Cisco Firewall :: Asa 5540 8.2.3 Arbitrarily Reload

Dec 19, 2011

I have two ASA 5540 working in Active/Standby mode. After I've upgraded them to 8.2.3 ver. I have the following issue: once a day presently active device arbitary reloadI have no err in show version and in syslogs:11:15:50 ASA : %ASA-6-302020: Built inbound ICMP connection for faddr gaddr laddr 1011:15:58 ASA : %ASA-1-104001: (Primary) Switching to ACTIVE - HELLO not heard from mate.

View 4 Replies


Cisco Wireless :: Linksys E4200 Arbitrarily Blocking Websites

Apr 19, 2013

I have a E4200 V1 router.  A website that I have been accessing for years all the sudden no longer works.  If I use my PC and PPTP VPN to another location, I can browse the website fine.  If I remove the router and plug directly into my Comcast internet connection, I can browse the website fine.  If I enable logging on the router, it shows the connection on port 80 just like every other outgoing connection.  Security log shows nothing.  I was on firmware version 1.0.03, upgraded to 1.0.05.  Tried resetting to factory defaults before I updated firmware, and after I updated the firmware.  The website all the sudden just stopped working 2 weeks ago.  I also tried putting my PC as the DMZ IP address and nothing.

View 1 Replies View Related

D-Link DIR-615 :: Arbitrarily Dropping Connections / Overheating Router

May 27, 2012

A few weeks ago I began having issues with my 615 arbitrarily dropping connections and so on which turned out to be an overheating router, due to sudden hot weather here in the UK, and I just wanted to share how I solved it. My solution was to dremel a hole in the case just big enough to fit a small, silent 12v brushless fan I salvaged from a wrecked computer's PSU, which would then rest on the PCB without any real fixtures. I even drilled some small holes in the side of the case for air to exit. This was fine though because the router is never moved around. Rather than solder the fan onto the power jack socket connections inside to use the unit's own supply, I used an old, disused multi-adaptor and ran the fan cables out of a small hole at the back. The benefit of that was that it didn't add any strain to the router's PSU as this was already under some load after messing around with transmit power in dd-wrt. Another small advantage is that I get voltage control on the fan for slowing on cooler days.

View 1 Replies View Related

Cisco VPN :: 1811 - Remotes Not Coming Up Immediately After Firewall Reload

Apr 6, 2012

I have about 30 remote EZVPN 1811 routers that never come up after a firewall reload for about an hour. I have watched the EZVPN remotes and they believe they still have an IPSEC SA and they never attempt to reconnect until their IKE SA times out. Is there any way I can change this behavior so that the remotes will more rapidly recognize that their SA is invalid and negotiate a new one?

View 2 Replies View Related

Cisco Firewall :: Can't Reload ASA 5505 After Flash And Memory Upgrade

Mar 1, 2013

I recently upgraded the flash and the RAM on one of my ASA 5505 lab machines. The flash was upgraded from 128 to 512MB and the RAM was also upgraded from 256 to 512MB. I am using asa845-k8.bin. The firewall boots and runs file until you issue the reload command. The system shuts down but never reloads.

View 11 Replies View Related

Cisco Firewall :: 6509 - Standby FWSM Stuck In Sync After Reload

May 8, 2011

We have a setup of FWSMs configured in single mode in 6509 chassis. Both 6509 are configured in VSS. Recently I have upgraded the firmwre from 4.0(3) to 4.1(3).....before upgradation config sync was not having any problem.
After upgradation...If any one of the FWSM reload..while coming up it gets stuck in config sync and no command we can run on any of the unit and get the error as..
Configuration update in progress by another process. Also on stannby fwsm no running-config displays.
If we used # failover suspend-config on primary and then reloads the standby fwsm...standby boots up with startup config and when  # no failover suspend-config command runs on active fwsm..the sync started and completing succssfully within 15 sec..
Also failover works well..with #no failover active..

View 3 Replies View Related

Cisco Firewall :: ASA 5540 - Version Change In Firewall?

Mar 15, 2012

How are asa5540 in high availability mode upgraded for their versions.

View 1 Replies View Related

Cisco Firewall :: Polycom HdX8000 Behind ASA 5540 Firewall?

Dec 28, 2012

I am encountering some problems setting up my new polycom hdx 8000 behind ASA 5540?I have opened reuired ports through the firewall ( incoming and outgoing). I have enabled inspection h323 on ASA and enabled the option NAT is 323 compatible on Polycom.
3230-3243 tcp
h323 tcp
h323 udp
3230-3285 udp
Here is the problem.I get connected to the call but I cannot  the remote site cannot see and hear me.But I can see and hear them.

View 9 Replies View Related

Cisco Firewall :: ASA 5540 Upgrade From 7.1 To 8.4

Jul 16, 2012

i need to upgrade ASA 5540 from 7.1 to 8.4 for secure connect feature of Cisco Jabber Configuration. Support forum guides that, i need to follow upgrade path from 7.1 --> 7.2  --> 8.0 --> 8.2 -->8.4 and also do a memory upgrade from 1GB to 2GB.
I need to use this feature for only three or maximum four users in company then would i really need to do  memory upgrade? or can i go with 1GB memory?also how i can get the prices of part number "ASA5540-MEM-2GB=" at
ASA-ISB-HQ# sh version  
Cisco Adaptive Security Appliance Software Version 7.1(2)
Device Manager Version 5.1(2)


View 2 Replies View Related

Cisco Firewall :: 5540 - ASA 8.2 No Nat-Control

Nov 19, 2011

ASA5540# sh run nat-control
no nat-control
this means higher security can talk to lower security without NAT rules
Question 1) - if I want higher security zone to to talk to lower security with NAT rules. I would use statements like below. Am I correct?
nat (dmz) 1
nat (inside) 1
global (dmz) 1 interface
global (inside) 1 interface
Is this correct? So in this case I am kindly of like overriding the no nat-control statement ...right?
Question 2) - Now I have no nat-control enabled. Would the below statements (nat 0) be of any use for NAT exemption??
nat (dmz) 0 access-list dmz-nonat
nat (inside) 0 access-list dbase-nonat
And do I have to have a global statement for NAT 0 below?
global (dmz) 0 access-list dmz-nonat
global (apps) 0 access-list dbase-

View 2 Replies View Related

Cisco Firewall :: Cannot Log In To ASA 5540 ASDM After Configuration IPS

Jun 10, 2012

I Have Cisco 5540 with AIP-SSM-40, recently i config AIP-SSM-40 to capture all traffic from all interface any to any with promiscous mode and if card fail traffic still flow throuh asa, but after that i can't login to cisco ASDM, the error is "Un Able To Launch Device Manager From xx.xx.xx.xx"               

View 2 Replies View Related

Cisco Firewall :: High CPU Utilization On ASA 5540

May 11, 2008

I have a remote site customer with a Cisco ASA 5540 running SSLVPN (Anyconnect)(8.03). It currently only serves about 450 SSLVPN clients. Since last friday, they've seen the CPU utilization go up to high 90% while only serving 400+ remote users. I saw some high cpu utilization bugs, but none looked to be relevant. How I can find the root cause of the CPU high utilization?

View 2 Replies View Related

Cisco Firewall :: ASA 5540 - NAT Not Working After Upgrade

Apr 26, 2011

Just upped our external ASA-5540 pair to 8.4(1), and now one of our nat's is busted.
Here's the lowdown:
Our public IP for our IronPorts ends in .167.  That IP is natted to a VIP on our ACE, which load balances to the IronPorts.
The outside interface of the ASA uses .162, which has been the pat for all outbound traffic for a few years... except for the subnet that houses the IronPorts.  Due to reverse lookup, that subnet uses the .167 IP address for all outbound traffic.
After the code upgrade, the nat won't work.  No email sent or received.  Nothing but Deny's on the ASA with flags reading either "SYN" or "RST".  IE: Apr 27 12:56:11 local5.crit %ASA-2-106001: Inbound TCP connection denied from to flags SYN  on interface outside
If I return the subnet pat back to the outside interface, then inbound traffic works fine, though reverse lookup fails and anyone running a reasonable spam filter won't send to us.

View 6 Replies View Related

Cisco Firewall :: Reasons To Upgrade ASA 5540

Apr 29, 2012

I have two Cisco ASA 5540, these ASA running ver 7.2. and used mainly as VPN gateways.My question is simple, Apart from the extra AnyConnect client functionality and the higher encryption, is there any specific security benefits (related to the VPN use) for upgrading to ver. 8.x ?

View 4 Replies View Related

Cisco Firewall :: ASA 5540 Simulation In GNS3

Jan 26, 2013

I have to use GNS3 for simulate ASA5540.but it does not work. I've installed latest GNS3( all in one) in Win7 32bit environment, and used IOS file is asa842-k8.bin.but i can't unpack it properly. it said "Couldn't find any ZIP header in asa842-k8.bin".

View 2 Replies View Related

Cisco Firewall :: ASA 5540 And FTP Over Implicit TLS / SSL Client

Jan 3, 2012

I am having the EXACT same problem as this user:URL
Error:   GnuTLS error -53: Error in the push function.
Response:   425 Can't open data connection.
Error:   Failed to retrieve directory listing
Response:   421 Connection timed out.
However I am using implicit instead of explicit. Here are the outputs of items that have been requested in the other thread.

View 1 Replies View Related

Cisco Firewall :: ASA 5540 SSH Not Working From Outside Port

Mar 13, 2011

We are try to connect ssh via outside system (from Internet) its was not getting connected.
When we try to connect from outside pool of ip than its working.

View 1 Replies View Related

Cisco Firewall :: ASA 5540 IPS Module Removal

May 20, 2012

I have 2 ASA 5540's that I want to run in HA A/F.  The active ASA has an IPS module running.  I no longer need this and would rather remove it than purchase another module for the spare.  What is the process to do this safely? After removal will the HA wizard recognize that the module was removed or do I have to update the software?

View 3 Replies View Related

Cisco Firewall :: ASA 5540 / Nat Line Removed From 8.4(3) To 8.4(4) 1?

Sep 23, 2012

we have noted the automatically removing of the only "nat (inside,any)" line, during the upgrade of ASA 5540 from 8.4(3) to 8.4(4) 1: why ?

View 1 Replies View Related

Cisco Firewall :: Unable To Run FTPS (FTP Over SSL) Across ASA 5540?

Mar 19, 2012

there was remote FTP - users behind ASA5540 can connect to it.
Now, with this ftp there is SSL/TLS encryption added and users behind this ASA can't connect to this FTPS.
It this possible for users behind ASA to connect to FTPSs?

View 2 Replies View Related

Cisco Firewall :: How To Load IOS From ROM Monitor In ASA 5540

Jul 20, 2011

I was looking in the CISCO webpage how to load an IOS from a tftp server but i got some questions:
I got the information from this webpage: [URL]
rommon #1> ADDRESS= <---- Which IP address? the one that I got on my firewall?

View 3 Replies View Related

Cisco Firewall :: Getting ASA 5540 Default Contexts?

Apr 19, 2011

Q1. I would like to confirm like how many total of contexts do I have by default when I purchase the ASA 5540 ? are they two contexts aside from the admin context or two contexts including the admin context?
Q2. can I configure the default box with High Availability using the default contexts?

View 3 Replies View Related

Cisco Firewall :: ASA 5540 - BGP Dynamic Routing

Jan 10, 2012

Does ASA 5540 support BGP routing protocol to be configured on it??
I'm talking about the latest versions.

View 3 Replies View Related

Cisco Firewall :: ASA 5540 To Block Software

Aug 10, 2012

I have an ASA 5540 , how can i block softwares like TeamViewer , VPN Adapters like Hamachi and all. Also , I have tried URL Blocking but i suppose ASA supports only HTTP url block and not HTTPS.

View 2 Replies View Related

Cisco Firewall :: ASA 5540 8.2 - Way To Make A Simple PAT

Sep 3, 2012

I have a cisco ASA 5540 and i cant make a simple PAT (many private IP to one public IP). Below you can find my conf.


View 4 Replies View Related

Cisco Firewall :: ASA 5540 - Code Versions / 8.4 Or 9.x

Feb 28, 2013

I am in the process of rebuilding our ASA 5540 pair.  We are currently on 8.2 code with this set of firewalls and I was going to upgrade it to 8.4 being I have a couple of other firewalls running this code currently and am familiar with it.  That said, I saw that the 9.x code is out there now.  Are there any major advantages or caveats with the 9.0 code?  I plan to use this firewall with SSL VPN and RSA Secure ID integration for the next 2-3 years at least. Any quick pointers on these two code versions and on upgrading to 9 or staying with 8.4 line.

View 2 Replies View Related

Cisco Firewall :: WCCP Redirection On ASA 5540?

Apr 3, 2013

I have the following topology, WCCP is configurated on ASA, inside interface, lan users and websense machine are located on the same VLAN of my catalyst 3750G?I want to filter traffic on port 80 (www) to the users on the LAN side debug on the ASA show me that comunication between that device and Websense is OK,  there is Here_I_Am and I_See_You packets
WCCP-PKT:D00: Sending I_See_You packet to WEBSENSE_PROXY w/ rcv_id 0000015B
 WCCP-PKT:D00: Received valid Here_I_Am packet from WEBSENSE_PROXY w/rcv_id 0000015B
 WCCP-PKT:D00: Sending I_See_You packet to WEBSENSE_PROXY w/ rcv_id 0000015C
 WCCP-PKT:D00: Received valid Here_I_Am packet from WEBSENSE_PROXY w/rcv_id 0000015C
 WCCP-PKT:D00: Sending I_See_You packet to WEBSENSE_PROXY w/ rcv_id 0000015D
From show WCCP i saw that WCCP engine and ASA were detected
FW# sh wccp 
Global WCCP information:
Router information:
Router Identifier:                   200.X.X.X
Protocol Version:                    2.0


View 5 Replies View Related

Cisco Firewall :: Slow SQLnet Throughput On ASA 5540?

Nov 14, 2011

I'm having a throughput problem with a new ASA 5540 running version 8.2 (1). When trying to access a database server using tcp port 1521 (sqlnet) it is about 10 to 20 times slower than when the database is not behind the firewall. We've been running the same software on a database behind an ASA 5520 running version 8.0 (3) with no problems for years. When I check the cpu usage on the 5540 at the ASDM home page, it is rarely above 20% and never above 30% while this is being tested. I tried testing ftp throughput over the same interface and it was normal with ~320 Mbps average rate transferring a 500 MB file.

View 6 Replies View Related

Cisco Firewall :: 5540 - Multicast Over Lan To Lan Ipsec Tunnel

May 3, 2011

I need to configure multicast between 2 Csico 5540's lan to lan ipsec tunnel for a Voip application.

View 2 Replies View Related

Cisco Firewall :: 5540 - Remote VPN Authentication Fail?

Mar 15, 2011

wht would be change on configuration of remote access VPN on asa 5540.
4|Mar 16 2011|15:26:01|713903|||Group = tesTGroup, Username = GSDc2gsIdc, IP =, Error: Unable to remove PeerTblEntry3|Mar 16 2011|15:26:01|713902|||Group = tesTGroup, Username = GSDc2gsIdc, IP =,


View 3 Replies View Related

Cisco VPN :: Juniper Firewall To ASA 5540 Drops Every 45 Minutes

Oct 10, 2012

We have a VPN established between the above devices (I don't have more info on the Juniper as it's a client site) The Juniper initiates the VPN and all is well, tunnel is up all ok but approx every 45 minutes the VPN drops.
the tunnel parameters are set to keep it alive for 8 hours but that doesn't work.

View 4 Replies View Related

Cisco Firewall :: 5540 PIM Multicast Routing In ASA Scenario

Jun 19, 2011

We have an ASA-5540 (8.4(1))  The inside interface faces a few multicast receivers. The outside interface faces the multicast source.All of the ASA multicast documents I've download describe very simple network designs, such as a single segment on the ASA inside.Our PC hosts that will be multicast receivers are a couple router hops away from the ASA inside interface. I'm not sure what the best way is to configure multicast on the ASA.Should I configure the ASA with PIM routing and a static RP address (plus the ACL to allow the multicast source traffic in) since the receiver hosts are a couple hops away?  I think I understand the IGMP joins are for a local PIM router, so configuring as a Stub Multicast router wouldn't work? The two Cisco routers between the host and the inside ASA interface already have PIM, a static RP address, and IP PIM Spare-Mode configured.

View 1 Replies View Related

Cisco Firewall :: Active Session Count Of ASA 5540 In HA?

Apr 15, 2012

We have configured our ASA5540 in active-standby failover.We are observing that current active session count is twice of session count before configuring HA. Earlier average active session was 50000 and now after HA it is around 100000. Failover configuration of both firewall are as follows
failover lan unit primary
failover lan interface FOLan GigabitEthernet1/0
failover polltime unit 15 holdtime 45
failover replication http
failover link StateLink GigabitEthernet1/1
failover interface ip FOLan standby


View 3 Replies View Related

Copyrights 2005-15, All rights reserved