I have a trouble with 2 IPSec tunnels on Cisco ASA 5510.Both of them are Site-to-Site tunnels.Both of them are established against the same public IP address on my site.It looks like they cannot run steadily in the same time. It looks like when one of them is actived, the other one could not be up.Is it some kind of limit of Cisco ASA?
View 6 RepliesI'm trying to monitor Tunnels activity. We want to gather statistics like bandwidth utilization per Tunnel and in the case of Remote Access also the user name associated with a tunnel. All this via SNMP
I've browse through the Cisco-IPSec-Flow MIB and found the TunnelTable, this seems to provide everything I need in Regards to Tunnels, I just need a tip in how to calculate or obtain the bytes Tx and Rx. I can obtain packets and Octets amounts but not actual bytes. Is there another OID I should be inquiring?
In regard to Remote Access I found the CRASSessionTable From here I can obtain the Group associated with the tunnel and I should be able to obtain the User name through the 1.3.6.1.4.1.9.9.392.1.3.21.1.1 OID, but I'm getting an UnSupported response when querying this particular OID.
What OID can provide the User name?
I know that Cisco Performance Monitor can in fact obtain all that info from the ASA so there must be an appropriate OID I can query to obtain this particular info.
I have an ASA 5510 running ver 8.0(2) that has (4) Ipsec tunnels going from it to various other locations. I am having an issue with data transfer speed on only one of the Tunnels. This tunnel is between the 5510 and the 5555, on that link I am getting a dat transfer rate of a little over 120k a second, whereas if I pull the same set of files from another location I am seeing a transfer rate of 5m per second.
I have verified that it is not a capacity issue on the Internet bandwidth on both locations, and I can pull the same data from the same location to various other locations via Ipsec tunnels, I am only having an issue with a specific tunnel going from the 5510 to the 5555.
Since it is not affecting other tunnels on the 5510 nor is it affecting tunnels on the 5555 going to other locations, I am leaning toward a routing issue within the ISP? I will say the ISP is taking me a long way around to stay in the same Metropolitan area.
I have an ASA 5510 at Site A with a L2L tunnel to another site, Site B. Single subnet at each site. In a few weeks we will be adding a second Internet connection to Site B, so both connections will be active. But we want traffic to go over the new connection unless it goes down, then use the other. How do I set that up on the ASA so it doesn't get confused as to which tunnel to take to get to the Site B subnet?
View 5 Replies View RelatedI tried to monitor via SNMP my ASA 5550&5510 my Active IPSEC tunnels , I want to receive Bandwidth for each tunnel interface.I’m running Version 8.2(1)? which OID to use?
View 3 Replies View RelatedDue to special circumstances we have 2 ISP links on an ASA5510. I am trying to terminate some L2L VPN tunnels on one link and others on the second ISP Link, eg below:
LOCAL FIREWALL
crypto map outside-map_isp1 20 match address VPN_ACL_Acrypto map outside-map_isp1 20 set peer 1.1.1.1crypto map outside-map_isp1 20 set transform-set TS-Generic
crypto map outside-map_isp2 30 match address VPN_ACL_Bcrypto map outside-map_isp2 30 set peer 3.3.3.3crypto map outside-map_isp2 30 set transform-set TS-Generic
crypto map outside-map-isp1 interface ISP_1crypto map outside-map-isp2 interface ISP_2
crypto isakmp enable ISP_1crypto isakmp enable ISP_2
route ISP_1 0.0.0.0 0.0.0.0 1.1.1.254route ISP_2 3.3.3.3 255.255.255.255 2.2.2.254
Establising the VPN tunnels in either direction when using ISP_1 works fine establishing in either direction from remote access users and multiple L2L tunnels (only showing one for example).
On ISP_2
1. Peer 3.3.3.3 device establishes a VPN tunnel, but the return traffic does NOT get back to devices on 3.3.3.3 tunnel.
2. The local firewall does NOT establish a VPN tunnel going to 3.3.3.3
It would seem to indicate that the problems lies with this multihomed firewall not directing the traffic correctly to either return down and establised VPN tunnel (point1) or to intiate a tunnel if none exists (point 2).
Reconfiguring the VPN tunnel peer for 3.3.3.3 to be on ISP_1 of the local firewall, all springs into life! There are sufficient license etc...
I am setting up a network that will use the 1941 router with a cellular card (HWIC) to connect to the Internet for communication with remote stations in the field. The 1941 has a static IP address (166.142.xxx.yyy) on the Internet provided by the ISP (Verizon). The 1941 is connected via ethernet to the ASA5510. The end goal is to have the field cell routers (Digi Transport WR-44-R, also static IP) connect to the ASA5510 via VPN tunnels for communication back to the servers behind the firewall. I'm not sure exactly how to configure the 1941 so that the remote router can connect to the ASA using the public IP of the 1941 router. I have the 1941 working stand alone and can connect to the Internet and pass traffic, but I tried a static NAT to translate the public IP to the private IP of the ASA and cannot pass traffic. below is part of the 1941 configuration: [code]
Do I need to use VLAN bridging to accomplish the task or am I missing something with the NAT?
Somehow in the process of researcing how to add my new laptop to the router, the router quit working and is now just blinking the blue panel lights.I was attempting to download Cisco Connect to my flash drive and instead it began to execute and I aborted that in about 10 seconds.
View 1 Replies View RelatedI have been working on my ASA 5510 version 8.2(1) trying to change the maximum connection time. Originally the custom "Group Policy" for IPSEC (Remote Access VPN) was set to inherit the settings from the default system Group Policy (DfltGrpPolicy). The custom group policy for the sake of this discussion is called "ABCD". I have modified the settings on the default (DfltGrpPolicy) as the custom policy (ABCD) was inheriting the configuration from default to disconnect after 1200 minutes. I changed the setting "maximum connection time" to 1200 minutes. I saved the configuration and what not then connected my VPN client, after two (2) hours I was disconnected. Something just doesn't add up.
I went ahead and deselected all inherited properties and manually configured them for the ABCD custom policy. No longer was the ABCD custom policy configured to use the inherited properties/settings. I saved the configuration again tested but instead of having a 1200 minute connection limit, I have 120 minute connection limit. Inside Monitoring --> VPN --> Sesssions : I can click on my session and see Session details". The Group Policy and Connection Profile properly list the "ABCD" custom profile. However, the "Conn Time Out" setting is: 120 minutes. I am completely stumped as to what is going on.
In the actual running config I see:
group-policy abcd attributes
banner none
wins-server value 123.123.123.123
dns-server value 123.123.123.123
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 60
vpn-session-timeout 1200
What I need to do next to get this working short of a recycle of the ASA.
How can I check I have the right vpn time on a VPN client session on a asa 5510 , and how can I modify it to more time...
View 3 Replies View RelatedI have an issue on an ASA 5510 that I have noticed today, when I am using the log viewer all of the information recorded only shows the high end source and destination ports. For example
Source IP 10.10.4.69
Source Port 59886
Destination IP 8.8.8.8
Destination Port 59866
So what seems to be happening is that I am seeing only half of the connection in the log viewer, I see the side with the high end ports and not the side with the ports the application uses, this example was done with a ping. All my services are working correctly and the client sending the ping gets the response expected, it just seems I have lost the logging display?
I'm new to an ASA 5510 running 8.4(3) and am trying to figure out something regarding time ranges in ASDM. I simply want to allow a single port during business hours only (I'm not concerned about open sessions needing to be closed). So as an example I add a rule something like:
(RULE1 on the internal interface) SRC=INTERNAL DEST=ANY SERVICE=RDP ACTION=PERMIT with a time range set for weekdays 8:00-16:59. I did a test after 5pm on a weekday and was still allowed to do RDP to a server (from INTERNAL), and after using the packet trace tool saw it was still passing through due to a rule a couple lines down (rule 4) that allowed a port range that happened to include port 3389. So my question is if I specify an "allowed" time range and someone attempts access outside that time range, why doesn't it drop it right there? I guess I'm assuming that anything outside the "allowed" time range would be dropped but that doesn't seem to be the case. I'm also assuming the rule base is processed top to bottom.
I have a new ASA 5510 running 8.3(1) and ASDM 6.4(5)
I am trying to use the real time log viewer to troubleshoot some access issues, but I am getting delays of up to 30 seconds or more between my client connecting to the ASA and the corresponding events showing in the RT Log viewer. I am using a simple filter for source IP as it's quite a busy device.
I've seen an article that says to turn off certain logging IDs (such as 304001 from memory) which I have done, but no different.
I have one 2621 router i want to creat time base access list so that one of my subnet user(10.128.194.0 255.255.255.128) use only internet between 11am to 2pm.
View 15 Replies View RelatedI just bought a WAP321 Wireless AP. I wonder why it cannot sync with our time server automatically. Every time I reboot it, the system time become "Fri Dec 31 1999 12:00:00 UCT". I have to do the sync manually by clicking on the "Save" button under the menu Administration > Time Setting.
View 5 Replies View RelatedCiso 1941 router frozen once a day, sometimes after 2 to 7 days. When the router frozen, no internet connection and cannot login/ping ethernet ports. I can login to console port and copy the error messages below. Reload the router and it will return back to normal operation. Re-installed IOS but still the same.
IOS Version 15.1(2)T2,
Cisco CISCO1941/K9 (revision 1.0) with 487424K/36864K bytes of memory.
DRAM configuration is 64 bits wide with parity disabled.
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash 0 (Read/Write)
[code]...
I have WRT54G2 router. All settings are more-less default and the behavior is following.You start up the router. If you do not connect wireless device within 10 minutes, then you have to restart the router.You have assigned IP via wifi, and when you connect cable device to the router, the wifi PCs are disconnected.
View 3 Replies View RelatedI recently purchased a X2000 ADSL modem/router combination. For some reason the current time will not stay set to the time zone. Rebooting clears the discrepancy for a short time before it drops an hour exactly. I'm in the central time zone and the setting are correct on the basic setup.?
View 1 Replies View RelatedIs the WAG320N iPv6 compatable ? ,or could it be with a firmware update ?.Is the X2000 in the same boat in iPv6 terms as th WAG320N ?.Is there a way of retrieving "UPTIME" / "DSL connection time" information from the WAG320N and also line attenuation stats etc.Wouldn't need the above but poor isp needs keeping an eye on.
View 3 Replies View RelatedAI have a Dir-825 router. The 5GHz is turned off and the wirless is on G/N. I have shawcable for my isp and my firmware is 2.06 and its a Rev B Router. I also have Qos Engine on for allowing me to have 2 xboxes on Open NAT.problem is my wireless signal for some wired reason is VERY weak. A while ago it used to work really far way outside. It was around 150ft distance at 4 bars. Now for some reason I can't even go upstairs without getting a 1 or 2 bar signal.
View 3 Replies View Relatedi have had my dir-655 one year now, have never had wireless problems with it until now.my notebook's internet gets very slow somedays, i just restart my router and then internet speed works normally.i have:
Hardware Version: A4 - Firmware Version: 1.32EU
My ASA's have the follwing Versions: ASA Version 8.4(3) ASDM Version 6.4(7)Have I a chance to configure a site-to-site tunnel with a hostname as peer address when I will use Identity and CA Certificates?
View 2 Replies View RelatedI set up a full mesh LAN-to-LAN VPN for a client with 4 sites. Each site has an ASA 5505 running 8.2(5). Site-to-site VoIP traffic runs in the VPN tunnels, as well as traffic to/from a file-server located at the main site. There are two back-up servers, one at the main site and one at a remote site. The main site has 2 bonded T1s and the other three sites have a single T1. How should I go about setting up my QoS?
My top requirement is that VoIP traffic will never be pushed out of the way for data traffic. My secondary consideration is to give more preference to file-server traffic than to web traffic and to make back-up traffic the least important. I'm currently researching to see if the VoIP provider is DSCP marking EF on the VoIP traffic, but I am going to assume they are for now. I know the IP of the file-server and back-up servers.
Is there a recommended number of GRE tunnels that Cisco 2921 ISR router with default configuration (512MB DDR2 ECC DRAM) can support?
View 5 Replies View RelatedI have read that the cisco 1841 can handle up to 100 VPN tunnels by default. Can this IOS version handle SSL VPN tunnels as well?
View 3 Replies View RelatedConfiguring MPLS over GRE tunnels. I did not find any proper configuration example. I need to do this for encrypt the traffic between two PE routers. I have 7609 routers.
View 20 Replies View RelatedI am trying to setup a VPN tunnel between a PIX and an ASA. I went through the IPSec Site to site wizzard using the same settings but I cannot ping hosts from either side.
Here is the setup
ASA 5520
Device Manager 6.4(5)106
Software version 8.0(5)
Inside network 10.0.0.0/24
Inside IP 10.0.0.1
[code]....
I have an ASA5515 and our remote sites which have a mesh topology of VPN. At some times of the day router to particular links are down do to the ISP core, but the tunnels from the same firewall can communicate to other sites. Is it possible to have a way where you could route traffic to another ASA which has a connection to both the ASA which want to communicate and have the traffic hairpinned, I know this is possible but is it possible to make this automated.
View 5 Replies View RelatedVPN Tunnels Monitoring on ASA5510 with IOS 7.0 (Monitoring through Nagios Server).I want to use Nagios to monitor each of the S2S Tunnels built on ASA 5510. I can use the icmp on Nagios by adding Nagios host in IPSEC network of each tunnel but in that case the change needs to be done at other end of Tunnel as well.
View 2 Replies View RelatedI have a Cisco 1921 and it has 2 VPN IP-sec site-to-site tunnels up and running. Lets say the tunnels goes from the Cisco to Site A and Site B.
Now i want Site A to reach Site B through the existing tunnels. I'm guessing that static routes maybe the answer but i cant seem to get it working.
The LAN networks is as follows:
Cisco: 192.168.15.0/24Site A: 192.168.0.0/24Site B: 10.27.27.0/24
At Site A i have set up a static route as follows:
Traffic destined for 10.27.27.0/24 Go to gateway 192.168.15.1 (the default gateway of Cisco LAN)
At Site B i have set up a static route as follows:
Traffic destined for 192.168.0.0/24 Go to gateway 192.168.15.1 (the default gateway of Cisco LAN)
We have multiple sites that have either fiber 20mb d/u or cable 50/10 d/u. Recently we have upgraded our head end router to a 2921 security based router and noticed that no matter if we are sending or receiving the most we can push is 1.6Mb. I would expect this number to be at least 8Mb for uploading and at least 18mb for downloading from other sites.I have included parts of my config and screen shots of bandwidth usage for troubleshooting. [code]
View 3 Replies View RelatedI am having an issue where the GRE tunnels are up/up but are not pingable. The GRE tunnels are on a cisco 1811 and cisco 2811 routers The tunnel source and destination IP addresses are private addresses. These private addresses are pingable to each other and they are connected via IPSEC. The IPSEC tunnels are generated from the ASA to which the cisco routers connect. Probably the tunnels are up/up because keepalives are not configured. But I am still not able to see why I cnt ping the end points. The ACL for IPSEC in ASA includes the "permit gre host <Private IP 1> hist <Private IP 2>" commands.
View 2 Replies View RelatedI have 3 tunnels established (full mesh) with 3 CISCO ASA (all security+), through Internet : - Site A : ASA5510 - Site B&C : ASA5505, There is no main site or client site, each site has more than one network behind it. So I'd like to setup OSPF between all the ASA for them to exchange their route within the tunnel. I thought this was automatic when establishing the tunnel, but it isn't.
View 1 Replies View Related