License with anyconnect on asa 5520

Dear All,
We have a single ASA 5510  with version 7.2 (3) in our network and configured many IPSEC site to site, IPSEC - remote access vpn and webvpn with SSL.  Everything is working well.
ASA-5510# sh ver
Cisco Adaptive Security Appliance Software Version 7.2(3)
Device Manager Version 5.2(2)
Compiled on Wed 15-Aug-07 16:08 by builders
System image file is "disk0:/asa723-k8.bin"
Config file at boot was "startup-config"
ASA-5510-1 up 86 days 11 hours
Hardware:   ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                             Boot microcode   : CNlite-MC-Boot-Cisco-1.2
                             SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
0: Ext: Ethernet0/0         : address is 0027.0d38.034e, irq 9
1: Ext: Ethernet0/1         : address is 0027.0d38.034f, irq 9
2: Ext: Ethernet0/2         : address is 0027.0d38.0350, irq 9
3: Ext: Ethernet0/3         : address is 0027.0d38.0351, irq 9
4: Ext: Management0/0       : address is 0027.0d38.0352, irq 11
5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs               : 100
Inside Hosts                : Unlimited
Failover                    : Active/Active
VPN-DES                     : Enabled
VPN-3DES-AES                : Enabled
Security Contexts           : 2
GTP/GPRS                    : Disabled
VPN Peers                   : 250
WebVPN Peers                : 25
This platform has an ASA 5510 Security Plus license.
===============================================================================================
As business improves we are now  planning to upgrade our ASA 5510 to ASA 5520 ( 02 nos ver 8.2(5).     With the new ASA 5520 we would be planning to buy Any connect vpn license as well.
Finally we will need on the ASA 5520  IPSEC site to site vpn, IPSEC - remote access vpn , clientless vpn with SSL & Any connect vpn license.  What are the licences should i purchase inorder to have all the above services on the box with version 8.2(5) ?
suppose  if i need to have cisco desktop software which is the license i should have along with other services?
Thanks in advance

I am just away from office .. Will provide same tomorrow...
Meanwhile  "L-ASA-SSL-50=ASA 5500 SSL VPN 50 Premium User License"  this is the licence i have procured from cisco. I would need
both Anyconnect vpn & SSL clientless should be working on the system.  Hope i would acheive with the above license.
Below is the output i got when generated the Licence key. please clarrify. thanks in advance
Failover                        : Enabled  
Encryption-DES                  : Enabled  
Encryption-3DES-AES             : Enabled  
Security Contexts               : 2        
GTP/GPRS                        : Disabled 
AnyConnect Premium Peers        : 50       
Other VPN Peers                 : 750      
Advanced Endpoint Assessment    : Disabled 
AnyConnect for Mobile           : Disabled 
AnyConnect for Cisco VPN Phone  : Disabled 
Shared License                  : Disabled 
UC Phone Proxy Sessions         : Default  
Total UC Proxy Sessions         : Default  
AnyConnect Essentials           : Disabled 
Botnet Traffic Filter           : Disabled 
Intercompany Media Engine       : Disabled 

Similar Messages

  • Failover License Sync Between Two ASA 5520

    According to the link here:
    http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/intro_license.html#wp1315746
    Starting with Version 8.3(1), it no longer needs to install identical licenses. Typically, we only buy a license only for the primary unit; for Active/Standby failover, the secondary unit inherits the primary license when it becomes active.
    So I wanna know if there's some additional configuration to synchronize the licenses such as SSL VPN or Context between the primary one and the second one? Or they can just synchronize by default as soon as I finish the failover configuration and when the primary one gets down, the second one will take over the role including licenses automatically?

    Karsten - I have an issue in synching the licenses between active and standby firewalls. I have installed the security plus license on the primary firewall and done the failover configurations, but on standby firewall i can't enable the failover commands as the license is not replicated to standby firewall. Earlier both ASA has base version installed. what might be the issue. Does the replication happen automatic? let me know.. how the primary firewall knows the standby inorder to replicate the license?

  • ASA 5520 Anyconnect License on Active/Standby Failover pair

    Hi
    Our customer has purchased 2 x L-ASA-AC-E-5520= Anyconnect Essentials VPN Licenses (750 Users)
    Ive installed both activated licenses as per the cisco guides, I didnt get any errors on the install. I did a reload on both, they are both back up and running as active/standby but when I do a sh ver the license still shows "ASA 5520 VPN Plus License"
    Am I being dumb and has this worked successfully or should it not now display Anyconnect when I do a sh ver
    Any help would be much appreciated on this one please
    Regards
    Graham

    Thanks Marvin
    Below is the show ver, but I was kind of expecting there to be a mention of Anyconnect if I had activated the license
    We previously had the VPN Plus License, and it still shows VPN Plus
    Licensed features for this platform:
    Maximum Physical Interfaces : Unlimited
    Maximum VLANs               : 150      
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                     : Enabled  
    VPN-3DES-AES                 : Enabled  
    Security Contexts           : 2        
    GTP/GPRS                     : Disabled
    VPN Peers                   : 750      
    WebVPN Peers                 : 2        
    AnyConnect for Mobile       : Disabled
    AnyConnect for Linksys phone : Disabled
    Advanced Endpoint Assessment : Disabled
    UC Proxy Sessions           : 2        
    This platform has an ASA 5520 VPN Plus license.

  • Patch: CSCun25809, AnyConnect Password Management Fails with SMS Passcode for ASA 5520

    Patch: CSCun25809, AnyConnect Password Management Fails with SMS Passcode for ASA 5520
    Will this patch be installed in a version which I can use on ASA5520, if I understand the documentation correct, this patch is only installed in versions which are running on -X models of the ASA. 9.2, 9.3

    Once the ASA has dynamic NAT enabled to an outside interface, routing between same security level will not work.
    You need to add route exempt the inside interfaces to all private subnet.

  • ASA 5520 VPN load balancing with Active/Standby failover on 2 devices only...

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    This topic has been beat to death, but I did not see a real answer. Here is configuration:
    1) 2 x ASA 5520, running 8.2
    2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
    3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
    4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
    This sounds trivial, but I cannot find a clear answer (without testing this); and many people are confusing the issue. Here are some examples of confusion. These do not apply to my scenario.
    Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
    The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
    In any case, any experts out there that can answer question? TIA!

    Wow, some good info posted here (both questions and some answers). I'm in a similar situation with a couple of vpn load-balanced pairs... my goal was to get active-standby failover up and running in each pair- then I ran into this thread and saw the first post about the unique IP addr pools (and obviously we can't have unique pools in an active-standby failover rig where the complete config is replicated). So it would seem that these two features are indeed mutually exclusive. Real nice initial post to call this out.
    Now I'm wondering if the ASA could actually handle a single addr pool in an active-standby fo rig- *if* the code supported the exchange of addr pool status between the fo members (so they each would know what addrs have been farmed out from this single pool)? Can I get some feedback from folks on this? If this is viable, then I suppose we could submit a feature request to Cisco... not that this would necessarily be supported anytime soon, but it might be worth a try. And I'm also assuming we might need a vip on the inside int as well (not just on the outside), to properly flip the traffic on both sides if the failover occurs (note we're not currently doing this).
    Finally, if a member fails in a std load-balanced vpn pair (w/o fo disabled), the remaining member must take over traffic hitting the vip addr (full time)... can someone tell me how this works? And when this pair is working normally (with both members up), do the two systems coordinate who owns the vip at any time to load-balance the traffic? Is this basically how their load-balancing scheme works?
    Anyway, pretty cool thread... would really appreciate it if folks could give some feedback on some of the above.
    Thanks much,
    Mike

  • Cisco ASA 5520 Failover with DMZ

    I have a pair of Cisco ASA 5520s running as a primary/standby. Everything is working properly with the primary ASA, however when I trigger a failover, everything works except for the DMZ interface on the standby ASA. I've poured over the configs, but perhaps I have been staring at them too long because I am just not seeing anything.
    Below is the output of the sh run failover, sh failover, and sh run interface commands for each unit...
    PRIMARY ASA
    Primary-ASA# sh run failover
    failover
    failover lan unit primary
    failover lan interface stateful1 GigabitEthernet0/3
    failover key *****
    failover link stateful1 GigabitEthernet0/3
    failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
    Primary-ASA# sh failover
    Failover On
    Failover unit Primary
    Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 160 maximum
    Version: Ours 8.2(5), Mate 8.2(5)
    Last Failover at: 20:39:23 CDT Sep 3 2013
    This host: Primary - Active
    Active time: 69648 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
         Interface outside (184.61.38.254): Normal
         Interface inside (192.168.218.252): Normal
         Interface dmz (192.168.215.254): Normal (Waiting)
         Interface management (192.168.1.1): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Other host: Secondary - Standby Ready
    Active time: 2119 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.253): Normal
    Interface inside (192.168.218.253): Normal
    Interface dmz (192.168.215.252): Normal (Waiting)
    Interface management (192.168.1.2): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
    IPS, 6.0(3)E1, Up
    Primary-ASA# sh run interface
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
    ospf cost 10
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
    ospf cost 10
    interface GigabitEthernet0/2
    nameif dmz
    security-level 50
    ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
    ospf cost 10
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
    ospf cost 10
    management-only
    STANDBY ASA
    Standby-ASA# sh run failover
    failover
    failover lan unit secondary
    failover lan interface stateful1 GigabitEthernet0/3
    failover key *****
    failover link stateful1 GigabitEthernet0/3
    failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
    Standby-ASA# sh failover
    Failover On
    Failover unit Secondary
    Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 160 maximum
    Version: Ours 8.2(5), Mate 8.2(5)
    Last Failover at: 20:39:23 CDT Sep 3 2013
    This host: Secondary - Standby Ready
    Active time: 2119 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.253): Normal
    Interface inside (192.168.218.253): Normal
    Interface dmz (192.168.215.252): Normal (Waiting)
    Interface management (192.168.1.2): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Other host: Primary - Active
    Active time: 70110 (sec)
          slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.254): Normal
    Interface inside (192.168.218.252): Normal
    Interface dmz (192.168.215.254): Normal (Waiting)
    Interface management (192.168.1.1): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Standby-ASA# sh run interface
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
    ospf cost 10
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
    ospf cost 10
    interface GigabitEthernet0/2
    nameif dmz
    security-level 50
    ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
    ospf cost 10
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
    ospf cost 10
    management-only
    Does anyone see something I might be missing? I am at a loss...

    I'll just answer my own question...the configs are correct, but it the interface on the standby ASA was plugged into an improperly configured switchport. That'll do it everytime.

  • ASA 5520 with multiple contexts becomes unresponsive

    Hi all. We have encountered a perculiar problem with a pair of our ASA 5520 firewalls with 2 contexts(each context being active on different ASA). What we are seeing is that sometimes when we have a sudden increase of inbound traffic(mostly HTTP) towards servers behind the firewalls they seem to go bananas for the lack of a better expression.
    They become unaccessible via ssh and the traffic drops significantly. The problem is mitigated by disabling one of the monitored interfaces for failover(on one of the switches the firewall is connected to) so that both contexts become active on one firewall. After that the firewalls seem to come to their senses and we can enable the switch interface again but sometimes one of the pair needs to be rebooted to restore full funcionality.
    To us it seems like there is a problem with failover and contexts but we haven't been able to pin it down. The failover link isn't stateful and when we tested the failover it works fine both ways with each ASA taking up the full load when the other ASA of the pair is not available.
    Did anyone come across a similar situation with their firewalls?

    We are using ASA version 8.2(5).
    The configuration of the failover is:
    failover
    failover lan unit primary
    failover lan interface fail_int GigabitEthernet0/3
    failover interface ip fail_int x.x.x.x 255.255.255.252 standby x.x.x.x
    failover group 1
      preempt
    failover group 2
      secondary
      preempt
    Output of the "show failover":
      This host:    Primary
      Group 1       State:          Active
                    Active time:    399409 (sec)
      Group 2       State:          Standby Ready
                    Active time:    111 (sec)
                    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
                      admin Interface out (x.x.x.x): Normal (Waiting)
                      admin Interface inside (x.x.x.x): Normal (Waiting)
                      admin Interface dmz4 (x.x.x.x): Normal
                      admin Interface dmz1(x.x.x.x): Normal (Not-Monitored)
                      C1 Interface out (x.x.x.x): Normal (Waiting)
                      C1 Interface inside (x.x.x.x): Normal (Waiting)
                      C1 Interface dmz5 (x.x.x.x): Normal
                      C1 Interface dmz1 (x.x.x.x): Normal (Not-Monitored)
                    slot 1: empty
      Other host:   Secondary
      Group 1       State:          Standby Ready
                    Active time:    0 (sec)
      Group 2       State:          Active
                    Active time:    398992 (sec)
                    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
                      admin Interface out (x.x.x.x): Normal (Waiting)
                      admin Interface inside (x.x.x.x): Normal (Waiting)
                      admin Interface dmz4 (x.x.x.x): Normal
                      admin Interface dmz1(x.x.x.x): Normal (Not-Monitored)
                      C1 Interface out (x.x.x.x): Normal (Waiting)
                      C1 Interface inside (x.x.x.x): Normal (Waiting)
                      C1 Interface dmz5 (x.x.x.x): Normal
                      C1 Interface dmz1 (x.x.x.x): Normal (Not-Monitored)
                    slot 1: empty
    Stateful Failover Logical Update Statistics
            Link : Unconfigured.
    When I disabled the monitored interface it was always the same interface altough I believe the same effect could be achieved with disabling any of the monitored interfaces.
    As for memory and CPU when it happens I cannot access the units to get a reading but I asume it's through the roof. 
    The thing that troubles me more is that the situation persists when the load drops and I have to perform the solution from the first post. One would assume that with the drop of the load that both firewalls would start to behave normally.
    And I see that I haven't mentioned it before but when the load drops both units continue to handle traffic normally but I sometimes see as a side effect that I cannot SSH to one of the units. That unit usually has to be restarted.

  • Inter VLAN Routing with ASA 5520 and Cat 2960

    Hi there,
    I am a complete novice at networking, but I was tasked to have an ASA 5520 do inter VLAN routing (since my shop doesn't have a layer 3 router).
    As a basic setup, I am trying to have three workstations on three different VLANs communicate with each other.  The attached screenshot shows the topology.
    I am unable to ping from a PC to the ASA...therefore I can't ping to other VLANs.  Any assistance would be greatly appreciated.
    ROUTER CONFIG:
    ciscoasa#
    ciscoasa# show run
    : Saved
    ASA Version 8.3(1)
    hostname ciscoasa
    domain-name null
    enable password ###### encrypted
    passwd ###### encrypted
    names
    dns-guard
    interface GigabitEthernet0/0
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/1
    no nameif
    security-level 100
    ip address 10.10.1.1 255.255.255.0
    interface GigabitEthernet0/1.10
    vlan 10
    nameif vlan10
    security-level 100
    ip address 10.10.10.1 255.255.255.0
    interface GigabitEthernet0/1.20
    vlan 20
    nameif vlan20
    security-level 100
    ip address 10.10.20.1 255.255.255.0
    interface GigabitEthernet0/1.30
    vlan 30
    nameif vlan30
    security-level 100
    ip address 10.10.30.1 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa831-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name null
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list global_access extended permit icmp any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu vlan10 1500
    mtu vlan20 1500
    mtu vlan30 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    asdm image disk0:/asdm-631.bin
    no asdm history enable
    arp timeout 14400
    access-group global_access global
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.5 inside
    dhcpd enable inside
    dhcpd address 10.10.10.101-10.10.10.253 vlan10
    dhcpd enable vlan10
    dhcpd address 10.10.20.101-10.10.20.253 vlan20
    dhcpd enable vlan20
    dhcpd address 10.10.30.101-10.10.30.253 vlan30
    dhcpd enable vlan30
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics port
    threat-detection statistics protocol
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DD
    CEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4ad1bba72f1f51b2a47e8cacb9d3606a
    : end
    SWITCH CONFIG
    Switch#show run
    Building configuration...
    Current configuration : 2543 bytes
    version 12.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname Switch
    boot-start-marker
    boot-end-marker
    no aaa new-model
    system mtu routing 1500
    ip subnet-zero
    spanning-tree mode pvst
    spanning-tree extend system-id
    no spanning-tree vlan 1
    vlan internal allocation policy ascending
    interface GigabitEthernet0/1
    description Port Configured As Trunk
    switchport trunk allowed vlan 1,10,20,30,1002-1005
    switchport mode trunk
    interface GigabitEthernet0/2
    switchport access vlan 10
    switchport mode access
    interface GigabitEthernet0/3
    switchport access vlan 20
    switchport mode access
    interface GigabitEthernet0/4
    switchport access vlan 30
    switchport mode access
    interface GigabitEthernet0/5
    interface GigabitEthernet0/6
    interface GigabitEthernet0/7
    interface GigabitEthernet0/8
    interface GigabitEthernet0/9
    interface GigabitEthernet0/10
    interface GigabitEthernet0/11
    interface GigabitEthernet0/12
    interface GigabitEthernet0/13
    interface GigabitEthernet0/14
    interface GigabitEthernet0/15
    interface GigabitEthernet0/16
    interface GigabitEthernet0/17
    interface GigabitEthernet0/18
    interface GigabitEthernet0/19
    interface GigabitEthernet0/20
    interface GigabitEthernet0/21
    interface GigabitEthernet0/22
    interface GigabitEthernet0/23
    interface GigabitEthernet0/24
    interface GigabitEthernet0/25
    interface GigabitEthernet0/26
    interface GigabitEthernet0/27
    interface GigabitEthernet0/28
    interface GigabitEthernet0/29
    interface GigabitEthernet0/30
    interface GigabitEthernet0/31
    interface GigabitEthernet0/32
    interface GigabitEthernet0/33
    interface GigabitEthernet0/34
    interface GigabitEthernet0/35
    interface GigabitEthernet0/36
    interface GigabitEthernet0/37
    interface GigabitEthernet0/38
    interface GigabitEthernet0/39
    interface GigabitEthernet0/40
    interface GigabitEthernet0/41
    interface GigabitEthernet0/42
    interface GigabitEthernet0/43
    interface GigabitEthernet0/44
    interface GigabitEthernet0/45
    interface GigabitEthernet0/46
    interface GigabitEthernet0/47
    interface GigabitEthernet0/48
    interface Vlan1
    ip address 10.10.1.2 255.255.255.0
    no ip route-cache
    interface Vlan10
    no ip address
    no ip route-cache
    interface Vlan20
    no ip address
    no ip route-cache
    interface Vlan30
    no ip address
    no ip route-cache
    ip default-gateway 10.10.1.1
    ip http server
    ip http secure-server
    control-plane
    line con 0
    line vty 5 15
    end

    ciscoasa# capture cap10 interface vlan10
    ciscoasa# capture cap20 interface vlan20
    ciscoasa# show cap cap10
    97 packets captured
       1: 17:32:32.541262 802.1Q vlan#10 P0 10.10.10.101.2461 > 10.10.10.1.8905:  ud
    p 96
       2: 17:32:36.741294 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
       3: 17:32:36.741523 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
       4: 17:32:37.539217 802.1Q vlan#10 P0 10.10.10.101.2462 > 10.10.10.1.8905:  ud
    p 98
       5: 17:32:39.104914 802.1Q vlan#10 P0 10.10.10.101.2463 > 10.12.5.64.8906:  ud
    p 95
       6: 17:32:41.738914 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
       7: 17:32:41.739143 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
       8: 17:32:42.544023 802.1Q vlan#10 P0 10.10.10.101.2464 > 10.10.10.1.8905:  ud
    p 93
       9: 17:32:46.747352 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      10: 17:32:46.747580 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      11: 17:32:47.546633 802.1Q vlan#10 P0 10.10.10.101.2465 > 10.10.10.1.8905:  ud
    p 98
      12: 17:32:51.739921 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      13: 17:32:51.740150 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      14: 17:32:52.544100 802.1Q vlan#10 P0 10.10.10.101.2466 > 10.10.10.1.8905:  ud
    p 98
      15: 17:32:56.741859 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      16: 17:32:56.742088 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      17: 17:32:57.547396 802.1Q vlan#10 P0 10.10.10.101.2467 > 10.10.10.1.8905:  ud
    p 98
      18: 17:33:01.742728 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      19: 17:33:01.742957 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      20: 17:33:02.547609 802.1Q vlan#10 P0 10.10.10.101.2468 > 10.10.10.1.8905:  ud
    p 97
      21: 17:33:06.742774 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      22: 17:33:06.743018 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      23: 17:33:07.543337 802.1Q vlan#10 P0 10.10.10.101.2469 > 10.10.10.1.8905:  ud
    p 93
      24: 17:33:10.375514 802.1Q vlan#10 P0 10.10.10.101.137 > 10.10.10.255.137:  ud
    p 50
      25: 17:33:11.114679 802.1Q vlan#10 P0 10.10.10.101.137 > 10.10.10.255.137:  ud
    p 50
      26: 17:33:11.742728 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      27: 17:33:11.742957 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      28: 17:33:11.864731 802.1Q vlan#10 P0 10.10.10.101.137 > 10.10.10.255.137:  ud
    p 50
      29: 17:33:12.546266 802.1Q vlan#10 P0 10.10.10.101.2470 > 10.10.10.1.8905:  ud
    p 98
      30: 17:33:16.746497 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      31: 17:33:16.746726 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      32: 17:33:17.548403 802.1Q vlan#10 P0 10.10.10.101.2471 > 10.10.10.1.8905:  ud
    p 97
      33: 17:33:21.744880 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      34: 17:33:21.745109 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      35: 17:33:22.545351 802.1Q vlan#10 P0 10.10.10.101.2472 > 10.10.10.1.8905:  ud
    p 95
      36: 17:33:23.785558 802.1Q vlan#10 P0 10.10.10.101.137 > 10.10.10.255.137:  ud
    p 50
      37: 17:33:24.522464 802.1Q vlan#10 P0 10.10.10.101.137 > 10.10.10.255.137:  ud
    p 50
      38: 17:33:25.272568 802.1Q vlan#10 P0 10.10.10.101.137 > 10.10.10.255.137:  ud
    p 50
      39: 17:33:26.744926 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      40: 17:33:26.745154 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      41: 17:33:27.548708 802.1Q vlan#10 P0 10.10.10.101.2473 > 10.10.10.1.8905:  ud
    p 96
      42: 17:33:31.749625 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      43: 17:33:31.749854 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      44: 17:33:32.550096 802.1Q vlan#10 P0 10.10.10.101.2474 > 10.10.10.1.8905:  ud
    p 97
      45: 17:33:36.748343 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      46: 17:33:36.748572 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      47: 17:33:37.546251 802.1Q vlan#10 P0 10.10.10.101.2475 > 10.10.10.1.8905:  ud
    p 95
      48: 17:33:41.745566 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      49: 17:33:41.745795 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      50: 17:33:42.547975 802.1Q vlan#10 P0 10.10.10.101.2476 > 10.10.10.1.8905:  ud
    p 97
      51: 17:33:46.747855 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      52: 17:33:46.748084 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      53: 17:33:47.548403 802.1Q vlan#10 P0 10.10.10.101.2477 > 10.10.10.1.8905:  ud
    p 94
      54: 17:33:51.747718 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      55: 17:33:51.747931 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      56: 17:33:52.547670 802.1Q vlan#10 P0 10.10.10.101.2478 > 10.10.10.1.8905:  ud
    p 97
      57: 17:33:54.134239 802.1Q vlan#10 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      58: 17:33:56.750678 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      59: 17:33:56.750891 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      60: 17:33:57.563035 802.1Q vlan#10 P0 10.10.10.101.2479 > 10.10.10.1.8905:  ud
    p 97
      61: 17:33:59.245272 802.1Q vlan#10 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      62: 17:34:01.752188 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      63: 17:34:01.752402 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      64: 17:34:01.995737 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 49
      65: 17:34:01.995813 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 34
      66: 17:34:01.995950 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 49
      67: 17:34:01.996011 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 34
      68: 17:34:01.996118 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 49
      69: 17:34:01.996179 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 34
      70: 17:34:02.551836 802.1Q vlan#10 P0 10.10.10.101.2480 > 10.10.10.1.8905:  ud
    p 98
      71: 17:34:03.011306 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 49
      72: 17:34:03.011367 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 34
      73: 17:34:03.011443 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 49
      74: 17:34:03.011489 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 34
      75: 17:34:03.011550 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 49
      76: 17:34:03.011596 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 34
      77: 17:34:04.027037 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 49
      78: 17:34:04.027082 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 34
      79: 17:34:04.027174 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 49
      80: 17:34:04.027250 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 34
      81: 17:34:04.027311 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 49
      82: 17:34:04.027357 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 34
      83: 17:34:04.745811 802.1Q vlan#10 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      84: 17:34:06.058514 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 49
      85: 17:34:06.058605 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.23.427:  u
    dp 34
      86: 17:34:06.058651 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 49
      87: 17:34:06.058712 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.16.22.427:  u
    dp 34
      88: 17:34:06.058758 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 49
      89: 17:34:06.058819 802.1Q vlan#10 P0 10.10.10.101.2263 > 156.80.200.40.427:
    udp 34
      90: 17:34:06.750907 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      91: 17:34:06.751151 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      92: 17:34:07.552751 802.1Q vlan#10 P0 10.10.10.101.2481 > 10.10.10.1.8905:  ud
    p 96
      93: 17:34:11.752082 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      94: 17:34:11.752326 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      95: 17:34:12.553392 802.1Q vlan#10 P0 10.10.10.101.2482 > 10.10.10.1.8905:  ud
    p 96
      96: 17:34:16.755438 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
      97: 17:34:16.755682 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
      98: 17:34:17.554811 802.1Q vlan#10 P0 10.10.10.101.2483 > 10.10.10.1.8905:  ud
    p 97
      99: 17:34:21.751303 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
    100: 17:34:21.751563 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
    101: 17:34:22.552034 802.1Q vlan#10 P0 10.10.10.101.2484 > 10.10.10.1.8905:  ud
    p 95
    102: 17:34:26.753989 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
    103: 17:34:26.754218 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
    104: 17:34:27.560334 802.1Q vlan#10 P0 10.10.10.101.2485 > 10.10.10.1.8905:  ud
    p 98
    105: 17:34:31.755499 802.1Q vlan#10 P0 10.10.10.101 > 10.10.10.1: icmp: echo re
    quest
    106: 17:34:31.755728 802.1Q vlan#10 P0 10.10.10.1 > 10.10.10.101: icmp: echo re
    ply
    107: 17:34:32.563950 802.1Q vlan#10 P0 10.10.10.101.2486 > 10.10.10.1.8905:  ud
    p 95
    107 packets shown
    ciscoasa# show cap cap20
    92 packets captured
       1: 17:26:53.653378 802.1Q vlan#20 P0 10.10.20.101.1187 > 216.49.94.13.80: S 8
    20343450:820343450(0) win 65535
       2: 17:27:12.019133 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
       3: 17:27:17.214481 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
       4: 17:27:55.593688 802.1Q vlan#20 P0 10.10.20.101.1188 > 216.49.94.13.80: S 1
    499891746:1499891746(0) win 65535
       5: 17:27:58.555284 802.1Q vlan#20 P0 10.10.20.101.1188 > 216.49.94.13.80: S 1
    499891746:1499891746(0) win 65535
       6: 17:28:04.564790 802.1Q vlan#20 P0 10.10.20.101.1188 > 216.49.94.13.80: S 1
    499891746:1499891746(0) win 65535
       7: 17:29:06.504856 802.1Q vlan#20 P0 arp who-has 10.10.20.1 tell 10.10.20.101
       8: 17:29:06.504917 802.1Q vlan#20 P0 arp reply 10.10.20.1 is-at 54:75:d0:ba:4
    6:bb
       9: 17:29:06.505222 802.1Q vlan#20 P0 10.10.20.101.1189 > 216.49.94.13.80: S 4
    7080594:47080594(0) win 65535
      10: 17:29:09.467032 802.1Q vlan#20 P0 10.10.20.101.1189 > 216.49.94.13.80: S 4
    7080594:47080594(0) win 65535
      11: 17:29:15.476537 802.1Q vlan#20 P0 10.10.20.101.1189 > 216.49.94.13.80: S 4
    7080594:47080594(0) win 65535
      12: 17:30:17.417245 802.1Q vlan#20 P0 10.10.20.101.1190 > 216.49.94.13.80: S 1
    445997597:1445997597(0) win 65535
      13: 17:30:18.156043 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      14: 17:30:20.378688 802.1Q vlan#20 P0 10.10.20.101.1190 > 216.49.94.13.80: S 1
    445997597:1445997597(0) win 65535
      15: 17:30:23.220356 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      16: 17:30:26.388102 802.1Q vlan#20 P0 10.10.20.101.1190 > 216.49.94.13.80: S 1
    445997597:1445997597(0) win 65535
      17: 17:30:28.721047 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      18: 17:30:34.222507 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      19: 17:33:43.156928 802.1Q vlan#20 P0 arp who-has 10.10.20.101 tell 10.10.20.1
    01
      20: 17:33:44.187002 802.1Q vlan#20 P0 arp who-has 10.10.20.1 tell 10.10.20.101
      21: 17:33:44.187047 802.1Q vlan#20 P0 arp reply 10.10.20.1 is-at 54:75:d0:ba:4
    6:bb
      22: 17:33:44.187261 802.1Q vlan#20 P0 10.10.20.101 > 10.10.20.1: icmp: echo re
    quest
      23: 17:33:44.187520 802.1Q vlan#20 P0 10.10.20.1 > 10.10.20.101: icmp: echo re
    ply
      24: 17:33:44.239016 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      25: 17:33:44.327360 802.1Q vlan#20 P0 10.10.20.101.53835 > 208.231.55.26.53:
    udp 34
      26: 17:33:44.989740 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      27: 17:33:45.150611 802.1Q vlan#20 P0 10.10.20.101.6646 > 10.10.20.255.6646:
    udp 236
      28: 17:33:45.331312 802.1Q vlan#20 P0 10.10.20.101.53835 > 208.231.55.27.53:
    udp 34
      29: 17:33:45.740943 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      30: 17:33:46.331892 802.1Q vlan#20 P0 10.10.20.101.53835 > 208.231.55.26.53:
    udp 34
      31: 17:33:46.492131 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      32: 17:33:47.243502 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      33: 17:33:47.994501 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      34: 17:33:48.335050 802.1Q vlan#20 P0 10.10.20.101.53835 > 208.231.55.26.53:
    udp 34
      35: 17:33:48.335141 802.1Q vlan#20 P0 10.10.20.101.53835 > 208.231.55.27.53:
    udp 34
      36: 17:33:48.745658 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      37: 17:33:49.496861 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      38: 17:33:50.248812 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      39: 17:33:50.249300 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      40: 17:33:50.999170 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      41: 17:33:50.999246 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      42: 17:33:51.750342 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      43: 17:33:51.750418 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      44: 17:33:52.341336 802.1Q vlan#20 P0 10.10.20.101.53835 > 208.231.55.26.53:
    udp 34
      45: 17:33:52.341474 802.1Q vlan#20 P0 10.10.20.101.53835 > 208.231.55.27.53:
    udp 34
      46: 17:33:52.501576 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      47: 17:33:52.501652 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      48: 17:33:53.254183 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 174
      49: 17:33:53.254320 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 204
      50: 17:33:54.134361 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      51: 17:33:54.755118 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 174
      52: 17:33:54.823535 802.1Q vlan#20 P0 10.120.2.198.1261 > 161.69.12.13.443: R
    250934743:250934743(0) ack 2427374744 win 0
      53: 17:33:54.823901 802.1Q vlan#20 P0 10.120.2.198.1262 > 161.69.12.13.443: R
    3313764765:3313764765(0) ack 1397588942 win 0
      54: 17:33:54.824618 802.1Q vlan#20 P0 10.10.20.101.1269 > 161.69.12.13.443: S
    2860571026:2860571026(0) win 65535
      55: 17:33:56.257448 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 174
      56: 17:33:57.759833 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 174
      57: 17:33:57.779729 802.1Q vlan#20 P0 10.10.20.101.1269 > 161.69.12.13.443: S
    2860571026:2860571026(0) win 65535
      58: 17:33:59.245394 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      59: 17:33:59.262178 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 186
      60: 17:34:00.263780 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 186
      61: 17:34:01.265382 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 186
      62: 17:34:02.266908 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 186
      63: 17:34:03.268540 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      64: 17:34:03.789189 802.1Q vlan#20 P0 10.10.20.101.1269 > 161.69.12.13.443: S
    2860571026:2860571026(0) win 65535
      65: 17:34:04.019591 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      66: 17:34:04.745933 802.1Q vlan#20 P0 10.10.10.101 > 10.10.20.101: icmp: echo
    request
      67: 17:34:04.770757 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      68: 17:34:05.521991 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      69: 17:34:06.273209 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      70: 17:34:07.024367 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      71: 17:34:07.775518 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      72: 17:34:08.526706 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 68
      73: 17:34:09.277939 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 174
      74: 17:34:09.278061 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 174
      75: 17:34:09.278702 802.1Q vlan#20 P0 10.10.20.101.138 > 10.10.20.255.138:  ud
    p 204
      76: 17:34:15.810489 802.1Q vlan#20 P0 10.10.20.101.49796 > 208.231.55.26.53:
    udp 31
      77: 17:34:16.809726 802.1Q vlan#20 P0 10.10.20.101.49796 > 208.231.55.27.53:
    udp 31
      78: 17:34:17.811222 802.1Q vlan#20 P0 10.10.20.101.49796 > 208.231.55.26.53:
    udp 31
      79: 17:34:19.814349 802.1Q vlan#20 P0 10.10.20.101.49796 > 208.231.55.26.53:
    udp 31
      80: 17:34:19.814380 802.1Q vlan#20 P0 10.10.20.101.49796 > 208.231.55.27.53:
    udp 31
      81: 17:34:23.820682 802.1Q vlan#20 P0 10.10.20.101.49796 > 208.231.55.26.53:
    udp 31
      82: 17:34:23.820788 802.1Q vlan#20 P0 10.10.20.101.49796 > 208.231.55.27.53:
    udp 31
      83: 17:34:30.822924 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 50
      84: 17:34:31.572892 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 50
      85: 17:34:32.324079 802.1Q vlan#20 P0 10.10.20.101.137 > 10.10.20.255.137:  ud
    p 50
      86: 17:34:33.083079 802.1Q vlan#20 P0 10.10.20.101.61089 > 208.231.55.26.53:
    udp 44
      87: 17:34:34.077007 802.1Q vlan#20 P0 10.10.20.101.61089 > 208.231.55.27.53:
    udp 44
      88: 17:34:35.078639 802.1Q vlan#20 P0 10.10.20.101.61089 > 208.231.55.26.53:
    udp 44
      89: 17:34:37.081584 802.1Q vlan#20 P0 10.10.20.101.61089 > 208.231.55.26.53:
    udp 44
      90: 17:34:37.081706 802.1Q vlan#20 P0 10.10.20.101.61089 > 208.231.55.27.53:
    udp 44
      91: 17:34:41.087809 802.1Q vlan#20 P0 10.10.20.101.61089 > 208.231.55.26.53:
    udp 44
      92: 17:34:41.087840 802.1Q vlan#20 P0 10.10.20.101.61089 > 208.231.55.27.53:
    udp 44
    92 packets shown

  • ASA 5520 VERSION 8.2 UPGRADE TO 9.0

    Hello friends,
    I am considering to perform an upgrade of my ASA 5520 with versión 8.2 to 9.0, so I will enjoy the benefits of anyconnect for mobile devices. I clearly understand that I must pay special attention to:
    NAT Rules.
    RAM Memory: 2 GB.
    Adding the part numbers to power on the newest versions of anyconnect and for mobile devices
    L-ASA-AC-E-5520= ASA-AC-M-5520=
    am I missing any other thing? Flash requirement? Or to pay attention to some other configurations? 
    Any comment or documentation will be appreciated.
    Regards!

    You can run the latest AnyConnect client - including mobile clients - with those licenses even on an ASA with the current  8.2 code - 8.2(5) as of now. While it's a bit old and lacking some of the newer features, it's a solid and stable release.
    That would save you the trouble of migrating your NAT configuration (and other bits) and upgrading memory.
    Since the ASA 5500 series (5510, 5520 etc.) is past End of Sales you have a limited future on those platforms. For instance, ASA 9.1(x) is the last set of code releases that will be available for them. (The current software on the 5500-X is 9.3(1).)

  • Asa 5520 "loosing" code after code has been put in and operating

    Sorry to ask this if it has all ready been covered.  We have an asa 5520 running 8.3.2(1) code.  Three times now I have entered code and rules in our asa and had things working, only to have the code "dissapear" and thus things stop working.  We upgraded to 8.3.2(1) back in January of 2011, and have not had this problem until the last month.  I was wondering if there is a bug with 8.3.2(1) code that has decided to show itself for whatever reason now.  We have also had some other things relating to the VPN that were "working" and at some point just stopped working.  We do have a second asa 5520 that is the failover/standby.  We also have two 6509 with firewall services modules, one primary and the other standby.  Just wondering how to troubleshoot something like this.  I have putty logs of me putting the code in and doing a write mem saving the changes, yet on three occations those things stopped working, and I had to put the code in again.
    **update** as I was typing this, we realised there was a problem with the two ASA's.  For some reason, failover had stopped working, and both ASA's were trying to be the primary and causing issues.  After several reboots, we wound up turning failover back on  on the second ASA, and things seem to be normal now.  No idea what would have caused the failover to break.  Not sure how long this had been going on, it may have had to do with my code seeming to dissapear?

    Here is the output of the show ver.  I removed the serial number.
    ACH-2nd-EXT-ASA01#sh ver
    Cisco Adaptive Security Appliance Software Version 8.3(2)1
    Device Manager Version 6.4(7)
    Compiled on Wed 04-Aug-10 21:41 by builders
    System image file is "disk0:/asa832-1-k8.bin"
    Config file at boot was "startup-config"
    ACH-2nd-EXT-ASA01 up 4 days 22 hours
    failover cluster up 4 days 22 hours
    Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz
    Internal ATA Compact Flash, 256MB
    BIOS Flash M50FW080 @ 0xfff00000, 1024KB
    Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
    0: Ext: GigabitEthernet0/0  : address is 001d.a298.c41c, irq 9
    1: Ext: GigabitEthernet0/1  : address is 001d.a298.c41d, irq 9
    2: Ext: GigabitEthernet0/2  : address is 001d.a298.c41e, irq 9
    3: Ext: GigabitEthernet0/3  : address is 001d.a298.c41f, irq 9
    4: Ext: Management0/0       : address is 001d.a298.c420, irq 11
    5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
    6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
    Licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited      perpetual
    Maximum VLANs                  : 150            perpetual
    Inside Hosts                   : Unlimited      perpetual
    Failover                       : Active/Active  perpetual
    VPN-DES                        : Enabled        perpetual
    VPN-3DES-AES                   : Enabled        perpetual
    Security Contexts              : 2              perpetual
    GTP/GPRS                       : Disabled       perpetual
    SSL VPN Peers                  : 10             perpetual
    Total VPN Peers                : 750            perpetual
    Shared License                 : Disabled       perpetual
    AnyConnect for Mobile          : Enabled        perpetual
    AnyConnect for Cisco VPN Phone : Disabled       perpetual
    AnyConnect Essentials          : Enabled        perpetual
    Advanced Endpoint Assessment   : Disabled       perpetual
    UC Phone Proxy Sessions        : 2              perpetual
    Total UC Proxy Sessions        : 2              perpetual
    Botnet Traffic Filter          : Disabled       perpetual
    Intercompany Media Engine      : Disabled       perpetual
    This platform has an ASA 5520 VPN Plus license.
    Failover cluster licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited      perpetual
    Maximum VLANs                  : 150            perpetual
    Inside Hosts                   : Unlimited      perpetual
    Failover                       : Active/Active  perpetual
    VPN-DES                        : Enabled        perpetual
    VPN-3DES-AES                   : Enabled        perpetual
    Security Contexts              : 4              perpetual
    GTP/GPRS                       : Disabled       perpetual
    SSL VPN Peers                  : 20             perpetual
    Total VPN Peers                : 750            perpetual
    Shared License                 : Disabled       perpetual
    AnyConnect for Mobile          : Enabled        perpetual
    AnyConnect for Cisco VPN Phone : Disabled       perpetual
    AnyConnect Essentials          : Enabled        perpetual
    Advanced Endpoint Assessment   : Disabled       perpetual
    UC Phone Proxy Sessions        : 4              perpetual
    Total UC Proxy Sessions        : 4              perpetual
    Botnet Traffic Filter          : Disabled       perpetual
    Intercompany Media Engine      : Disabled       perpetual
    This platform has an ASA 5520 VPN Plus license.
    Serial Number: xxxxxxxxxxx
    Running Permanent Activation Key: 0xf730cf7a 0x0449cabf 0xc922e5d4 0xc7bc5cb0 0x851ed6bb
    Configuration register is 0x1
    Configuration has not been modified since last system restart.
    ACH-2nd-EXT-ASA01#

  • ASA 5520 k8 model

    I have asa 5520 k8 model presently i am running with IOS version 8.0(4) i am upgrading to 8.2(5) is ? any license required from cisco to upgrade to this IOS, and also let me know how many site to site vpn can be configure on this device.
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled
    VPN-3DES-AES                 : Enabled
    Security Contexts            : 2
    GTP/GPRS                     : Disabled
    VPN Peers                    : 750
    WebVPN Peers                 : 2
    AnyConnect for Mobile        : Disabled
    AnyConnect for Linksys phone : Disabled
    Advanced Endpoint Assessment : Disabled
    UC Proxy Sessions            : 2
    This platform has an ASA 5520 VPN Plus license.
    Serial Number: JMX1051K2S5

    Hi,
    There is no license needed for the software upgrade
    To my understanding the device should support the mentioned 750 IPsec peers. Totally other thing is how this is in practice. Depends on other things also.
    The command "show vpn-sessiondb detail" gives a nice information on the VPN connections and limits also
    - Jouni

  • ASA 5520 Activation Key Help

    Hi All,
    we recently installed a activaiton key for the Anyconnect License on our ASA 5520. We have a pair runnning, in Active/Standby mode, on IOS 8.0. The Activation/License was installed on the Primary ASA. Once installed the all failover configuration was removed, and we were left with 2 ASAs running in Active/Active mode. This cause haoc across the network. I would like to go back and recover and reinstall the old activation key. Is this possible?? If so how would I be able to achieve this. Or do I need to ontain a new license key. Ultimately I would like to get back to the stage before instlaling the Anyconnect License, where we had a 2 ASAs running in Active/Standby mode.
    Thank you for your help and suggestions.
    Cheers
    Deena
    oput put from sh activation-key detail and sh version
    CH-ASA# sh act det
    Serial Number:  JMX1101K2SU
    Permanent Flash Activation Key: 0x370fc559 0x2476a024 0xccc355a4 0xacd81440 0x4110329d
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled
    VPN-3DES-AES                 : Enabled
    Security Contexts            : 2
    GTP/GPRS                     : Disabled
    VPN Peers                    : 750
    WebVPN Peers                 : 2
    AnyConnect for Mobile        : Disabled
    AnyConnect for Linksys phone : Disabled
    Advanced Endpoint Assessment : Disabled
    UC Proxy Sessions            : 2
    Temporary Flash Activation Key: 0x29249e66 0x500f33dc 0xcd79274e 0x534c7c93 0x81bc53bc
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled
    VPN-3DES-AES                 : Disabled
    Security Contexts            : 2
    GTP/GPRS                     : Disabled
    VPN Peers                    : 750
    WebVPN Peers                 : 750
    AnyConnect for Mobile        : Disabled
    AnyConnect for Linksys phone : Disabled
    Advanced Endpoint Assessment : Disabled
    UC Proxy Sessions            : 2
    This is a time-based license that will expire in 27 day(s).
    Running Activation Key: 0x29249e66 0x500f33dc 0xcd79274e 0x534c7c93 0x81bc53bc
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled
    VPN-3DES-AES                 : Enabled
    Security Contexts            : 2
    GTP/GPRS                     : Disabled
    VPN Peers                    : 750
    WebVPN Peers                 : 750
    AnyConnect for Mobile        : Disabled
    AnyConnect for Linksys phone : Disabled
    Advanced Endpoint Assessment : Disabled
    UC Proxy Sessions            : 2
    This platform has an ASA 5520 VPN Plus license.
    This is a time-based license that will expire in 27 day(s).
    The flash activation key is the SAME as the running key.
    CH-ASA# sh ver
    Cisco Adaptive Security Appliance Software Version 8.0(5)
    Device Manager Version 6.2(5)53
    Compiled on Mon 02-Nov-09 21:22 by builders
    System image file is "disk0:/asa805-k8.bin"
    Config file at boot was "startup-config"
    CH-ASA up 18 hours 30 mins
    Hardware:   ASA5520-K8, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz
    Internal ATA Compact Flash, 256MB
    BIOS Flash AT49LW080 @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.05
    0: Ext: GigabitEthernet0/0  : address is 0019.0665.6dfc, irq 9
    1: Ext: GigabitEthernet0/1  : address is 0019.0665.6dfd, irq 9
    2: Ext: GigabitEthernet0/2  : address is 0019.0665.6dfe, irq 9
    3: Ext: GigabitEthernet0/3  : address is 0019.0665.6dff, irq 9
    4: Ext: Management0/0       : address is 0019.0665.6dfb, irq 11
    5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
    6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled
    VPN-3DES-AES                 : Enabled
    Security Contexts            : 2
    GTP/GPRS                     : Disabled
    VPN Peers                    : 750
    WebVPN Peers                 : 750
    AnyConnect for Mobile        : Disabled
    AnyConnect for Linksys phone : Disabled
    Advanced Endpoint Assessment : Disabled
    UC Proxy Sessions            : 2
    This platform has an ASA 5520 VPN Plus license.
    This is a time-based license that will expire in 27 day(s).
    Serial Number: JMX1101K2SU
    Running Activation Key: 0x29249e66 0x500f33dc 0xcd79274e 0x534c7c93 0x81bc53bc
    Configuration register is 0x1
    Configuration has not been modified since last system restart.
    CH-ASA#

    If you upgrade your ASA software to a bit more recent image first you can share the AnyConnect license (activation key) across both devices. Otherwise you would need to install a separate activation key on the second unit.
    Sent from Cisco Technical Support iPad App

  • ASA 5520 - LU allocate xlate failed - Failover unit reloads

    We just had an issue with our failover unit reloading. In perusing the logs there were a number of %ASA-3-210007: LU allocate xlate failed, errors prior to the reload. These units had just had their OS upgraded to fix a DOS issue a few weeks ago. I have not seen the error since it reloaded. However, I was asked to report the issue just in case it is a bug in the new version of the OS.Two units in failover.
    Cisco Adaptive Security Appliance Software Version 8.0(5)9
    Device Manager Version 6.0(2)
    Compiled on Mon 01-Feb-10 10:36 by builders
    System image file is "disk0:/asa805-9-k8.bin"
    Config file at boot was "startup-config"
    CP-ASA up 17 days 21 hours
    failover cluster up 17 days 22 hours
    Hardware:   ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz
    Internal ATA Compact Flash, 256MB
    BIOS Flash M50FW080 @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                                 Boot microcode   :  CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode:  CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  :  CNlite-MC-IPSECm-MAIN-2.05
    0: Ext: GigabitEthernet0/0  : address is 0025.45d7.6e62, irq 9
    1: Ext: GigabitEthernet0/1  : address is 0025.45d7.6e63, irq 9
    2: Ext: GigabitEthernet0/2  : address is 0025.45d7.6e64, irq 9
    3: Ext: GigabitEthernet0/3  : address is 0025.45d7.6e65, irq 9
    4: Ext: Management0/0       : address is 0025.45d7.6e66, irq 11
    5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
    6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150      
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled  
    VPN-3DES-AES                 : Enabled  
    Security Contexts            : 2        
    GTP/GPRS                     : Disabled 
    VPN Peers                    : 750      
    WebVPN Peers                 : 2        
    AnyConnect for Mobile        : Disabled 
    AnyConnect for Linksys phone : Disabled 
    Advanced Endpoint Assessment : Disabled 
    UC Proxy Sessions            : 2       
    This platform has an ASA 5520 VPN Plus license.
    I noted a report on errors with verison 7 and a conflict between nat(0) and static commands. I don't show nat(0) being used on these units.
    nat (public) 0 access-list NO_NAT
    nat (public) 1 10.190.16.64 255.255.255.192
    nat (public) 1 172.16.22.0 255.255.255.0
    nat (dmz) 0 access-list NO_NAT
    nat (dmz) 1 0.0.0.0 0.0.0.0
    nat (csacelb) 0 access-list NO_NAT
    nat (csacelb) 1 0.0.0.0 0.0.0.0
    nat (app) 0 access-list NO_NAT
    nat (app) 1 0.0.0.0 0.0.0.0
    nat (db) 0 access-list NO_NAT
    nat (db) 1 0.0.0.0 0.0.0.0
    nat (internal) 0 access-list NO_NAT
    nat (internal) 1 0.0.0.0 0.0.0.0
    nat (management) 0 access-list NO_NAT
    nat (management) 1 0.0.0.0 0.0.0.0
    no crypto isakmp nat-traversal
    static (app,dmz) 10.190.15.0 10.190.15.0 netmask 255.255.255.192
    static (csacelb,public) 999.999.999.999 10.190.14.70 netmask 255.255.255.255 (The external address was replaced with 999.999.999.999 intentionally for this forum)
    static (db,app) 10.190.16.0 10.190.16.0 netmask 255.255.255.192

    Do you have any solution ? we have the same problem.
    Thanks .

  • Vpn-framed-ip-address not working with anyconnect

    Hi Folks, please help me to verify if this case is a bug or a "not valid scenario".
    Scenario:
    ASA 5520, OS 9.1, SSL VPN with Anyconnect v3.x, static ip address for the client, and RSA token authentication (all the users/pin/passwords are in the RSA server, not in the ASA, but i need to create some users in the ASA in order to apply the vpn-framed-ip-address attribute for specific users).
    In fact the anyconnect ssl vpn with RSA auth works fine, the ssl connection works, the user is authenticated, the anyconnect works, traffic passing,  BUT.. the anyconnect its getting an ip address from the ip local pool INSTEAD of the static ip defined with the  vpn-framed-ip-address command.
    I'm trying to assign a static ip address for a user (defined locally on the ASA) that performs auth via RSA (aaa-server), by using the  vpn-framed-ip-address  command as an attribute for this local user. But it seems the command is not working.
    Already I´ve tried to resolve (with no success) by entering the
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    vpn-addr-assign local
    Also i´ve tried by removing the pool from tunnel-group in order to force all the connection session to use the static ip address, but in this case, the anyconnect sends a message "No Address Available for SVC Connection".  Meaning the ASA simply is ignoring the  vpn-framed-ip-address command.
    Its supposed the ASA implement the policies in this order, DAP > User policy > UserGrp policy > ConnProfile > DefGrpPolicy, and according to this, the vpn-framed-ip-address command should take effect first since its specified as User policy, overriding everything else. But its not working.
    At this point i think the issue is... since the user is locally defined but its password its being authenticated via RSA (not local), the user attributes (static ip) are being ignored by the ASA because its not expecting to receive an ip address from the aaa server (RSA), so jumps to the next policies falling to the pool. Anyway the user policies attributes SHOULD work according to cisco.
    Please your advise, or tell if its a bug? or a not valid scenario for this command to work with the ASA.
    This is the current config:
    ip local pool PoolSSL 192.168.229.10-192.168.229.19 mask 255.255.255.0
    aaa-server RSA protocol sdi
    aaa-server RSA (inside) host 192.168.12.1
     retry-interval 5
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    group-policy GroupPolicyABC internal
    group-policy GroupPolicyABC attributes
     wins-server none
     dns-server value 192.168.61.1 192.168.61.2
     vpn-tunnel-protocol ssl-client
     group-lock value TunnelGroupABC
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value ServersDB
     default-domain value my.domain.com
     split-tunnel-all-dns disable
     webvpn
      anyconnect ask none default anyconnect
    username USER1 password xHhacRZ56Uadqoq encrypted
    username USER1 attributes
     vpn-framed-ip-address 192.168.229.7 255.255.255.0
     group-lock value TunnelGroupABC
    tunnel-group TunnelGroupABC type remote-access
    tunnel-group TunnelGroupABC general-attributes
     address-pool PoolSSL
     authentication-server-group RSA
     default-group-policy GroupPolicyABC
    tunnel-group TunnelGroupABC webvpn-attributes
     group-alias AccessToDB enable
    I´ll wait for your answers, regards!

    https://tools.cisco.com/bugsearch/bug/CSCtf71671/
    you need AAA assignment, or at least you needed to have it a couple of years back. 

  • ASA 5520 Not Failing over

        Hi All
    Im preparing a lab and I have 2 ASA 5520's. I have configured them for failover so the Primarys config will replicate over to the Secondary. They are connected via a 3560 switch. the switch ports are configured as access ports on vlan 1. Spanning-tree portfast is enabled
    Firewall (Primary)
    Cisco Adaptive Security Appliance Software Version 9.1(1)
    Device Manager Version 7.1(2)
    Compiled on Wed 28-Nov-12 10:38 by builders
    System image file is "disk0:/asa911-k8.bin"
    Config file at boot was "startup-config"
    DEO-FW-01 up 5 hours 1 min
    failover cluster up 5 hours 1 min
    Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz,
    Internal ATA Compact Flash, 256MB
    BIOS Flash M50FW080 @ 0xfff00000, 1024KB
    Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x0)
                                 Boot microcode        : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.08
                                 Number of accelerators: 1
    0: Ext: GigabitEthernet0/0  : address is 001e.f762.bc44, irq 9
    1: Ext: GigabitEthernet0/1  : address is 001e.f762.bc45, irq 9
    2: Ext: GigabitEthernet0/2  : address is 001e.f762.bc46, irq 9
    3: Ext: GigabitEthernet0/3  : address is 001e.f762.bc47, irq 9
    4: Ext: Management0/0       : address is 001e.f762.bc43, irq 11
    5: Int: Not used            : irq 11
    6: Int: Not used            : irq 5
    Licensed features for this platform:
    Maximum Physical Interfaces       : Unlimited      perpetual
    Maximum VLANs                     : 150            perpetual
    Inside Hosts                      : Unlimited      perpetual
    Failover                          : Active/Active  perpetual
    Encryption-DES                    : Enabled        perpetual
    Encryption-3DES-AES               : Enabled        perpetual
    Security Contexts                 : 2              perpetual
    GTP/GPRS                          : Disabled       perpetual
    AnyConnect Premium Peers          : 2              perpetual
    AnyConnect Essentials             : Disabled       perpetual
    Other VPN Peers                   : 750            perpetual
    Total VPN Peers                   : 750            perpetual
    Shared License                    : Disabled       perpetual
    AnyConnect for Mobile             : Disabled       perpetual
    AnyConnect for Cisco VPN Phone    : Disabled       perpetual
    Advanced Endpoint Assessment      : Disabled       perpetual
    UC Phone Proxy Sessions           : 2              perpetual
    Total UC Proxy Sessions           : 2              perpetual
    Botnet Traffic Filter             : Disabled       perpetual
    Intercompany Media Engine         : Disabled       perpetual
    Cluster                           : Disabled       perpetual
    This platform has an ASA 5520 VPN Plus license.
    Here is the failover config
    failover
    failover lan unit primary
    failover lan interface SFO GigabitEthernet0/3
    failover replication http
    failover link SFO GigabitEthernet0/3
    failover interface ip SFO 10.10.16.25 255.255.255.248 standby 10.10.16.26
    Here is the Show failover output
    Failover On
    Failover unit Primary
    Failover LAN Interface: SFO GigabitEthernet0/3 (Failed - No Switchover)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 160 maximum
    failover replication http
    Version: Ours 9.1(1), Mate Unknown
    Last Failover at: 12:53:27 UTC Mar 14 2013
            This host: Primary - Active
                    Active time: 18059 (sec)
                    slot 0: ASA5520 hw/sw rev (2.0/9.1(1)) status (Up Sys)
                      Interface inside (10.10.16.1): No Link (Waiting)
                      Interface corporate_network_traffic (10.10.16.21): Unknown (Waiting)
                      Interface outside (193.158.46.130): Unknown (Waiting)
                    slot 1: empty
            Other host: Secondary - Not Detected
                    Active time: 0 (sec)
                      Interface inside (10.10.16.2): Unknown (Waiting)
                      Interface corporate_network_traffic (10.10.16.22): Unknown (Waiting)
                      Interface outside (193.158.46.131): Unknown (Waiting)
    Stateful Failover Logical Update Statistics
            Link : SFO GigabitEthernet0/3 (Failed)
    Here is the output for the secondary firewall
    Cisco Adaptive Security Appliance Software Version 9.1(1)
    Device Manager Version 6.2(5)
    Compiled on Wed 28-Nov-12 10:38 by builders
    System image file is "disk0:/asa911-k8.bin"
    Config file at boot was "startup-config"
    ciscoasa up 1 hour 1 min
    failover cluster up 1 hour 1 min
    Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz,
    Internal ATA Compact Flash, 256MB
    BIOS Flash M50FW080 @ 0xfff00000, 1024KB
    Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x0)
                                 Boot microcode        : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.08
                                 Number of accelerators: 1
    0: Ext: GigabitEthernet0/0  : address is 0023.0477.12e4, irq 9
    1: Ext: GigabitEthernet0/1  : address is 0023.0477.12e5, irq 9
    2: Ext: GigabitEthernet0/2  : address is 0023.0477.12e6, irq 9
    3: Ext: GigabitEthernet0/3  : address is 0023.0477.12e7, irq 9
    4: Ext: Management0/0       : address is 0023.0477.12e3, irq 11
    5: Int: Not used            : irq 11
    6: Int: Not used            : irq 5
    Licensed features for this platform:
    Maximum Physical Interfaces       : Unlimited      perpetual
    Maximum VLANs                     : 150            perpetual
    Inside Hosts                      : Unlimited      perpetual
    Failover                          : Active/Active  perpetual
    Encryption-DES                    : Enabled        perpetual
    Encryption-3DES-AES               : Enabled        perpetual
    Security Contexts                 : 2              perpetual
    GTP/GPRS                          : Disabled       perpetual
    AnyConnect Premium Peers          : 2              perpetual
    AnyConnect Essentials             : Disabled       perpetual
    Other VPN Peers                   : 750            perpetual
    Total VPN Peers                   : 750            perpetual
    Shared License                    : Disabled       perpetual
    AnyConnect for Mobile             : Disabled       perpetual
    AnyConnect for Cisco VPN Phone    : Disabled       perpetual
    Advanced Endpoint Assessment      : Disabled       perpetual
    UC Phone Proxy Sessions           : 2              perpetual
    Total UC Proxy Sessions           : 2              perpetual
    Botnet Traffic Filter             : Disabled       perpetual
    Intercompany Media Engine         : Disabled       perpetual
    Cluster                           : Disabled       perpetual
    This platform has an ASA 5520 VPN Plus license.
    Here is the failover config
    failover
    failover lan unit secondary
    failover lan interface SFO GigabitEthernet0/3
    failover replication http
    failover link SFO GigabitEthernet0/3
    failover interface ip SFO 10.10.16.26 255.255.255.248 standby 10.10.16.25
    Here is the Show failover output
    failover
    failover lan unit secondary
    failover lan interface SFO GigabitEthernet0/3
    failover replication http
    failover link SFO GigabitEthernet0/3
    failover interface ip SFO 10.10.16.26 255.255.255.248 standby 10.10.16.25
    Failover On
    Failover unit Secondary
    Failover LAN Interface: SFO GigabitEthernet0/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 0 of 160 maximum
    failover replication http
    Version: Ours 9.1(1), Mate Unknown
    Last Failover at: 12:58:31 UTC Mar 14 2013
    This host: Secondary - Active
    Active time: 3630 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/9.1(1)) status (Up Sys)
    slot 1: empty
    Other host: Primary - Not Detected
    Active time: 0 (sec)
    Stateful Failover Logical Update Statistics
    Link : SFO GigabitEthernet0/3 (up)
    interface g0/3 on both are up via the No shutdown command. However I get the following error No Active mate detected
    please could someone help.
    Many thanks

    Hello James,
    You have configured  the IPs on the interfaces incorrectly.
    Let me point it out
    failover
    failover lan unit primary
    failover lan interface SFO GigabitEthernet0/3
    failover replication http
    failover link SFO GigabitEthernet0/3
    failover interface ip SFO 10.10.16.25 255.255.255.248 standby 10.10.16.26
    You are telling the Primary device use IP address 10.10.16.25 and the secondary firewall will be 10.10.26.26
    Now let's see the configuration on the Secondary Unit?
    failover
    failover lan unit secondary
    failover lan interface SFO GigabitEthernet0/3
    failover replication http
    failover link SFO GigabitEthernet0/3
    failover interface ip SFO 10.10.16.26 255.255.255.248 standby 10.10.16.25
    On the secondary you are saying the primary IP will be 10.10.16.26 and the secondary will be 10.10.16.25
    You have it backwards and based on the output I would say you configured it on all of the interfaces like that
    So please change it and make it the same on all of the interfaces so both devices know the same thing ( which IP they should use when they are primary and secondary, this HAVE to match )
    Hope that I could help
    Julio Carvajal

Maybe you are looking for