Anyconnect on the asa

Hi
I see on the ASA you can either use a web portal and run links through your web browser, or you can download a copy of the anyconnect client from the asa itself
where is the options on the asa to do this?
cheers

Hello Carl,
Here is a link regarding the configuration of anyconnect using ASDM:
http://tools.cisco.com/squish/76Ff9
Now regarding your query, if you want to ask the users when they access the web-portal to donwload the anyconnect client and then have it into the PC installed.
group-policy TEST attributes
webvpn
anyconnect keep-installer installed
anyconnect ask enable
Regards,
Julio

Similar Messages

Blocking iPads via AnyConnect on the ASAs?

Has anyone succesfully blocked iPads from using AnyConnect to VPN in? I can see how you can block the preinstalled IPSEC client via the IPSEC client rules, but I don't see how I can block an iPad or iPhone if they've installed the AnyConnect Mobile client.

The release notes for Anyconnect 2.4 for iPad have a section on how to do it. You have to use a Dynamic Access Policy to test for the OS.
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/release/notes/rn-ac2.4-apl4.2.html#wp1095241

Problem with AnyConnect VPN on ASA 5505

Hello everyone,
We're troubleshooting an issue where a client cannot pass any traffic across an AnyConnect VPN with an ASA5505 as the endpoint. The client receives and IP address in the 172.16.0.1/24 range and the ASA creates a static route to the 10.0.0.0/24 internal network but we cannot ping or connect to any internal IP address. The connection appears to fully build and pass traffic (based on the byte counts which increase) but we can't talk to the main network.
Does anyone have any ideas as to what I can check?
Thanks!
Ryan

AnyConnect client should not be in the same subnet as the internal hosts. It needs to be unique subnet within your environment, so you were on the right path initially.
If you can share your config, that would be easier for us to check.
In the meantime, a few things to check:
1) Have you configured split tunnel policy?
2) Do you have NAT exemption configured?
3) Any VPN filter configured that might be blocking the traffic?
4) Does the internal network know how to route back to the VPN Pool subnet (ie: via the ASA)
5) Lastly, do you have "inspect icmp" configured?

Verification on the asa 8.4 5505 about PAT and port forwarding.

hi all
ihae topology as blow :
inside------------eth0/1-------asa---eth0/7---------outside-------------------internet
my goal is
i want to make pat of inside network (10.66.12.0/24) with outside interface when it request the internet
also ,
i need port forwaridng to following hosts :
10.66.12.122 to 3389
10.66.12.249 to http
10.66.12.249 to https
10.66.12.249 to citrix
=============================================================
just m i need somebody to check my config it is correct
=============================================================
i have asda 5505 with :
ASAAAAA(config)# sh version
Cisco Adaptive Security Appliance Software Version 8.4(2)
Device Manager Version 6.4(5)
Compiled on Wed 15-Jun-11 18:17 by builders
System image file is "disk0:/asa842-k8.bin"
Config file at boot was "startup-config"
ASAAAAA up 1 hour 32 mins
Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                             Boot microcode        : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.06
                             Number of accelerators: 1
0: Int: Internal-Data0/0    : address is d48c.b597.ce35, irq 11
1: Ext: Ethernet0/0         : address is d48c.b597.ce2d, irq 255
2: Ext: Ethernet0/1         : address is d48c.b597.ce2e, irq 255
3: Ext: Ethernet0/2         : address is d48c.b597.ce2f, irq 255
4: Ext: Ethernet0/3         : address is d48c.b597.ce30, irq 255
5: Ext: Ethernet0/4         : address is d48c.b597.ce31, irq 255
6: Ext: Ethernet0/5         : address is d48c.b597.ce32, irq 255
7: Ext: Ethernet0/6         : address is d48c.b597.ce33, irq 255
8: Ext: Ethernet0/7         : address is d48c.b597.ce34, irq 255
9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
10: Int: Not used            : irq 255
11: Int: Not used            : irq 255
Licensed features for this platform:
Maximum Physical Interfaces       : 8              perpetual
VLANs                             : 3              DMZ Restricted
Dual ISPs                         : Disabled       perpetual
VLAN Trunk Ports                  : 0              perpetual
Inside Hosts                      : 50             perpetual
Failover                          : Disabled       perpetual
VPN-DES                           : Enabled        perpetual
VPN-3DES-AES                      : Enabled        perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 10             perpetual
Total VPN Peers                   : 25             perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual
This platform has a Base license.
Serial Number: JMX162740GP
Running Permanent Activation Key: 0x6801f547 0xe81c57c4 0x20f339f4 0xaaf48040 0x
480e2fbc
Configuration register is 0x100003
Configuration last modified by enable_15 at 23:58:15.999 UTC Wed Jan 22 2014
ASAAAAA(config)# sh run
: Saved
ASA Version 8.4(2)
hostname ASAAAAA
enable password ffffCCSH encrypted
passwd 2KFfffff2KYOU encrypted
names
interface Ethernet0/0
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
switchport access vlan 2
interface Vlan1
nameif ins
security-level 100
ip address 10.66.12.1 255.255.255.0
interface Vlan2
nameif outside
security-level 50
ip address x.x.55.34 255.255.255.248
boot system disk0:/asa842-k8.bin
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj-0.0.0.0
host 0.0.0.0
object network localsubnet
subnet 10.66.12.0 255.255.255.0
description localsubnet
object network HTTP-Host
host 10.66.12.249
description web server
object network HTTPS-HOST
host 10.66.12.249
description Https
object network RDP-Host
host 10.66.12.122
description RDP host
object network citrix-host
host 10.66.12.249
description citrix
object service rdp
service tcp destination eq 3389
object service https
service tcp destination eq https
object service citrix
service tcp destination eq 2598
object service http
service tcp destination eq www
object-group network RDP-REDIRECT
object-group network HTTP-REDIRECT
object-group network HTTPS-REDIRECT
object-group network CITRIX-ICA-HDX-REDIRECTION
object-group network CITRIX-ICA-SESSION-RELIABILITY-REDIRECTION
object-group service CITRIX-ICA-HDX
object-group service CITRIX-SR
object-group service RDP
object-group network MY-insideNET
network-object 10.66.12.0 255.255.255.0
object-group service DM_INLINE_SERVICE_1
service-object object citrix
service-object object http
service-object object https
service-object object rdp
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 a
ny interface outside
pager lines 24
mtu ins 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
nat (ins,outside) source static RDP-Host interface service rdp rdp
nat (ins,outside) source static HTTP-Host interface service http http
nat (ins,outside) source static citrix-host interface service citrix citrix
object network obj_any
nat (ins,outside) dynamic obj-0.0.0.0
object network localsubnet
nat (ins,outside) dynamic interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.55.33 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 10.66.12.0 255.255.255.0 ins
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
    0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
    30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
    0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
    65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
    30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
    68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
    3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
    63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
    0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
    a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
    9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
    7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
    15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
    63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
    18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
    4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
    81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
    db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
    7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
    ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
    45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
    2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
    1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
    03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
    69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
    02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
    6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
    c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
    69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
    1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
    481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
    b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
    5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
    6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
    6c2527b9 deb78458 c61f381e a4c4cb66
quit
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username ADMIN password 5iEuCUW0P3ThngqY encrypted privilege 15
username cisco password eT0.bmvcLOAQcNEL encrypted privilege 15
prompt hostname context
call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DD
CEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:65c9b8c35749959d1159e162ff106166
: end
=======================================================
i configured PAT , PORTFORWARD and ACCESS RULES
just want to mae verification to my work
regards

Hi,
Dont think I can really give you an answer but thought I'd write anyway.
It does seem on the basis of the documentation of the ASA (8.4) that with Twice NAT you wont be able to do any modifications to the DNS replies.
Heres one quote from Configuration Guide
Gonfiguring Network Address Translation -> Information About NAT -> DNS and NAT
If you configure a twice NAT rule, you cannot configure DNS modification if you specify the sourceaddress as well as the destination address. These kinds of rules can potentially have a differenttranslation for a single address when going to A vs. B. Therefore, the ASA cannot accurately match theIP address inside the DNS reply to the correct twice NAT rule; the DNS reply does not containinformation about which source/destination address combination was in the packet that prompted theDNS request.
So if I'm not totally wrong I guess your options might be to either
Start doing changes to the local DNS server directly?
Separate the remote overlapping network from your current firewall with another firewall device?
I dont know the whole setup so this might be impossible
Thinking that if the NAT for the remote overlapping network was done on another firewall it could do the DNS reply changes before they arrived on your ASA from the remote DNS server?
I have not really had to tackle such a situation before. I most commonly run into situations where a customer has public IP configured with 1:1 Static NAT and there is no DNS parameter in the Static NAT configuration while the customer tries to use the DNS name to connect to their local server.
Just some of my thoughts. Maybe someone else might have more expirience with same type of situations.
- Jouni

Download Anyconnect client inside ASA

Hi,
I currently have a Cisco 5520 ASA which is up and running and the users are able to connect to Anyconnect to VPN into the network.
However, users plugged into the internal network inside the ASA are unable to connect to the vpn address and download the Anyconnect Client. I think this may be to do with reverse NAT missing?
I would appreciate any help.
Thanks in advance.
Nisha

Hi Lee,
I enabled the Anyconnect Client on the inside interface but have had no luck.
The users are trying to browse to a vpn address from which they are prompted to install the Anyconnect software. This comes under Network (Client) Access right?
Thanks in advance.
Nisha

How do I block pings from the outside to the ASA 5505 outside interface?

I was asked to block pings from the internet to the outside interface of our ASA-5505 firewall. I found a post that said to enter "icmp deny any outside", however that does not do it.
I created an ACL to try and do the trick, also to no avail:
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in in interface outside
access-group outside_in in interface outside
Anyone have a clue what I'm doing wrong? I'm not the firewall guy as you can tell. :/
Thanks in advance...
Block / Deny ICMP Echo (Ping) on Cisco ASA Outside Interface
Most networks that you protect with a Cisco ASA device, will probably want to deny ICMP (maybe not all ICMP types, but a lot of network admins will want to block ICMP Echo, etc.) on the outside interface. This will make the network harder to find through external enumeration, but not impossible.
ASA5505(config)#icmp deny any outside
You will deny ICMP on the outside interface, but if you include ICMP as a protocol in the default global policy map, you can ping from the inside to any host on the outside, and it will be permitted back through the ASA, as it knows about the previous ICMP “connection

You are allowing echo-reply, thus it will reply to a ping
try this ACL:
icmp deny any echo-reply outside
From:
https://supportforums.cisco.com/thread/223769
Eric

Cisco ASA 5505 performance issues on downloads - data into the ASA from the Internet

I have having serious issues with performance on my ASA 5505s that I am testing with 9.2.3 code.
I stripped the config and removed as much stuff as I could - no VPN etc. and I am ONLY getting about 30-40Mbps downloads from sites but 95Mbps uploads???? Anyone else seeing these problems? If I remove the firewall my PC can hit 300/300Mbps to the same sites using the same switch and cable.
I installed 1Gb of mem on the ASA 5505 but it made no difference. The ASA has a UL IP Security license but I am only using and inside and outside address for these tests, no other ports configured.
Is anyone else seeing this performance problem with the 9.2.3 code? I went to this from 8.2.5 to try to resolve QOS failure bugs that I found in the 8.2.5 code. I did not expect to have a performance hit though and it is only on downloads TO the ASA from the Internet from all speed test sites that I try. Uploading speeds seem fine. No access-lists on my interfaces either...barebones config.
My FIOS and switch interfaces are fine...no errors on any interfaces and the same switch interface hits 300/300Mbps when my laptop is directly attached.
Anyone have a barebones config on their ASA 5505 that flies...I will try it on mine and see if some command somewhere (hidden) is causing the issue. I even cleared the config and started with a clean slate just in case I was missing some command from the older configs that may have impacted performance.

After changing the switch with a high end switch my performance increased but I am still not happy with the throughput out of my ASA. I have about 50+ ASAs 5505s and a dozen 5510s. Most remote sites have 5505s. All my sites right now have 8.2.5-51 and I wanted to put 9.2.3 out there to solve issues I have uncovered on the 8.2.5 code with regards to QOS issues.
I get much better results using the Cisco 3750X attached to the FIOS (right around 300/300 with my laptop directly attached to the 3750x bypassing the ASA - my FIOS circuit rating is also 300/300). Going through the ASA to the same test site I get download speeds of 35 to 75. Changes randomly which really bothers me. My uploads speeds are ALWAYS faster then my download speeds. Example - best download I would ever get is 75Mb and my upload would usually hit 95Mb during the same test period.
I may have to live with it but the inconsistency is what really bothers me.
Here is the config I am currently using. Nothing going on during testing since only a single PC is attached. VPN tunnel to the main site can be up or down...doesn't seem to make any difference. PC does to site directly from outside interface of ASA...split tunneling. Even when I removed tunnels and tested with just the ASA as a firewall to the Internet I was still seeing the same inconsistencies.
Anything obviously missing - new command or anything? Xlates causing issues?

How to set a maximum download size per connection in the ASA?

Hi, I would like to avoid big downloads so I want to set a maximum download file size. How can I set the limit MB allowed per connection in the ASA?
Thanks

Hello Andrew,
I got your question, but I think we might be confused here, I did not specify something after the timeout but when you configure it you will see you have the same options
Here is the configuration options on 8.2.5
ciscoasa(config-pmap-c)# set connection timeout ?
mpf-policy-map-class mode commands/options:
dcd          Configure dead-connection-detection retry interval.
embryonic    Configure absolute time after which an embryonic TCP connection
               will be closed, default is 0:00:30.
half-closed Configure idle time after which a TCP half-closed connection
               will be freed, default is 0:10:00
idle         Configure idle time after which a connection state will be
               closed.
Now on an ASA running 8.4.4(9)
WPLG-ASA-1(config-pmap-c)# set connection timeout ?
mpf-policy-map-class mode commands/options:
dcd          Configure dead-connection-detection retry interval.
embryonic    Configure absolute time after which an embryonic TCP connection
               will be closed, default is 0:00:30.
half-closed Configure idle time after which a TCP half-closed connection
               will be freed, default is 0:10:00
idle         Configure idle time after which a connection state will be
               closed.
So as you can see same options, no change at all
Hope that I could help
Remember to rate all of the helpful posts

How to Enable logging of the ASA 5525?

I need help to enable logging of the ASA 5525 for all new rules created today from the firewall module, rules changed, deleted desabilidas and disabled rules.
Not found in the historic level of the ID on new firewall rules.
0 or emergencies—System is unusable.
1 or alerts—Immediate action needed.
2 or critical—Critical conditions.
3 or errors—Error conditions.
4 or warnings—Warning conditions.
5 or notifications—Normal but significant conditions.
6 or informational—Informational messages.
7 or debugging—Debugging messages.
Thank you.

You cannot log only those changes but you can log *all* changes.
The messages 111008 and 111010 are the ones to look for (as described in this post).

Replacing the Java Code Signing Certificate on the ASA 55xx VPN/Firewall Appliance

Hi,
basically I am trying to achieve what's documented in
http://www.cisco.com/en/US/docs/security/asa/asa80/release/notes/asarn80.html#wp242704
(using ASDM: "crypto ca import" = Remote Access VPN -> Certificate Management -> Code Signer -> Import)
I give it a complete PKCS12 bundle (unencrypted private key + certificates up to the root CA) to the ASA.
I can indeed verify that it has been imported correctly by exporting it again:
crypto ca export CodeSignerBundle pkcs12 1234
It shows me the private key and all the certificates.
However, the jars used in WebVPN, while carrying the correct certificate, don't have a full certification chain at their disposal:
Using jarsigner -verify I see on a random file from the jar:
sm       905 Fri Nov 30 00:00:00 CET 1979 Java/lang/CpUtf8.class
      X.509, CN=COMMONNAME, O=ORGANIZATION, L=LOCATION, ST=STATE, C=COUNTRY
      [certificate is valid from 8/1/13 4:30 PM to 8/1/16 4:30 PM]
      X.509, CN=LuxTrust Qualified CA, O=LuxTrust S.A., C=LU
      [certificate is valid from 6/5/08 11:25 AM to 10/18/16 12:40 PM]
      [CertPath not validated: Path does not chain with any of the trust anchors]
Indeed the certificate file inside the jar (META-INF/.....RSA) does not contain what I uploaded to the ASA. One of the intermediary certificates is missing (while another certificate is listed twice).
What could be the problem here? (ASA v8.2(5))
Thanks for any help,
Marki

It may be that a ip address pool is not assigned to the default webvpn group:
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool testpool

Lost my certificate on the asa

Hi Community.
My installed certificate is not shown anymore under "Identity Certificates". Now i just have my ".cer" file from the CA Certifier and like to install that again. But the ASA says I need to install the certifiacte in the "PKCS12 format with Certificate and Private Key".
Wha ca i do ?
Thanks and kind regards patrick

When you generate the request on the ASA, the key is saved locally and you can only export it via a system backup (with ASDM e.g.). If the certificate and the key is gone you can only restore via backup (or you have a PKCS12).
Michael
Please rate all helpful posts

How can I hold the public IP on a specific profile on the asa 5510

Hi Guys
How can I hold the public IP on my cisco client VPN NAT session so nobody else can use it? I have a cisco asas 5510
inside is 172.10.20.86
public 166.245.192.90
Did I need to call my ISP?
thanks

sorry
I willl like to lock or reserve the public IP address from a NAT session on the ASA vpn.
that way a sepcific profile and public IP can be use all the time. I know how on the inside IP but not on the public IP.
it make sense

How does the ASA handle Host Headers for a webserver

If I have an IIS webserver with multiple private IP address, and a site assigned to each of these private IPs. I have defined all internal private IPs in the ASA and now I want to map 1 public IP to all sites on these different private IP's but need to use port 80, is this possible?

I know this is a old thread and maybe no one is watching it anymore but I'm going to be dealing with a similar situation and trying to sort it out. All my past experience is with non-Cisco products so I a not familiar with ASA (yet).
In the original question here I think it is complicated by having multiple private IPs on the *same* web server. This should not really be. Since it is one server it can do fine with multple sites all runing on the same port 80 and the same IP# as long as they are separated via Host Headers. If this were done then the question to me would be "Does the ASA retain the hostHeader when it passed the traffic back to the web server?" If the answer to that is "Yes" then the problem is solved. The ASA does not need to "care" about individual web sites,...all it has to do is take whatever comes in on the Public IP on port 80 and send it back the the Web server on port 80 at whatever Single IP# it is (should be) running and then the Web Server software "sorts it out" and picks the correct web site to feed it to.
Would this be a correct way to look at it?

Can I format the CF in a cisco 1800 router and then use it on the ASA 5520?

Can I format Compact Flash in a cisco 1800 router and then use it on the ASA 5520?

You don't have to format the card in the router. You can do that on your PC. Just format the CF-card as FAT32 and plug it into the ASA.
BUT: If you just want to "upgrade" the old card with a different one, then first attach the original card from the ASA to your PC and copy all files (including the hidden ones) to your PC and then copy them back to the new card. That way you also move your licenses to the new card which are stored in hidden files and your private data like keys.

VIDEO CONFRENCING THROUGH THE ASA

HI can anyone tell me what ports need to be allowed to allow video confrencing through the ASA
can i use nat instead of access lists to do the same

Incase of H323.
PORT
TYPE
PROTOCOL
DESCRIPTION
1719
Static
UDP
Gatekeeper RAS
1720
Static
TCP
Q.931 (Call Setup)
1024-65535
Dynamic
TCP
H.245(Call Parameters)
1024-65535
Dynamic
UDP (RTP)
Video Data Streams
1024-65535
Dynamic
UDP (RTP)
Audio Data Streams
1024-65535
Dynamic
UDP (RTCP)
Control Information
You can use NAT but better not to use.
Thanks
ajay

Anyconnect on the asa

Similar Messages

Maybe you are looking for