ASA5520

Similar Questions

• Getting started: ASA5520 w / AIP - SSM

  I'm trying to deploy an ASA5520 to a customer. I have no problem with the piece of implementing firewall, but I don't know where to start with the piece of IPS.

  I searched a bit on the ASA55XX & AIP - SSM, but can't seem to find much on what to do with the AIP - SSM beyond the initial Setup.

  Can someone point me to some beginners IPS documentation that focuses on the AIP - SSM?

  Thank you

  Jeff

  In my view, there is a lack of documentation on how to get the IPS module to work with the ASA. It would be nice if there was a single document on how to get IPS working module with the ASA.

  Start with the documentation of the IPS. It's just on how to configure the IPS himself module. Assign an IP address for management, set the admin password, etc..

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/csids/csids12/index.htm

  Then go to the documentation of the SAA on how to configure ASA to send traffic to IP addresses (via a service-policy):

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/csids/csids11/cliguide/clissm.htm#wp1033926

  There is a free viewer of IPS Cisco event offering to monitor events on the IPS. It can be downloaded from the download page of the Cisco IPS software.

  Finally, read the whitepaper SAFE on the deployment of the IPS and the setting.

  http://www.Cisco.com/en/us/NetSol/ns340/ns394/ns171/ns128/networking_solutions_white_paper09186a00801bc111.shtml

  I hope this helps. Remember messages useful rate. Thank you!

• Placement of asa5520 VPN

  I have an asa5520 I would use to terminate the remote access and VPN l2l for our users and suppliers.

  It seems that the best 2 methods is to have either in parallel with our firewall or in an area demilitarized (recommended Cisco I guess)

  So, I prefer to put behind the DMZ because I will migrate VPN l2l off an asa5540 towards the 5520, I don't want to take contact with all of our suppliers to change their IP endpoint, if I put the 5520 at the same time, that I can't use the 5540 IP address because it is a different placement and current public IP address is not in the same subnet as our border/firewall routers

  Now, IF I put it in a DMZ, the internal interface would connect to the firewall or can I connect it directly to our heart?

  It's one thing, you can decide, based on the security requirements that both options are valid

  If you want the VPN traffic decrypted to be inspected by the firewall, then you must put an end to the inside interface of the FW VPN to perimeter firewall if no need of what you put inside the interface directly to your network internal

  hope this helps

• HA possibility of twinning? two ASA5520s, one with Anyconnect Essentials with Anyconnect more licenses - can these two equivalent license types HA pair successfully?

  I have two ASA5520s... we have 750 Anyconnect Essentials licenses and the other 750 Anyconnect more licenses.

  These can two successfully pair HA or I need to have both on the same exactly the type of license?  that is the two Anyconnect more...

  Thank you!

  HAL

  Hi hmcandrew,

  As far as I know, you need to require one of the ASA on the other to run in failover mode.

  Maybe if you run them in a private network virtual-balancing of the load in place, they will be able to work, but it will not give you HA.

  Please see the following link for more information:

  https://supportforums.Cisco.com/document/67701/ASA-versions-image-names-...

  Please rate if you find this information useful.

  Kind regards

  -Javier-

• NAT 0 to inside and outside of translations in ASA5520

  We have a nat (inside) 0 acl-sheep config statement that defines an acl not NAT 10 internal networks to specific external networks. In addition, we have remote VPN connections that terminate on the ASA5520, and we have 10 networks on sites remote not nat to external networks as well.

  My questions are:

  (1) can I configure a command "nat 0 (outside) acl-nonatremote" in sheep these remote users?

  (2) a nat (inside) 0 aclxx1 can coexist with a nat 0 (outside) aclxx2?

  (3) will be implemented from the nat 0 (outside) command causes a power outage during the implementation or will it be a transparent change? (i.e. a nat acl must be removed and redone to allow them to take effect in the right order).

  Any comments would be appreciated.

  Thank you

  -Scott

  Hi Scott,.

  Don't worry, you're on the right track. Just one last thing, if you have a 'global (internal), 10' then you need to add inside subnet / network in the acl-remotenonat as a destination.

  Kind regards

  Kamal

• ASA5520 routing?

  I connected my asa5520 as:

  CAT6 (port Access)-> ASA5520 (outside)

  CAT6 (trunk port)-> (inside)-> vlan101 and vlan 102

  Configure asa5520 as:

  interface GigabitEthernet0/0

  nameif inside

  security-level 100

  no ip address

  !

  interface GigabitEthernet0/0,101

  VLAN 101

  No nameif

  no level of security

  10.1.1.1 IP address 255.255.255.0

  !

  interface GigabitEthernet0/0,102

  VLAN 102

  No nameif

  no level of security

  10.1.2.1 IP address 255.255.255.0

  !

  interface GigabitEthernet0/1

  nameif outside

  security-level 0

  IP 10.1.3.9 255.255.255.0

  on the cat6, I add static route:

  Route IP 10.1.1.0 255.255.255.0 10.1.3.0

  Because I don't want to use Protocol ospf/rip road. Can I use static route? If so, how can I do it?

  Any comments will be appreciated

  Thanks in advance

  I think your static route in Cat6 must point to the IP of specific next hop of 10.1.3.x instead of 10.1.3.0 (it is subnet ID).

  Anyway, you can still use static in ASA. It supports RIP OSPF.

  To configure static on ASA to Cat6, use (example):

  Route outside 0.0.0.0 0.0.0.0 10.1.3.1, or

  external route 10.1.1.0 255.255.255.0 10.1.3.1

  * assuming 10.1.3.1 is your IP of the interface Vlan Cat6 facing ASA outside interface

  Otherwise, from Cat6, road to ASA inside VLan 101:

  Route IP 10.1.1.0 255.255.255.0 10.1.3.9

  But the other condition is that you must configure static nat for the Vlan101 to talk to the segment of the outside, inside like:

  static (inside, outside) 10.1.1.0 10.1.1.0 netmask 255.255.255.0

  This will allow users/guests of the outside/Cat6 side to talk to Vlan101 internal hosts.

  HTH

  AK

• VPN Internet access ASA5520

  Now my VPN works fine, it connects the user to the network, but it prevents them from using the internet.

  How can I set ASA5520 to force users to use their staff internet vs. Internet companies through the VPN tunnel?

  I agree with Jay's advice on the implications of the split tunneling and the potential threat to your network.

  With the ASA and 7 code version you aren't necessarily need to proxy server. In PIX code pre 7 versions the PIX would not transmit on the same interface, happened on the traffic. With version 7 (also good for PIX and ASA) code, it is possible to configure it so that it will transmit to the interface on which it was received. So even if a proxy server can be a good thing he is most needed.

  HTH

  Rick

• ASA5520 with IPS question

  Hi all

  I'm new in the world of the ASA/IPS, and I have a few questions.

  We buy two ASA5520 with IPS Modules(aip-ssm-10) to a new location, I intend to run in active / standby. This will be my first ASA5520 series.

  My design of network for this site is simple:

  WAN--> 2950 / 24--> 2 x ASA5520 with IPS--> 6513 with SUP2/MFSC-5 x 48-Port 10/100 blades, 1 10/100/1000

  Here are my questions:

  (1) do I need a subscription to Cisco IPS modules? IM being taken is an annual cost to have updates. is it necessary? they will work with it?

  (2) if so, do I need one subscription for each module? even if they are in redundant mode?

  (3) will be an ASA5520 with the support of AIP-SSM-10 200 users?

  (4) do I need a special permit to me to make the VPN? I intend only to have Site to SIte vpn for the moment with perhaps 20 Yes IPhone user VPN, I intend to spend all my VPN user on my next series of ASA (100 VPN users or more).

  any help would be appreciated.

  Kind regards

  Brad

  Brad-

  1 you have a (renewed annually) licence in order to apply the updates to the signature. If you do not have a license, you can still apply the software updates (less frequently) that also contain signature was last updated. The sensor will work correctly without a license. This ism; t as good a agreement that it seems because in software releases there are new engines with the first generation of several new signings. These are generally very noisy and subject to refinement in the subsequent updates of signature.

  2. Yes, you will need a license for each sensor/module.

  3. it depends on how much and what kind of traffic they generate.

  4. no special permits are required for virtual private networks.

  -Bob

• asa5520s load sharing

  Greeting

  I configure Active/active failover on two boxes.

  but, it looks like two active/standby add now. (for subnet 1 go to the first asa5520 and traffic subnet 2 second go to asa5520).

  If possible, configure a subnet share the load on the two asa5520s? If so, how can I do it?

  Comments will be apprecaited

  Thanks in advance

  Product sheet ASA5520 stipulates a flow rate up to 450Mbps and for its 225Mbps vpn, so when you create the solution, you should consider the existing network installation and also the volume of future growth.

  In your case, it's a multi context configuration, so it will not VPN, support dynamic routing, so you need not worry about the use of these features in the future.

  However, sometimes you may experience heavy traffic / firewall uses of the resource due to some malwares or show WILL scan through the firewall

  To avoid this kind of situation,

  Configure the firewall to perform anti-spoofing, prevent back attacks by limiting / control the concurrent connections/sessions.

  Here is a link for Cisco to prevent network attacks.

  http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00809763ea.shtml

• connectivity from client to client on ASA5520 RAS VPN

  All,

  We have a firewall ASA5520-K8, through which client internal connect and receive IP 10.26.206.0/23 addresses. They are not however unable to ping or DRC to the other. A co-worker and I both connect to the firewall and VPN and I tried to make a packet trace of my internal internal assigned IP to its assigned IP. The package is removed in step 10. As a beginner to ASAs, I need help.

  Phase: 10
  Type: NAT
  Subtype:
  Result: DECLINE
  Config:
  NAT (outside) 10 access-list VPN_CLIENTS
  match outside ip 10.26.206.0 255.255.254.0 outside of any
  dynamic translation to the pool 10 (199.x.x.x [Interface PAT])
  translate_hits = 5268139, untranslate_hits = 397840
  Additional information:
  Direct flow from returns search rule:
  ID = 0xc89cc760, priority = 2, domain = nat, deny = false
  hits = 5364150, user_data = 0xc89cc6c0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
  SRC ip = 10.26.206.0, mask 255.255.254.0, port = 0 is
  DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0
  ============================
  Username: weichenberger index: 3455
  Assigned IP: 10.26.206.174 public IP address: 70.x.x.x
  Protocol: IKE IPsecOverNatT
  License: IPsec
  Encryption: AES128 AES256 hash: SHA1
  TX Bytes: bytes 7573810 Rx: 2810147
  Political group: Group of Tunnel JDL_VPN_Users: SecureAuth-access
  Opening time: 08:25:57 Wednesday, January 14, 2015
  Duration: 0 h: 46 m: 42s
  Result of the NAC: unknown
  Map VLANS: VLAN n/a: no

  There are two necessary configs:

  (1) NAT-Exemption for the outside interface. It is similar as what you have inside.

   access-list outside_nat0 permit ip 10.26.206.0 255.255.254.0 10.26.206.0 255.255.254.0 nat (outside) 0 access-list outside_nat0 

  (2) allow SAA send traffic on the same interface, where it was received:

   same-security-traffic permit intra-interface

• Cisco ASA5520 facing ISP with private IP address. How to get the IPSec VPN through the internet?

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-marge-top : 0 ; mso-para-marge-droit : 0 ; mso-para-marge-bas : 10.0pt ; mso-para-marge-left : 0 ; ligne-hauteur : 115 % ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ;}

  Hello guys,.

  I have Cisco ASA5520 facing the ISP with private IP address. We don't have a router and how to get the IPSec VPN through the internet?

  The question statement not the interface pointing to ISP isn't IP address private and inside as well.

  Firewall configuration:

  Firewall outside interface Gi0 10.0.1.2 > ISP 10.0.1.1 with security-level 0

  Firewall inside the interface Ethernet0 192.168.1.1 > LAN switch 192.168.1.2 with security-level 100

  I have public IP block 199.9.9.1/28

  How can I use the public IP address to create the IPSec VPN tunnel between two sites across the internet?

  can I assign a public IP address on the Gig1 inside the interface with the security level of 100 and how to apply inside to carry on this interface?

  If I configure > firewall inside of the item in gi1 interface ip address 199.9.9.1/28 with security-level 100. How to make a safe lane VPN through this interface on the internet?

  I'm used to the public IP address allocation to the interface outside of the firewall and private inside the interface IP address.

  Please help with configuration examples and advise.

  Thank you

  Eric

  Unfortunately, you can only complete the VPN connection on the interface the VPN connection source, in your case the external interface.

  3 options:

  (1) connect a router in front of the ASA and assign your public ip address to the ASA outside interface.

  OR /.

  (2) If your ISP can perform static translation of 1 to 1, then you can always finish the VPN on the external interface and ask your provider what is the static ip address assigned to your ASA out of the IP (10.0.1.2) - this will launch the VPN of bidirectionally

  OR /.

  (3) If your ISP performs PAT (dynamic NAT), then you can only start the tunnel VPN on the side of the ASA and the other end of the tunnel must be configured to allow VPN LAN-to-LAN dynamics.

• S2S VPN ASA5520 and PIX501

  A PIX501 must be able to connect to an ASA5520 on a VPN S2S if they are on the same version of the code, etc.?

  They need not be on the same version of the code. The last code for a PIX501 is 6.3 (5) and an ASA cannot execute code that low. There is no problem swith each with different spec

  It will be useful.

• License to ASA5520 AnyConnect

  Dear team,

  Here is the configuration of one of our clients and they asked for 50 users Anyconnect license with the software installed on the client.

  **************************************************************************************************************************

  ABC # sh ver

  Cisco Adaptive Security Appliance Version 8.2 software (2)
  Version 5.2 Device Manager (3)

  Updated Tuesday, January 11, 10 14:19 by manufacturers
  System image file is "disk0: / asa822 - k8.bin.
  The configuration file to the startup was "startup-config '.

  PSO - ASA up to 110 days 22 hours
  failover cluster upwards of 110 days 22 hours

  Material: ASA5520, 512 MB RAM, Pentium 4 Celeron 2000 MHz processor
  Internal ATA Compact Flash, 256 MB
  BIOS Flash M50FW080 @ 0xffe00000, 1024 KB

  Hardware encryption device: edge Cisco ASA - 55 x 0 Accelerator (revision 0 x 0)
  Start firmware: CN1000-MC-BOOT - 2.00
  SSL/IKE firmware: CNLite-MC-Smls-PLUS - 2.03
  Microcode IPSec:-CNlite-MC-IPSECm-HAND - 2.04
  0: Ext: GigabitEthernet0/0: the address is 001e.f760.a75c, irq 9
  1: Ext: GigabitEthernet0/1: the address is 001e.f760.a75d, irq 9
  2: Ext: GigabitEthernet0/2: the address is 001e.f760.a75e, irq 9
  3: Ext: GigabitEthernet0/3: the address is 001e.f760.a75f, irq 9
  4: Ext: Management0/0: the address is 001e.f760.a760, irq 11
  5: Int: internal-Data0/0: the address is 0000.0001.0002, irq 11
  6: Int: not used: irq 5
  7: Ext: GigabitEthernet1/0: the address is 001e.f760.b729, irq 255
  8: Ext: GigabitEthernet1/1: the address is 001e.f760.b72a, irq 255
  9: Ext: GigabitEthernet1/2: the address is 001e.f760.b72b, irq 255
  10: Ext: GigabitEthernet1/3: the address is 001e.f760.b72c, irq 255
  11: Int: internal-Data1/0: the address is 0000.0003.0002, irq 255

  The devices allowed for this platform:
  The maximum physical Interfaces: unlimited
  VLAN maximum: 150
  Internal hosts: unlimited
  Failover: Active/active
  VPN - A: enabled
  VPN-3DES-AES: enabled
  Security contexts: 2
  GTP/GPRS: disabled
  SSL VPN peers: 2
  Total of the VPN peers: 750
  Sharing license: disabled
  AnyConnect for Mobile: disabled
  AnyConnect Cisco VPN phone: disabled
  AnyConnect Essentials: disabled
  Assessment of Advanced endpoint: disabled
  Proxy sessions for the UC phone: 2
  Total number of Sessions of Proxy UC: 2
  Botnet traffic filter: disabled

  This platform includes an ASA 5520 VPN Plus license.

  Serial number: JMX1210L21K
  Activation key running: 0x7c1f6a6e 0x44e5b71d 0xa8b04110 0x9e043c5c 0x0d329294
  Registry configuration is 0x1
  Last modified by enable_15 at 10:58:52.275 UTC Wednesday, December 18, 2013 configuration

  ****************************************************************************************************************************************

  I quoted the "L-ASA-SSL-50 =" but confused about licensing ASA.

  Please let me know if it's the right one or should I cite something else?

  Kindly let me know if we need to buy the client software for client based SSL VPN?

  Kind regards

  Farhan.

  If the fares user requests the license 50 so I think because it is a pretty clear indication that they are interested in the premium license on this 5520 Essentials license would give them the total number of VPN connections that the platform supports (750 for the 5520).

  Farhan may want to talk with the user know if the Essentials license would give them what they want. If YES Essentials license is much cheaper than the Premium license. What you get with the premium license you do not get with the Essentials license is clientless VPN support and support for things like the assessment distance. But for regular client access VPN Essentials license is often enough.

  Also note that these licenses grant users access when using the regular PC platforms. If you want users to access using mobile devices like smart phones, then you also need the AnyConnecct for the Mobile license.

  HTH

  Rick

• How to upgrade the asa5520?

  I have two asa5520s and they are configured as multi-content and active/active failover.

  Now, I need improve their images. But, I found:

  1. on the asa5520 what admin is active, I can go to the system (System changeto) and I can update the image of the asa and the image of adsm.

  2. on the asa5520 what admin content is standby, I can't go on the side of the system.

  My-asa5520-2/content2 #changeto system

  Command is not valid in the current performance space.

  Could someone advice me:

  How can I upgrade the image of second zone?

  my configuration of failover / multi-contents is false? If so, how to configure the failover / multicontents to make me able to go to the system of the space on the second box?

  Any comments will be appreciated

  Thanks in advance

  YW...

  There is no shutdown command available on SAA. We need walkup to the device and it turned off manually.

  On step 7, "can I first supply ASA1 and after ASA1 take control, that the stop ASA2?

  This will not work, because when ASA1 appear, there is a conflict because both are run on a different version. It can cause other problems in the network so I would not recommend doing so.

  Hope that helps.

  Kind regards

  Maryse.

• Configure asa5520 help

  I connected my asa5520 as:

  CAT6 (port Access)-> ASA5520 (outside)

  CAT6 (trunk port)-> (inside)-> vlan101 and vlan 102

  because I need people to see inside the machines, I used "no-nat-control."

  asa5520 configured as:

  interface GigabitEthernet0/0

  No nameif

  no level of security

  no ip address

  !

  interface GigabitEthernet0/0,101

  VLAN 101

  nameif vlan101

  security-level 100

  10.1.1.1 IP address 255.255.255.0

  !

  interface GigabitEthernet0/0,102

  VLAN 102

  nameif vlan102

  security-level 100

  10.1.2.1 IP address 255.255.255.0

  !

  interface GigabitEthernet0/1

  nameif outside

  security-level 0

  IP 10.1.3.9 255.255.255.0

  access outside the permitted scope icmp a session list

  access outside the interface allowed icmp extended outside the vlan101 interface list

  outside access-group in external interface

  on the cat6, I add static route:

  Route IP 10.1.1.0 255.255.255.0 10.1.3.1

  IP route 10.1.2.0 255.255.255.0 10.1.3.1

  Currently:

  in the box to asa5520, I ping out any machine, but not inside any machine (10.1.1.12 or 10.1.2.12)

  from the outside, I can ping external interface (10.1.3.9), not in interface 10.1.1.1 and not inside the 10.1.1.12 machine

  inside the 10.1.1.12 machine, cannot ping anything.

  Please advice me what I did wrong?

  Thanks in advance

  Did you apply the "permit same-security-traffic inter-interface" command? This is to allow communication between the same interfaces of security (enabled by the inter-interface same-security-traffic command) offers the following benefits:

  ? You can configure more than 101 communication interfaces. If you use different levels for each interface, you can configure only one interface per level (0 to 100).

  ? You can allow traffic to flow freely between all the interfaces of security even without access lists.

  This is necessary because both of your interfaces Vlan101 and Vlan102 are set to use the same level of security 100:

  HostName (config) # permit same-security-traffic inter-interface

  hostname (config) #static (vlan101, vlan102) 10.1.1.0 10.1.1.0 netmask 255.255.255.0

  hostname (config) #static (vlan102, vlan101) 10.1.2.0 10.1.2.0 255.255.255.0 netmask

  http://www.Cisco.com/en/us/customer/products/ps6120/products_command_reference_chapter09186a008063f0fb.html#wp1283601

  Pls note all useful message (s)

  HTH

  AK

• Remove asa5520 access list

  What is the cli command to remove the entire access list, but not a single ACE on asa5520 v7.2.1?

  Hello

  He has 'clear config access-list WORD' where the WORD is the name of the access list.

  Caution - If you do not specify a particular access list, then all access lists are disabled.

  HTH

  Andrew.