Using it this way through a single 2960 (such that device 1 is connected to fa0/2 and device 2 is connected to fa0/23) with its own dedicated VLAN and no other traffic on the switch (all other ports shutdown), the two devices are unable to "connect".  Using a SPAN session, I can clearly see them exchanging LLC frames, but if I connect my computer to the internal device switch and try to ping the other device through the LLC encapsulated link, I get anywhere from a 25% to 100% loss with response times between 2ms and 15ms.
When I connect the special ports of each device together directly with a straight through cat-5e cable, they can connect and I can successfully ping through the link with sub-millisecond response times.  The same goes if I connect them through an old unmanaged Linksys switch.  I have toggled everything on the 2960 I can think of, including STP, CDP, LLDP, storm control, keepalives, IGMP snooping, management interface VLAN1, and QoS.  In general, the more of those that I turned off, the faster the ping responses became, but nothing seems to stop the data loss.

View 1 Replies View Related

Copyrights 2005-15, All rights reserved