Cisco Firewall :: Active ASA5520 Remote VPN Access Limitations

Sep 19, 2011

We have an Active/Active ASA 5520 setup, as i know in Active/Active setup there is no remote VPN access, So i could overcome this limitations?I have a solution but i dont know if it is ablecable or not? we have a spare ASA 5510, so i can use it behind Active/Active Firewalls and assign a public static NAT IP address to it and open all IPSEC and VPN ports and let the remote users to connect to it, is this ablecable setup or not?

View 1 Replies


ADVERTISEMENT

Cisco VPN :: Active / Active ASA 5520 Remote VPN Access Limitations?

Sep 19, 2011

We have an Active/Active ASA 5520 setup, as i know in Active/Active setup there is no remote VPN access, So i could overcome this limitations?I have a solution but i dont know if it is ablecable or not? we have a spare ASA 5510, so i can use it behind Active/Active Firewalls and assign a public static NAT IP address to it and open all IPSEC and VPN ports and let the remote users to connect to it, is this ablecable setup or not?

View 1 Replies View Related

Cisco Firewall :: ASA5520 - Active / Active Failover In Multiple Security Contexts With Dual ISP?

Jun 1, 2011

I have an ASA5520 in location A with an ISP connection and a matching ASA5520 in location B with a separate ISP connection. We have fiber connecting the two locations and vlans passing back and forth so I will be able to configure the failover via a vlan as well as extend the ISP's to each location via vlans. The Active/Active configuration with the multiple security contexts does not seem to be an issue but how is a redundant ISP configured in this mode?We want to have context A using the ASA in location A with ISP1 as the primary and failing over to ISP 2 in locaiton B We also want to have context B using the ASA in location B with ISP 2 as the primary and failing over to ISP1 in location A Would route tracking provide the desired result? Is there a better option?

View 1 Replies View Related

Cisco Firewall :: How To Configure ASA5520 For Active / Active

Mar 17, 2013

How to Configure ASA5520 for Active/Active

View 8 Replies View Related

Cisco :: ASA5520 Bandwidth Limitations

Oct 10, 2011

I'm trying to use a 5520 to test something but the bandwidth seems pretty low for the product I'm testing over it. Can anyone tell me if there is a bandwidth limitation by default? I'm seeing 1.5mb/s average with spikes to 6mb/s or so. On the ASA5550 I was seeing usage up to 80mb/s.

View 5 Replies View Related

Cisco Firewall :: ASA5520 - AnyConnect License On Active / Standby Failover Pair?

Mar 6, 2013

Our customer has purchased 2 x L-ASA-AC-E-5520= Anyconnect Essentials VPN Licenses (750 Users)Ive installed both activated licenses as per the cisco guides, I didnt get any errors on the install. I did a reload on both, they are both back up and running as active/standby but when I do a sh ver the license still shows "ASA 5520 VPN Plus License"Am I being dumb and has this worked successfully or should it not now display Anyconnect when I do a sh ver?

View 8 Replies View Related

Cisco VPN :: ASA5520 Remote Access VPN Pool Migration?

Nov 29, 2012

best way to migrate to a new pool for remote access DHCP address assignment.  We are currently using a /24 pool, allowing us 253 IP Addresses... during the recent hurricane we hit 250 IP Addresses used, and had to start asking users to connect to our backup ASA VPN device in another country, not an ideal solution.  I'd like to expand our current VPN subnet to a /23, however I do not have a free /24 subnet above (or below) our current /24 subnet.

I can certainly allocate a new /23 subnet, but I am looking for the best migration plan with minimal downtime (no downtime would be preferred).  Can I just add the new pool range to the tunnel-group RAVPN general-attributes section alongside the current pool, or should I just remove the old pool, log off all existing remote access VPN users and have them log on again to start using the new pool?We are running ASA Version 8.2(1).

View 2 Replies View Related

Cisco VPN :: ASA5520 / How To Restrict The Remote Access Network

Sep 6, 2010

in our VPN configuration (ASA5520, Anyconnect VPN Client), we have different VPN User Groups. These Group Policies are retrieved from an LDAP Server.We'd like to restrict the acess like this:

A Group "Home User" might establish a VPN from anywhere on the Internet

A Group "restricted 3rd party" should only be allowed to establish a VPN from their specific public Source IP Address on the Internet (the public IP Address of this 3rd party Company). When these Users try to connect from any other IP Address on the Internet(Home, hotel, etc), VPN Access should not work!
 
On our old solution, we were able to limit the remote access network, per user group,  to some source IP's.
 
The IP Filters related to group policies in here seem only to be filters concerning the VPN Address (after the VPN is established: where can this user group connect to). But I did not find filters/access lists, where yoiu can define/restrict public access networks for some groups.Or is it possible to do that by Dynamic Access Policies? How?

View 1 Replies View Related

Cisco VPN :: ASA5520 / Remote Vpn User Access Notification By Email?

Apr 5, 2011

Our customer has an ASA5520 Security appliance, I have already config the remote vpn in asa , user can logon via internet  by vpn client and can access internal network,customer hope us can make some configuration if the remote user logon asa by vpn and notify them  someone login their vpn by email .

View 2 Replies View Related

Cisco VPN :: 5520 Active Monitoring Of Remote Access Vpn Connections

Apr 14, 2012

I am using asa 5520 and asa 5540 for remote access vpn connections. Is it possible to do active monitoring of my vpn connections so that there would be alerts for vpn tunnels that fail to establish due to other reasons other than user authentication?

View 5 Replies View Related

Cisco Firewall :: ASA 5520 Active / Standby Remote Software Update

Jun 7, 2011

We have a pair of 5510s and a pair of 5520s, each in Active/Standby mode.  I'd like to upgrade the ASDM and ASA software on these, but am finding no documentation that advises on how this can be done without physical access to the devices.  It so happens I am on site, but we will be deploying these throughout our network and I'd like to be able to perform this type of maintenance without travelling to each site.  We utilize CSM and ASDM to manage these for the most part, but are certainly capable of configuring via CLI. 
 
The issue may be my lack understanding of the ASA fundamentals, but I don't really get how the software can be copied to the individual ASAs of the pair so they may be reloaded and upgraded without outage. With a remote SSH connection to the pair, I'm only copying the software to the Active ASA, correct?  Or is there a way to get the software to each disk individually from the single SSH connection?  I'm not quite sure how to manage the Standby ASA without consoling into it... If I can indeed remotely get the software to each ASA (copying to different disks?? i.e. disk0: and disk1:?), then I also run into an issue updating the boot statement for each of them individually, though to resolve that I suppose I could just remove the old software, but that seems like bad practice before confirming the new software is ok.If there is a simpler way of deploying new code via ASDM or CSM, I'm certainly open to that.

View 4 Replies View Related

Cisco Firewall :: ASA 5520s From Active / Standby To Active / Active

Jul 17, 2012

I have a pair of ASA 5520s operating in failover pair as active/standby, having two contexts on them. I am planning to share the load and make it active/active making first context active on the primary unit and second context active on the secondary unit. My question is if this will disrupt any connectivity thru these firewalls when I do "no failover" on the active/standby and assign the contexts to different failover groups and enable the failover back.

View 6 Replies View Related

Cisco Firewall :: Access-list On ASA5520

Feb 23, 2011

I have a question about access-lists on ASA: (5520 running 8.4)Often I want to permit all traffic from networks behind an interface (let's say DMZ in this example) to Internet, but NOT to internal networks. Then I  first configure a Deny from DMZ to all internal network and then a Permit to ANY. If I forget the first Deny I will allow all traffic also to my internal networks. Is it possible to configure an access-list that permit all traffic from a network to all networks that are reachable via a given interface? In this example: Permit all traffic from DMZ to all networks that are reachable via the Outside-interface? This should permit traffic to Internet and deny traffic to internal networks in one statement.If I specify the outside-interface as the destination only traffic to the interface itself will be allowed.

View 1 Replies View Related

Cisco Firewall :: ASA5520 - Access-Rule ASDM Ver 6.2(1) Vs 5.2(3)

Apr 17, 2011

I am creating access rule on a ASA5520 running ASA 8.2 (1) and ASDM 6.2(1) and found that the GUI has less option then when creating access rule on a ASA5505 running ASA 7.2 (3) and ASDM 5.2(3) (see attachment). Is there an option that enables me to get the same configuration options on the ASA5520 running ASA 8.2 (1) and ASDM 6.2(1) as I have on the ASA5505 running ASA 7.2 (3) and ASDM 5.2(3).

View 4 Replies View Related

Cisco Firewall :: Unable To Access ASA5520 ASDM Through Web Browser

Jun 1, 2011

I recently had a vendor configure our 2 firewalls (ASA5520). We are replacing a active-failover PIX525 firewall in 2 locations. After the vendor configured the new ASA5520's, I was unable to access the ASDM. The configurations are a basically modified versions of the config on the PIX525. I did find that they did not set the ASDM image path. [code]
 
I have tried from my browser as well as downloading and installing th ASDM on my computer.

View 2 Replies View Related

Cisco Firewall :: ASA5520 - ASDM Access After MGMT IP Change

Oct 9, 2012

I have an ASA 5520 new. I am trying to migrate from a PIX 515E. I can connect via the CLI and ASDM on the management port (IP 192.168.1.1 the default) What I am having an issue with though is when I change the management port to 10.0.1.1 via the CLI or ASDM I can no longer use ASDM. I issue the show IP command in the CLI and I see that the IP has indeed changed but I still can not get into it. I must be missing something really simple, but this is driving me insane. I want to change the IP because I need the a different interface to be 192.168.1.1.

View 2 Replies View Related

Cisco Firewall :: ASA5520 To ASA5520 Via L2L Tunnel

May 31, 2011

Our firewall expert has gone off on long term illness leave and I am trying to pick up the pieces :-(
 
We have an ASA 5520 (local office) talking to another ASA (remote office) via a VPN Tunnel.
 
My 1st problem is that I cannot ping from my inside network (local) to the outside interface of my remote ASA.
 
My 2nd is that I have debug enabled on my rules but am not logging anything.

View 1 Replies View Related

Cisco Firewall :: Access List Object Name Substitution ISR871 And ASA5520

May 10, 2011

I am troubleshooting a s2s vpn between an ISR871 and my ASA5520 and I suspect a problem with my crypto-maps.
 
Is there a way I can display an access-list on the ASA and have the object names substituted with their IP addresses?

View 5 Replies View Related

Cisco Firewall :: ASA 5585X Active / Active Failover Group Inter Routing

Mar 20, 2012

I am looking at deploying a pair of 5585X's in an active/active multiple context state.  I am creating Mulitple contexts that need to be able to route to each other.  I was going to deploy a type of Gateway context that has a shared interface to all of the other contexts, instead of sharing interfaces directly between the contexts, i beleive this will work as basically i am just cascadng the contexts and sharing interfaces.
 
The main problem i have come across, is that if i deploy active/active across two appliances using 2 failover groups i can not see a way to route between them, for example. 
 
I have Context 1, Context 2 and Context GW A including the shared interfaces of Con1 and Con2  in failover group 1 on appliance A with the respective standbys on Appliance 2. I have Context 2, Context 4 and Context GW B including the shared interfaces of Con 3 and Con 4 in failover group 2 on appliance B with the respective standbys on Appliance 1.
 
I need to be able to route traffic between Context GW A and GW B so that the contexts can communicate in normal operation and in failover.  I do not beleive that I can share an interface between contexts in two separate failover groups and to be honest without adding a L3 device between the appliances i am not sure if this is possible.

View 9 Replies View Related

Cisco Firewall :: ASA 5510 Configuration Modifications In Active / Active Mode

Dec 17, 2012

I have two ASA 5510s running in Active/Active mode. I need to make config changes on them. How do I go about it? Do I power off the secondary ASA and make the config changes on the primary and then power on the secondary ASA ? Or this another way to do this?

View 3 Replies View Related

Cisco Firewall :: 5520 - ASA Active / Active Failover And IPS Failure

Mar 30, 2011

I have 2 asa 5520 firewalls including and 1 AIP-SSM-10 module in each of them. the configuration is set using active/active failover and context mode.
 
Both of them run individualy the IPS module. The IPS is configured using inline mode and fail-open option. However when one of the module fails and the state is changing from up to init or anything else making the IPS to fail then failover is detected and ASA consider it as failover and bounce context to the other unit.
 
IPS soft is 6.0(4) and ASA soft is 8.0(3)
 
I have checked cisco doc and it is confusing to me. it says:  "The AIP-SSM does not participate in stateful failover if stateful failover is configured on the ASA failover pair." but it really does participate. Running is not really an option because of production network impact matter..

View 2 Replies View Related

Cisco Firewall :: ASA5585-X Active / Active Failover Using Etherchannel?

Dec 27, 2011

its possible to set up active/active failover using etherchannel on 5585s? 

View 1 Replies View Related

Cisco Firewall :: 5505 Server Looses Network Access When Vpn Is Active

Sep 27, 2012

When I start a VPN-session my server looses internet access. The server is host for a few virtual machines and they have internet access.using 5505 and asa is version 8.4(2). [code]

View 6 Replies View Related

Cisco Firewall :: DHCP Scope Limitations For ASA5505

Feb 22, 2013

I have a ASA5505 that i have running asdm 6.4 on it and have tried setting up some DHCP scopes for the interfaces.I have the security plus key.I set up 4 interfaces all with different subnets and all with different DHCP being doled out by the firewall for the time being.Anyway, 3 of the 4 work.I have tried to change interfaces wondering if there was an issue with that phy device.I tried enableing the subnet that would not work first and it didnt matter still would not issue dhcp.the other 3 work fine.Is there a limitation to the amount of scopes that will issue dhcp for an asa5505 ?

View 3 Replies View Related

Cisco Firewall :: ASA 5505 And 5510 DHCP Limitations?

Nov 17, 2011

Our company is planning to buy one of cisco ASA 55xx series.But there is still one question left about DHCP pool limitations.Here I found some information about licensing for DHCP on ASA 5505: [URL]In other words, we don't have any information about ASA 5510, which contains DCHP pool licensing.

View 9 Replies View Related

Cisco Firewall :: 2811 - Limitations To ACL List Length

Sep 20, 2011

I came across this site. I wanted to produce a better incoming ACL at  home and work to prevent known bad sites
 
Here is their list of the Top 10 Global Spammers is out. The biggest  surprise on the list is Korea, as it takes over the number one global  spammer spot from China. With the improved high speed internet  infrastructure in Korea and ease of network access, who knew Korea would  be on the rise.
 
Here is the complete Global Spanner Top Ten List for the first quarter
 
[URL]
 
Korea
China
India
Russia
Turkey
Viet Nam
Ukraine
Brazil
Venezuela
Pakistan
 
When I sort the list, it is over 16k lines of ACL!
 
My question relates to what performance limits I would find.
Can I actually put that many lines in an ACL?
Will the router choke and do any other work
 
I have attached the sorted ACL list for you to review
 
Any of the following router lines will accept a  list that large and still run acceptably?
 
2811
2911  
3925
2945

View 1 Replies View Related

Cisco VPN :: Remote VPN On ASA5510 Getting Static IP From ASA5520

May 22, 2013

i configured a remote VPN on cisco ASA 5520 and everythings seems to be working fine...DHCP IP were been lease to users that connect to the VPN. but the issue now is that our customer want a static IP to be given to a particular user when he connect via VPN.

View 1 Replies View Related

Cisco :: ASA5520 - Implementing VPN For Remote Users?

Apr 25, 2012

I have roughly 50 users that are remote, and use VPN to access the resources in my network such as file servers, application servers etc.  We currently use Microsoft VPN to authenticate those users.  It works, but I am not a fan on Microsoft VPN.
 
I have purchased an ASA5520 to replace my crappy layer 3 HP core backbone switch, and plan on replacing my Microsoft VPN with Cisco VPN.  I want to configure my ASA so my remote users can continue to VPN into my network securely?Is this possible?

View 8 Replies View Related

Cisco VPN :: ASA5520 - IPSec L2L VPN Remote Peer Is Being Denied

Mar 18, 2012

We are trying to add an additional LAN-to-LAN IPsec VPN to our network.  We currently have one remote office connected, when we configure the second VPN matching the first the tunnel never begins to establish.  There is an ACL that is dening the static IP for our remote office.
 
The layout is as follows:
 
Main office = ASA 5520
Remote Office A = ASA (Unknown Model)
Remote Office B = Adtran Router
 
All devices have static IP addresses.
 
We used the ASDM VPN wizard to create both VPN's.
 
We have created a rule allowing all traffic from our remote office IP, and that had no effect on the VPN aside from eliminating the following message from our logging:
 
4          Mar 19 2012          15:18:01          106023          67.50.19.230          50234          TWT-hq-e          31326          Deny udp src TWT-outside:67.50.19.230/50234 dst inside:TWT-hq-e/31326 by access-group "outside-in" [0x0, 0x0]
 
We have verified that both sides are configured the same however the VPN never is initiated so as of right now the ASA is simply blocking all attempts from our remote office to connect.

View 1 Replies View Related

Cisco Firewall :: Remote Access VPN 10.42.10.0

Nov 26, 2012

I have a remote access VPN to our office network 10.42.10.0. however I have some web services that are located in a production network 10.42.1.0 that users in the office network need to access.This is obviously no problem when using remote desktop to an office PC but when users with laptops remote in and try to access the website on the production network it does not work.
 
Is there any way for the tunnel also to also allow traffic to the production network  for the remote hosts?

View 8 Replies View Related

Cisco Firewall :: Remote Management Access Through VPN On ASA 5505

May 21, 2012

I have a remote ASA5505 running 8.4(3) with a working site 2 site VPN tunnel to my main office. (The main office is running an ASA 5510 with OS 8.4.3 as well). The encryption domain is all private IP on main site vs. 172.16.10.0/23 on remote site.
 
Relevant config of the remote ASA:
 
interface Vlan1
nameif inside
security-level 100

[Code].....
 
I can manage the ASA on the outside interface (outside of the site 2 site VPN) using the TACACS credentials I can also ping my management station from the ASA using the inside interface, but as stated, the other way around does not work. I have not yet tested if management from the local 172.16.10.0/23 subnet works, but I will try this next.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 / ASDM Access With Remote VPN

Apr 18, 2012

I have a cisco ASA 5510 that I have set up currently to access via ASDM through the Inside interface. When I VPN in using our older VPN server I can connect to it fine.  I recently set up the ASA to also be a VPN server which will eventually replace the older server for our HQ.  I noticed that when I'm VPN using the ASA as the VPN server, I can only ASDM to the public which I prefer not to allow.  Access to the inside doesn't seem to work this way. What configurations if any would be causing this.  I'm assuming it's some thing I need to adjust in the VPN configuration.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Remote Access To ASDM?

Jan 5, 2012

How do I enable remote access to ASDM from outside of the network on the ASA 5505?  This would be used for remote access to the firewall at a site that is not utilizing VPN.

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved