Cisco VPN :: Remote VPN On ASA5510 Getting Static IP From ASA5520

May 22, 2013

i configured a remote VPN on cisco ASA 5520 and everythings seems to be working fine...DHCP IP were been lease to users that connect to the VPN. but the issue now is that our customer want a static IP to be given to a particular user when he connect via VPN.

View 1 Replies


Cisco Firewall :: ASA5520 - Static Route Shows A- Or A-

Jul 14, 2012

We use ASDM 6.2 to manage our Cisco ASA 5520 running ASA Software Version 8.2 (1). I just noticed that some static routes have "A-" when you view the static routes with ASDM e.g. A- or A- (pls see attached print screen). I haven't seen this before and dont know what it means.

View 4 Replies View Related

Cisco Firewall :: Configure HTTP Traffic To ISP2 And Static NAT To ISP1 On ASA5520?

Jun 20, 2011

is this possible to configure HTTP traffic to ISP2 and Static NAT to ISP1 on ASA5520?

View 2 Replies View Related

Cisco :: ASA5520 - Implementing VPN For Remote Users?

Apr 25, 2012

I have roughly 50 users that are remote, and use VPN to access the resources in my network such as file servers, application servers etc.  We currently use Microsoft VPN to authenticate those users.  It works, but I am not a fan on Microsoft VPN.
I have purchased an ASA5520 to replace my crappy layer 3 HP core backbone switch, and plan on replacing my Microsoft VPN with Cisco VPN.  I want to configure my ASA so my remote users can continue to VPN into my network securely?Is this possible?

View 8 Replies View Related

Cisco VPN :: ASA5520 - IPSec L2L VPN Remote Peer Is Being Denied

Mar 18, 2012

We are trying to add an additional LAN-to-LAN IPsec VPN to our network.  We currently have one remote office connected, when we configure the second VPN matching the first the tunnel never begins to establish.  There is an ACL that is dening the static IP for our remote office.
The layout is as follows:
Main office = ASA 5520
Remote Office A = ASA (Unknown Model)
Remote Office B = Adtran Router
All devices have static IP addresses.
We used the ASDM VPN wizard to create both VPN's.
We have created a rule allowing all traffic from our remote office IP, and that had no effect on the VPN aside from eliminating the following message from our logging:
4          Mar 19 2012          15:18:01          106023          50234          TWT-hq-e          31326          Deny udp src TWT-outside: dst inside:TWT-hq-e/31326 by access-group "outside-in" [0x0, 0x0]
We have verified that both sides are configured the same however the VPN never is initiated so as of right now the ASA is simply blocking all attempts from our remote office to connect.

View 1 Replies View Related

Cisco VPN :: ASA5520 Remote Access VPN Pool Migration?

Nov 29, 2012

best way to migrate to a new pool for remote access DHCP address assignment.  We are currently using a /24 pool, allowing us 253 IP Addresses... during the recent hurricane we hit 250 IP Addresses used, and had to start asking users to connect to our backup ASA VPN device in another country, not an ideal solution.  I'd like to expand our current VPN subnet to a /23, however I do not have a free /24 subnet above (or below) our current /24 subnet.

I can certainly allocate a new /23 subnet, but I am looking for the best migration plan with minimal downtime (no downtime would be preferred).  Can I just add the new pool range to the tunnel-group RAVPN general-attributes section alongside the current pool, or should I just remove the old pool, log off all existing remote access VPN users and have them log on again to start using the new pool?We are running ASA Version 8.2(1).

View 2 Replies View Related

Cisco VPN :: ASA5520 / How To Restrict The Remote Access Network

Sep 6, 2010

in our VPN configuration (ASA5520, Anyconnect VPN Client), we have different VPN User Groups. These Group Policies are retrieved from an LDAP Server.We'd like to restrict the acess like this:

A Group "Home User" might establish a VPN from anywhere on the Internet

A Group "restricted 3rd party" should only be allowed to establish a VPN from their specific public Source IP Address on the Internet (the public IP Address of this 3rd party Company). When these Users try to connect from any other IP Address on the Internet(Home, hotel, etc), VPN Access should not work!
On our old solution, we were able to limit the remote access network, per user group,  to some source IP's.
The IP Filters related to group policies in here seem only to be filters concerning the VPN Address (after the VPN is established: where can this user group connect to). But I did not find filters/access lists, where yoiu can define/restrict public access networks for some groups.Or is it possible to do that by Dynamic Access Policies? How?

View 1 Replies View Related

Cisco Firewall :: Static Nat On ASA5510

Aug 25, 2012

We have network topology:

Inside Network ( --- ASA5510----- Outside network (
ASA5510 have: Inside interface:; outside interface:
And we config:
# object network obj_inside
# subnet
# nat (inside,outside) dynamic interface
So, we í in from outside, we can't access web at

View 3 Replies View Related

Cisco Firewall :: Active ASA5520 Remote VPN Access Limitations

Sep 19, 2011

We have an Active/Active ASA 5520 setup, as i know in Active/Active setup there is no remote VPN access, So i could overcome this limitations?I have a solution but i dont know if it is ablecable or not? we have a spare ASA 5510, so i can use it behind Active/Active Firewalls and assign a public static NAT IP address to it and open all IPSEC and VPN ports and let the remote users to connect to it, is this ablecable setup or not?

View 1 Replies View Related

Cisco VPN :: ASA5520 / Remote Vpn User Access Notification By Email?

Apr 5, 2011

Our customer has an ASA5520 Security appliance, I have already config the remote vpn in asa , user can logon via internet  by vpn client and can access internal network,customer hope us can make some configuration if the remote user logon asa by vpn and notify them  someone login their vpn by email .

View 2 Replies View Related

Cisco VPN :: Dynamic From SA520 To ASA5510 With Static IP

Sep 7, 2011

Is it possible to configure a Site to Site VPN from a SA520 with Dynamic IP (DSL) to a Cisco ASA5510 with static IP? I need to make sure about because i am trying to sell this solution to a customer with two branch offices with DSL connection and a Main Office with Metroethernet.
I know that using a a pre-share-key on the defaultl2lgroup of the ASA, the ASA will accept any site to site VPN. I have tried this with the ASA 5505  instead of the SA500 for the branch office, but the ASA5505 is too expensive for my customer.

View 2 Replies View Related

Cisco Firewall :: ASA5510 Static Nat From Outside To 2 Internal Interfaces?

Mar 18, 2012

I have an ASA5510 running 8.2 code and I have over 200 static nats from  the outside to the inside interface and that is how I expose our systems  to the Internet.  If this inside interface fails we also have a bypass  interface that also terminates on the internal network but I am not sure  how the nats will behave given they are statically mapped to the  inside.

View 1 Replies View Related

Cisco Firewall :: ASA5510 Static 1to1 NAT Configuration

May 21, 2012

We are replacing our EOL Watchguard X1000 Firewall(s) with Cisco ASA 5510 unit - ASA Version 8.4(3).  Following is the static NAT I have build and the corresponding access list.
nat (FW2Inside,FW2Outside) source static BW_XSP1_Private BW_XSP1_Public destinat
ion static BW_XSP1_Private BW_XSP1_Public

access-list FW2Outside_access_in extended permit tcp any object BW_XSP1_Public object-group DM_INLINE_TCP_1
Unable to access the server on the inside interface via the public NAT address. Can you point me in the right direction as to what I might be missing to make this work?

View 1 Replies View Related

Cisco Firewall :: ASA5510 Dynamic Routing And Static NAT

Dec 10, 2011

I have a ASA5510 with 2 internal interfaces (inside1 and inside2 same security level) configured with OSPF for dynamic routing with 2 routers to corporate subnets. I have a server in a private subnet that needs to be accessed from Internet. So static pat is used in ASA with the command
static (inside1, outside) tcp interface www www netmask
As OSPF is in use, the subnet may be reachable from interface inside2. When I tried to configure the static command for inside2,
static (inside2, outside) tcp interface www www netmask error message came out "WARNING: mapped-address conflict with existing static...". Is this just a warning, or this is not possible in ASA.

View 2 Replies View Related

Cisco Firewall :: ASA5510 With Dual ISPs And Static NAT On Backup

Dec 12, 2012

Looking to have an ASA5510 with two internet feeds. Moreover, I would like to have my static nat translations continue to work on the backup feed. I have outbound nat working, however I cannot get the inbound nat to work. I had this all figured out in 7.x but now with 8.x I cannot seem to get it working. If anyone has a 8.x example config.

View 4 Replies View Related

Cisco Firewall :: ASA5510 - Applying Static Command / Not Found Error

Apr 3, 2011

I have Cisco ASA5510 OS version 8.4(1), when i try to apply static command, this command is not found, the NAT issues used nat(inside,outside).

So why i can't found this command ?

View 1 Replies View Related

Cisco Firewall :: ASA5510 Static Routes For Management Interface Not Working

Mar 30, 2011

We have several pairs of ASA5510s in failover A/P mode, some running 8.3(2) and others running 8.4(1).
e0/0 = outside
e0/1 = inside
m0/0 = management
The problem we're having is we can't get anything to route out of the management interface unless we put in a static route at least to the subnet level. For example, we want syslog traffic to exit out m0/0 to our syslog server Our 'gateway of last resort' points to the next hop out e0/0, and a second static route with a higher metric and a more distinct network space is for m0/0 as in:
route outside 1route management 10
This doesn't work, and ASDM loggin gives this error: ".....Routing failed to locate next hop for udp from NP Identity Ifc: to management:"
If I put in a more granular subnet route, or a host route of the syslog server it works, such as:
route management 10   <------------- this works
route management 10   <------------- this works too
Why won't a static route for work in this case?
We are going to have numerous hosts access and be sent messages though the management interface of these ASAs, and it would be very burdonsome to have to add a host, or even a subnet, route for every one. I've removed all static routes and tried to rely on EIGRP, but that doesn't work. I also had to put 'passive-interface management' under the EIGRP for this to work.
Here is the pertinant ASA config concerning syslog, routing, and interfaces:
interface Ethernet0/0 nameif outside security-level 0 ip address standby !interface Ethernet0/1 nameif inside security-level 100 ip address standby


View 3 Replies View Related

Cisco VPN :: ASA5510 / Remote IPSEC VPN ASA Behind NAT?

Mar 18, 2012

i want to create Remote IP Sec VPN on Cisco ASA5510.Problem is this 5510ASA is behind another 5520ASA and it dont have any public IP address on any of 5510 interface.if i do static NAT of ASA 5510 Private IP on internet facing 5520 IP Public POOL, then will VPN work on 5510 ASA? and what ports need to forward on 5520 for 5510 to become IPSEC VPN head end

View 1 Replies View Related

Cisco VPN :: Remote Access VPN On ASA5510?

Dec 11, 2012

how to configure simple VPN access for a user to login to the corporate network and access the resource and get emails I do not want to use CA certificate for authentication instead a very simple method is what i plan to start up with the configuration step so i can test this out.

View 4 Replies View Related

Cisco VPN :: ASA5510 Remote Access Vpn

Sep 20, 2011

I have access to my enterprise network through Cisco VPN (software) client and it goes through remote-access ipsec vpn setup on an ASA 5510. Everything works fine.
But now users that connect to the enterprise network have in addition need to access remote sites networks that are connected through the site-to-site VPN tunnels: IPSec tunnels between mentioned ASA5510 and remote ASA5510s and ASA5505s in branch offices.
there is NAT exemption rule that exempts networks,, traffic from local network have full ip connectivity with all the networks in branch offices. The PROBLEM is that remote vpn clients can reach only local network, but not the remote networks.
The ASAs in remote branch offices has set up NAT exemption towards both local network and remote access clients network, but as I said, it doesn't go.

View 2 Replies View Related

Cisco VPN :: Remote Access VPN In ASA5510?

Mar 20, 2011

I like to create a remote access VPN in our company. But it already has a site to site VPN.
1. Can we implement it with existing ASA?

2. How many users can be logged in at a time?

3. Is the currently available bandwidth sufficient at a high traffic ? Current bandwidth is 2Mbps (Expect maximum 30 users at a time)

4. How can we make authentication using active directory?

5. Can we use default VPN client in windows with ASA?

6. How can we monitor user’s activity while logging in using VPN?

View 7 Replies View Related

Cisco Firewall :: Create Static PAT To Allow Host Address To Access Network Through ASA5510

Aug 23, 2012

The old syntax that I am much more familiar with has been deprecated.  On older IOS it would have been something like static (inside,outside) tcp 14033 1433 netmask  Plus an extended ACL to allow the traffic.I am trying to create a Static PAT to allow a host address to access our Network through an ASA.  I have external address that I want to hit the external interface on an obscure port (say 14033) and translate that traffic to an internal host address on  port 1433.

View 11 Replies View Related

Cisco VPN :: ASA5510 Remote Vpn Ipsec Not Working

Feb 29, 2012

I configured my cisco client with the info from the vpn wizard and get the following error :
error in the cisco vpn client when enabling the log : Invalid SPI size (log) + reason 412 the remote peer is no longer responding (application) message I see via the ASDM-IDM : Built inbound UDP connection for interface WAN
I'll explain briefly what I'm trying to do here :
* Remote vpn with windows users having cisco clients
* Group authentication and in the asa5510 LOCAL authentication
My WAN interface contains a public ip/29 I also defined a LAN interface with security level 100 in range the vpn dhcp range I want to attribute to vpn users :
Basically I want users to initiate the vpn tunnel to the public IP and be able only to access the LAN range with the range
ASA Version 8.2(5)
hostname xxxx
domain-name xxxx


View 7 Replies View Related

AAA/Identity/Nac :: ASA5510 With 2 Remote Access VPN And 2 MS IAS

Jun 17, 2011

We have a Cisco 5510 with 2 IPSec Connection Profiles each using a different IAS for authentication.If we add another VPN profile we need another IAS.With Cisco ACS can it be configured for different VPN profiles from the same ASA 5510?

View 4 Replies View Related

Cisco VPN :: ASA5510 - Windows 7 Connects To It But Not Remote Desktop

Mar 15, 2010

we just got several laptops that came with Windows 7 Pro 32bit installed, and we have installed the VPN Client  The VPN client appears to connect to our ASA5510, but we are unable to connect to any machines on our network as it does on our XP machines. 

Furthermore, we cannot ping any as well.  Also, while connected the Windows 7 machine is still able to access internet site as if split-tunneling was configured, which its not!  I've seen alot of people posting on the internet about the same issue, but I have not run into any resolutions that work.

View 14 Replies View Related

Cisco Firewall :: Connecting ASDM To ASA5510 Over Remote VPN

Apr 19, 2011

I have two ASA5510 with a peer to peer VPN configuration which is working pretty well.I'm trying to connect to my remote ASA (ASA2) with ASDM on my PC through the VPN on the local ASA (ASA1)I already connected the ASDM to ASA1 through the inside interface but I cant connect to the ASA2 the same way (over the VPN).
When I ping the ASA2 inside interface from my computer, I get the following events:
ASA1: PC)                     |  512  |    |    0    |  Built outbound icmp connection inside interface)  |   0    |  |   512  |  Teardown icmp connection
 ASA2 PC)                     |  512  |    |    0    |  Built local-host Corporativo(outside): inside interface)  |   0    |  |   512  |  Built local-host identity: PC)                     |  512  |    |    0    |  Built inbound icmp connection PC)                     |  512  |    |    0    |  Teardown icmp connection
This is my config in ASA2
ASA Version 8.0(5)!hostname ciscosnqdomain-name password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptednamesname SNQ-Servername Srvplxaname e-Servername Experion-networkdns-guard!interface Ethernet0/0 nameif Corporativo security-level 0 ip address!interface Ethernet0/1 nameif ExP_LS security-level 90 ip address!interface Ethernet0/2 shutdown no nameif no security-level no ip address!interface Ethernet0/3 shutdown no nameif no security-level no ip address!interface Management0/0 nameif management security-level 100 ip address!boot system


View 9 Replies View Related

Cisco VPN :: ASA5510 Configured Remote Access To Allow Users Log In Via SSL VPN

Apr 12, 2011

We have a high availability pair of ASA 5510's in Data Centre where we have configured remote access to allow users log in via SSL VPN, now we want to add further security to our environment we are adding endpoint assessment licenses...the question I have would I need two sets of the license ASA-ADV-END-SEC ?
I learned the hardway before with ASA SSL VPN licenses breaking other failover pair as it needed identical licenses on both units! Will I need 2 separate license sets to keep my firewalls in a HA pair?

View 1 Replies View Related

Cisco VPN :: ASA5510 - L2TP Remote Access Disconnects After Few Hours

Nov 17, 2011

Have a few users on Vista/7 using Windows L2TP to connect to our ASA5510. It is reported that after a few hours the connection drops. From what I have seen this can be anywhere around 5-6 hours. Of course my connection will drop after an amount of time has passed and no traffic has passed the tunnel. But the users are adament that this drops during large transfers; i.e. not a timeout issue. Before I spend anymore time on this I just want to know if this is normal behavior for a remote access L2TP using Windows to disconnect on it's own after this amount of time. Never had a reason myself to remain connected that long, and when I did I used a site 2 site tunnel.

View 2 Replies View Related

Cisco VPN :: ASA5510 Remote Access / LAN Not Accessible Inside Network

Jan 6, 2013

I am facing a problem with Cisco ASA remote access VPN, the remote client is connected to VPN and receiving IP address but the client is not able to ping or telnet any internal network.I have attached running configuration for your reference.
-FW : ASA5510

-Version : 8.0
Site to Site VPN is working without any issues

View 10 Replies View Related

Cisco VPN :: ASA5510 Easy VPN Remote / IPsec Session Count

Feb 21, 2013

I recently upgraded our head end ASA5510 at our datacenter from 8.2.1 to 8.4.5. The ASDM was also upgraded from 6.2.1 to 7.1.(1)52. Under the old code, a remote ASA5505 connected via Easy VPN Remote showed 1 IPsec tunnel. However, after the upgrade, it shows 42 sessions. It would seem to me that each split tunnel network defined in the Easy VPN profile is being counted as a tunnel. Is it possible that I may have something misconfigured now that the code is upgraded?

View 6 Replies View Related

Cisco Firewall :: ASA5510 / Unable To Establish Remote VPN Through AnyConnect

Mar 31, 2011

We have ASA5510 with version 7.x and asdm 5.X, i upgraded it to 8.3 and asdm 6.2, and i got vpn peers 250 and 2 ssl.when i try to connect through client software , i can see in the logs UDP 500 port is created as shown below.Mar 31 2011 23:54:40 302015 57013 x.x.x.x 500 Built inbound UDP connection 56694 for outside: ( to identity:x.x.x.x/500 (x.x.x.x/500) no other things are going on , and i get error as shown below.
Secure VPN Connection terminated Locally by the client
Reason 412: Remote peer is no longer Responding
Connection terminated on.
i am suspecting it is VPN-3DES-AES activation key issue.when i go to Remote Access VPN ---Advanced---SSL Seetings--From Left Encryption Panel Available Algorithems i have DES-SHA1 when i try to drag it tto Right panel of Active algorithems it gives me error *** below [ERROR] sl encryption rc4-sha1 des-sha1 The 3DES/AES algorithms require a VPN-3DES-AES activation key and currently in right panel of Active Algorithms i have only RC4-SHA1,

View 4 Replies View Related

Cisco Firewall :: ASA5510 Permit Incoming Connection From Remote LAN

Sep 4, 2011

Actually all service from site to site is permitted, without restriction.I want to insert an ASA to block some internet traffic on main site.I try to configure my ASA5510.No problem for outgoing connection or to permit a single service on main site.But impossible to give access to all service/connection from all remote site to main site. [code]

View 7 Replies View Related

Cisco WAN :: ASA5510 - Multiple L2L VPN With Overlapping Remote Network Ranges?

Feb 4, 2013

I have an ASA5510, and site-to-site VPN with several remote clients. I have to add another client but their network range overlaps an existing tunnel. Both are using I would like to 1-to-1 NAT them as
Is it possible to perform the NAT on my device, post-decryption, or is it necessary that I have them perform the NAT at their end?

View 2 Replies View Related

Copyrights 2005-15, All rights reserved