Cisco VPN :: ASA 5520 / Change Peer IP Of Remote VPN?

May 25, 2012

I have an ASA 5520 with multiple site-to-site VPN's.  A remote customer has changed their Public IP address and now the VPN has gone down.  How can I easily change the peer IP of the remote site to the new one without have to put the pre-shared key in again as we don't know what it is and they don't manage their firewall.

View 7 Replies


Cisco VPN :: Changing Peer IP On ASA 5520?

Jun 10, 2013

I have a few site-to-site VPNs connecting to my ASA 5520, but one of the remote VPNs is changing it's public IP, how can I change this IP on the ASA without starting again?  On the ADSM it is greyed out so I can't edit it, but can I just change it in the CLI?

View 2 Replies View Related

Cisco VPN :: 5520 - ASA Dead Peer Detection?

Oct 22, 2011

I have a simple question regarding dead peer detection on the ASA 5520.  I am using a cellular VPN device to connect back to an ASA 5520 and I have noticed that the connection drops at random periods during the day.  The vendor for the cellular device recommends disabling dead peer detection on their device, which I have done.  The question is, where is this disabled on the ASA?  is it the IKE Keepalive setting under the tunnel group option?

View 1 Replies View Related

Cisco VPN :: PIX-515E Remote Peer Is No Longer Responding

Jul 8, 2012

I am unable to VPN to my network from outside using cisco VPN client to PIX-515E. When I try it say: Reason 412: the remote peer is no longer responding. From inside everything work ok, I can connect... (same computer, same settings...)

View 3 Replies View Related

Cisco VPN :: ASA5520 - IPSec L2L VPN Remote Peer Is Being Denied

Mar 18, 2012

We are trying to add an additional LAN-to-LAN IPsec VPN to our network.  We currently have one remote office connected, when we configure the second VPN matching the first the tunnel never begins to establish.  There is an ACL that is dening the static IP for our remote office.
The layout is as follows:
Main office = ASA 5520
Remote Office A = ASA (Unknown Model)
Remote Office B = Adtran Router
All devices have static IP addresses.
We used the ASDM VPN wizard to create both VPN's.
We have created a rule allowing all traffic from our remote office IP, and that had no effect on the VPN aside from eliminating the following message from our logging:
4          Mar 19 2012          15:18:01          106023          50234          TWT-hq-e          31326          Deny udp src TWT-outside: dst inside:TWT-hq-e/31326 by access-group "outside-in" [0x0, 0x0]
We have verified that both sides are configured the same however the VPN never is initiated so as of right now the ASA is simply blocking all attempts from our remote office to connect.

View 1 Replies View Related

Cisco VPN :: 5505 IPSec VPN Remote Peer Address

Mar 5, 2013

I've been using an ASA 5505 -- ASA 9.1(1) -- with an IPSec Remote Access VPN. Everything works properly, though I recently noticed that when my IPSec session is disconnected, I get the standard message ID 113019, but within that message the Peer IP address is incorrect. In fact, it isn't even close to my actual remote address. [code]
When I first researched the IP, I found it coming from China, which freaked me out. I changed settings, rolled back to 9.0(1), and nothing worked. Finally I rebooted, reconnected the VPN, and the IP changed. This time it was an address from RIPE NIC. I rebooted again, now an address from ARIN in the USA. One more reboot, now a random Comcast residential address.
Within that boot cycle, the peer address always stays the same. I've connected from different devices, different IPs, different ISPs - nothing matters. Additionally, there are no firewall logs for these IP addresses at all.
ASA Remote Access VPN peer addresses in disconnect message are incorrect and change at reboot.

View 3 Replies View Related

Cisco VPN :: 2951s / Pre-Shared Key For Remote Peer Missing?

Mar 25, 2013

I am trying to establish a site-to-site VPN between two Cisco routers (2951s). I am using the below config on both routers. One router has an interface with a public IP assigned to it, the other uses a private IP and is natted by our ASA outbound.
If i remove the tunnel protection ipsec profile command from the tunnel interface, the tunnel comes up no problem and I can ping both ends of the tunnel. But as soon as I apply the tunnel protection on the tunnel interface, it dies. Both sides of the tunnel show up but no pings are allowed and I see in the debugs that for some reason the routers don't think the Pre-Shared keys are configured properly. I have gone as far as making the ISAKMP keys very simple and I know there is something I'm missing here.
On the ASA i'm allowing ESP (protocol 50) and ISAKMP (UDP 500) both directions (in and out of the firewall). I am also allowing UDP NAT-T (4500) just in case. I don't see anything on the firewall being blocked but I can't be certain that isn't causing the problem. What could I be missing here?
*****Router Config*****
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
lifetime 1800
crypto isakmp key cisco123 address PUBLICIPHERE


View 3 Replies View Related

Cisco Switching/Routing :: Nexus 5548UP Change Peer Keep Alive Link

Apr 19, 2013

I have a pair of Nexus 5548UPs that have some high priority servers running on them.  Servers are ESX hosts running Nexus 1000v's.  Each host has multple connections in a VPC to both 5548s.  We have been having intermittant ping loss and slowness of traffic to the VM's on these hosts.  I was poking around trying to figure out what the issue could be and found that the peer-keepalive command was not set to send the heart beat across the mgmt0 interface.  I would like to change this to point it accross the mgmt0 interface. Any tips or advice for me on making this change with production servers running on the switches?  I do not want to cause any loss to any systems when I make this change. [Code] ..........

View 3 Replies View Related

Cisco VPN :: Create Peer From Remote Router To Both ASR 1002 / 2811

Mar 14, 2011

I have an ASR 1002.   Behind that and across another small MAN network (considered inside) I have an ASA.  On the remote end, I have a simple 2811.
I need to create a vpn peer from the remote router to both the ASR (to hand off traffic there) and also a peer at the ASA (to encrypto across the MAN). The ASR1002 has the serial connection (DS3) to our MPLS cloud in which the remote is on the opposite side of. 
So basically, I've created a single isakmp policy with two crypto map's by the same name but set to different peers and placed on the remote router then applied it to the serial interface. This works fine. Now i throw in the ASA which is behind the ASR.   However, the connection still comes through that ASR to get to the ASA.After setting it up, it works as long as I don't have the crypto map applied to the ASR. If i apply the crypto map to the so interface of the ASR, my asa vpn connection stops working.It almost seems as if the crypto map on the ASR is grabbing my enrypted traffic destined for and trying to do something with it. [code]
Why can't i peer from my remote router to both the ASA and the ASR on the opposite end of the serial link?

View 1 Replies View Related

Cisco Switching/Routing :: 2800 / Peer To Peer Blocking On Network?

Feb 25, 2013

I am working on wi-fi networks (ISP), So I need to block the peer to peer on my network.My network involves cisco switch 2950/2960, cisco 2800 routers and Access Points, config for peer to peer blocking, for this where I need to config either switches or router.My network basic setup is, The internet will pass from router to switch and then Access Points.

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Peer-2-Peer Traffic From Inside To Outside Blocked?

Apr 19, 2012

I got ASA 5510 with base license, can I block all Peer-2-Peer traffic from inside to outside.

ASA Giga 0/0 connected to ISP Router 2811

ASA Giga 0/1 connected to LAN switch 3560

View 3 Replies View Related

Cisco Firewall :: Configure 2911 ISR To Block Peer-to-peer Traffic?

Jul 25, 2011

I see that Application protection - blocking peer-to-peer file sharing traffic is a capability of Cisco IOS Firewall. How do i configure my Cisco 2911 ISR to block peer-to-peer file sharing traffic?

View 1 Replies View Related

Cisco Switching/Routing :: 881 Blocking Peer To Peer Applications On LAN

Feb 13, 2013

I am facing issues in blocking Peer to Peer applications in LAN. I am using 881 Cisco router and below is the config done. [code]

View 1 Replies View Related

Linksys Cable / DSL :: WAG320N Can Block Peer To Peer File Sharing On Network

Jul 31, 2011

I recently bought the WAG320N can I block Peer to Peer file sharing on my Network?

View 3 Replies View Related

Linksys Cable / DSL :: Block Peer To Peer File Sharing With WAG320N

Jul 31, 2011

I bought my WAG320N, I too have the internet drop out and from reading in here is a very common problem. Cisco really should bring out a new firmware version and address this issue. Any way you can block peer to peer file sharing with the WAG320N? If so how do you go about it?

View 1 Replies View Related

Setting Proxy Server On Peer To Peer Network

Jan 28, 2011

One of the schools whose networks I administer has a peer to peer network running about 30 xp machines. DHCP is achieved and DNS settings distributed via a basic Linksys router; is there any way of distributing proxy server address and port short of entering manually in LAN settings of IE on every terminal - there is no budget to install a server.

View 4 Replies View Related

Windows 7 - Share Internet In Peer To Peer Network?

Jan 18, 2011

i just set up my 2Xp pc's and one windows7 laptop peer to peer for file and printer sharing but i can not configure internet connection for those pc's

View 2 Replies View Related

Cisco VPN :: ASA 5510 - ISP Site To Site Failover With Single Remote Peer Address

Apr 16, 2011

I have a ASA 5510 actve/standby and create one site to site VPN with remote peer ip address xx.xx.xx.xx, Our VPN traffic running on 6 mb internet link for video conferancing traffic.Now client give another link 2 mb internet and client told to us our data traffic runnig on 2 mb link but this data traffic running on the same remote peer IP xx.xx.xx.xx.
Secondly request also they need failover over the ISP link.
how we immplement the same on ASA 5510.

View 0 Replies View Related

How To Setup Peer To Peer Network

Mar 12, 2011

i want to set up my two computers /win xp/ installed using peer to peer network , just tell me the needed steps

View 2 Replies View Related

Cisco :: Prevent Guest From Doing Peer-peer Communication On Guest 5508 Controllers

Jan 24, 2013

I want to prevent guest from doing peer - peer communication on my Guest (5508) controllers.  Is this a feature on the WLC or only by applying an ACL on the router interface?

View 2 Replies View Related

Cisco WAN :: ASA 5505 Remote WAN IP Change?

Dec 6, 2010

There is a site I oversee that is moving to a new ISP. The drive is 2 hours round trip and I need to do is change an IP. DHCP is being handed out by the internal Domain Controller and all the workstations point to the server for DNS. Will the following commands inputted over an SSH putty session into the current WAN IP change the IP and allow me to hookup to the new ISP? The plan is to copy and paste the following commands into global config mode. Currently they are using DHCP on the WAN side which I do not approve of and their external route is pointing to the internal IP of Things still work but I want to do away with this. Will these commands get the job done?

interface vlan 2ip address 68.x.x.2 route outside outside 68.x.x.1

View 7 Replies View Related

Cisco Firewall :: 5520 Change Of Subnets

May 19, 2013

i have a asa 5520 that is working with three zones DMZ, inside and outside.
my DMZ is for all my branches and it had a /24 subnet my inside had a /24 subnet and all was fine i could talk to branches and they could talk to me. i also had all the branchess accessing internet via the ASA which is at HO. i changed the subnets from /24 to /21 and broke everything
below is the configs for the asa
interface GigabitEthernet0/0
nameif outside


View 4 Replies View Related

Cisco Firewall :: ASA 5520 - ISP Change Procedure

Oct 30, 2011

our company is going to change its´ ISP. The External Isp are going to obviously change too. We have an Active/Standby Firewall and we would like to make the change with at least connectivity downfall as possible. In our configuration we have nearly all features configured as in a normal Productive Firwall such as , NAT, Site-to Site VPN, Remote Access Webvpn, ACLs and also routing.  I have looked up some information in this community and still I am not sure about the steps to be made so to reach our goal.
I have read that changing only the "names" from the old IP Range to the new Ip range would not really make the change. The old Ip range will still be configured in the features using the external Ip address. Therefore we have to first delete all the information (in the running config) connected to these Variables and then re insert them. My biggest worry is that this could be a little bit tricky during the implementation, if some config lines or objects could be left out during the deleting and inserting procedure.
How we could make this change with a low percentage of "copy and paste failures"? I was thinking about in changing the "names" to their new Ips and then afterwards reload the ASA. Will this workout? Primary ASA will be changed first with the secondary shutdown. ASA Firmware 8.2.2 (12).

View 4 Replies View Related

Cisco WAN :: Remote Change Outside IP Address For ASA5505

May 23, 2011

How to remotely changing ip address for my ASA5505.

View 1 Replies View Related

Cisco VPN :: ASA 5510 - Remote Access VPN Failed After WAN-IP Change

Jun 23, 2012

Router: ASA 5510
We have changed the ISP, so therefore new wan ip-addresses.
Internet works, and site-to-site vpn works, but I'm failing to localice why the remote access vpn won't work.

View 10 Replies View Related

Group Policy Change On Remote Machine?

May 27, 2011

I have 4-5 machines connected to each other in network which are in workgroup. Now I want to change one group policy on remote machine. The name of that policy is " Network access: sharing and security model for the local accounts :- Guest only" . How can I change this policy from remotely?

View 1 Replies View Related

Cisco Switching/Routing :: To Change Nortel 5520 Switch

Aug 19, 2012

I have a customer that wants to change their Nortel 5520 switches to a Cisco solution, and I wanted to ask what would be a good solution for this customer. presently they have 4 48 port PoE and 2 24 port PoE stackable 5520, and they are interested in redundant power supplies for the switches. I was thinking that the 3750 is good for this site.

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ISE 1.1.2 Change Of Authorization With Avaya Switches (5520)?

Jan 27, 2013

I am configuring ise to do the posture assessment. I am having avaya as my LAN and Core switches. The idea is once the user is authenticated using 802.1x then it will be moved to qurantine vlan and after it is compliant with the company's policy then it will be moved to the actual vlan. I have configured the avaya switch to accept the radius assigned vlan and also configured the 802.1x dynamic-authorization. Currently, radius assigned qurantine vlan is working but once the nac agent scan and mark the PC status as Compliant then the CoA is not happening and User is not moved to the actual vlan.
I tested the same ise authorization policy of dynamically assigning VLANs on cisco switches and it worked perfectly, but the same is not happening on avaya switch.

View 1 Replies View Related

Cisco Firewall :: 5510 Remote Access VPN / Change The Outside Interface IP

Dec 19, 2012

I have a Cisco 5510 which has remote access VPN configured.Now I have new block of IP address, is there a way I can just change the outside interface IP so that people can remote in without doing anythng else?Or if I coulds be taught to create a new one.Or best way to approcah this issue?For example: it was 67.64.x.x now I need to change to 64.44.x.x.

View 1 Replies View Related

Cisco VPN :: 5520 Remote VPN And Hair Pinning

Jan 27, 2013

I have a dmz interface on a ASA 5520 that is used for wireless internet and i would like the users to be able to vpn in however they can not because they are coming back through the same outside interface. Do i have to nat the VPN ip pool or just use some form of hairpin routing or nat. I am using 8.2.

View 4 Replies View Related

Cisco VPN :: ASA 5520 / Access To DMZ From Remote Sites Over S2S VPN?

Nov 10, 2011

We have a Main ASA 5520 and two remote site ASA 5505's that connect to each other via S2S VPN tunnels. Currently they are doing split tunneling, so only local traffic goes over the tunnel. We have are local LAN ( and our DMZ ( network at the main site. The DMZ hosts our external sharepoint, but we have access to it internally The problem is site A ( and site B ( have no idea of it, and when attempting to go to the site, it fails. You can access it via the external site address, but that's the only way. Normally the external address is blocked when you are internal.What i'm stuck at is even when we had all traffic sent from Site A to our main hub, it still wouldn't find it. Would i have to make a separate vpn tunnel purely for that DMZ traffic?

View 6 Replies View Related

Cisco VPN :: ASA 5520 / Failover Between Two Remote Locations?

Dec 5, 2011

I have 2 dual ASA 5520 devices running VPN at two geographically different locations. What is the best way to do failover between the two remote locations?i.e. can Cisco GSS / Cisco CSM/ACE be used and if so how would this work.

View 3 Replies View Related

Cisco VPN :: ASA 5520 - Remote VPN Via Internal Network

Jan 27, 2013

I have a small request.  I have a setup where the internal users within the corporate network need to remote VPN into the VPN concentrator.
The setup is as below
(202.x.x.x)VPN ASA 5520 ----------------    FW ------------- intenal network
The problem is that the internetl network establishes the connection via the outside interface. However, the return path is via the inside interface. But the vpn concentrator keeps showing next-hop not reachable for USP 500. Why does it show that when it has a route via the inside interface.
6|Jan 29 2013 13:44:38|110003: Routing failed to locate next hop for udp from NP Identity Ifc:202.x.x.x..29/62465 to outside:10.163..x.x/5892
Also, since we are trying to send traffic from outside to the inside interface, I tried to NAT the source ip i.e 202.x.x.x and left the source unaltered. But it still doesnt work.
I am wondering why is the ASA not routing via the inside interface and looks for the return traffic via the same outside interface the traffic entered in. The outside has a security-level of 0 and the isnide has a sec-level of 100.

View 17 Replies View Related

Copyrights 2005-15, All rights reserved