Cisco Firewall :: How Many Route Entries Can ASA5520 (8.2.1-k8) Support

Sep 24, 2011

how many route entries can ASA5520 (8.2.1-k8) support?

View 2 Replies


Cisco Switching/Routing :: How Many Route Entries Does 3945E Or/and 3900 ISR G2 Support

Dec 1, 2011

I have a question concerning about how many ospf and bgp route entries does 3945E isr g2 router support?

View 6 Replies View Related

Cisco Switching/Routing :: How Many Route Entries 2821 Or 881 Router Can Support

May 21, 2012

One of our client wants to know "How many route entries a 2821 router or 881 router can support" Such as the 3750 can support 11k routes in ‘desktop routing’ mode. But I want to know the limitations on routers.

View 1 Replies View Related

Cisco Firewall :: ASA5520 - Static Route Shows A- Or A-

Jul 14, 2012

We use ASDM 6.2 to manage our Cisco ASA 5520 running ASA Software Version 8.2 (1). I just noticed that some static routes have "A-" when you view the static routes with ASDM e.g. A- or A- (pls see attached print screen). I haven't seen this before and dont know what it means.

View 4 Replies View Related

Cisco Firewall :: ASA5520 VPN Support Over DSL

Jan 5, 2012

Any limits on the number of IPSec sessions an ASA5520 can support over a DSL connection?
Currently, as we increase the number of IPSec VPN tunnels, our LAN switches connected to the DSL/ASA start seeing CRC/input errors.   Tried different LAN ports for both DSL/ASA connections - same reults (CRCs and errors).   Swapped ASA for PC running 1 IPSEC w/HD video and no issues.
VPN connection bandwidth demand 50% of DSL capacity, so not exceeding DSL bandwidth.    Errors get so bad that all VPN sessions drop - sometimes VPN sessions re-establish while other instances a DSL modem reboot is required.
cause of LAN switch connections seeing errors with 4+ VPN sessions established on ASA across a DSL Internet circuit?

View 1 Replies View Related

Cisco Switching/Routing :: 5500 ARP Entries And Support For VMs?

Jul 15, 2012

How many VMs can a pair of 5548s support? Remember, for each VM, I will have an ARP entry in the 5500 ARP Table (assume 5500 is the L3 default gateway).

View 3 Replies View Related

Cisco WAN :: Routing Table Entries Support On 1921 / K9?

Nov 27, 2012

Is there a Table which the list the route table entries on Cisco ISR Router especially ISR 1921 Router.

View 3 Replies View Related

Linksys Wireless Router :: How Many Port Forwarding Entries Does WRT310N Support

Dec 13, 2011

I want to upgrade my router but I need a router that supports more port forwarding entries for my applications.  I have my eye on the WRT310N router but I need to know how big its port forwarding table is.

View 2 Replies View Related

Cisco VPN :: ASA5520 Outside Interface Non Route-able Address

Aug 29, 2012

I am currently working with a vendor to get my ASA5520 setup to handle IPsec VPN connections for my clients and we are stumped with how to get the outside interface to respond to connections/requests.
I work for a state agency and our network connectivity is provided to us by another agency/department.  The firewall I want to use for VPN connectivity has an outside address of which is not routable outside the state's network.  I have been assigned a set of public IP addresses for servers in my DMZ and I am wondering if it is possible to configure the ASA to utilize one of those public IP addresses for VPN communication.  My DMZ network is setup as a local network and the ASA is performing NAT translations to the corresponding public IP addresses.
Putting in a NAT rule to translate one of the public IP addresses to the outside interface, but I wasn't sure if that would work.

View 1 Replies View Related

Cisco Firewall :: ASA5520 To ASA5520 Via L2L Tunnel

May 31, 2011

Our firewall expert has gone off on long term illness leave and I am trying to pick up the pieces :-(
We have an ASA 5520 (local office) talking to another ASA (remote office) via a VPN Tunnel.
My 1st problem is that I cannot ping from my inside network (local) to the outside interface of my remote ASA.
My 2nd is that I have debug enabled on my rules but am not logging anything.

View 1 Replies View Related

Cisco Firewall :: 5510 Trace-route / Antispoofing On Not Default Route

Jun 24, 2011

I've enabled antispoof on all interfaces on asa 5510.If you start a traceroute to a network on the default route, everything works, since replies comes to an interface with route defined.If you start a tracer route to a network that is NOT on the default route (let's assume coporate MPLS), you only get response from first carrier router, the other are discarded because of anti spoof violation.
I have ICMP inspection and icmp-error inspection enabled.

View 1 Replies View Related

Cisco Firewall :: 15.2 / How To Interpret IOS Log Entries

Oct 12, 2011

how to read some of these log entries I see on the IOS 15.2 router I'm working with.  I'm fairly new to this stuff.  My understanding is that the first socket ( is the originating one, and the 2nd socket is the receiving or destination.  This makes sense when I see an entry like:
01043: *Nov 21 2012 10:28:34.323 PCTime: %FW-6-DROP_PKT: Dropping tcp session xx.xx.241.163:39557 192.168.xx.xx:80  due to  RST inside current window with ip ident 0
The internal IP is our email server inside the LAN, the first IP is some IP in a foreign country, so someobody visited our web interface for the email server, obviously trying to breach or recon the interface but whatever.  Then I see an (unrelated) entry like this elsewhere in the logs:
001095: *Nov 21 2012 25:56:03.531 PCTime: %FW-6-DROP_PKT: Dropping tcp session xx.xx.178.210:25 192.168.xx.xx:47343 on zone-pair inside-outside class INSIDE-OUTSIDE due to  Stray Segment with ip ident 0
What this latter entry tells me is that the Internet host sent data FROM port 25 to what I am guessing is the open port our internal email server must have originated some other communication from.  However we do not accept incoming port 25 mail from anywhere but a designated IP so this "send" is not supposed ot occur.  So first off, am I reading that correctly?  Is the first IP the sending system, and the second IP the receiver?   there are no other entries in the logs between these two hosts, so either the logs have truncated with oldest entries removed (log buffer is set to 51200), or that outside host is sending, hoping to get our mail server to respond?  BTW, the outside host WHOIS's to Microsoft's IP range, Block 1. 

View 8 Replies View Related

Cisco Firewall :: Cannot View Permit Entries In The Log On ASA 5520

Apr 6, 2011

I can not seem to view my "permit" entries in the log on my ASA 5520. I set up logging-lists, changed the level to 3 on  the logging statement, and simply can't find it anywhere.
Partial config:
logging enabled
logging timestamp
logging JC-L3 level errors
logging monitor JC-L3
logging buffered JC-L3
logging trap notifications


View 6 Replies View Related

Cisco VPN :: ASA5520 / Route Subnet Behind Site To Site To Reach Each Other

Jan 14, 2012

I have some VPN site to site ( site B and site C connect to site A ). This subnet is behind site B. Another subnet is behind site C. I would like to route this to reach the subnet Is there any possibility to do this on ASA5520 (site A)?

View 3 Replies View Related

Cisco Firewall :: 6552 Static Entries With Same Ip Address But Different Ports

Sep 15, 2011

Our proxy/anti-smap/IPS box called PROXY is behind our Cisco ASA firewall. The PROXY is set in transparent mode.The PROXY internal ip is (internal ip)We have the MX record for with public ip (public ip as we entered with ISP public DNS)What happens now is that the emails that come through get "caught" by the PROXY and then we setup a thing whereby the emails are then forwarded from PROXY to our server. Also, we made a static entry in PROXY whereby we can https to our email server for the outlook web access from outside of work therefore allowing for users to see the outlook web access web page.On the Cisco firewall, we put the static entry that is mapped to thus the mail server public ip is mapped to the PROXY.
Now, the box has this thing whereby it sends an email to all staff once a day telling them how many mails are legit, how many rejected and how many are spam - the spam emails are listed within the email and staff can at a click of a release button next to each spam email release a particular email from the PROXY box and make it to into their inbox.  This works fine from the inside network, but I have issues from the outside due to the DNS and other things.I also put in the PROXY that any network can release spam and that our staff vlan can release emails. Also, on the inside of the firewall we did an access list that computers from staff vlan can access on port 6552 (Which is the release spam port).Hence, we can release emails from internal network through the Microsoft Outlook.
On the outside network, we cannot release emails when using outlook web access.The host name for the PROXY release spam is so what we did also today is ask "ISP" to make an A record entry for another public ip which is for meanwhile made an entry on the access list that comptuers from outside can access on port 6552 (which is the release port).Now the only question is in regards to the static entries:
1. do we (and can we?) static map to through a port 3840 on the Cisco ASA (although we have already mapped to - I have a doubt here as this might mean we might not get emails? Or would we have to do the static again for this one specifcying the as an smtp entry and the as a release button?

2. have I made a mistake in general and should I have just told the ISP to make a CNAME entry for with the public ip (which is the public ip for MX record?)?

View 9 Replies View Related

Cisco WAN :: 7600 - How Many Sessions BGP Route Reflector Can Support

Jan 20, 2011

how many sessions a BGP Route Reflector can support? is it 10, 100 or 1000 BGP sessions? What degradation of performance may arise in the case of a BGP RR sessions overload? Consider that the RR I'm deal with has both the control plane and teh forwarding plane. Which command I may use for get the output about BGP sessions resurces used level?

The following are the data about the RR:
Cisco 7600
Version 12.2(33)SRD5
cisco CISCO7609 (R7000) processor (revision 1.2) with 983008K/65536K

View 1 Replies View Related

Cisco Firewall :: 5580 To Create Syslog Entries When Someone Connects Via HTTPS / SSH

Mar 13, 2011

Is it possible for a Cisco ASA 5580 to create Syslog entries when someone connects via HTTPS or SSH to it. I need to obtain information from Syslog when someone does this.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 / 8.0 - Capture Type ASP Drop Entries With No Reason?

Dec 4, 2011

I have a capture set up of type "asp-drop all", and I am capturing certain packets with no indicated ASP drop reason.  See output below (ASA 5510 with 8.0(5)23 code):asa5510-8.0#  show capture, capture ASP type asp-drop all buffer 15000 circular-buffer [Capturing - 14912 bytes]

View 2 Replies View Related

Cisco Firewall :: Maximum Number Of 1-1 Static Nat Entries On ASA 5515X Or 5525X?

Aug 7, 2012

I have a FWSM cluster that I exceeded the maximum number of static nat entries on.  i migrated the connectivity off to a pair of PIX 535's that seem to be handling the adderess translation needs.  however the number of NAT entries being required is increasing and being the PIX series wal EOL'd several years back..I need to replace them..  The static 1-1 nat entries cannot be summarized into network as the hosts that are being nat'd are scattered all over various micro subnets in the all 3 rfc1918 ipv4 address ranges and they are being manged directly by snmp and SNMP-trap and other services that prohibit the use of many-to-one nat.   Is there a mknown maximum number of static 1-1 nat entries that can be defined on the ASA 5515-x, 5525=x and higher ASA firewalls?  Say I wanted to be able to grow to 2500 or more static 1-1 nat entries.  I am currently running 2010 1-1 static host nats currently.

View 1 Replies View Related

Cisco Firewall :: 5585x - Threat Detection Log Entries In Multi Context Mode

Dec 29, 2012

We have a 5585X running in multi context mode, and we are getting log entries for scanning threat detection, such as:
%ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 2 per second, max configured rate is 10; Current average rate is 5 per second, max configured rate is 5; Cumulative total count is 3116
Threat detection is not supported in multi context mode so I cannot tune the thresholds, is there any way that I can get rid of this outside of messing about with logging levels/message IDs?

View 2 Replies View Related

Cisco Switching/Routing :: Route-map Command Support On Switch 3550?

Sep 30, 2012

I have cisco switch 3550 IOS Version 12.1(19)EA1c.   
I can configure route-map commands on that.  but i can not apply that into any vlan interface.   while i try to apply the following command ( ip policy route-map PBR) on VLAN int i get an error msg saying that the command is not recognized.

View 3 Replies View Related

Cisco Firewall :: ASA5520 Bypass All Network Through Firewall

Dec 22, 2011

With regarding to the firewall ASA5520, i'm using it in my network, all the confiuration are properly configured and working but with the use of proxy address in internet explorer(e.: all the blocked contents as easily accessible simply it bypass all the network through will u guide me to block the proxy servers.

View 1 Replies View Related

Cisco Firewall :: Keep ASA5520 Firewall In Sync

Aug 22, 2011

I have two asa 5520 firewalls. one at my primary data center connected to our production Internet feed, and one at my fail over data center connected to a backup internet feed. I was wondering if there was an easy way to keep the firewall rules in sync between the two firewalls. We have failover with our isp that will move our public facing address block from our primary site to our dr site in the event of a disaster so the ip addresses will not change if we were to have to fail over to the DR site. currently i just have to do any changes that i make on the fail over server but would like a way to at least simi-automat this if not fully automat this so that i can eliminate the possibility of human error of a change happening at primary but never getting don at DR.

View 1 Replies View Related

Cisco Firewall :: Only One Internet IP Can Be Used In Asa5520?

Sep 25, 2011

I have a asa5520 with five Internet IP.One for the internet interface and the others are static maped to dmz hosts. It runs rightly until yesterday.Now it will lose the connection to the gateway many times everyday and the dmz hosts can not connect to internet any time. configuration(simplified):
interface GigabitEthernet0/0
nameif internet
security-level 0


I called ISP to check,when ISP clear their router's ARP, the asa will lose the connection at the same time and then the ISP's router couldn't learn the ASA's MAC. After I 'clear arp' manually,The ISP's router can learn the ASA's MAC and the connection recovered,but the DMZ's cann't access internet still (of course,There is no problem between DMZ and ASA ,I ping the internet gateway from DMZ host and can not get any reply.).

View 2 Replies View Related

Cisco Firewall :: Upgrade 8.2.2 On ASA5520?

Oct 3, 2011

We have 2 x ASA5520 and I upgraded this to 8.2.2 last year, I see 8.2.5 and now 8.4 is out.  If we are having no issues, is it best just to leave it as it is?  I can see a couple of features I may find useful in 8.2.5, but 8.4 seems like a huge jump and a risky one too.

View 1 Replies View Related

Cisco :: Firewall ASA5520 Is Very Slow

May 8, 2011

I have one firewall ASA5520, are very slow

View 3 Replies View Related

Cisco Firewall :: Cannot Ping ASA5520 From LAN

Mar 7, 2011

I am trying to introduce an ASA5520 to my network based on the following diagram: ISP Internet ------> ASA5520 ------- > Cisco Router ------> LAN. The problem is I cannot ping the ASA from the LAN. I can ping it from  inside the router.  I already allow ICMP within ASA. If i remove the  cisco router and replace it by a swich, I can ping the ASA with NO problem.

View 5 Replies View Related

Cisco Firewall :: ASA5520 With Different CPU Type?

May 16, 2011

We want to use ASA5520 but both Firewall have different CPU. One has CPU Pentium 4 2400 MHz and another has Pentium 4 Celeron 2000 MHz. Can it be configured for replica / failover?

View 5 Replies View Related

Cisco Firewall :: LAN To LAN Between ASA5520 Version 8.3 And PIX?

Apr 19, 2011

We have 2 firewalls on PIX facing the Internet and connected to interface e1 (behind it) an ASA version 8.3 Both the PIX (Firewall facing) and the ASA are on the same subnet.
By using Routing statements and statics I have been able to reroute specific traffic to the ASA5520 version 8.3 Now I need to inverse the 2 devices. The ASA5520 will be facing the Internet and the PIX will be behind it.Unfortunately the ASA5520 is refusing to route the traffic to the PIX. The access-lists are open accordingly and a NAT on the ASA has been created.

View 2 Replies View Related

Cisco Firewall :: Client Uses ISP DNS Under ASA5520?

May 31, 2013

i have my router connected to ISP then my router directly connected to my ASA5520....i use also ASA5520 as my DHCP Server and i was wondering with the DHCP Server function of ASA 5520 because if i use the ASA 5520 LAN ip ...all workstation will not be able to browse anything from the internet unless i use my ISP DNS IP which they gave me?

View 3 Replies View Related

Cisco Firewall :: Using CSC SSM 6.6.1125.0 With ASA5520 8.4(4)1?

Sep 4, 2012

Get the following log message on secondary ASA console output when turning on the ASA failover function?
"Mate's service module (CSC SSM 6.6.1125.0) on slot 1 is different from mine (CSC SSM 6.6.1125.0)"
After that the secondary cannot join as a failover unit and shows in disabled status.We have the same model ASA & CSC module and each pair of them are in same firmware (CSC 6.6.1125.0 with ASA5520 8.4(4)1), when I shutdown both the csc modules, the ASA failover works fine.

View 8 Replies View Related

Cisco Firewall :: ASA5520 To Act As Web Proxy

Dec 15, 2012

I am using a squid proxy behind an ASA5520 firewall to collect the users to the internet. Squid is just necessary to log what is going on in order to find a quick solution when the internet slows down.
Considering that I have unlimited licenses and I would like to get rid of squid, I wonder if the ASA has some functionalities to track which websites are being used and how much traffic is generated. If there is not, I would like to know if Cisco offers a good product to replace Squid.

View 2 Replies View Related

Cisco Firewall :: ASA5520 Upgrade 7.2 To 8.4

Jun 8, 2011

Upgraded an ASA5520 from 7.x to 8.4 in one step? Release notes for 8.4 state that you can "...upgrade from any previous release directly to 8.4..."  I've read the previous version release notes and see the various changes in NAT etc that 8.3 made.

View 3 Replies View Related

Copyrights 2005-15, All rights reserved