Cisco ASA 5520, 8.02, 4GE SSM, IPS?

Similar Questions

• What VPN work as a PPTP vpn firewall CISCO-ASA-5520.

  Hi all

  Can you please tell me which replace the VPN I can configure PPTP on ASA 5520 firewall. What VPN work as a PPTP vpn firewall CISCO-ASA-5520.

  You can use the wizard VPN of RA with ASDM and confiugre L2TP IPSEC VPN that does not need a VPN Client must be installed.

  Michael

  Please note all useful posts

• Is supported PPTP vpn cisco ASA 5520 firewall?

  Hi all

  I'm Md.kamruzzaman. My compnay buy a firewall of cisco asa 5520 and I want to configure PPTP vpn on asa 5520 firewall. Is it possible to configure the PPTP vpn to asa firewall. If possible can you please tell me what is the procedure to configure the PPTP vpn.

  Best regards

  MD.kamruzzaman

  Sorry, but the Cisco ASA firewall does not support PPTP VPN termination.

  You may terminate IPSec and SSL VPN but not of type PPTP.

  If you are new to the ASA, how best to configure the supported VPN types is via the VPN Wizard integrated into the application of management of ASSISTANT Deputy Ministers.

• Routing with Cisco ASA 5520 VPN

  I have installed IPsec vpn remote users in the Cisco ASA 5520 using RADIUS in my main network. Works very well. I have a site to my Cisco ASA5520 tunnels going to other sites, some of the tunnels have Cisco ASA and some have SonicWalls. I wish that my users VPN remote IPSec to be able to navigate in these tunnels is a site to access remote subnets attached to these tunnels. Do I need to use a combination of routing and the ACL? Or can I just use ACL only? Or just use routing only?

  Thank you

  Carlos

  Hello

  The key to set up here is the two ACL of VPN L2L end points that determine the 'interesting' traffic to connect VPN L2L. You will also need to confirm that the connection of the VPN Client is configured so that traffic to the remote sites have sent to the connection of the VPN client. There are also other things that you should check on your ASA plant

  Here most of the things you usually have to confirm

  • Set up 'permit same-security-traffic intra-interface' if it is already present in your configuration
    • This setting will allow connections to form between the hosts that are connected to the same interface on the ASA. In this case, applies because the VPN client users are connected to the interface 'outside' of the ASA and also remote sites are connected to the ASA to "external". If the traffic between the remote VPN Client and VPN L2L sites will be to enter and exit the same interface
  • You will need to check how the customer if configured VPN connection. Split or full Tunnel tunnel
    • If the connection of the VPN Client is configured as Split Tunnel then you need to add all the networks from the remote to the Split Tunnel, so that the connections between the VPN Client is transmitted to the ASA and from there connections VPN L2L
    • If the connection of the VPN Client is configured as full Tunnel, then there no problem that all traffic is transferred to the Client VPN connection all its assets
  • Define the VPN pool in the ACL of VPN L2L
    • You should make sure that the pool network VPN Client is defined in the ACL that define 'interesting' traffic to connect VPN L2L. So, you need to add the pool VPN VPN L2L configurations on the sites of Central America and remote control
  • Configure NAT0 / NAT exempt for remote VPN Client to L2L VPN Site traffic at both ends of the VPN L2L
    • You must ensure that the NAT0 / exempt NAT rules exist for the VPN Client for Remote Site traffic. This will have to be configured on the SAA "outside" interface. Format of configuration varies naturally a bit on the ASA Central his software level.

  These should be the most common things to set up and confirm for traffic to flow between the VPN Client and Remote Sites

  Hope this helps please rate if yes or ask more if necessary.

  -Jouni

• Upgrade to Cisco ASA 5520 8.2.5 to 9.1.7

  Hello

  I have an upgrade tonight for a customer to upgrade a StandAlone ASA 5520 in version 8.2.5 in 9.1.7. I have the same upgrade week next to the same client for a failover pair.

  I already have this kind of process of 8.2.x upgrade to 9.1.x so I know the entire process, since I have to take a first step 8.2.5 8.4.6 then 9.1.7. In addition this customer has no statement of Nat therefore normally an easy process.

  But today during my routine to prepare for the upgrade (I prefer to make a double or triple check before) I found this bug:

  https://BST.cloudapps.Cisco.com/bugsearch/bug/CSCuh19234;JSESSIONID=0A69...

  This bug is fixed in version 8.4.7, and 8.4.6.99. But it is not recommended by the upgrade process for a 8.2.5 to 8.4.7 jump and I can not find the 8.4.6.99 version.

  I don't want to have any problems during my upgrade with something I can avoid.

  As I said I already have this updated in the past without any problem and with a more complex configuration.

  Has anyone as a return to this process for the last months? Should I do an extra step? (before first 8.2.5 to 8.4.5 8.4.6 or 8.4.7)

  Thank you in advance for your answer.

  There are a few incidents reported for ASA 5520 8.2.5 hit this defect running.

  You can go for an extra for 8.4.x upgrade as you mentioned to avoid default we can't say for sure if you will encounter this situation or not.  8.4.6.99 can be a picture of development so be unavailable unless you want to call TAC and confirm or obtain any other image in 8.4.x train.
  Maybe add another upgrade code can't hurt as that hit the bug.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• Addition of Compact Flash in a Cisco ASA 5520

  I'm trying to install a 512 MB COmpact Flash for an ASA 5520 Cisco.  We inserted the compact flash, but when we do a DIR, it does not show.  even as an unformatted device.

  What should we do to make this a usable CF?  I just need to recharge the ASA or do I need to format the CF.  It was inserted into the slot in the back of the ASA 5520, and we ensured that had been properly rests.

  Thank you

  Dwane

  The Cisco FAQ article:

  I can hot flash player? For example, is it possible to change the flash player when Cisco ASA is turned on and running?

  It is always recommended that you turn off the Cisco ASA, while you insert the flash drive. This disables all working processes and allows the ASA to recognize the flash from the startup process.

• iPad VPN from Cisco ASA 5520

  Hello

  I'm trying to get my ipad to VPN to our Cisco ASA5520.

  I think I have all the correct settings on both ends (I am able to vpn to the asa using a cisco 871 as the remote client).

  I think that for some reason the client vpn on ipad is not even make the asa. My question is: How can I monitor the ASA logs to see if the same connection attempt and eventually find the failure?

  Thank you

  M

  try: -.

  Debug crypto ISAKMP

  Debug crypto ipsec

  Vpn-sessiondb SH remote control (to see if the client is connected)

  I have configured ipad for remote vpn client, the user could connect to the 5520 but why that I had to use the ip addresses to access, but I couldn't use internal dns names. try to understand that at this moment.

  It may be useful

  Manish

• Cisco ASA 5520 cannot ping between VPN Tunnels

  I have the main site and sites A and B.  A to connect to the hand and B connects to the main.  I can ping from A hand and has for main.  I can ping from main to B and B to main.  However, I can not ping from A to B.  A and B are sonicwall 2040 and main is a 5520.  The question should not be with the 5520 none allowing traffic between the two VPN Tunnels, but I can't understand why it does not work.  Can someone give an idea on that?  Thanks in advance.

  Hello

  I see that you use ASDM. Always makes my eyes bleed when I need to look at the DM_INLINE of named objects and try to make sense the CLI format

  Seems to me that there are problems with the NAT.

  If you don't mind a small break between the main Site and remote locations, I'd say changing some follows the NAT configuration

  Remove old

  no nat source (indoor, outdoor) public static DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_10 DM_INLINE_NETWORK_10 non-proxy-arp-search of route static destination

  no nat source (indoor, outdoor) public static DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_12 DM_INLINE_NETWORK_12 non-proxy-arp-search of route static destination

  Add a new

  object-group network NETWORK-2790

  object-network 10.217.0.0 255.255.255.0

  object-network 10.217.1.0 255.255.255.0

  object-group network NETWORK-3820

  object-network 10.216.0.0 255.255.255.0

  object-network 10.216.1.0 255.255.255.0

  object-group network NETWORK-COLO

  object-net 10.8.0.0 255.255.255.0

  destination of NETWORK of NETWORK-2790-2790 static NAT (outside, outside) static source NETWORK - 3820 - 3820

  NAT static destination of NETWORK of NETWORK-COLO-COLO (indoor, outdoor) static source NETWORK - 2790 - 2790

  NAT static destination of NETWORK of NETWORK-COLO-COLO (indoor, outdoor) static source NETWORK - 3820 - 3820

  The first new line of configuring NAT manages the NAT0 configuration for traffic between SiteA and SiteB. The following configurations of NAT 2 manage the NAT0 for traffic between the main Site - hand Site SiteA - SiteB

  -Jouni

• CISCO ASA 5520 telnet

  I have a CISCO5520 and telnet has suddenly stopped working on my inside interface.

  I checked my syslog error and get the following

  5

  October 15, 2013

  11:56:02

  Resource 'telnet' limit 5 reaching for the context "single_vf".

  No idea what this could be?

  Thank you

  James.

  You can get the output of

  Conn. HS all the port 23

  Show proc | in telnet and

  See the version

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• VPN Cisco ASA 5520

  Hello, my name is Jeremy Rose, I am a novice...

  I'm trying to set up a VPN in a private network to access a server from outside of our firewall.

  The VPN functions, however, we are unable to contact the server once the VPN is in place.

  I can provide more information, as requested, any ladies or gentlemen reccomendations?

  Thank you

  Jeremy

  Ensure that valuable traffic corresponds to both ends basically.  So if your server is 192.168.1.10 and changed to 10.1.1.10 you must update under the card encryption ACL.

• Cisco Anyconnect VPN and IPSEC coexist on ASA 5520?

  Can a Cisco ASA 5520 which has been configured as IPSEC VPN gateway and also be configured as a gateway ANYCONNECT VPN and vpn IPSEC service anyconnect vpn clients clients maintenance at the same time? Any negative impact on the performance or any other problem that everyone knows?

  I guess that by 2 connection limit, you are referring to the 2 licenses for anyconnect?  You should consider using the anyconnect essentials license, which is relatively cheap (100-200 dollars I think) and will take you to the edge of the platform with anyocnnect.

  You shouldn't have any problem using IPSEC with LDAP client.  It is quite common - my company is IPSEC as Anyconnect off the coast of the same interface using authentication ldap (even same-group policy) for the two.

  -Jason

• Between Cisco ASA VPN tunnels with VLAN + hairpin.

  I have two Cisco ASA (5520 and 5505) both with version 9.1 (7) with Over VPN and Security Plus licenses. I try to understand all the internet a traffic tunnel strategy VLAN especially on the 5520 above the 5505 for further routing to the internet (such as a hair/u-turn hairpin). A few warnings:

  1. The 5505 has a dynamically assigned internet address.
  2. The 5505 has sometimes no device turned on behind her, bringing interfaces down to the inside (which can cause problems from site to site).
  3. The 5520 cannot be a client of ezvpn due to its current role as a server of webvpn (anyconnect).

  Let me know if I need to post my current config. Basically, I'm starting from scratch after several attempts.

  Thank you!

  1. The 5505 has a dynamically assigned internet address.

  You can use the following doc to set up the VPN and then this document to configure Hairping/U tuning

  2. the 5505 has sometimes no device turned on behind her, bringing interfaces down to the inside (which can cause problems from site to site).

  Make sure that the interface is connected to a switch so that it remains all the TIME.

  3. 5520 the may not be a ezvpn customer due to she has current as one role anyconnect webvpn ()) server.

  You can use dynamic VPN with normal static rather EZVPN tunnel.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• nat ASA 5520 problem

  Hi I have a Cisco Asa 5520 and I want to vpn site-to-site by using another interface with a carrier of lan to lan, the problem is when I try to pass traffic have the syslog error to follow:

  No translation not found for udp src lan2lan:10.5.50.63/44437 dst colo: biggiesmalls groups / 897
   
  LAN to LAN service interface is called: lan2lan
  one of the internal interfaces is called: colo
  
  I think that is problem with Nat on the SAA but I need help with this.
   
  Config:
   
  !
  interface GigabitEthernet0/0
  nameif outside
  security-level 0
  eve of fw - ext 255.255.255.0 address IP XXaaaNNaa
  OSPF cost 10
  OSPF network point-to-point non-broadcast
  !
  interface GigabitEthernet0/1
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/1.50
  VLAN 50
  nameif lb
  security-level 20
  IP 10.1.50.11 255.255.255.0
  OSPF cost 10
  !
  interface GigabitEthernet0/1,501
  VLAN 501
  nameif colo
  security-level 90
  eve of fw - int 255.255.255.0 172.16.2.253 IP address
  OSPF cost 10
  !
  !
  interface GigabitEthernet1/1
  Door-Lan2Lan description
  nameif lan2lan
  security-level 0
  IP 10.100.50.1 255.255.255.248
  !
  access extensive list ip 10.1.0.0 lan2lan_cryptomap_51 allow 255.255.0.0 object-group elo
  permit access list extended ip sfnet 255.255.255.0 lan2lan_cryptomap_51 object-group elo
  pager lines 24
  Enable logging
  host colo biggiesmalls record
  No message logging 313001
  External MTU 1500
  MTU 1500 lb
  MTU 1500 Colo
  lan2lan MTU 1500
  ICMP unreachable rate-limit 1 burst-size 1
  ARP timeout 14400
  NAT-control
  Global 1 interface (external)
  interface of global (lb) 1
  Global (colo) 1 interface
  NAT (lb) 1 10.1.50.0 255.255.255.0
  NAT (colo) - access list 0 colo_nat0_outbound
  NAT (colo) 1 10.1.13.0 255.255.255.0
  NAT (colo) 1 10.1.16.0 255.255.255.0
  NAT (colo) 1 0.0.0.0 0.0.0.0
  external_access_in access to the external interface group
  Access-group lb_access_in in lb interface
  Access-group colo_access_in in interface colo
  Access-group management_access_in in management of the interface
  Access-group interface lan2lan lan2lan
  !
  Service resetoutside
  card crypto match 51 lan2lan_map address lan2lan_cryptomap_51
  lan2lan_map 51 crypto map set peer 10.100.50.2
  card crypto lan2lan_map 51 game of transformation-ESP-3DES-SHA
  crypto lan2lan_map 51 set reverse-road map
  lan2lan_map interface lan2lan crypto card
  quit smoking
  ISAKMP crypto identity hostname
  ISAKMP crypto enable lan2lan
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Crypto isakmp nat-traversal 20
  enable client-implementation to date
  IPSec-attributes tunnel-group DefaultL2LGroup
  pre-shared-key xxXnnAA
  tunnel-group 10.100.50.2 type ipsec-l2l
  tunnel-group 10.100.50.2 General-attributes
  Group Policy - by default-site2site
  No vpn-addr-assign aaa
  No dhcp vpn-addr-assign
  Telnet timeout 5
  !
   

  The VPN is OK? ("' isakmp crypto to show his" should show a MM_Active tunnel to the peer address ")

  Normally exempt us VPN site-to-site of NAT traffic. This could be your problem. If you can share your configuration, we can have a look.

  p.s. you should affect the question of the security / VPN forum.

• disable the cisco ASA connection using only activate password via asdm

  Hi all

  How to disable the connection to my cisco asa 5520 using only activate password via asdm? I like to asdm connection using the user name and password. TIA!

  The command:

   aaa authentication http console LOCAL

  .. .will be force users accessing to ASDM (which uses transport http (s)) to be authenticated on the LOCAL database.

  You can also specify another list of defined authentication method, such as RADIUS, RADIUS or AD. (Although t wew love to leave a LOCAL method on the spot, in which case your external authentication server is not available.)

• With an ASA 5520 port forwarding

  Hi all

  I recently bought a Cisco ASA 5520 on eBay for study and I decided to only use it as a firewall between my home LAN and Internet. Wow, what a learning curve! I managed to add my internal networks as objects and create a rule (thanks to youtube) NAT to PAT my internal devices out of the Internet with ASSISTANT Deputy Ministers, but I am really struggling to do the following:-

  -allow all incoming traffic that hits the outside interface for port 38921 and nat at 10.1.10.101:38921

  -allow all incoming traffic that hits the outside interface for port 30392 and nat at 10.1.10.101:30392

  Can someone guide me on how to do it, because I have a couple of services that run behind these ports on a server I want to get when I'm not at home? My (rather messy) config is as follows:-

  hostname FW1

  activate the encrypted password

  encrypted passwd

  names of

  !

  interface GigabitEthernet0/0

  Description * externally facing Internet *.

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  interface GigabitEthernet0/1

  Description * internal face to 3750 *.

  nameif inside

  security-level 100

  IP 10.1.10.2 255.255.255.0

  !

  interface GigabitEthernet0/2

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface GigabitEthernet0/3

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Management0/0

  nameif management

  security-level 100

  IP 192.168.1.1 255.255.255.0

  !

  passive FTP mode

  the VLAN1 object network

  subnet 192.168.1.0 255.255.255.0

  Legacy description

  network of the WiredLAN object

  10.1.10.0 subnet 255.255.255.0

  Wired LAN description

  network of the CorporateWifi object

  10.1.160.0 subnet 255.255.255.0

  Company Description 160 of VLAN wireless

  network of the GuestWifi object

  10.1.165.0 subnet 255.255.255.0

  Description Wireless VLAN 165 comments

  network of the LegacyLAN object

  subnet 192.168.1.0 255.255.255.0

  Description Legacy LAN in place until the change on

  the file server object network

  Home 10.1.10.101

  Description File Server

  service object Service1

  tcp source eq eq 38921 38921 destination service

  1 service Description

  the All_Inside_Networks object-group network

  network-object VLAN1

  network-object, object WiredLAN

  network-object, object CorporateWifi

  network-object, object GuestWifi

  network-object, object LegacyLAN

  object-group service Service2 tcp - udp

  port-object eq 30392

  object-group service DM_INLINE_TCPUDP_1 tcp - udp

  port-object eq 30392

  Group-object Service2

  object-group Protocol TCPUDP

  object-protocol udp

  object-tcp protocol

  Outside_access_in list extended access allowed object-group TCPUDP any inactive FileServer object-group DM_INLINE_TCPUDP_1 object

  Outside_access_in list extended access allowed object Service1 any inactive FileServer object

  pager lines 24

  Enable logging

  asdm of logging of information

  Outside 1500 MTU

  MTU 1500 internal

  management of MTU 1500

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 714.bin

  don't allow no asdm history

  ARP timeout 14400

  service interface NAT (inside, outside) dynamic source FileServer Service1 inactive Service1

  NAT (all, outside) interface dynamic source All_Inside_Networks

  Access-group Outside_access_in in interface outside

  Internal route 10.1.160.0 255.255.255.0 10.1.10.1 1

  Internal route 10.1.165.0 255.255.255.0 10.1.10.1 1

  Internal route 192.168.1.0 255.255.255.0 10.1.10.1 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  Enable http server

  http 10.1.160.15 255.255.255.255 internal

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  Telnet 10.1.160.15 255.255.255.255 internal

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  interface ID client DHCP-client to the outside

  management of 192.168.1.2 - dhcpd address 192.168.1.254

  enable dhcpd management

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  username privilege of encrypted password of Barry 15

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  Cryptochecksum:19be38edefe8c3fd05e720aedee62c8e

  : end

  1. This is just one example of configuration and another option with to reason and avoid to send us the complete configuration of NAT:

  network of the 10.1.10.101 object

  Home 10.1.10.101

  service object 38921

  tcp source eq 38921 service

  service object 30392

  tcp source eq 30392 service

  NAT (inside, outside) 1 static source 10.1.10.101 38921 38921 service interface

  NAT (inside, outside) 1 static source 10.1.10.101 30392 30392 service interface

  Let me know if it works