ASA 5520 Active standby and ssl vpn loadbalancing

Similar Questions

• AnyConnect and SSL - VPN without client

  Are there problems in running Cisco AnyConnect and SSL - VPN without client side by side?

  I am currently looking into adding features for an ASA AnyConnect who currently set up to operate without SSL - VPN client. The system without client is not removed. I don't know how to set it up, I wonder if someone has already set up this or if there is no problem with this Setup?

  Hi Daniel

  It's a little complicated if you want a granular authentication and authorization, but it works.

  I'm running an ASA with IPSec, SSL Client and clientless SSL.

  Each of these virtual private networks with user/one-time-password name and certificate based authentic.

  The main challenge is to put in place its own structure of profile cards, connection profiles, group policies and dynamic access policies.

  Feel free to ask questions...

  Stephan

• ASR1K and SSL VPN

  I'm having trouble finding information on SSL VPN for ASR1K, when we bought the boxes told us that SSL VPN was on the roadmap of the software, but that was back in 2010 and now I can not find anything nor can I get the right information.

  Does anyone have a recommendation on what to do or who to ask?

  PLS, contact your Cisco account manager as he or she would be able to provide additional information.

  There is normally a long list of features to add to the product, and SSL VPN is one of them who was asked to appear on the ASR. However, depending on the needs, it might be on the top of the list of the road map, or to the bottom of the list. Your Cisco AM should be able to get information from the product team.

• Windows IPSEC and SSL VPN client on the same machine

  Matches (coexistence) installation of IPSEC and SSL vpn clients that are supported on the same computer, windows (XP and Win7)?

  As mentioned by Patricia and Jennifer (5 stars), you can install two clients on the same machine without any problem.

  The tricky part comes when you are trying to connect two clients at the same time, that's when you may encounter unexpected problems.

  However, if your intention is to install both clients and connect them individually and not at the same time, you'll be fine.

  If you have any other questions, please mark this question as answered and note all messages that you have found useful.

  Thank you.

  Portu.

  Post edited by: Javier Portuguez

• ASA from Site to Site and SSL VPN stop working

  Thanks in advance for any advice

  We have an ASA 5510, users were able to connect via to all connect without any problems. We opened a new office with an ASA 5505 and decided to give VPN site-to-site on IPSec. We used the basic wizard and everything went smoothly at both ends. However, users who always used SSL VPN says so that they can connect to the original site, they are no longer in their RDP virtual machines or get anywhere on the network. I don't know why something like this can happen.

  You can change the SSL VPN DHCP scope to give a different subnet for IP addresses. Maybe try 192.168.10.0 255.255.255.0. Let me know if you can and if that corrects the issue.

  Sent by Cisco Support technique iPhone App

• ASA5505: Configure the ASA for IPSec and SSL VPN?

  Hello-

  I currently have my 5505 for SSL AnyConnect VPN connections Setup.  Is it possible to set up also the 5505 for IPSec VPN connections?

  So, basically my ASA will be able to perform SSL and IPSec VPN tunnels, at the same time.

  Thank you!

  Kim,

  Yes, you can configure your ASA to support the AnyConnect VPN IPSec connections and at the same time.  In short, for the configuration of IPSec, you should configure at least a strategy ISAKMP, a set of IPSEC, encryption, tunnel group card processing and associated group policy.

  Matt

• Tunnels of router that support s multiple VPN IPsec AND SSL VPN

  I have a main office and an office, each with a RVL200 connected via the IPSec VPN tunnel. We grow faster than we thought and add 2 more branches. Is there a router that is similar to the RVL200 can I put in my main office in support of multiple IPSec tunnels connected to RVL200 in branches, but also keep the SSL VPN?

  It seems that the Cisco ASA 5505 will do.

• Cisco ASA CX active / standby

  Hello friends

  One of my clients has a couple of ASA 5545 work quite well as active / standby failover. But the configuration that is not copied to the secondary unit is CX. Do you know how to get it? Please, do not hesitate to request further information, comment or document will be appreciated.

  Kind regards!

  The CX configurations are not part of the active reserve ASA replication.

  How to synchronize the configurations of CX is to use PRSM (first Security Manager - product under separate license, not the one provided with the CX) running on a virtual machine in device mode.

  Reference.

  Once you find out what pair CX with a PRSM "out of area", all configuration changes are deployed both to the pair.

• VPN site to Site and SSL VPN

  Hey guys,.

  I'm working on a solution. I have a Home Office with my data center being there while my DR site is my plant and she nearly 20 users. I have a third place, which is a branch offices with only 2 people.

  I intend to deploy a VPN Site to Site between the data center and DR Site while branches can connect via SSL VPN. Please confirm whether this solution is viable or not. Where do I go to a Site for the office too.

  Thank you

  If we knew more about your environment so we might be able to give more complete answers. But base on what you've described, I believe that a VPN site-to site between the data center and the disaster recovery site and VPN for remote access of the branch is an appropriate solution.

  HTH

  Rick

• L2 VPN and SSL VPN-Plus server on the same edge is not possible

  Hello

  Today, I was busy trying to test the L2 VPN functionality and I got an error message that I had no right to allow the 'L2 VPN server' when the SSL VPN-Plus feature is enabled on the server VPN of L2.

  Is it possible that these two can run concurrently?

  And what is the reason for which (technical) why it does not work, or may not work at the moment?

  The L2 VPN as well as the VPN-Plus SSL enabled overall feature works very well elsewhere, but with the server it does not work...

  OK, I should have been more precise here. It is using the same service on the GSS. You cannot activate both at the same time. This is how it is. Maybe this will change later.

• VPN site to site ASA and SSL VPN

  Hello

  Already configured vpn site to site for both sites. Now, I try to configure vpn remote access to one site.

  But I'm starting to config some command like below to access remote vpn, the existing site-to-site vpn disconnected auto.

  No crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  Please, help me to check.

  Thank you

  Ko Htwe

  Hello

  You can have a single card encryption for an interface, you must configure both tunnels (access site to & remote) in a single card with number of different sequesnce encryption. Please make sure that the sequence number for the remote access is higher than for the site to site.

  You can also get this back to the config command, why did you remove it.

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  If you still have a problem, please let us know the configuration.

  Kind regards

  Mohammad

• Licenses, IPS on pair of Cisco ASA 5510 active / standby

  I have two ASA 5510 devices in Active mode / standby.  I think of buying both used IPS modules and their installation.  My question is, me 1 or 2 licenses IPS that requires?  We are on 8.4 right now, and I see 8.3 Cisco changed license to c/o to where you need only one license, not two.  This is true for any way VPN licenses, so I was wondering if the same applies to licenses IPS.

  In addition, the unique licensing model will as much as only requiring a base for the pair a/s license too?  Or is the base license, something that you must have two pair a/s?

  Failover doesn't f, you have only one module in the ASA elementary school. You must have two modules. But it is fine if you do not have a subscription license for your secondary IPS (at least for the system).

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• ASA 5520 IPSEC L2L and ACL

  Just a quick question.  I have two ASA with a vpn site-to-site tunnel built between them.  One is the Central Administration

  site and the other is a remote site.   On the remote site, I have the following IP as local hosts:

  192.168.1.5

  192.168.1.6

  192.168.1.55

  Those workstations attempt to access networks according to destination

  10.1.1.0 24

  10.1.2.0 24

  10.1.3.0 24

  In my interesting traffic on the remote end, I set myself to use

  IP 192.168.1.0 255.255.255.0---> 10.1.0.0 255.255.0.0

  On the side of the Central Headquarters, my interesting traffic looks like

  IP 10.1.0.0 255.255.0.0---> 192.168.1.0 255.255.255.0

  So now I'm encrypting IP traffic between 10.1.0.0 24 16 to 192.168.1.0.   This part works very well.    But now I want to put an ACL

  the tunnel to allow ONLY 3 hosts on the 192.168.1.x on some ports for 3 subnets.   This is done by group policy for a tunnel from Lan Lan 2.  If I apply a group policy and define a filter of IPV4.  This will accomplish what I'm shooting?

  I am doing this on the ASDM, so keep this in mind when you try to explain to me how to solve this problem.

  Thanks in advance,

  I should stay in bed...

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml

• Moving from SSL VPN licenses to other ASA

  Hello

  Be gentle, it's my first post.  We currently have an ASA 5520 with 25 remost SSL VPN licenses.  We have also some 5510's unused.  Anyone know if the SSL licenses are transferable to the 5510 unused to the 5520 to increase the amount that the 5520 has?

  Thank you

  Alistair

  Unfortunately the licenses are not transferable to one ASA to another.

  Here is the URL for your reference:

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/license/license82.html#wp194956

  second indent under the 'Guidelines and additional Limitations' section)

  Hope that answers your question.

• SSL VPN - ASA - Active Directory LDAP

  Hello

  Scenario: ASA 8.0 (3) running SSL VPN for remote users. LDAP also authenticates access and connect to the ASA.

  For some reason any (we had a power failure, but the problem may be caused by other reasons as well), I can not connect to the ASA, as my login ID does not work, and remote users get connection error when trying to authenticate via SSL VPN web gui.

  I have rebooted the ASA and AD without any change in the situation. This service worked very well before and the problem happened suddenly. No one has all the changes for the configs. Customer do not have a backup configuration. Any suggestion on what would be the best next action to solve this problem? I'm not expert on the Microsoft LDAP configuration, and if anyone knows where I can check in Microsoft windows server 2003 for the possible LDAP problem, that would be greatly appreciated.

  Thank you

  rdianat

  the ldap bind account is just a normal user account. He didn't need even administrative permissions. If you want to use ldap for password changes he needs to password change permissions, but otherwise just a normal user account - make sure it cannot be locked in AD or the password never expires none of this things. you will see the name of the ldap account in the config of the SAA.

  LDAP-login-password *.

  LDAP-connection-dn *.