Cisco VPN :: 5510 - AnyConnect Backup Server When Session Limit Hit
Mar 21, 2012
Is it possible for AnyConnect to utilise the backup server defined in the connection profile when the session limit is hit on an ASA? Essentially if I hit the 250 limit on my ASA 5510 in Region A, will it try the backup server ASA defined in the connection profile which is in Region B?
From what I have read, the backup server only kicks in when the AnyConnect client cannot connect, but in this scenario it will connect but get an error message.
View 1 Replies
ADVERTISEMENT
May 29, 2012
ow to backup Cisco ASA-5510 from a Linux server via TFTP?I do know how to backup a switch or a router. Basically creating an access list such as:
access-list 55 remark PERMIT hosts requesting TFTP access
access-list 55 permit host 172.16.0.27
and allowing access to
tftp-server nvram:startup-config 55
all this inside the router or the switch. From the Linux box just running a simple command such as:
tftp 172.16.0.3 -c get startup-config newbackup.conf
where 172.16.0.3 is the IP address of the switch and newbackup.conf is the name of the config file stored on the Linux machine.So, how do I do that with an ASA box? how to backup ASA from inside it.
View 1 Replies
View Related
Jul 12, 2012
I have a need to capture some traffic but my core 6513's are already using the limit of 2 span sessions. I can't edit any of the sessions either because I want to source traffic from vlans and you can only do one or the other. Is using a VACL with 'switchport capture' on the destination interface an option ? E.g. I want to source traffic from vlan 10,20,30,40 and send the all to interface Gi10/10 ? Is there any caveats ? I dont need to be too granular with the ACL's but just capture all traffic in those vlans.
View 2 Replies
View Related
Feb 22, 2013
Need deployed accounting method to log Anyconnect session details ? Do you do it via a radius server or via logging messages to a syslog server ?
Any appropriate configuration ? I am looking to log successful and unsuccessful authentications as well as session length, log on and log off times.
I've been playing around with Anyconnect authenticating to AD via ACS 5.1 but can't seem to get the accounting details I require. Similarly I have tried to catch appropriate syslog messages but again without much success.
View 4 Replies
View Related
Apr 5, 2011
How to terminate a vpn session on the asa 5510, when u issue the command sh vpn-sessiondb remote?
View 1 Replies
View Related
Oct 7, 2012
I am able to establish a single VPN session on an ASA 5510. The network is as follows:Cisco 2600 router----> ASA 5510---->non cisco UTM----> LAN.Once another session is connected (same profile different username) is connected the first one disconnected.
View 2 Replies
View Related
Sep 11, 2011
My company has a cisco ASA 5510 and we have a Citrix remote desktop solution. In a nutshell I have users from outside our network accessing a virtual Citrix NetScaler inside our DMZ. There is a session reliability feature enabled on the Citrix solution. Session reliability uses tcp port 443. A user from outside the network connects to our network and is handed a virtual desktop to work with. When a remote user is working on their virtual desktop and there is a network connection issue the end user loses network connectivity for a brief period of time (in most cases just seconds) then the Citrix session reliability feature takes over and holds in a buffer all data destined for the end user . Once the connection is re-established then the buffer is emptied and the session goes on like before and the end user is able to use the virtual desktop. At least this is the way it should work.
In our case the connection never re-establishes between the end user outside the network and the NetScaler in our DMZ. We have been working with Citrix Support and they believe the issue is in our firewall. We have taken packets captures with Wire shark and we can see when the network failure occurs the NetScaler in the DMZ is holding information in a buffer and trying to communicate with the remote end user outside our network via packets and TCP port 443. We can also do the same packet captures from the end user computer and see where it is not receiving any packets from the NetScaler in our DMZ. The fire wall has an access list allowing any traffic in the outside port destined to the NetScaler Public IP on port 443. Then once in the firewall outside port we have a static rule pointing to the NetScaler IP in the DMZ.Everything is working quite well until we need to rely upon the session reliability. We have tried altering the TCP & Global Timeouts options in the firewall via the ASDM with no luck.
View 1 Replies
View Related
Sep 11, 2011
How can I check I have the right vpn time on a VPN client session on a asa 5510 , and how can I modify it to more time...
View 3 Replies
View Related
Jun 2, 2012
What command sequence disconnects you from a TS session? My setup is as followsr1 > TS > 2009-2621XM 2010-3825-R1 2011-3825-R2I can connect from the TS to any of the devices. The issue is that I am telnet'd to r1 and from there telnet'd to the TS. So when I type "Crtl+Shft+6, x" I go directly back to r1 and not the TS. Furthermore if I resume the session on r1 the TS is still connected to whatever session I was in prior to disconnecting. I've experimented with the disconnect and escape characters but I'm at a loss what it is that changes this.
View 4 Replies
View Related
Dec 14, 2010
I've been reading that the Windows Server Backup that is included with Server 08 R2 is pretty good. Is spending $400 on a third party utility worth it?
I'm asking because we're purchasing a new server soon and I want to know if the included backup is going to be good enough. Will be backing up server state as well as data to tape and possibly an off site server (server 2003) if I get my way.
View 19 Replies
View Related
Dec 9, 2012
I have an ASA 5510 running 8.4 with dual ISPs setup on 2 different interfaces: outside(primary),backup(backup). I also have a site to site VPN to another ASA in another city. The VPN is now setup on the outside interface and works fine. What I wanted to do is to make the VPN run over the backup interface only.
So, I modified the the crypto map on the remote side to use the backup interface IP and created a tunnel-group for it. I then created a crypto map for the backup interface and enabled ikev1 on it. The default route is set to use the outside interface so I created a static route that routes traffic bound for the outside interface on the remote side to the backup interface default gateway. I can get the tunnels to establish but no traffic is passing through them. I though then that I need a NAT for the tunnel traffic to I created a NAT as well but still no traffic passed. I tried the packet-tracer and it said the traffic was allowed and from the show crypto ipsec sa command I can see the tunnel setup but no traffic will go across it.
View 5 Replies
View Related
Jan 17, 2012
I'm trying to limit one of my inside hosts, since it's been a little of a hog. I have 3Mb available from my ISP via 2x T1. I'm testing this on a computer in a lab:
PC 10.10.10.10------Cisco2960-------- 10.10.10.1 Inside - ASA - Outside 208.66.x.1------------------------208.66.x.2-Cisco 2811-2xT1
Here's what I've tried so far, please see text in red:
***global (outside) 1 208.66.x.115
***nat (inside) 0 access-list No-Nat
***nat (inside) 1 0.0.0.0 0.0.0.0
[Code].....
It didn't work... I was able to max the bandwidth again. I also tried to apply service-policy to inside int, which didn't make a difference.
View 1 Replies
View Related
Apr 5, 2011
I would like to setup backup ISP in our ASA5510. Right now the the firewall has for default gateway following command:
"route outside 0.0.0.0 0.0.0.0 114.324.321.33 1" i am changing this to route outside 0.0.0.0 0.0.0.0 114.324.321.33 10 track 1 ...so i can setup sla monitoring. As soon as i do the above command and remove the original "route outside 0.0.0.0 0.0.0.0 114.324.321.33 1" from asa then internet connection drops. Right now asa interface Ethernet0/0 has main isp configured and configuring interface Ethernet0/3 as backup. interface Ethernet0/3 name if backup security-level 0 ip address 114.324.321.34 255.255.255.252 no shut global (backup) 1 interface.
route outside 0.0.0.0 0.0.0.0 114.324.321.33 10 track 1 ( Right now in firewall i have" route outside 0.0.0.0 0.0.0.0 114.324.321.33 1 " ) route backup 0.0.0.0 0.0.0.0 115.283.212.23 20 track 2
track 1 rtr 1 reach ability
track 2 rtr 2 reach ability
sla monitor 1type echo protocol ipIcmpEcho 114.324.321.33 interface outside sla monitor schedule 1 life forever start-time now sla monitor 2type echo protocol ip Icmp Echo 115.283.212.23 interface backup sla monitor schedule 2 life forever start-time now. Also our firewall has site to site vpn and 1 main ip configured for exchange and remote access.
View 4 Replies
View Related
Jul 7, 2012
i have user connected to office using Cisco vpn client , Cisco asa 5520 acts as vpn gateway, frequently the users got disconnected from the server while the VPN still established and not disconnected!
what is the cause of the issue , where the fault is located ? how to start the troubleshooting to figure out the issue?
View 1 Replies
View Related
Apr 3, 2012
I am facing problem connecting via vpn to my asa5510 using anyconnect.My anyconnect client shows "network access: unavailable - no networks detected" before i attempt to establish my vpn.Upon establishing vpn, i was prompted username and password which went through but i was given the error "anyconnect was not able to establish a connection to the specified secure gateway. Please try connecting again".I face this problem after replacing my pc. I was able to connect without problems on my previous pc.The vpn connection uses cert which i have already import to my new pc and authentication is fine since no authentication error. No changes made on my firewall.
View 1 Replies
View Related
May 23, 2012
I have an ASA 5510 I'm trying to use as an SSL VPN provider. I have Anyconnect windows and mobile licenses from Cisco. I'm looking for a straight forward configuration guide to use. Right now I only need to iPhone and Android clients to work with the VPN, but in the future we might add windows clients.
I was going to use this guide: [URL]. Until I talked to Cisco tech support, they recommended I use the following:[URL] Which is a lot longer and a bit unclear about the whole process, and also points me to this guide:[URL]Which is longer still, and not applicable for the most part.So, what's going to be the best guide to use? Did I have it right the first time? Do I need to go to another site to find something?
View 1 Replies
View Related
May 17, 2011
we have ASA 5510 with IPS and base license. Now we need Anyconnect support for more than 2 users.
Is for Anyconnect (tunnel-mode) only the Anyconnect Essentials license enough? Do I need a license for SSL VPN peers? What about Anyconnect clientless, I see that I need a premium license? Is this one enough ASA5510-SSL50-K9? It is really expensive in comparison with Anyconnect Essentials.
Here is my sh ver output:
Licensed features for this platform:Maximum Physical Interfaces : Unlimited Maximum VLANs : 50 Inside Hosts : Unlimited Failover : DisabledVPN-DES : Enabled
[Code]....
View 7 Replies
View Related
Apr 17, 2013
I have an internal application which requires operators to have a static IP address. I'm looking for a way to do this for our VPN users. At the moment they are given a random DHCP address from a pool. Is there an easy way to get a static address assigned to VPN users on a Cisco ASA5510 any connect VPN?
View 3 Replies
View Related
Nov 12, 2012
We have a 5510 and I have a second ISP setup for a backup link. We have 4 ports connected to 4 different internal subnets. I want to force one of the ports to use the backup ISP link at all times. I'm having a little problem with where I need to make the changes in my ASA.
Interface "outside" is my main ISP
Interface "building3" is my backup ISP.
I want to force the "Guest" network to use the "building3" link for all traffic. Here's a snippet of my config
global (outside) 10 interface
global (building3) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 0.0.0.0 0.0.0.0
nat (Guest) 10 0.0.0.0 0.0.0.0
[URL]
Do I need to change the global pool or create a new one? I have a couple free public IP addresess on the building3 subnet I can use for a pool.
View 2 Replies
View Related
Mar 4, 2011
I have two ISP circuits and the following devices in hand:
1. Cisco ASA 5510
2. Cisco 2800 router
3. Cisco 3750 switch
I've finished a part of the configs on above equipments, please refer to the attached diagram.And I'm making a test in order to achieve the below features:
1. By default, packets from PC1 go out through ISP 1. Packets from PC2 go out through ISP 2
2. When ISP 1 is down, packets from PC1 changed its way to ISP 2 through the 2800 router. And when ISP 2 is down, Packets from PC2 changed its way to ISP 1 through ASA 5510.
View 2 Replies
View Related
Apr 1, 2008
I'm looking for a system to backup the configuration of the ASA like this I've noticed:
if the ASA is 5510 or higher and has sw 8.x and ASDM 6.x we have ASDM -> Tools -> Backup Configuration command that create a folder containing all configuration files and webvpn personalization
What I have to do to have the same command on ASA 5505 sw 8.x and ASDM 6.x? Or is there someting similar using the console too?
And what else for ASA which have sw 7.x and ASDM 5.x, is there the possibility to backup webvpn personalization?
View 2 Replies
View Related
Nov 1, 2012
I am working on an ASA 5510 on 8.4 IOS and need to know how to limit icmp to just a single host? What I would like to do is be able to PING from the Inside interface 10.X.X.X to host 4.2.2.2 on the Outside, but thats it no other host would be PINGable.I tried MANY different access-list statements but the only way I can get icmp out and working is using the "fixup protocol icmp" but then everything is PINGable and the ASA does not block anything.
View 3 Replies
View Related
Oct 29, 2012
We have Cisco ASA 5510, I am about to add another 2 Objectgroup network groups on the firewall to our already growing list. Under this Object-group Network xxxx , we are planning to add about about 500 network-object host xxx.xxx.xxx.xxx . This objectgroup will then be applied to an ACL. Just wanted to know if thats possible - meaning addnig 500 hosts? If it is whats the limit?
Also are there any other things to keep in mind before i go-ahead with this huge object group?
View 3 Replies
View Related
Dec 2, 2011
Can anyconnect clients and cisco vpn ikev1-2 clients use the same certificate on an ASA 5510 ?
View 4 Replies
View Related
Jan 24, 2013
We have an ASA 5510 running 9.1 and the latest 3.1 AnyConnect package for Linux. The problem that i am having is that the AnyConnect VPN will drop after maybe 30 seconds or less of connection. It will connect fine. I can ping my remote servers. Then it will drop and go into a "Reconnecting State". Of which it will not reconnect. I have to close AnyConnect and then try to connect again. Then I'll get the same results. We have about 25 employees that use the AnyConnect VPN all day on Windows 7 machines without any problems. The issue appears to be isolated to my Ubuntu laptop. I have gone so far as to completely reinstall Ubuntu, both 64 and 32 bit versions but end up with the same results.
View 2 Replies
View Related
Dec 26, 2012
I have configured an Asa 5510 as SSL vpn gataway ver 8.2(4) Anyconnect Essential. The clients are authenticated via Radius and OTP password.All work well since yesterday. When I have did same configuration changes. My objective was has that the clients accept the self signed certificate issued by the Asa whitout give the warning about the private cert.
So I have try to generaste a new certificate with FQDN equal to myasa.mydomain.com and also a CN=myasa
Then I have change the profile XML file of my anyconnect in this way: [code]
View 1 Replies
View Related
Apr 23, 2012
I have a PC at home which is dedicated to one specific task, and need it to be connected to our company VPN at all times. This PC gets accessed by another remote worker (RDP), through the VPN.
This works fine with the PC at my home office connecting via the Anyconnect client... for a few days, then mysteriously disconnects and doesnt automatically reconnect, with the following Anyconnect error;
"The vpn connection to the secure gateway was disrupted and could not be automatically re-established. A new connection is necessary, which requires re-authentication".I have to manually reconnect and re-enter the password, after which it connects fine.
I have looked on the central ASA5510 (which all clients connect to) and set the idle timeout to unlimited for the appropriate AnyConnect profile and group policy, I cant seem to find any other settings to allow it to stay 'always on' from the client.
I am wondering (but am not sure if this is the problem) if it is perhaps because I am on a normal home broadband connection, which uses a dynamic IP, not static. My ISP (Sky) cannot provide a static IP for my public interface..
View 1 Replies
View Related
Jan 11, 2012
We have a SSL Gateway setup with the anyconnect client.We have picked up on some of the Windows 7 Tablets that you can install via the web page.Once installed you are connected to the network.However once you disconnect, and try with the anyconnect client u get the following error;
" Anyconnect was not able to establish a connection to the specified secure gateway. Please try connecting again"
We have not seen this on any of the Windows 7 laptops nor Windows XP.
The URL have been added to the trusted zones.We have gone as far to disable anti-virus / windows firewallDisabled the "Protected mode" with in internet explorer.
Anyconnect client version 2.5.3055..ASA 5510 Serial number JMX1504L05Y - ver asa841-k8
View 2 Replies
View Related
Apr 9, 2012
II have a management network 192.168.5.x and VPN network 192.168.25.x. I can ping a all my network elements except to firewall (ASA5510). The ASA has the IP 192.168.5.1. I think that the firewall has some restriction but I don't know. I have 8.2 software and any connect 3.0 and work fine. If I am in the management network (192.168.5.7), I can ping to firewall. The restrict is with the VPN network.
View 4 Replies
View Related
Feb 20, 2011
I have a problem with my AnyConnect clients connecting to an AD network via a 5510. Anyconnect VPN clients provide AD plus a one time passcode to authenticate to the 5510. This works fine apart from 3 things:
1. Once the VPN session has been established the user is further prompted for AD credentials when accessing an AD share for the first time. Once they provide the credentials the share can be accessed. Should the AD credentials not be passed through when the VPN connection is established? Or is this by design? What makes me think it's not be design is the fact that this could be related to problem 2.
2. Group Policy Update (windows gpupdate) fails. This again suggests to me that the full client/server relationship is not fully in tact.
3. In order to get Outlook to connect to exchange I've had to change Outlooks security settings from Negotiate (which would naturally choose Keberors), to NTLM. Not sure if this is related or not.
Note: DNS is functioning with out any problems
Maybe the first 2 issues are by design, but I thought the whole idea behind the AnyConnect VPN was that the remote machine would function as if connected to the LAN?
View 1 Replies
View Related
Apr 8, 2012
I am trying to load the anyconnect VPN client package v3 for windows and Mac on ASA 5510. The ASA has 256MB for RAM and Flash. After I uploaded pkg files and selected the 2 files and applied from ASDM, ASDM spots responding...
I tried to tftp the running config from ASA to my laptop to analyse but got "No memory available" message...
So it seems like the "unzip" process of the pkg files used up memory... what is really the requirement of the mini Memory/RAM on ASA for hosting anyconnect Clients for 2 OS platform? Requirement on Cisco web site is kind of vague.
View 4 Replies
View Related
Feb 21, 2013
I am just getting more confused the more I try to work it out. Not sure if this goes in the IP Telephony section or here. We have an ASA 5510 with the base license. We are needing to install IP Phones at remote workers homes, and I understand there are Cisco IP phones which have VPN clients built in to allow a tunnel to the central private network. IT appears that you can only use Any connect VPN for this, ans I am trying to work out what licensing upgrade we need to apply to the ASA, as the two Any connect licenses you get free on the ASA is not enough.
This is the phone we are looking to get; {URL} . What I want to know is will the Any connect Essentials license work with these IP phones? When I do a show version,
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 50
Inside Hosts : Unlimited
Failover : Disabled
[code].....
This platform has a Base license. It shows "Any Connect for Linksys phone : Disabled", is this the same for Cisco IP Phones? Is this the specific licensing type I should be looking to get for Any connect on IP phones or will Essentials do?
View 4 Replies
View Related
Nov 21, 2012
if i enable Controller Configuration Backup is that included in the server backup? and can the controller configs be specifically extracted from the server backup?
View 8 Replies
View Related
