ASA CX and PRSM
Hello
If we have only one x-ASA5545 we need a server PRSM manage cela or is it only for the management of multiple devices?
Thanks in advance
PRSM runs either "local" or "out of area".
While you can use PRSM outside to manage one of the ASA CX, you can do all the management of a single device using the PRSM can just as you can do it with out-of-area.
The only limitation that comes to mind is if you want to keep all your logs for a very long time (sometimes needed for legal or regulatory reasons). Eventually they will be filled with local PRSM (which saves on SSD of the ASA) and old. This time is much longer with PRSM outside area that you can allocate more storage for these newspapers.
Tags: Cisco Security
Similar Questions
-
LAN to Lan tunnel between ASA 5505 and 3030.
I am unable to build a tunnel vpn site-to-site between an ASA 5505 and our Cisco 3030. I tried all possible combinations except one that will work. I am able to ping each peer on the other site. Someone at - it a config between two tunnels of Lan to Lan to work between a 5505 and 3030 that works. Thank you
Hello
Please visit this link using config:
http://www.Cisco.com/c/en/us/support/docs/security/VPN-3000-series-conce...
Kind regards
Aditya
Please evaluate the useful messages.
-
Log each ASA connection and router
Hello
I have a Cisco ASA 5520 and a Cisco 3825 router in my network. I want to log every connection to these devices. There are a few users who have different levels of access to these devices in n/w. I would like to connect all these users and what they actually change and to implement in the devices. Is this possible using a RADIUS server or any other method pls. I also have access to reading / writing to these devices. Thank you very much
You can do it too.
You can use auth-proxy (router) passage proxy (ASA) to have the user to authenticate to the connections he and do accounting of GBA. But I don't think you need to do this for all connections, for those who require the intervention of the user.
Let us know if that answers the question.
PK
-
Site to Site VPN between Cisco ASA 5505 and Sonicwall TZ170
I'm trying to implement a VPN site-to site between our data center and office. The data center has a Cisco ASA 5505 and the Office has a Sonicwall TZ170. I managed to configure the two so that the vpn connects. Each of the firewall I ping the IP Address of the internet firewall on the other side and a desktop computer I can ping the IP Address of the firewall internal datacenter but I can't carry traffic between private subnets datacenter and desktop. Can anyone help?
The config below has had IPs/passwords has changed.
External Datacenter: 1.1.1.4
External office: 1.1.1.1
Internal data center: 10.5.0.1/24
Internal office: 10.10.0.1/24
: Saved
:
ASA Version 8.2 (1)
!
hostname datacenterfirewall
mydomain.tld domain name
activate thepassword encrypted
passwdencrypted
names of
name 10.10.0.0 OfficeNetwork
10.5.0.0 DatacenterNetwork name
!
interface Vlan1
nameif inside
security-level 100
10.5.0.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
1.1.1.4 IP address 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone IS - 5
clock to summer time EDT recurring
DNS server-group DefaultDNS
buydomains.com domain name
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
inside_access_in list extended access permit icmp any one
inside_access_in list extended access permitted tcp a whole
inside_access_in list extended access udp allowed a whole
inside_access_in of access allowed any ip an extended list
outside_access_in list extended access permit icmp any one
outside_access_in list extended access udp allowed any any eq isakmp
IP DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0
IP OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0
outside_cryptomap_66.1 list of allowed ip extended access all OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 ip OfficeNetwork 255.255.255.0 allowed extended access list all
outside_cryptomap_66.1 list extended access permit icmp any OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 list extended access allowed icmp OfficeNetwork 255.255.255.0 everything
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
IP verify reverse path to the outside interface
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 623.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route inside 0.0.0.0 0.0.0.0 1.1.1.1 1
Route OfficeNetwork 255.255.255.0 outside 1.1.1.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 10.5.0.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-aes-256 walthamoffice, esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto dynamic-map ciscopix 1 corresponds to the address outside_cryptomap_66.1
Crypto dynamic-map ciscopix 1 transform-set walthamoffice
Crypto dynamic-map ciscopix 1 the value reverse-road
map dynmaptosw 66-isakmp ipsec crypto dynamic ciscopix
dynmaptosw interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 13
preshared authentication
aes-256 encryption
sha hash
Group 2
lifetime 28800
crypto ISAKMP policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 10.5.0.0 255.255.255.0 inside
Telnet timeout 5
SSH 10.5.0.0 255.255.255.0 inside
SSH timeout 5
Console timeout 0
management-access inside
dhcpd address 10.5.0.2 - 10.5.0.254 inside
dhcpd allow inside
!a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP server 66.250.45.2 source outdoors
NTP server 72.18.205.157 source outdoors
NTP server 208.53.158.34 source outdoors
WebVPN
attributes of Group Policy DfltGrpPolicy
VPN-idle-timeout no
username admin passwordencrypted
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key *.
!
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
!
context of prompt hostname
Cryptochecksum:7f319172e5de9c0e550804a263f8e49e
: endMattew, obvious lack of education is the rule exempt from nat for your tunnel, your access list pixtosw is similar on this example, I assume that you have gone through this link, if it does not see the configs on both sides.
Add the statement of rule sheep in asa and try again.
NAT (inside) 0-list of access pixtosw
Concerning
-
ASA 5545 and Anyconnect Licenses
Currently, we use several devices to Cisco ASA 5545. Initially, we learned that we were automatically allowed using the Anyconnect Secure Mobility client with our ASA devices. With recent security issues, we are trying to move to a solution that supports TLS 1.2, and it seems that anyconnect Mobility Client 4.0 will do exactly that. My question is, the automatic authorization supplied with the unit of 5545 ASA include Client Anyconnect 4.0? After an exhaustive search, I am still unable to find this information. Also, is there an official document detailing exactly what licenses is part of 5545 device, with respect to other Cisco Software Solutions?
Thank you
David
All * ASAs include two licenses AnyConnect Premium "free." Which is designed primarily for the evaluation, as most businesses need more two simultaneous remote access users. However, if that's all you need is free and fully functional. It was designed around the Client AnyConnect Secure Mobility 3.x and earlier offer.
From 4.0, there is a new model of licence for AnyConnect. It is explained in the Guide of command AnyConnect. While it is not currently applied by technical means, use of AnyConnect 4.0 requires having a license to do so.
For some additional supporting documents as you initially requested, see also "Feature Licenses" of the Configuration Guide of the SAA.
* Some models do not support remote access VPN and either do not have the feature available or cannot use the license - for example ASA 1000v and an ASA working in multiple context mode.
-
How to accompany the IDS in ASA 5505 and 5520?
Dear All;
We have the following configuration of HW for the ASA 5505 and ASA 5520, we add the functionality of system of detection of Intrusion (IDS) to the two ASA. My question is: what are the modules required to support this function, and what is the deference between IPS and IDS, fact the same Module both the feature?
Part number: Description QTY. ASA5505-BUN-K9
ASA 5505 appliance with SW 10 users, 8 ports, 3DES/AES
1
CON-SNT-AS5BUNK9
SMARTNET 8X5XNBD ASA5505-BUN-K9
1
SF-ASA5505 - 8.2 - K8
ASA 5505 Series Software v8.2
1
CAB-AC-C5
Power supply cord Type C5 U.S.
1
ASA5500-BA-K9
ASA 5500 license (3DES/AES) encryption
1
ASA5505-PWR-AC
ASA 5505 power adapter
1
ASA5505-SW-10
ASA 5505 10 user software license
1
SSC-WHITE
ASA 5505 hood SSC of the location empty
1
ASA-ANYCONN-CSD-K9
ASA 5500 AnyConnect Client + Cisco Security Office software
1
Part number: Description QTY. ASA5520-BUN-K9
ASA 5520 appliance with SW HA, 4GE + 1FE, 3DES/AES
2
CON-SNT-AS2BUNK9
SMARTNET 8X5XNBD ASA5520 w/300 VPN Prs 4GE + 1FE3DES/AES
2
ASA5520-VPN-PL
ASA 5520 VPN over 750 IPsec User License (7.0 only)
2
ASA-VPN-CLNT-K9
Cisco VPN Client (Windows Solaris Linux Mac) software
2
SF - ASA - 8.2 - K8
ASA 5500 Series Software v8.2
2
CAB - ACU
Power supply cord (UK) C13 BS 1363 2.5 m
2
ASA-180W-PWR-AC
Power supply ASA 180W
2
ASA5500-BA-K9
ASA 5500 license (3DES/AES) encryption
2
ASA-ANYCONN-CSD-K9
ASA 5500 AnyConnect Client + Cisco Security Office software
2
SSM-WHITE
ASA/IPS SSM hood of the location
2
Thanks in advance.
Rashed Ward.
Okay, I was not quite correct in my first post.
These modules - modules only available for corresponding models of ASA.
They all can act as IPS (inline mode) or IDS ("Promiscuous" mode), depending on how you configure your policies.
When acting as IPS, ASA redirects all traffic through the module, then all the traffic is inspected and can be dropped inline if a signature is triggered.
When she acts as an ID, ASA a few exemplary traffic is the module for inspection, but the actual traffic is not affected by the module, as it's not inline in this case.
In addition, these modules can be both comdination. That is part of the traffic can be inspected "inline", when some other (more sensitive) traffic can be inspected in promiscuous mode.
To better understand, familiarize themselves with this link:
http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/modules_ips.html
-
Hi all. In our company we have recently upgraded our PIX 515 firewall to ASA 5520, and we started to live a thing strange event. On one of the sites we host, I saw a lot of outdated SSM messages popping up and I think that they are the source of the problem when they surf the site (mainly surfing works fine, but sometimes people cannot content etc.).
I found the Cisco solution for this problem by using the MPF, but one thing confuses me. If I ask a MPF allowing adults MSS on the external interface of the ASA does this political conflict with the comprehensive policy that is on the SAA by default or can they both at the same time?
Thanks in advance for any help.
You can have a single policy per interface and another - global, that by default applies to default-inspection-traffic.
See http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/mpc.html for more details.
-
I hope someone can help me to answer this question:
Currently, we have redundant FWSM and consider a migration of standalone ASA 5500 series firewalls. However, we have a complete VMWare environment and look at the Nexus 1000V. I understand the Nexus 1000V and ESR architecture and implementation, and I don't understand that the ASA 1000V is designed for cloud environments. But I have a question about the ASA 1000V.
Is it possible that a firewall series ASA 5500 be replaced by ASA 1000V? Basically, can an ASA 1000V to be a single firewall solution, or are that ASA 5500 is always necessary?
Is there a datasheet anywhere that compares the ASA 1000V and ASA 5500 series?
Thanks for your help.
-Joe
Depending on what you are using the ASA5500 series for now. If you use the ASA5500 for the remote access vpn and AnyConnect VPN, he will not rely on the first version of the ASA1000V yet.
Here's the Q & A on ASA1000V which includes more information:
http://www.Cisco.com/en/us/partner/prod/collateral/vpndevc/ps6032/ps6094/ps12233/qa_c67-688050.html
Hope that answers your question.
-
VPN site to Site ASA 5510 and 871 w / dynamic IP
What is the best method of creating a VPN site-to site between an ASA 5510 and a router 871 where the 5510 has a static IP address and has 871, a dynamic IP address?
My ASA is running ASA software version 7.0 (5) and I can't find how to create a tunnel for a dynamic IP address via the ASDM. I have currently a tunnel between these two arrangements in place, but it was done by specifying the remote IP address, even if it is dynamic.
Any suggestions or pointers would be * very * appreciated.
-Adam
This can help but it does not show ASDM.
-
Cisco asa 5505 and centos VPN server connection
Hi all
Please I want to set up a VPN between Cisco asa 5505 and centos server.
Here's my senerio
-------------------------
ASA 5505
Public IP 155.155.155.2
Local NETWORK: 192.168.6.X
CentOS Server
------------------
Public ip address: 155.155.155.6
Thank you guys
Apology, do you mean access remote VPN Client of hundred BONE for Cisco ASA 5505?
If the remote access, here are the sample configuration:
http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008060f25c.shtml
-
CSCux29978 - Cisco ASA IKEv1 and IKEv2 buffer overrun vulnerability - 1
Hello
im confused. In the Advisory secruity on this bug https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/ci...
He said not "affected" in the line of the main version of ASA 9.1. 9.1 is so affected by this bug and we need to upgrade to 9.1. (7) or not?
regarding
Christian
Hi Christian,
According to the chart, the only version not affected is code 8.5 9.1 code, you must update to 9.1.7 to be safe from this vulnerability.
Cisco ASA Major Release First version fixed 7.21 Affected; migrate to 9.1 (7) or later version 8.21 Affected; migrate to 9.1 (7) or later version 8.31 Affected; migrate to 9.1 (7) or later version 8.4 8.4 (7.30) 8.51 Not affected 8.61 Affected; migrate to 9.1 (7) or later version 8.7 8.7 (1.18) 9.0 9.0 (4.38) 9.1 9.1 (7) 9.2 9.2 (4.5) 9.3 9.3 (3.7) 9.4 9.4 (2.4) 9.5 9.5 (2.2) It may be useful
-Randy-
-
Hi to everyone.
I have a firewall asa with the external interface pointing to a router on the subnet 192.168.1.0
And the inside of the 192.168.0.0 subnet interface
I want to know if is required to configure the Nat object between the two interface or is not a prerequisite to have connectivity to the Internet behind the asa in the LAN segment
Thank you all!
Hello
It is not necessary to configure the NAT on the SAA, providing your gateway router knows how to route the packets intended for your home network and routers NAT ACL can be configured to include your home subnet.
If you have a router in bridge base that can not configure static routes or dynamic routing and cannot have its edited NAT policy, then you need to configure NAT on the SAA.
see you soon,
SEB.
-
ACS - ASA authorization and accounting
Hello
I have a few questions about the authorization and accounting on the ASA via an ACS server
- When I activate the command 'aaa authorization command' users of SSH commands I get locked on console then I have to configure the console, telnet and allow to be authenticated via Ganymede too, is it possible to allow SSH via Ganymede while keeping the Console and telnet authenticated locally or not even no authentication?
- I visited command 'aaa accounting TAC' accountant on ASA, but I noticed that GBA records just mod configuration commands ' focus on in 15 "not show all command or privilege 1, is possible to fix this?"»
- RADIUS supports authorized SHELL?
Thank you for your support
1.] Unfortunately, it is currently not possible to exclude the command authorization serial number / console or ssh to users while having it apply to other methods of access in the case of ASA. Once you run this command, it would be applicable to all methods such as ssh, telnet, http, enable and console. This can be easily achieved by IOS (routers and switches) by creating a list of method.
2.] when configuring the aaa accounting command , each other than display command command commands entered by an administrator is recorded and sent to accounts or servers. This is a default behavior on the SAA. IOS send/check orders show on ACS/Ganymede.
http://www.Cisco.com/en/us/docs/security/ASA/asa81/command/ref/A1.html
Kind regards
Jousset
The rate of useful messages-
-
VLANS with Cisco ASA 5505 and non-Cisco switch
I have an ASA5505 and a switch Netgear GSM7224 L2 that I try to use together. I can't grasp how VLANs (or at least how they should be put in place). When configuring my VLAN on the ASA5505 it seems simple enough, but then on my switch, I thought I'd create just the same VLAN numbers that I used on the SAA and then add the ports that I wanted to use for each VLAN.
Currently on my ASA, I have the following VLAN configured...
outside - vlan11 - Port 0/0
inside - vlan1 - Port 0/1
dmz_ftp - vlan21 - Port 0/2
Port of Corp - vlan31 - 0/3
I need to do the same thing on my switch as well... On my way, I'm a little confused as to how I need to configure the VLAN. Below is the screenshot of web GUI...
Note: Normally you can now change the VLAN ID (red), but in this case the default vlan (vlan id 1) may not be changed or deleted, you can does not change its settings.
Tagged (green), Untagged (purple) and Autodetect (yellow) you must select at least 1. I'm not sure how to in one place to tell my inner vlan (vlan1).
I want VLAN1 ports 1-8 on my Netgear switch used alone to talk to interface/0/1 on the ASA5505 port. I don't want to NOT port 9-24 able to talk to ports 1-8 on the Netgear switch ports OR 0/0, 0/2 - 0 / 7 on the Cisco ASA 5505.
So, how can I configure my inner Vlan1 on ports 1-8 on the switch? Do mark, UNTAG, autodetect them? What about tours? I've been a bit the impression that I would set up my VLAN on both devices, then trunk port 1 and dedicate this port on both devices to nothing other than the sheath and the security of vlan would then take the packages where they need to go. Is this the wrong logic?
Hi Arvo,
If the port of the ASA is just part of a single VLAN (i.e. e0/0 single door 11 VLAN), this is called an access port. If the port of the ASA had to carry several VLANs, it would constitute a Trunk port.
To access ports (VLAN unique), you must set the switch corresponding to be unidentified for port this VLAN individual. If you decide to configure a trunk port, then the port of the switch must be set for labelling for each of VLAN who win the trunk.
For example, ASA I have:
interface Ethernet0/1
switchport access vlan 20
!
interface Vlan20
nameif inside
security-level 100
ip address 192.168.100.254 255.255.255.0
With the above configuration, the configuration of the switch would look like this (assuming the e0/1 port of the SAA is connected to 0/1 on the switch):
VLAN 20 - 0/1 = untagged
If instead you use a trunk port, the config would look like this:
interface Ethernet0/0
switchport trunk allowed vlan 10,20
switchport mode trunk
!
interface Vlan10
nameif outside
security-level 0
ip address dhcp setroute
!
interface Vlan20
nameif inside
security-level 100
ip address 192.168.100.254 255.255.255.0
Assuming that the ASA e0/0 port is connected to 0/1 on the switch):
VLAN 10 - 0/1 = tagged
VLAN 20 - 0/1 = tagged
Hope that helps.
-Mike
-
Between asa 5510 and router VPN
Hello
I configured ASA 5510 to vpn LAN to LAN with router 17 857. and between the routers.
between vpn routers works very well.
from the local network behind the ASA I can ping the computers behind routers.
but computers behind routers, I cannot ping PSC behind ASA.
I have configured the remote access with vpn cisco 4.X client, it works well with routers, but cannot work with asa.
the asa is connected to the wan via zoom router (adsl)
Are you telnet in the firewall?
Follow these steps to display the debug output:
monitor terminal
farm forestry monitor 7 (type this config mode)
Otherwise if its console, do "logging console 7'.
can do
Debug crypto ISAKMP
Debug crypto ipsec
and then generate a ping from one device to the back of the ASA having 192.168.200.0 address towards one of the VPN subnets... and then paste the result here
Concerning
Farrukh
Maybe you are looking for
-
Change the video recording in the camera mode?
Just bought an iPad 9.7 inch Pro. I can't believe that they did not provide a way to switch between video and recording slo - mo resolutions and cadences of the camera app. I can go slipping between video and Slo - Mo and the amount of time, but I ca
-
TrueSuite Access Manager on Portege M700 - 13p
Whenever I start my new Portege M700 this program says that the drivers are not installed for the fingerprint reader and t testing install again. Install TrueSuite Access Manager starts and then it asks me to restart my PC. Every time. I'm currently
-
Why I can't get through to the Fund on the website of the general register Office?
I try to bmd certificates order from my laptop but it won't let me through the page "order". I have no problem on my home computer so I think it's something to do with the settings on the laptop.
-
I bought PS 14 elements of office Depot and after going on with my redemption code download site, it fails. I think the code is bad. Any help?
-
How to create more output to browsers
Having a strange problem with the size of the preview in the Muse.My design in Muse appears about 25% greater than when previewed in Google, FF, IE and Safari, even if my opinion is set to 100% in Muse and 100% in each respective browser. Also smalle