Cisco Firewall :: How To Configure 6 To 4 Manual Tunnel On ASA5585
Jul 6, 2012
I have ASA5585 Firewall between my WAN Cloud and LAN Network. I plan to configure Layer 3 Vlan Interfaces inside FW and it would be Layer 3 gateway for some of Subnets. Layer 3 VLAN Interfaces are planned to be dual stack containing both IPv4 and IPv6 Address stack.
I plan to configure 6 to 4 Tunnel with my Hub Site where we have native Ipv6 awareness. One tunnel end point would be ASA and the other endpoint would be Hub site WAN Router/L3 Switch. So IPv6 traffic hitting to vlan interfaces on ASA would be policy checked and routed over tunnel interface to Hub Site.
6to4 Tunnel manual tunnel configuration on ASA. I have configured such tunnel on L3 Switch or Router with following config.
Int tunnel xyz
ipv6 address <ipv6 address>
ipv6 enable
tunnel source <loopback address of my L3 Switch>
tunnel destination <loopback address of my hus site L3 Switch/Router>
tunnel mode ipv6ip
end
I need to implement something similar in ASA. How can I do that?
View 2 Replies
ADVERTISEMENT
Sep 7, 2012
Can I configure two IPsec tunnel in a ASA5525X, when the destination is same.
View 1 Replies
View Related
Dec 19, 2011
I am interesting how ASA 5585-X with SSP-60 operates in dual firewall mode, if I install two SSP-60 modules in chassi, do I get one logical firewall with doubled performance of (SSP-60) ?
View 1 Replies
View Related
May 17, 2012
I have put 2 physicl interfaces (te0/8 & 9) on the ASA-5585 into a PO and am assigning ips/vlans to the sub-interfaces. I have 2 issues: - Why am I not able to ping the other sub-interface from the ASA itself? (I can ping the 1st one), Secondly, why the IPs are not visible in "sh int ip brief" ?Although I can see them in "sh ip" ..
/actNoFailover(config-if)# int po17.100
/actNoFailover(config-subif)# vlan 100
/actNoFailover(config-subif)# ip add
[Code]....
View 2 Replies
View Related
Jan 22, 2012
I am responding to a tender where the client is asking for the firewall to support an onboard disk drive for logging purposes, which is a minimum of 500 GB in size.
The other requirements all point towards the top of the range ASA 5585-X Chas w/SSP60,IPS SSP60,12GE, 8 SFP+,2 AC,3DES/AES.
I note the 5585 when configured on DCT comes with HDD blanking plates, is there an HDD supported on this?
View 1 Replies
View Related
Jul 9, 2012
Do you know when will be possible to manual configure ipv6 settings? I have all parameters from my ISP but the settings on the router are only automatic and 6rd. Is it possible to enable this in future firmwares?
View 1 Replies
View Related
Aug 4, 2012
I have had several Linksys and Cisco routers in the past, and I'm a network engineer. My E3000 died after only 18 months so I had to run down and buy a new router, thus the EA4500.
I use the manual way to configure all my network gear. Nothing on my network changed, except the router replacement.If I leave the router default address at the 192 range, DHCP will issue a IP address. However, I do not use that range and after cdhanging the range, setting my start IP address, etc, I save everything and even tried rebooting the router to no avail. The router will not issue a DHCP addrss if you change the default range.
I can manually configure my clients with a static IP and all is good, no issues at all. I just can't get DHCP to work. My E3000 was configured exactly the same way and worked just fine, well up until two days ago.I have tried upgrading to the latest router firmware, so I'm not on 2.0.37 and I did set the router back to Factory Defaults, rebooted, then configured it, and still no DCHP.
View 7 Replies
View Related
Mar 12, 2013
I've read through netpro and found everyone points to this doc.
[url]....
However that still doesnt allow traceroute through for us. We still see syslogs with deny's on high level random UDP ports to different Internet destinations.
[code]....
View 2 Replies
View Related
Oct 17, 2012
I got some issues with my CISCO ASA, the thing is that when I add a new rule on the device this rule duplicate and goes to the bottom. We already tried to delete the duplicate rule but it always show an error.
-Model 5585
-ASA Version: 8.2(5)
-ASDM version: 6.4(5)
View 5 Replies
View Related
Jun 7, 2011
We saw this syslog on ASA5585 with version 8.4(1). I have two HA firewall pairs (contains 4 ASA5585, active/standby), and I saw this message on the standby ones.
Jun 7 07:36:26 10.99.96.32 last message repeated 4 times
Jun 7 07:36:26 10.99.96.32 :Jun 07 07:36:26 HKST: %ASA-ha-3-210005: LU allocate connection failed
[Code]....
View 4 Replies
View Related
Apr 25, 2013
How do i measure the total throughput going via 5585-X.It has the firewall througput of 5Gbps. Looking at aggregate of all the interfaces traffic going through it seems about 4gbps is going through.
I use show traffic command and add up the trasmit and receive traffic on each live interface.Is that correct method and are there any more commands?
View 1 Replies
View Related
Aug 18, 2011
use of a pair of ASA 5585's in active/active mode with a shared outside interface.Last time I did this was with FWSM, there was a restriction where all contexts that share an outside interface have to be in the same failover group.Does this apply also to the ASA? My thought is that it will, but I am unable to find that in any documentation.
View 1 Replies
View Related
Oct 24, 2012
We're currently PATing everything from a particular subnet to the IP of an outside interface using our ASA5585 (dynamic PAT). We're experiencing pool exhaustion and therefore need to expand the global IP range. Any way of cutting over to the new range without dropping existing connections? For clarity, the current interface address is x.x.x.37/22 and the new PAT pool is x.x.x.114-6/22.
View 6 Replies
View Related
Jun 29, 2011
Running ASA5585’s in active/standby across a local campus MPLS network. Supported design, leading practice etc. Specifically our design is that two ASA5585 are configured as active/standby through a local campus MPLS network over 10gig links through ASR9k etc. The ASA’s are providing inter-vrf routing capability only with p2p l2vpn circuits configured for each logical interface between the ASA over MPLS etc.The failover link is via a direct fibre and the state link will be through a p2p l2vpn (option for direct fibre also)Is this a supported design to begin with?
View 2 Replies
View Related
Dec 9, 2012
I have a ASA5585 running 8.4 that is redirecting Internet http to a websense server via GRE.The integration is working fine, except when a user PC sends a large packet (~1500 bytes).With WCCP/GRE headers, the user packet is too large to be transmitted to websense, so the ASA fragments the packet in two and transmits both to websense.
A sniffer trace confirms that both fragments reach the websense server, but the TCP packet is never acknowledged.User-side TCP retransmits the large packet three times over 15 seconds, and eventually retransmits fine with smaller packets. The 15 second delay is of course not acceptable.Users and Websense server are both on the Inside interface.
We are considering imposing browser proxy to websense (which works fine), but would prefer not, considering the increasing diversity of devices.
View 4 Replies
View Related
Oct 19, 2011
We are experiencing intermittent issues with the IPS on our ASA5585 vs 8.4(2). Probably something with the dataplane. So I want to keep debug cplane 255 activated and logged with log debug-trace setting to syslog server. But when session times out the debug command is cleared so the output stops. Since it is a intermittent issue I want to keep debug activated...Totally different behaviour then with routers which keeps it activated. how to keep debug activated on a ASA.
View 1 Replies
View Related
Aug 14, 2011
I have two ASA in failover with Active/standby configuration. When I switch from standby to active from the standby ASA I get a lot (like 100) of error messages like these below: [code] The failover works fine and nothing seems to be wrong with the firewalls function.
-Hardware is ASA5585-SSP-10.
-Software version: ASA 8.2(5),
ASA is in multiple mode with 17 active context. Why these error messages appear and what they mean?
View 2 Replies
View Related
Jun 9, 2012
We have pair of ASA5585 (ver 8.4(4) with IPS module configured with Active/Standby failover. There are total 09 interfaces are connecting to different zones in the firewall and out of which three(3) interfaces are connecting to Palo Alto 2nd layer firewall. When we test the failover whatever interfaces not connecting Palo Alto failed or shutdown, ASA triggers the failover to other unit, however the Palo Alto is not detecting this failover and it still keeps its previous Active Palo Alto to pass traffic, thereby failing passing traffic on Active firewall through Standby Palo Alto firewall.
But when there's a interface failed or shutdonw on the interfaces where PaloAlto also connected, then once the ASA failover triggers and the same time Palo Alto also trigger its failover then both new active firewall and Palo Alto sending traffic through firewall.However we we cant all the interfaces of ASA also to connect Palo Alto and let the Palo Alto to inspect all the interfaces, but we need our ASA to work in a situation where any of the interfaces failed, the failover to work smooth the pass the traffic via either Palo Alto device.I just need to know is there anything tricky that we can configure on our ASA in this failover senario, or to confirm if there's no any workable solution to this situation.
I have attached the senario that I explained above. Just to emphasis the issue again, if any interface of Gig0/0, Gig0/4 or Gig0/5 failed on active firewall, ASA switching to standby firewall and act as Active, but Palo Alto still remains his Active state and the new Active ASA is not passing traffic via standby PA as its not detecting any of its interfaces as failed or unreachable..?
View 1 Replies
View Related
Jun 1, 2012
WE have to deploy ASA5585 in between User vlans & server vlans. we have to find all the ports that needs to be opened on firewall. any tools to do same.
View 2 Replies
View Related
Dec 27, 2011
its possible to set up active/active failover using etherchannel on 5585s?
View 1 Replies
View Related
Mar 24, 2011
I'm attempting to configure a tunnel on a PIX-501 version 6.3. It's an old device that's due to be replaced soon, but unfortunately we need a tunnel now... I have been using this document as a reference (6211): URL ,The remote end is a sonicwall.
The problem seems to be that the pix never sees the interesting traffic for the tunnel, and never tries to initiate a connection. I have enabled crypto ipsec and crypto isakmp debugs, but no data is ever displayed, even when attempting to access a device on the remote side of the tunnel! Someone had tried to set up this device with some tunnels in the past, but was never successful, so I'm thinking there might be remaining commands in the running-config causing problems.
View 7 Replies
View Related
Sep 13, 2012
configure ip-sec vpn tunnel between ASA5525x and RV042
View 5 Replies
View Related
Mar 19, 2012
how can you configure remote vpn ipsec tunnel on a Cisco 800 router?
View 12 Replies
View Related
Jun 3, 2012
I am trying to confgure a L2L VPN tunnel to a service provider using an ASA 5505.My problem is that the service provider will not accept traffic from a LAN subnet, they will only accept traffice from a public IP.We have a small public subnet of x.x.x.50/255.255.255.248, our public IP (outside interface IP on the ASA 5505) is x.x.x.50 and the service provider wants to see traffic coming from us on x.x.x.51How can I NAT our LAN subnet (10.0.0.0/24) to one public IP (x.x.x.51)?
View 14 Replies
View Related
Jun 28, 2012
Can this scenario be done one the cisco 877 router? I have VPN Ipsec up and runing on both site. How can to configure the port forwarding to the remote server over the tunnel? url...
View 16 Replies
View Related
Jan 31, 2011
How can I configure an ASA 5505 NEM client to allow access to the Internet when the tunnel to the headend is down? I am planning on deploying back to back ASA 5505s in network extension mode but I do not want to block Internet access on the client side if the tunnel to the server should go down.
View 4 Replies
View Related
May 3, 2013
One of the customers has deployed Cisco 7609S in their infrastructure for Branch/RO connectivity. When we tried to configure per-tunnel QoS with DMVPN for MPLS connected sites, we came to know that Cat 6500 and Cisco 7600 series routers don't support this feature.
Now, we are looking for suitable replacement of Cisco 7609S. I found a document for configuring above feature on Cisco ASR 1000 series routers, but it has many restrictions always.
We are now looking for
(a) suitable platform in the league of Cisco 7609S which support above feature.
(b) suitable technology replacement of DMVPN with minimum restrictions.
View 1 Replies
View Related
May 6, 2013
user from home PC via Anyconnect making RDP session to work PC, on this PC Microsoft policy allow making disk mappind via RDP. Is that posible to inspect this traffic and deny this(disk mapping) action on ASA5585-X with IPS?
View 1 Replies
View Related
Nov 20, 2011
we just purchased 2 asa 5585-40's and tried to add them to our lms 3.2 system and we were informed by cisco tac that they were not supported in lms 3.2. since we don't having funding for an upgrade, any work around within lms that could allow me to add the devices so i can use lms for syslog and to fetch the firewall configs on a regular basis, instead of having to setup a seperate syslog server and having to tftp the config's everytime i make a change.
View 3 Replies
View Related
May 15, 2006
Can I configure a PIX (515), as PPTP client to establish a tunnel with non-Cisco PPTP server ? Can my PIX initiate this type of connection ?Today, I use a PC with PPTP client to establish this and I want replace this with a PIX and I don´t want depends of a PC.
View 5 Replies
View Related
Jun 16, 2011
I want to configure QoS for voice traffic over a site-to-site VPN tunnel. I have a Cisco 851 router on the branch end and a Cisco 1800 router at the HQ. The setup is an Avaya Gateway located at the HQ and the idea is that the phones at the branch office are connected over the VPN tunnel to the gateway at the HQ.
I have a 1MB internet link at the HQ from a service provider and 256kbps internet link (from a different service provider) at the branch office. The branch office has just 3 users.
View 12 Replies
View Related
Jun 9, 2013
I have ASA 5555-x and configurated site to site vpn. Now that our side wants to receive multicast messages from the other side. In this case i know that i must configurate gre tunnel on router. because asa is not supported gre tunnel. i have also router 2811. I know that we need to add a cisco router behind the firewall in order to receive multicast messages.
configurate site to site vpn on asa and gre tunnel configuration on router.
View 6 Replies
View Related
Oct 5, 2011
I need to create a vpn tunnel between my Cisco 837 having a dynamic IP and my Firewall (Static IP).
View 1 Replies
View Related
