Cisco VPN :: 5540 - L2L ESP Error 402116

May 9, 2012

I have one established IPSec tunnel between the host at the far end. When they try to eatablise a second IPSec tunnel to our seconf IP we get this error
May  9 18:51:51 odc-np-gw %ASA-4-402116: IPSEC: Received an ESP packet (SPI= 0x47995CC7, sequence number= 0xCF) from (user= to  The decapsulated inner packet doesn't match the negotiated policy in the SA.  The packet specifies its destination as, its source as, and its protocol as icmp.  The SA specifies its local proxy as and its remote_proxy as is the far end peer is the local peer is the remote configured protected host is the local configured protected host is the working local configured protected host
we have a Cisco 5540 on the far end also.

View 8 Replies


Cisco Firewall :: 5540 - Extended Access-list Error Using FQDN

Nov 7, 2011

I'm trying to add an access-list rule to allow internal servers to connect an outside host on a asa 5540. The hostname translates to multiple ip's. Normally I just lookup the ip address or one of the ip's the hostname translates too and use that in the access-list as the host. For some reason the actual ip's, which are a few, are not always available so using a specific ip sometimes does not work, thus the reason I have to use the hostname instead of the ip. I have 2 hostnames. and
This is how I normally add these rules (the ip addresses are fictive): access-list internet_access extended permit tcp host host eq www log
When I try to add this using the hostname on our asa I get an error: access-list internet_access extended permit tcp host host  ?ERROR: % Unrecognized command
I've tried it without the 'www', so but same error.

View 4 Replies View Related

Cisco Firewall :: 5540 ASA Interface Input Error On Outside Interface

May 28, 2013

We are having Cisco ASA 5540 having Cisco Adaptive Security Appliance Software Version 8.0(5)23 at certain time of moment daily wer are facing latency and packetdrop wherin when I checked for ASA Interface which gives me " Input Errors" on outside interface ,so can any one tell me what are the causes to get input errors on cisco asa outisde interface.

View 2 Replies View Related

Cisco Switching/Routing :: Input Error And CRC Error On Router 1841?

Mar 12, 2013

The router 1841 is connected directly to the layer switch. the network diagram is below:
Office A --> Switch (L3) --> Router 1841 --> Internet --> Office B
However, when I transfer the file from Office A to office B, the speed very slow ( only around 40 kb/second), and there are an input error and CRC error:
Cisco-R1841#sh interfaces FA0/1
FastEthernet0/1 is up, line protocol is up
Hardware is Gt96k FE, address is 0019.e02f.03dd (bia 0019.e02f.03dd)


View 5 Replies View Related

TCP Error - Communication Error Occurred Operation Timed Out

May 1, 2012

I'm trying to open certain websites but the browser gives me this message: "Network Error (tcp_error) A communication error occurred: "Operation timed out" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time.

View 8 Replies View Related

Servers :: Error Code - 500 Internal Server Error

Apr 20, 2011

i'm currently studying at a college which has a website with a student intranet that is available to log in from any computer. So far it has been working well and I can log in on my home laptop and upload documents and look at presentations etc. Today for no reason when I try and log in I get the message Error Code 500: Internal Server Error and the webpage does no appear.I have had no problems previously and this has only happened today and yesterday, I went down to the college and accessed the website fine from the computers in the library but still no joy from my home computer.

View 1 Replies View Related

Cisco VPN :: 5540 - License Key From 1 ASA To Another

Dec 3, 2012

Can I bind SSL license key from 1 ASA to another , we recently got 5540 and i want to use my SSL 5510 license on the new firewall

View 1 Replies View Related

Cisco VPN :: 5540 - VoIP Over VPN

May 21, 2013

I have a Cisco ASA 5540 running 8.2(5). When I dial a phone on the other of the the VPN the first time I get a blank after it rings(i.e when the voice mail get activated if someone picks the phone up), however works the second and consequent times i dial.

A little background. Two sites A and B connected via IPsec Tunnel. No problems in communication except for the VoIP issue. A Phone in on site A(172.17.168.x) and other on site B(192.168.103.x). Site A and Site B is connected via an IPsec tunnel on the Cisco ASA. First call fails. Second call works. Result of a packet trace is also the same. The UDP packet get drops when tried for the first time but subsequent ones pass.
First time
ASA5520# packet-tracer input inside udp 10000 10000 
Phase: 1
Subtype: input
Result: ALLOW
Additional Information:
in         outside

View 0 Replies View Related

Cisco VPN :: One Way With ASA 5540 And 800 Router

Apr 4, 2012

I have a site to site vpn to set up between an asa 5540 and an 800 router
i only want the vpn to be initiated from the asa with the remote 800 listening for inbound connections
i know i can set the connection type on the asa as originate-only but i can find a command equivalent to answer-only for the remote 800
Is it sufficient to simply configure the asa as originate-only for this crypto map

View 3 Replies View Related

Cisco VPN :: ASA 5540 Procedure After Setting Up One To One Nat

Mar 17, 2011

We have ASA 5540.  After setting up one-to-one nat, do I need to do anything else? static (Inside,Outside) public ip address private ip address netmask

View 4 Replies View Related

Cisco VPN :: 5540 VPN Web Page Not Opening

Jul 14, 2012

I have a ASA 5540 on which VPN is configured (Both SSL through Browser and Anyconnect) , everything was working fine but suddenly the webpage has stopped working and gives the page cannot be displayed error , moreover anyconnect client also fails to connect to the ip.

View 7 Replies View Related

Cisco VPN :: Upgrade ASA 5540 In Failover

Feb 11, 2013

I have 2 ASA 5540 in our network. I want to upgrade it from 8.0.4 to 8.4.3. I want assistance in the configuration because I know that there is a change a configuration while migrating from 8.0.4 to 8.4.3.Is there any tool available on Internet that facilitates me to convert the current configuration computable to 8.4.3.

View 2 Replies View Related

Cisco VPN :: 5540 - How To Configure AnyConnect ACL's

Apr 29, 2012

I am a little new to Cisco ASA's but we bought two new 5540's to use as a new VPN solution for our company. We want to implement Cisco Anyconnect full client and Clientless based solutions for our end users. I am having problems working with setting up access lists based on groups. I simply want to create access-lists to certain IP's based on groups. I ultimately want to get to the point where we have Dynamic Access Policies that are based on Active Directory Groups allowing access to back end servers based solely on their group membership in AD. But first I need to figure out how to just apply an ACL on a group.  

View 2 Replies View Related

Cisco VPN :: Migrate All Configs To New ASA 5540

Mar 21, 2011

We setup both site-to-site VPN and Remote Access VPN client on VPN 3005 Concentrator.  We want to migrate all the configs to the new ASA 5540.  Do you recommend that we migrate all the configurations for VPN client first before setting up the site-to-site VPN on the ASA or it does not make any difference? 

View 5 Replies View Related

Cisco VPN :: ASA 5540 - SSL And VPN License Count

Aug 14, 2012

Any method to determine the maximum number of concurrently used SSL VPN licenses (sessions) on an ASA5540 over a period of time?  For instance, over a week, the MAXIMUM number of concurrent users that were utilizing SSL licenses on the box.  We are trying to determine current license capacity of the device.
We are running 8.2(5) on the ASA itself, and have 6.47 ASDM deployed.

View 1 Replies View Related

Cisco VPN :: ASA 5540 - Display Passwords

Jul 19, 2011

We have two ASA's 5540, running IOS 8.2(4).  Is there a command to find out the password that we setup for VPN Load balancing?  I recall there was a command that you type under CLI and it will display all passwords. 

View 3 Replies View Related

Cisco Firewall :: ASA 5540 Upgrade From 7.1 To 8.4

Jul 16, 2012

i need to upgrade ASA 5540 from 7.1 to 8.4 for secure connect feature of Cisco Jabber Configuration. Support forum guides that, i need to follow upgrade path from 7.1 --> 7.2  --> 8.0 --> 8.2 -->8.4 and also do a memory upgrade from 1GB to 2GB.
I need to use this feature for only three or maximum four users in company then would i really need to do  memory upgrade? or can i go with 1GB memory?also how i can get the prices of part number "ASA5540-MEM-2GB=" at
ASA-ISB-HQ# sh version  
Cisco Adaptive Security Appliance Software Version 7.1(2)
Device Manager Version 5.1(2)


View 2 Replies View Related

Cisco VPN :: PAT Outbound On 5540 For Traffic?

Feb 28, 2011

We're running 8.3(2) in the ASA5540. Users all over our enterprise connect to a business partner's application through the ASA/VPN. We have a class-b address space, and since the users are spread out all over the place, I have the entire class-b space as the local object in the ACL that allows traffic through the VPN tunnel.
The business partner has concerns that our entire address space is available to access the VPN tunnel. So I thought, to alleviate their concerns, to PAT all of our connections outbound to a single IP address.
How is this done in 8.3(2)?  We use ASDM to configure the 5540.  For example, say our class-b is and the PAT'd IP address will be

View 5 Replies View Related

Cisco VPN :: Telnet Through WebVPN In ASA 5540?

Nov 24, 2011

I've configured in an ASA5540 (8.4) access to a server in my LAN using telnet with webVPN. I've installed the ssh/telnet plug-in in the ASA and SSH access to the servers works fine but when I try telnet access I always get this error:
Could not connect to: "ip server" 23
Reason: Connection failed
It happen with any server I try. I'm not trying to access to the ASA, just servers inside my LAN that I can access with anyconnect correctly. There is a Cisco bug (CSCsq89467) saying that not configuring any Web-acl in the ASA solve the problem. Telnet always show the same error.

View 1 Replies View Related

Cisco VPN :: Profile Of Connection With ASA 5540

Jun 6, 2011

I have a problem with one of our IPSec site-to-site vpns.

-we use ASA5540 and the remote site uses a software based FW (steelgate borderware). -there are some old ACLs on our FW that have the remote site's IP address as an incoming node having TCP.... access to some servers on our LAN (why they didn't use static/dynamic NAT for clients of both end to have TCP connection???)
-when I try to set up the vpn the name entry of the remote site (which is optional) changes with IP address of the peer in vpn profile and it confuses the vpn, so the IKE phase1 won't establish. the name entry is because of those ACLs that have been entered in the past.
Q- How to stop ASA creating names via ASDM when adding ACLs?
Imagine the other site's network people are the most inflexible IT guys to do any changes in terms of using static or dynamic nat for their clients to have access to ours, so I can replace their FW IP address in ACL with other NAT addresses.

View 1 Replies View Related

Cisco Firewall :: 5540 - ASA 8.2 No Nat-Control

Nov 19, 2011

ASA5540# sh run nat-control
no nat-control
this means higher security can talk to lower security without NAT rules
Question 1) - if I want higher security zone to to talk to lower security with NAT rules. I would use statements like below. Am I correct?
nat (dmz) 1
nat (inside) 1
global (dmz) 1 interface
global (inside) 1 interface
Is this correct? So in this case I am kindly of like overriding the no nat-control statement ...right?
Question 2) - Now I have no nat-control enabled. Would the below statements (nat 0) be of any use for NAT exemption??
nat (dmz) 0 access-list dmz-nonat
nat (inside) 0 access-list dbase-nonat
And do I have to have a global statement for NAT 0 below?
global (dmz) 0 access-list dmz-nonat
global (apps) 0 access-list dbase-

View 2 Replies View Related

Cisco Firewall :: Cannot Log In To ASA 5540 ASDM After Configuration IPS

Jun 10, 2012

I Have Cisco 5540 with AIP-SSM-40, recently i config AIP-SSM-40 to capture all traffic from all interface any to any with promiscous mode and if card fail traffic still flow throuh asa, but after that i can't login to cisco ASDM, the error is "Un Able To Launch Device Manager From xx.xx.xx.xx"               

View 2 Replies View Related

Cisco Firewall :: High CPU Utilization On ASA 5540

May 11, 2008

I have a remote site customer with a Cisco ASA 5540 running SSLVPN (Anyconnect)(8.03). It currently only serves about 450 SSLVPN clients. Since last friday, they've seen the CPU utilization go up to high 90% while only serving 400+ remote users. I saw some high cpu utilization bugs, but none looked to be relevant. How I can find the root cause of the CPU high utilization?

View 2 Replies View Related

Cisco WAN :: 5540 Planning A New Redundancy Network

Jun 26, 2011

I designing a new network for the company.

-Core layer is Cat6509 with VSS
-FW Lauer: Cisco ASA 5540
-Switches: L2 Cisco 2960
 What is the best plan to make this redundant to the Firewalls?

View 1 Replies View Related

Cisco Firewall :: ASA 5540 - NAT Not Working After Upgrade

Apr 26, 2011

Just upped our external ASA-5540 pair to 8.4(1), and now one of our nat's is busted.
Here's the lowdown:
Our public IP for our IronPorts ends in .167.  That IP is natted to a VIP on our ACE, which load balances to the IronPorts.
The outside interface of the ASA uses .162, which has been the pat for all outbound traffic for a few years... except for the subnet that houses the IronPorts.  Due to reverse lookup, that subnet uses the .167 IP address for all outbound traffic.
After the code upgrade, the nat won't work.  No email sent or received.  Nothing but Deny's on the ASA with flags reading either "SYN" or "RST".  IE: Apr 27 12:56:11 local5.crit %ASA-2-106001: Inbound TCP connection denied from to flags SYN  on interface outside
If I return the subnet pat back to the outside interface, then inbound traffic works fine, though reverse lookup fails and anyone running a reasonable spam filter won't send to us.

View 6 Replies View Related

Cisco VPN :: 5540 VPN Commands Generator Tool

Jan 5, 2012

To test the VPN performance of  ASA 5540, I will have to build at least 1000 VPN tunnels. It is time-consuming works if I put all of commands line by line manually. It looked like a bundle of VPN tunnels won't be created by ASDM. I am wonder if there is any generator tool for this. I just tried to google it. I found a software is named as VPN Configure Generator, but it is not free.

View 6 Replies View Related

Cisco VPN :: 5540 How To Go About Getting Session Keys From Either Device

Apr 25, 2013

I have a Cisco 5540 that terminates one end of a L2L tunnel, the remote end is a Sonicwall TZ100.  The tunnel is in place to carry voice traffic and I have a need to decrypt the traffic that's been captured in .cap file using Wireshark 1.8.5. How to go about getting the session keys from either device?

View 3 Replies View Related

Cisco Firewall :: Reasons To Upgrade ASA 5540

Apr 29, 2012

I have two Cisco ASA 5540, these ASA running ver 7.2. and used mainly as VPN gateways.My question is simple, Apart from the extra AnyConnect client functionality and the higher encryption, is there any specific security benefits (related to the VPN use) for upgrading to ver. 8.x ?

View 4 Replies View Related

Cisco Firewall :: ASA 5540 Simulation In GNS3

Jan 26, 2013

I have to use GNS3 for simulate ASA5540.but it does not work. I've installed latest GNS3( all in one) in Win7 32bit environment, and used IOS file is asa842-k8.bin.but i can't unpack it properly. it said "Couldn't find any ZIP header in asa842-k8.bin".

View 2 Replies View Related

Cisco Firewall :: Asa 5540 8.2.3 Arbitrarily Reload

Dec 19, 2011

I have two ASA 5540 working in Active/Standby mode. After I've upgraded them to 8.2.3 ver. I have the following issue: once a day presently active device arbitary reloadI have no err in show version and in syslogs:11:15:50 ASA : %ASA-6-302020: Built inbound ICMP connection for faddr gaddr laddr 1011:15:58 ASA : %ASA-1-104001: (Primary) Switching to ACTIVE - HELLO not heard from mate.

View 4 Replies View Related

Cisco Firewall :: ASA 5540 And FTP Over Implicit TLS / SSL Client

Jan 3, 2012

I am having the EXACT same problem as this user:URL
Error:   GnuTLS error -53: Error in the push function.
Response:   425 Can't open data connection.
Error:   Failed to retrieve directory listing
Response:   421 Connection timed out.
However I am using implicit instead of explicit. Here are the outputs of items that have been requested in the other thread.

View 1 Replies View Related

Cisco VPN :: Remote Access On ASA 5540 Version 8.4?

May 22, 2013

I have two Firewalls one on MAIN site and another on BR site. I have configured RA VPN for both and i am able to access the internal networks of respective Firewalls. But the requirement is i want to connect to the Main site through RA VPN and access the BR SITE internal networks through that connection.

View 4 Replies View Related

Cisco VPN :: Initiate VPN From Router On Local LAN Behind ASA 5540?

Sep 16, 2012

We currently have an ASA with site to site VPN and anyconnect VPN being utilized. We received a third party  cisco router which will  be used to initiate their own site to site VPN from inside our local LAN to their LAN through our ASA.
1. Would NAT Traversal be required on our ASA? 5540(config)#crypto isakmp nat-traversal

2. Would the ports listed below interfere with ports for site to site VPN and anyconnect VPN?

- allow access from xxxxx on TCP Port 22
- allow access from xxxxx - protocol 1
- allow access to xxxxx on UDP Port 500, also add UDP 4500 for NAT-T


View 1 Replies View Related

Copyrights 2005-15, All rights reserved