Cisco Security :: 2x ASA 5510 With AIP-SSM And CSC-SSM On Each One

Mar 23, 2012

I want to ask for the possibility of configuration below? 2x Cisco ASA 5510 running Multi-Context mode and Active/Active Failover1 Cisco ASA 5510 (ASA 1) has AIP-SSM1 Cisco ASA 5510 (ASA 2) has CSC-SSMThere are 2 contexts, context A and context BASA 1 is the primary firewall for context A, and secondary firewall for context BASA 2 is the primary firewall for context B, and secondary firewall for context A 

Can AIP-SSM on ASA 1 inspects traffic of context B which primarily runs on ASA 2?Can CSC-SSM on ASA 2 inspects traffic of context A which primarily runs on ASA 1? 

View 2 Replies


ADVERTISEMENT

Cisco Security :: How Many Default Context In ASA 5510 Security Plus Edition

Aug 8, 2006

ASA 5510 security plus edition will it support active/active failover. and does it support context with securiyt plsu edition. and how many default context do we get with asa 5510 security plus edition.

View 3 Replies View Related

Cisco Security :: ASA 5510 - Upgrade From 7.0(6) To 8.2(5)

Aug 18, 2011

I want to upgrade my ASA 5510 from version 7.0(6) to 8.2(5).  Reading the release notes for 8.2(5) it says the DRAM requirement is 256MB unless you have high CPU usage. Also it says I need to upgrade through the major releases, from 7.0(x) to 7.1(x) and 7.1(x) to 7.2(x) and then from 7.2(x) to 8.2(x).  The questions are:
 
- My ASA has 256MB of RAM and 68% of free memory, would you think it will run the 8.2(5) version with no problem?
- When making the upgrades to the major releases, is there any consideration regarding the configuration file? Or the versions to use for the 7.1 and 7.2 versions?
- Would you recommend making all the upgrades in one maintenance window?  How much time could it take?

View 2 Replies View Related

Cisco VPN :: ASA 5510 - Security Plus License

Aug 21, 2012

We’ve ordered ASA 5510 with security plus license as below description: 

ASA5510-K8
ASA 5510 Appliance with SW,   5FE, DES
L-ASA5510-SEC-PL=
ASA 5510 Security Plus License   w/ HA, GE, more VLANs + conns
 
The license details on the appliance shows as the below,
Fail over                        : Enabled 
Encryption-DES                  : Enabled 
Encryption-3DES-AES             : Disabled
Security Contexts                : Default 
GTP/GPRS                        : Disabled
Any Connect Premium Peers      : Default 
Other VPN Peers                 : Default 
Advanced Endpoint Assessment    : Disabled
Any Connect for Mobile            : Disabled
Any Connect for Cisco VPN Phone  : Disabled
Shared License                  : Disabled
UC Phone Proxy Sessions          : Default 
Total UC Proxy Sessions          : Default 
Any Connect Essentials            : Disabled
Bot net Traffic Filter            : Disabled
Inter company Media Engine        : Disabled 
  
I’ve noticed that the 3DES is disabled, do I need to order another license to use 3DES or not ?Also, I need 2 ~ 5 branches to connect simultaneously and have VPN access on their laptops to the main branch via vpn software, which VPN software I should use and is our license enough or I should order another license.

View 3 Replies View Related

Cisco Security :: Upgraded PIX 525 Lately To 5510 ASA

Sep 26, 2012

i have upgraded a PIX 525 lately to a 5510 ASA, but i have faced a problem after this.One of the DMZ's are connected to a switch that is not connected to my VTP domain on a DMZ port.
 
with access-list to permit from host to host with all ports opened.my problem is that the outside client is able to initiate a windows VPN to a server that i have in the DMZ, BUT it disconnects after almost 10minutes. What might be the reason of the disconnection.Note, a cisco remote access VPN is also configured on the FW, and it doesnt disconnect.

View 1 Replies View Related

Cisco Security :: IOS VPN Endpoint Behind ASA 5510

Aug 2, 2011

trying to TS a VPN device that is behind an ASA basic set up is IOS VPN<firewall/nat<internet>ASA/nat>IOS VPN
 
I do not have a lot of insight into the other side of the connection, although the tech on the other side claims all is good. so to the point.
 
Is the asa capable of allowing this tunnel to work? The configs and debug follow.
 
1.1.1.1 = my public ip
2.2.2.2 = peer public ip
The asa -

[Code]......

View 2 Replies View Related

Security / Firewalls :: Using NAT With Cisco ASA 5510 Firewall?

Mar 25, 2011

I was under the impression that those global addresses that we used with NAT were from the outside IP addresses range?Lets say my outside IP address is idk 192.112.40.11 /30 and I only had two usable IPs (since you can't use network and broadcast IPs) so how would I set up NAT for a couple of Inside addresses with a shorting of addresses like this? Idk if that makes sense what I'm trying to say

View 3 Replies View Related

Cisco Security :: Monitoring ASA 5510 Tunnels

Sep 22, 2008

I'm trying to monitor Tunnels activity. We want to gather statistics like bandwidth utilization per Tunnel and in the case of Remote Access also the user name associated with a tunnel. All this via SNMP
 
I've browse through the Cisco-IPSec-Flow MIB and found the TunnelTable, this seems to provide everything I need in Regards to Tunnels, I just need a tip in how to calculate or obtain the bytes Tx and Rx. I can obtain packets and Octets amounts but not actual bytes. Is there another OID I should be inquiring?
 
In regard to Remote Access I found the CRASSessionTable From here I can obtain the Group associated with the tunnel and I should be able to obtain the User name through the 1.3.6.1.4.1.9.9.392.1.3.21.1.1 OID, but I'm getting an UnSupported response when querying this particular OID.
 
What OID can provide the User name?
 
I know that Cisco Performance Monitor can in fact obtain all that info from the ASA so there must be an appropriate OID I can query to obtain this particular info.

View 3 Replies View Related

Cisco Security :: ASA 5510 Client Static IP

Sep 28, 2011

I have a ASA 5510 that uses Radius for Authentication.  What I am trying to do is assign each user that logs into VPN to have a specfic static IP based on userid.  I have about 30 to 50 users.  I don't want to complicate this by having them select a different profile when logging into the ASA.  What is a clean and simply way to assign user static ip and not use local database for login?

View 1 Replies View Related

Cisco Security :: Replacing VPN Router With ASA 5510

Feb 20, 2011

I got a task to replace our current cisco 2800 series router which is used for easy vpn remote access with cisco asa 5510.I have a got a lot of users, i wish that user shall see no difference except of ip address they are going to use for remote login.

View 1 Replies View Related

Cisco Security :: ASA 5510 - Unable To Connect SSH?

Mar 12, 2013

I configured Cisco ASA5510 firewall, but i am facing the problem with ssh login, i gave ssh for inside and outside access, but i am getting "server ... error" i enabled LOCAL  for the authentication for ssh and HTTP. and i am able to acees the device through HTTP using ASDM, but not able to access from outside.
 
ASA Version 8.2(1)
!
hostname ASA5510

[Code].....

View 3 Replies View Related

Cisco Security :: Cannot Login To Firewall ASA 5510

Sep 1, 2012

i have in my network firewall ASA 5510 but the problem i cannot login to my firewall thru telnet or ssh even ASDM or bowser this is my configuration :
 
ASA Version 8.2(5)
!
hostname Amco-ASA

[Code].....

View 9 Replies View Related

Cisco :: ASA 5510 / Upgrade All Firewalls To Security Plus?

Sep 21, 2011

I am trying to upgrade all my firewalls to Security Plus but I am not sure what firewalls are needing the upgrade.  Is there a SNMP pull I can do to see what license is on my firewall?  example: "This platform has an ASA 5510 Security Plus license." via SNMP

View 1 Replies View Related

Cisco Security :: ASA 5510 Multiple Non-contiguous Blocks Of IPs?

Apr 30, 2012

Currently I have an asa 5510 set up with one block of outside IP addresses. Everything is working fine in regards to my initial setup. However we needed to purchase additional IPs from our provider and ended up being a whole complete different block. Where I am getting stuck is getting the new IPs to NAT to inside addresses.

View 2 Replies View Related

Cisco Security :: ASA 5510 - ASDM Software Won't Load

May 26, 2011

I've tried 3 different machines including a server.
 
Basically when I try to access my ASA 5510 with the ASDM software the software never loads.  So I have tried to access it through the management port https://192.168.1.2 and installed the software.  The software starts up, I enter the password and it connects and loads to 100% but doesn't go beyond that point.  I then try the java applet, and it as well loads up to 100% and says "Please wait, the main is coming up." 
 
I have http server enabled, and asdm image is pointed correctly
 
As I said, I've tried this on two Windows XP machines and a machine running Server 2008.
 
I can connect through CLI all day and all night, but I'd rather (read feel much safer) configuring it through ASDM. 
 
Here is some system version info
 
Cisco Adaptive Security Appliance Software Version 7.0(8)
Device Manager Version 5.0(8) 
Compiled on Sat 31-May-08 23:48 by builders
System image file is "disk0:/asa708-k8.bin"

View 4 Replies View Related

Cisco Security :: Change Ipsec Vpn To L2tp Over ASA 5510

Nov 14, 2011

i configurated ipsec vpn at cisco asa 5510. all them are working very well. now i want to change ipsec remote vpn to L2tp over ipsec.i have router, asa and 3750 switch. all nat translation are done at router , ipsec vpn configurate at asa.
 
this is my ipsec configuration. this is working config. as you see i do static nat asa outside ip for vpn at router. now i want l2tp over ipsec. before i do it i have some question
 
1. must i do static nat port  udp 1701 for l2tp over ipsec vpn?  can i write access list at asa to open port 1701?

2. can i remove this  static nat or i can not be change anything.is this nat is true for l2tp over ipsec vpn?
 
3.as you see user authentication from radius server at ipsec vpn. i also want this is same as l2tp over ipsec vpn..
 
4. i think that i must be add this addtional config. is this true? tunnel-group DefaultRAGroup ppp-attributesno authentication chapauthentication ms-chap-v2
 
is this config enougth for l2tp over ipsec vpn?? what is addtional config i need?

View 2 Replies View Related

Cisco Security :: 2911 Routers - Does ASA 5510 Support BGP

Jan 25, 2012

I have a new BGP configuration that consists of two asa 5510 and two routers 2911 at the back. My question is : Does asa 5510 support BGP?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Security For One Specific User

Jan 18, 2013

We have an ASA 5510 version 8.3 (2) that we accept VPN users via a radius server. Is there a way to lock down a specific user that connects to the ASA as a SSL client or IPSEC VPN user? If the specific user were to connect to the ASA, we would want the user to have minimal to not access to our system.

View 1 Replies View Related

Cisco Security :: Backup WebVPN Personalization On ASA 5510?

Apr 1, 2008

  I'm looking for a system to backup the configuration of the ASA like this I've noticed:
 
if the ASA is 5510 or higher and has sw 8.x and ASDM 6.x we have ASDM -> Tools -> Backup Configuration command that create a folder containing all configuration files and webvpn personalization
  
What I have to do to have the same command on ASA 5505 sw 8.x and ASDM 6.x? Or is there someting similar using the console too?
 
And what else for ASA which have sw 7.x and ASDM 5.x, is there the possibility to backup webvpn personalization?

View 2 Replies View Related

Cisco Security :: IPsec VPN Access-list At ASA 5510?

Sep 13, 2011

i configurated Ipsec vpn at asa 5510.

my inside ip 192.168.10.156
my public ip: 85.x.x.x 
my peer ip : 62.x.x.x
 
the project is that:the remote site want the interesting traffic like that:
 
source ip 172.16.1.104 can access destination ip 10.0.154.27
 
my inside ip is 192.168.10.0/0 and i can not to change it 172.16.1.0/24 and i can not to add this ip at my network.i do that way but i can not test it.
 
interface Ethernet0/0
nameif outside
security-level 0
ip address 85.x.x.x.106 255.255.255.248 standby 85.132.71.107
!

[code]....

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Difference Between CSC-10-PLUS And Security Plus License

Mar 3, 2011

I have ASA 5510. Is there any difference between CSC-10-PLUS license and Security Plus License...

View 3 Replies View Related

Cisco Security :: RDP Access For Remote VPN Client On ASA 5510?

Jan 17, 2011

We have configured site to site VPN tunnel from offshore to client location using ASA5510 and accessing RDP from client location. Also configured remote VPN access at offshore location. But using remote VPN client we are able to get RDP from officeshore location but not able to access RDP from client location. Is there any additional changes required ?

View 4 Replies View Related

Cisco Security :: CSCSSM 20 Module On ASA 5510 Causes 100 Percent Cpu Usage

Aug 13, 2011

I installed a CSC-SSM-20 module on ASA 5510. After policy services  have been enabled, services works well for a few minutes, after that the  cpu usage's module rise to 100% and all http traffic is wholy blocked,  till the cpu usage go down.This happens very frequently and  traffic stay blocked for such a long time that it makes the csc-ssm  module unusable. It's disabled right now. ASA version is 8.2(1)and CSC-Module version is 6.6.1172.0.

View 1 Replies View Related

Cisco Security :: ASA 5510 / Routing Http Flow On Two Different Interfaces?

Jun 21, 2012

I use 3 interfaces on an ASA 5510. First interface is Lan, Second interface is Outside, Third interface is ADSL The Outside interface is used for VPN L2L and smtp traffic. (Leased line on router managed by ISP)The Adsl interface is used for Http traffic. (Adsl Cisco router) I use this configuration found on another forum subjet for routing.route outside 0.0.0.0 0.0.0.0 x.x.x.x 1route adsl 0.0.0.0 0.0.0.0  y.y.y.y 2 nat (inside) 1 0 0global (outside) 1 interfaceglobal (Adsl) 1 interface static (Adsl,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0 The problem is now I have an www intranet server on the VPN remote site. How i can exempt the http traffic to the intranet server routed through Adsl interface?

View 7 Replies View Related

Cisco Security :: ASA 5510 Object-group And Range Option

Feb 6, 2013

I have 3 ASA 5510s; two of which are in production and the 3rd one is new. I inherited the two in production and was trying to configure that 3rd one using some of the existing object-group network statements.  The problem is that when I try to create a range of IPs in one of the object-groups; the range command is not available. Here is one of the statements extracted from one of the production ASAs:  object network REMOTE range 62.77.130.14 62.77.130.208.Both ASAs have the same image ver (asa842-k8).  Is there something that I am missing to be able to enable the range option on the new ASA?

View 2 Replies View Related

Cisco VPN :: 5510 IPSec VPN In Security Context / Shared Interface Or Not

Feb 17, 2013

I have at the moment an ASA5510 pair in Multiple Context configured. Everything is ok, but we use til now only ACL features.Now I would be interested in configuring 2 contexts, with IPSec VPNs. One VPN per context. But I cannot find any information if it would be possible to use a shared interface for both contexts. My wish would only be to spare public IPs.If I have to configure 100 VPNs in 100 contexts, do I need 100 public IPs ?

View 5 Replies View Related

Cisco Security :: Remove License Previously Installed On ASA 5510?

Nov 15, 2010

I'm currently reconfiguring an ASA5510 installation to a HA setup with a second 5510. The old 5510 has an "AnyConnect for Mobile" license which isn't being used. So we upgrade that one to a SecPlus License to enable failover posibilities and we bought a new 5510 also with a SecPlus license. When I'm trying to enable failover I get the message that my mate hasn't got the "AnyConnect for Mobile" license. I know for failover both devices must be exactly the same (at first i thougth that the AnyConnect license would be lost when upgrading to SecPlus). So now I'm wondering and searching for solutions to remove the AnyConnect license (because we don't use it).

View 7 Replies View Related

Cisco Security :: 5510 Allocate A Bandwidth Of 512kbps For Each Connect

Jul 29, 2011

Recently i had a requirement for implementing a Qos on one of my Mpls link which is of  2Mbps, the requirement was to allocate a bandwidth of 512kbps for each connect that comes in and 512 kbps for out going, and it is in ASA 5510 firewall.
 
So i have done the configuration successfully, now the issue is,  the bandwidth is limited to 512kbps only for all the connection,how many may be the connections,  it working below 512kbps,
 
But my requriemt was for the first connection, it should allocate 512kbps , and for the second another 512kbps so on.its not happening, the bandwith got struckup at 512kbps , all the connection are sharing this bandwidth only.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Bandwidth Management And Content Security

Sep 13, 2012

I have some clarifications regarding ASA firewall, it can be support bandwidth management and content security at the same time. we are looking for below features in ASA5510.
 
IP/Policy based bandwidth management.Controll the bandwidth and allocate the bandwidth to specified users or servers.Content Security.  If not, which device I need to set for Internet Bandwidth Management and content security.

View 3 Replies View Related

Cisco Security :: ASA 5510 - Internet Connections Dedicated VPN Traffic

May 22, 2011

We have an ASA5510 and we're currently using 1 internet connection to handle our site-to-site VPN connection and our internet traffic. We have a second internet connection on hand. What we would like to do it use BOTH internet connections: (1) will be dedicated to our VPN connection, (1) will be handling all our internet traffic. How can we get this setup? We're running Software Version 8.4(1)

View 1 Replies View Related

Cisco Firewall :: ASA 5510 With Security Plus License Lost Contexts

Jan 28, 2013

I have a ASA 5510 with Security Plus License and when I looked at the devices a few days ago I had 2 contexts, however after configuring the Mgm port as a regular port the contexts show 0, why?  I can not find any post on the internet where this issue has happen:  here is the output from show ver:

Cisco Adaptive Security Appliance Software Version 7.0(8)
Compiled on Sat 31-May-08 23:48 by builders
System image file is "disk0:/asa708-k8.bin"

[Code]......

View 3 Replies View Related

Cisco Security :: 5510 Doesn't Save Config And Disk0 Error

Jan 3, 2013

my Cisco ASA 5510 doesn't save the  configuration to the disk.

View 1 Replies View Related

Cisco Security :: Disabling XAuth For Remote VPN Users On ASA 5510 Version 7.2(1)?

Jul 1, 2006

how to disable XAuth for Remote VPN users on the ASA 5510 running 7.2(1)? 
 
HPMFIRE(config)# tunnel-group vpn3000 general-attributes
HPMFIRE(config-tunnel-general)# authen
HPMFIRE(config-tunnel-general)# authentication-server-group none
ERROR: The authentication-server-group none command has been deprecated.
The isakmp command in the ipsec-attributes should be used instead.

--[code]....
 
I couldn't find anything under isakmp to disable it. 

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved