ASA 5505 speed reduction when connected to a Planet fiber converter

Hi!
We have many customers running ASA 5505, and a number of them are running 100 Mbit connections. This normally works fine. But recently, our ISP has started setting up all new fiber connections using a Planet fiber to RJ converter (Before they used Cisco switches), and with those, the locations only get around 50-60 Mbit. We have done all the testing - force port speed and duplex settings, test with a PC directly connected to the converter etc. And the connection allways runs 100 Mbit. And the ASA's themselves also run 100 Mbit when connected to anything else than the Planet converter. We have for now circumvented the problem by placing a simple L2 switch between the converter and the ASA's, but this is not an ideal solution as it adds another single point of failure element etc.
Any ideas?

The Express units can extend wireless on the TC or each other.. but they cannot extend wireless on the Asus anyway..
So the setup is Asus--TC (that has to be ethernet) The TC in bridge mode.
Then TC -- express can be done by ethernet in roaming mode as bob listed above or extend wireless.
I am guessing.. what model are the express units.. they are older Gen1 N model ??
IMHO the TC is simply no longer viable.. replace it with one express as the AP and extend it with the other Express.. see if that works better.
But I would be trying to use the wireless just from the AC66U.
I would also force the Asus back to 20mhz on the 2.4ghz band.. so you can provide adequate channel separation.. 40mhz wireless on 2.4ghz works poorly anyway because you have too much wifi .. there is very limited number of non-overlapping channels.. ie 3. 11, 6 and 1.

Similar Messages

  • ASA 5505 configured for WebVPN connecting to Citrix Web Interface

    ASA 5505 configured for WebVPN connecting to Citrix Web Interface.
    i have a ASA 5505 that I am attempting to configure for WebVPN with passthrough into Web Interface .  The user authenticates into WebVPN OK and gets the option to click on the Citrix Link (which is i add bookmark  citrix server http:// 172.30.40.5.) i enter the citrix and then for example  i want to open to outlook it can not open. (when i want to open some application no application is open)).there is no alarm at asa. how i solve this issue?
    thanks.

    Teymur,
    Can you confim that after disabling the ssl/tls on the Citrix server (secure connectivity) that you are getting exactly the same error.  It is possible that it is generating a different error.
    The bug where we have see the existing error was CSCtf06303 but that has been fixed in 8.4.1.  Can you confirm the exact version of code you are running on the ASA.
    If you have confirmed the above two notes it may be adventageous to open a TAC case as we may need to do some live additional troubleshooting.
    Thanks
    -Jay

  • Cisco ASA 5505 - Keeps dropping internet connection

    Hi,
    We are having some issues with our Cisco ASA 5505 unit, it intermittently drops the outside interface connection. Internally the network appears to be working correctly with no issues. Even though the outside interface indicates it is 'up' access to the internet is lost from our LAN. This seems to be ocourring more and more often! This is happening for all users on the network too. Reloading the ASA seems to correct the problem temporally but this isn't really an option during peak periods in the day as this would obviously hinder work being carried out by employees.
    Any ideas?
    Any help would be greatly appreciated!!
    Thanks,
    John
    Running Config Below:
    ASA Version 8.2(1)
    hostname ******************
    domain-name *************************
    enable password ************************* encrypted
    passwd **************************** encrypted
    names
    dns-guard
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.3.0.254 255.255.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address ***************** 255.255.255.248
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server *****************
    domain-name **********************
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list outside_access_in extended permit tcp any any eq smtp
    access-list outside_access_in extended permit tcp any any eq 3389
    access-list outside_access_in extended permit tcp any any eq https
    access-list outside_access_in extended permit tcp any any
    access-list outside_access_in extended permit tcp any any eq 3839
    pager lines 24
    logging enable
    logging asdm warnings
    mtu inside 1500
    mtu outside 1500
    failover timeout -1
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-621.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp 10.3.0.2 smtp netmask 255.255.255.255
    static (inside,outside) tcp interface https 10.3.0.2 https netmask 255.255.255.255
    static (inside,outside) tcp interface 3839 10.3.0.1 3839 netmask 255.255.255.255
    static (inside,outside) tcp interface 3389 10.3.0.1 3389 netmask 255.255.255.255
    static (inside,inside) 10.3.0.0 10.3.0.0 netmask 255.255.0.0 norandomseq nailed
    static (inside,inside) 172.16.63.0 172.16.63.0 netmask 255.255.255.240 norandomseq nailed
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 *************** 1
    route inside 172.16.63.0 255.255.255.240 10.3.0.253 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.3.0.0 255.255.0.0 inside
    http 10.3.0.0 255.255.255.0 inside
    http 10.10.2.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt noproxyarp inside
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 1
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics port
    threat-detection statistics protocol
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username ************ password *********************** encrypted privilege 15
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global

    Hello,
    What happens when you assign eth0 as internal interface and eth1 as outside if?
    Also configure logging (/debugging) to see if there are hardware issues or something else.
    And it seems you have a range of public addresses. What happens when you connect a device, e.g. a laptop directly on the internet access device and send continue ping to an internet host.
    When you loose internet connectivity, is the laptop still pinging to that host?
    Hopefully this helps you,
    Kind regards,
    Ralph Willemsen
    Arnhem, Netherlands

  • ASA 5505 LCP terminated: loosing connection every so often

    hi,
    i'm a little lost with interpreting the following debug messages of an ASA 5505 running "asa724-k8.bin".
    I'm loosing the connection every so often after 20-45 Minutes:
    %ASA-3-403503:PPPoE:PPP link down:
    %ASA-3-403503:PPPoE:PPP link down:Peer Terminated
    %ASA-3-403503:PPPoE:PPP link down:
    %ASA-3-403503:PPPoE:PPP link down:LCP down
    Debugs are attached.
    thanks
    colin

    Hi Colin,
    To me the PPPoE debug is a bit of a distraction.
    It would be wonderful just to see the PPP debug and not a PPPOE PADI etc.. but that's just my preference :-)
    If the Service provider is sending PPP LCP echo request, these act almost like a keepalive to verify the PPP link from the PPPoE access concentrator to the client is up and running. If the ASA doesn't respond, the Service providers access concentrator 'thinks' ah this link is down.
    The PPPoE access comncentrator send another LCP echo request and the client should send a echo reply.
    Usually in a PPP scenario, both ends send LCP echo requests and expect to see LCP echo replies. As both ends of a PPP link want to know if they are sending packets to a real end point, and that this end point is still up and running.
    Or if the Service provider doesn't see the LCP echo reply it will be patient and resent a LCP echo request. But if it still doesn't get a response to a echo request, maybe as a result of congestion over the PPPoE interface and Echo replies getting dumped, the service provider will send a PPP LCP terminate request.
    It does this as it has to assume that the link is down between the Access concentrator and the ASA PPPoE client, but it send the LCP terminate request so if the remote end of the link is really up, it will have an option to restart ppp negotiation again and bring up the PPPoE link. This i believe what you are seeing.
    The ASA should then start to initaite a PPPoE session again. You will keep on seeing;
    %ASA-3-403503:PPPoE:PPP link down:
    %ASA-3-403503:PPPoE:PPP link down:Peer Terminated
    %ASA-3-403503:PPPoE:PPP link down:
    %ASA-3-403503:PPPoE:PPP link down:LCP down
    As the Service provider is not seeing an appropriate response to it sending LCP echo requests.
    The ASA should be responding to LCP echo requests with LCP echo reply, worthwhile checking this in a debug. (LCP echo requests and replied are very different to ICMP echo requests and echo replied)
    The problem could be caused by LCP echo-replies being lost due to congestion.
    Again, would be wonderful to see how often you are receiving LCP echo-requests from the service provider and the responses.
    Interesting to see a wireshark or ethereal capture of only PPP LCP negotiation and LCP packets. To really see where the problem is.
    Sorry not much help without seeing a packet capture..
    regards Dave

  • ASA 5505 Speed Issue - Help Requested if possible

    Hi All,
    I am wondering if anybody here can shed some light on any potential configuration issues with the configuration below (Sanitized). Current State:
    1.     SIte to Site VPN is up and running perfectly.
    2.     Client to Site VPNs work through L2PT/IPSEC and through mobile devices such as IPhone.
    3.     The outside interface is at line speed - approximately 5-6MBits per second.
    4.     When performing a download of a service pack from microsoft - Bit rate on the inside interface is approximately 1/3rd of the outside interface (A lot of loss). Interface shows no CRC errors and no input errors.
    5.     The outside interface shows CRC errors and INPUT errors but due to the line speed being optimal (as the client experienced via their WAN router direct (with the ASA out of the mix), have not looked in to this further. I suspect the device it is directly attached to does not auto negotiate correctly even though the interface is set to 100Mb Full Duplex.
    6.     Outside interface MTU is set to 1492, purposely set this way due to PPPOE over head (Please correct me if I am wrong). (Approx 8 bytes)
    7.     Inside Interface MTU is set to 1500, no drops or loss detected on that interface so have left it as is.
    8.     All inspection has been disabled on the ASA as I thought that scans on the traffic could have impaired performance.
    Current Environment Traffic Flow:   
    1.     All hosts on the network have there DNS pointed to external IP addresses currently as the DNS server is out of the mix. This usually points to DNS servers in the US. If the hosts use this, the DNS queries are performed over the site-to-site VPN but the internet traffic is routed around the VPN as the traffic is a seperate established session. Split tunneling is enabled on the ASA to only trust the internal hosts from accessing the US hosts. Everything else uses the default route.
    2.     The version of software on this ASA is 8.2(1). I have checked and there does not seem to be any underlying issues that would cause this type of behaviour.
    3.     Memory is stable at roughly 190Mb out of 512Mb
    4.     CPU is constant at approximately 12%.
    5.     WAN and INSIDE switch are Fast Ethernet and the ASA interfaces are all Ethernet - Potential compatibility issue between standards? I'm aware they should be compatible - any body that has experienced any issues regarding this would be greatly apprecaited.
    Current Issues:
    1.     Speed on the inside interface is approximately 1/3rd of the WAN/Outside interface - download speeds are sitting at approximately 250 - 300kb (should be sitting at approximately 700-800kb).
    2.     Noticed that when the DC is pointed to the USA Root Domain Controller (Across the tunnel) latency is approximately 400ms average. (Performed using host name).
    3.     I ping the IP address of the exact same server and the latency is still 400ms.
    4.     Changing the DCs DNS address to 8.8.8.8, I perform the same ping to the same servers. Still 400ms.
    5.     I ping google.co.nz and I still get 400ms (You would expect it to route out the default gateway but session is still active for that IP on the ASA).
    6.     I ping 74.x.x.x (The IP from the resolution from step 5) and I get the same result.
    7.     I flush dns, same issue for 5/6.
    8.     I clear xlate on the ASA and the same issue persists.
    9.     I close command line, repen it, and perform the test again - latency is now back to 40 - 50ms as we would expect for non-vpn traffic.
    I am currently out of ideas and would like some advice on what I have actually missed.
    Things I suspect that I may need to do:
    1.     Upgrade IOS to latest version (Other than that - I'm out of ideas).
    ASA Version 8.2(1)
    hostname BLAH
    enable password x.x.x.x encrypted
    passwd x.x.x.x encrypted
    names
    name x.x.x.x BLAHPC
    name 8.8.8.8 Google-DNS description Google-DNS
    name 202.27.184.3 Telecom-Alien-Pri description Telecom-Alien-Pri
    name 202.27.184.5 Telecom-Terminator-Sec description Telecom-Terminator-Sec
    name 203.96.152.4 TelstraClearPri description TCL-PRI
    name 203.96.152.12 TelstraClearSec description TCL-Sec
    name x.x.x.x BLAH_Network description BLAH-Internal
    name x.x.x.x DC description DC VPN Access
    name x.x.x.x Management-Home description Allow RDP Access from home
    name x.x.x.x SentDC description BLAHDC
    name x.x.x.x Outside-Intf
    dns-guard
    interface Vlan1
    nameif inside
    security-level 100
    ip address x.x.x.x 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group pppoex
    ip address pppoe setroute
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    banner exec [BLAH MANAGED DEVICE] - IF YOU ARE UNAUTHORIZED TO USE THIS DEVICE, LEAVE NOW!!!
    banner login If you are Unauthorized to use this device, leave now. Prosecution will follow if you are found to access this device without being Authorized.
    banner asdm [BLAH MANAGED DEVICE] - IF YOU ARE UNAUTHORIZED TO USE THIS DEVICE, LEAVE NOW!!!
    ftp mode passive
    clock timezone WFT 12
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server Google-DNS
    name-server Telecom-Alien-Pri
    name-server Telecom-Terminator-Sec
    name-server TelstraClearPri
    name-server TelstraClearSec
    object-group service RDP tcp
    description RDP
    port-object eq 3389
    object-group network BLAH-US
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    object-group network x.x.x.x
    network-object x.x.x.x 255.255.255.0
    network-object  x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    object-group service Management_Access_Secure
    description Management Access - SECURE
    service-object tcp eq https
    service-object tcp eq ssh
    service-object tcp eq 4434
    object-group service FileTransfer tcp
    description Allow File Transfer
    port-object eq ftp
    port-object eq ssh
    object-group service WebAccess tcp
    description Allow Web Access
    port-object eq www
    port-object eq https
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service AD_Access udp
    description Allow Active Directory AD ports - UDP Only
    port-object eq 389
    port-object eq 445
    port-object eq netbios-ns
    port-object eq 636
    port-object eq netbios-dgm
    port-object eq domain
    port-object eq kerberos
    object-group network DM_INLINE_NETWORK_2
    group-object x.x.x.x
    group-object x.x.x.x
    object-group network DM_INLINE_NETWORK_3
    group-object x.x.x.x
    group-object x.x.x.x
    object-group network BLAH_DNS
    description External DNS Servers
    network-object host Telecom-Alien-Pri
    network-object host Telecom-Terminator-Sec
    network-object host TelstraClearSec
    network-object host TelstraClearPri
    network-object host Google-DNS
    object-group service AD_Access_TCP tcp
    description Active Directory TCP protocols
    port-object eq 445
    port-object eq ldap
    port-object eq ldaps
    port-object eq netbios-ssn
    port-object eq domain
    port-object eq kerberos
    port-object eq 88
    object-group network DM_INLINE_NETWORK_4
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    object-group network DM_INLINE_NETWORK_5
    network-object x.x.x.x 255.255.255.0
    network-object x.x.x.x 255.255.255.0
    object-group network DM_INLINE_NETWORK_6
    group-object x.x.x.x
    group-object x.x.x.x
    object-group network DM_INLINE_NETWORK_1
    group-object x.x.x.x
    group-object x.x.x.x
    access-list inside_access_in remark Allow Internal ICMP from BLAH
    access-list inside_access_in extended permit icmp Sentinel_Network 255.255.255.0 object-group DM_INLINE_NETWORK_2
    access-list inside_access_in remark Allow Internal ICMP to BLAH
    access-list inside_access_in extended permit icmp object-group DM_INLINE_NETWORK_3 BLAH 255.255.255.0
    access-list inside_access_in remark External DNS
    access-list inside_access_in extended permit object-group TCPUDP BLAH 255.255.255.0 object-group BLAH_DNS eq domain
    access-list inside_access_in remark Allows Web Access
    access-list inside_access_in extended permit tcp BLAH 255.255.255.0 any object-group WebAccess
    access-list inside_access_in remark Allow Remote Desktop Connections to the Internet
    access-list inside_access_in extended permit tcp BLAH 255.255.255.0 any object-group RDP
    access-list inside_access_in remark Allow File Transfer Internet
    access-list inside_access_in extended permit tcp BLAH 255.255.255.0 any object-group FileTransfer
    access-list inside_access_in remark ldap, 445, 137, 636, dns, kerberos
    access-list inside_access_in extended permit udp BLAH 255.255.255.0 object-group DM_INLINE_NETWORK_4 object-group AD_Access
    access-list inside_access_in remark ldap, 445, 137, 636, dns, kerberos
    access-list inside_access_in extended permit tcp BLAH 255.255.255.0 object-group DM_INLINE_NETWORK_5 object-group AD_Access_TCP
    access-list inside_access_in extended permit ip any any
    access-list outside_cryptomap_65535.1 extended permit ip BLAH 255.255.255.0 object-group DM_INLINE_NETWORK_6
    access-list nonat extended permit ip BLAH 255.255.255.0 object-group BLAH-US
    access-list nonat extended permit ip BLAH 255.255.255.0 object-group BLAH-USA
    access-list nonat extended permit ip BLAH 255.255.255.0 x.x.x.x 255.255.255.0
    access-list tekvpn extended permit ip BLAH 255.255.255.0 object-group BLAH-US
    access-list tekvpn extended permit ip BLAH 255.255.255.0 object-group BLAH-USA
    access-list tekvpn extended permit ip BLAH 255.255.255.0 x.x.x.x 255.255.255.0
    access-list inbound extended permit icmp any any
    access-list inside_nat0_outbound extended permit ip BLAH 255.255.255.0 10.1.118.192 255.255.255.224
    access-list inside_nat0_outbound extended permit ip BLAH 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list outside_1_cryptomap extended permit ip BLAH 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list outside_access_in extended permit icmp any any
    pager lines 24
    logging enable
    logging monitor informational
    logging buffered notifications
    logging trap informational
    logging asdm informational
    logging class auth monitor informational trap informational asdm informational
    mtu inside 1500
    mtu outside 1492
    ip local pool ipsec_pool x.x.x.x-x.x.x.x mask 255.255.255.0
    ip local pool Remote-Access-DHCP x.x.x.x-x.x.x.x mask 255.255.255.0
    ip verify reverse-path interface outside
    icmp unreachable rate-limit 1 burst-size 1
    asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 BLAH 255.255.255.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    nac-policy DfltGrpPolicy-nac-framework-create nac-framework
    reval-period 36000
    sq-period 300
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    aaa authorization command LOCAL
    aaa authorization exec authentication-server
    http server enable RANDOM PORT
    http 0.0.0.0 0.0.0.0 outside
    http x.x.x.x x.x.x.x inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection tcpmss 1428
    sysopt connection tcpmss minimum 48
    auth-prompt prompt You are now authenticated. All actions are monitored! if you are Unauthorized, Leave now!!!
    auth-prompt accept Accepted
    auth-prompt reject Denied
    service resetoutside
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
    crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 1 set transform-set TRANS_ESP_3DES_SHA TRANS_ESP_3DES_MD5
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set peer x.x.x.x
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 2
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh x.x.x.x 255.255.255.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    ssh version 2
    console timeout 0
    management-access inside
    vpdn group pppoex request dialout pppoe
    vpdn group pppoex localname **************
    vpdn group pppoex ppp authentication pap
    vpdn username ************** password PPPOE PASSPHRASE HERE
    dhcpd auto_config outside
    dhcpd address x.x.x.x/x inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics port
    threat-detection statistics protocol
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server x.x.x.x source outside prefer
    tftp-server outside x.x.x.x /HOSTNAME
    webvpn
    group-policy DfltGrpPolicy attributes
    banner value Testing ONE TWO THREE
    vpn-idle-timeout 300
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    ipsec-udp enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value outside_cryptomap_65535.1
    user-authentication enable
    nem enable
    address-pools value Remote-Access-DHCP
    webvpn
      svc keepalive none
      svc dpd-interval client none
    USER CREDENTIALS HERE
    vpn-tunnel-protocol l2tp-ipsec
    tunnel-group DefaultL2LGroup ipsec-attributes
    pre-shared-key SITETOSITE PSK
    peer-id-validate nocheck
    tunnel-group DefaultRAGroup general-attributes
    authorization-server-group LOCAL
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key CLIENTTOSITE PSK
    peer-id-validate nocheck
    isakmp keepalive disable
    tunnel-group DefaultRAGroup ppp-attributes
    authentication pap
    no authentication chap
    no authentication ms-chap-v1
    authentication ms-chap-v2
    authentication eap-proxy
    tunnel-group x.x.x.x type ipsec-l2l
    tunnel-group x.x.x.x ipsec-attributes
    pre-shared-key *
    tunnel-group-map default-group DefaultL2LGroup
    class-map inspect_default
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    privilege cmd level 3 mode exec command perfmon
    privilege cmd level 3 mode exec command ping
    privilege cmd level 3 mode exec command who
    privilege cmd level 3 mode exec command logging
    privilege cmd level 3 mode exec command failover
    privilege show level 5 mode exec command import
    privilege show level 5 mode exec command running-config
    privilege show level 3 mode exec command reload
    privilege show level 3 mode exec command mode
    privilege show level 3 mode exec command firewall
    privilege show level 3 mode exec command asp
    privilege show level 3 mode exec command cpu
    privilege show level 3 mode exec command interface
    privilege show level 3 mode exec command clock
    privilege show level 3 mode exec command dns-hosts
    privilege show level 3 mode exec command access-list
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command vlan
    privilege show level 3 mode exec command ip
    privilege show level 3 mode exec command ipv6
    privilege show level 3 mode exec command failover
    privilege show level 3 mode exec command asdm
    privilege show level 3 mode exec command arp
    privilege show level 3 mode exec command route
    privilege show level 3 mode exec command ospf
    privilege show level 3 mode exec command aaa-server
    privilege show level 3 mode exec command aaa
    privilege show level 3 mode exec command eigrp
    privilege show level 3 mode exec command crypto
    privilege show level 3 mode exec command vpn-sessiondb
    privilege show level 3 mode exec command ssh
    privilege show level 3 mode exec command dhcpd
    privilege show level 3 mode exec command vpnclient
    privilege show level 3 mode exec command vpn
    privilege show level 3 mode exec command blocks
    privilege show level 3 mode exec command wccp
    privilege show level 3 mode exec command dynamic-filter
    privilege show level 3 mode exec command webvpn
    privilege show level 3 mode exec command module
    privilege show level 3 mode exec command uauth
    privilege show level 3 mode exec command compression
    privilege show level 3 mode configure command interface
    privilege show level 3 mode configure command clock
    privilege show level 3 mode configure command access-list
    privilege show level 3 mode configure command logging
    privilege show level 3 mode configure command ip
    privilege show level 3 mode configure command failover
    privilege show level 5 mode configure command asdm
    privilege show level 3 mode configure command arp
    privilege show level 3 mode configure command route
    privilege show level 3 mode configure command aaa-server
    privilege show level 3 mode configure command aaa
    privilege show level 3 mode configure command crypto
    privilege show level 3 mode configure command ssh
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    privilege clear level 3 mode exec command dns-hosts
    privilege clear level 3 mode exec command logging
    privilege clear level 3 mode exec command arp
    privilege clear level 3 mode exec command aaa-server
    privilege clear level 3 mode exec command crypto
    privilege clear level 3 mode exec command dynamic-filter
    privilege cmd level 3 mode configure command failover
    privilege clear level 3 mode configure command logging
    privilege clear level 3 mode configure command arp
    privilege clear level 3 mode configure command crypto
    privilege clear level 3 mode configure command aaa-server
    prompt hostname context
    Cryptochecksum:894474af5fe446eeff5bd9e7f629fc4f
    : end

    Hi all, this post can be officially closed. The issue had nothing to do with the ASA but required a firmware upgrade on the WAN router which boosted the throughput on the external interface on the ASA to 10Mbps and the inside throughput naturally corrected itself to what was expected.
    Thanks to everybody who looked at this issue.
    Andrew

  • Buffering, speed reduction when on different floor than router. How to solve?

    Hi. We have the newest N router and whatever super speed package offered. Things are fabulous unless I'm in the basement, one level below the router. When working in the basement (wireless thru VPN) my laptop performance is generally fine. However when streaming live tv via the Fios app or a movie via the Amazon app on my iPad, it buffers constantly. This occurs even when no other devises are accessing the wireless network. I'd like to figure out how to boost the speed when in the basement. Any suggestions? Be gentle, I'm not very techy . Thanks!

    Sverige wrote:
    ...  We have the newest N router ... Things are fabulous unless I'm in the basement, one level below the router ... when streaming live tv ... or a movie ... , it buffers constantly ... I'd like to figure out how to boost the speed when in the basement ... ...
    Several issues are at work here.
    First, trying to get a good signal when the receiving device is below the radio is a problem.  For details, do a basic search on wireless propagation.  Second, the farther you are from the transmitting radio (i.e., the router), the poorer the signal.  Simple propagation physics.
    Third,  you haven't indicated your speed tier and it's possible that increasing your  Internet speed may help.  Fourth, see if you can run Ethernet (or even coax) to the basement area.  This will allow either a direct connection or a second router with wireless capability.
    Based on your statement of the problem, the above routes appear to give the best chance to improve your situation.

  • ASA 5505 VPN Can not connect clients

    Hi,
    I tried to search for an answer to this question but I couldn't find the answer.
    I configured the VPN on the ASA, I can not  get a client to connect to the ASA  I've tried and search for an answer and I really need som help!
    Any help is greatly appreciated.
    : Saved
    ASA Version 7.2(2)
    hostname
    domain-name
    enable password
    names
    ddns update method
    ddns both
    interface Vlan1
    nameif inside
    security-level 100
    ddns update hostname
    ddns update
    dhcp client update dns
    ip address 192.168.1.1 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.0
    ospf cost 10
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    passwd 2KFQnbNIdI.2KYOU encrypted
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server
    name-server
    domain-name
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list EasyVPN_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list OUTSIDE_IN_ACL extended permit ip any any
    access-list OUTSIDE_IN_ACL extended permit icmp any interface outside
    access-list Remote-VPN_splitTunnelAcl standard permit any
    access-list DefaultRAGroup_splitTunnelAcl standard permit any
    access-list Bild_splitTunnelAcl standard permit any
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool TKK 192.168.1.200-192.168.1.220 mask 255.255.255.224
    ip local pool VPN-Pool 192.168.254.1-192.168.254.10 mask 255.255.255.0
    no failover
    monitor-interface inside
    monitor-interface outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (outside) 0 access-list outside_nat0_outbound
    static (inside,inside) tcp interface 3389 access-list inside_nat_static
    static (inside,inside) tcp interface ftp access-list inside_nat_static_2
    static (outside,inside) x.x.x.x 192.168.1.0 netmask 255.255.255.255 dns
    access-group inside_access_in in interface inside
    access-group inside_access_out out interface inside
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    vpn-tunnel-protocol l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server value 192.168.1.253
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission
    to use any of the VPN features. Contact your IT administrator for more information
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy EasyVPN internal
    group-policy EasyVPN attributes
    dns-server value 192.168.1.253
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value EasyVPN_splitTunnelAcl
    default-domain value xxx.se
    group-policy Remote-VPN internal
    group-policy Remote-VPN attributes
    dns-server value 192.168.1.253
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Remote-VPN_splitTunnelAcl
    default-domain value xxx.se
    group-policy CiscoASA internal
    group-policy CiscoASA attributes
    dns-server value 192.168.1.253 x.x.x.x
    vpn-tunnel-protocol IPSec webvpn
    group-policy Bild internal
    group-policy Bild attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Bild_splitTunnelAcl
    username User attributes
    vpn-group-policy DfltGrpPolicy
    username Bild password encrypted privilege 0
    username Bild attributes
    vpn-group-policy Bild
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 60 set pfs
    crypto dynamic-map outside_dyn_map 60 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 80 set pfs
    crypto dynamic-map outside_dyn_map 80 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 100 set pfs
    crypto dynamic-map outside_dyn_map 100 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 120 set pfs
    crypto dynamic-map outside_dyn_map 120 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 140 set pfs
    crypto dynamic-map outside_dyn_map 140 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 160 set pfs
    crypto dynamic-map outside_dyn_map 160 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 180 set pfs
    crypto dynamic-map outside_dyn_map 180 set transform-set TRANS_ESP_DES_SHA
    crypto dynamic-map outside_dyn_map 200 set pfs
    crypto dynamic-map outside_dyn_map 200 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 220 set pfs
    crypto dynamic-map outside_dyn_map 220 set transform-set ESP-DES-SHA
    crypto dynamic-map inside_dyn_map 20 set pfs
    crypto dynamic-map inside_dyn_map 20 set transform-set ESP-DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic inside_dyn_map
    crypto map inside_map interface inside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp nat-traversal  20
    crypto isakmp ipsec-over-tcp port 10000
    tunnel-group DefaultRAGroup general-attributes
    address-pool vpn
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *
    tunnel-group Bild type ipsec-ra
    tunnel-group Bild general-attributes
    address-pool TKK
    default-group-policy Bild
    tunnel-group Bild ipsec-attributes
    pre-shared-key *
    tunnel-group CiscoASA type ipsec-ra
    tunnel-group CiscoASA general-attributes
    address-pool vpn
    default-group-policy CiscoASA
    tunnel-group CiscoASA ipsec-attributes
    pre-shared-key *
    tunnel-group EasyVPN type ipsec-ra
    tunnel-group EasyVPN general-attributes
    address-pool vpn
    default-group-policy EasyVPN
    tunnel-group EasyVPN ipsec-attributes
    pre-shared-key *
    tunnel-group Remote-VPN type ipsec-ra
    tunnel-group Remote-VPN general-attributes
    address-pool VPN-Pool
    default-group-policy Remote-VPN
    tunnel-group Remote-VPN ipsec-attributes
    pre-shared-key *
    class-map global-class
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global-policy
    class global-class
      inspect ftp
      inspect icmp
      inspect pptp
    service-policy global-policy global
    prompt hostname context
    Cryptochecksum:8cdda33b1993ba7bb33db88d996e939c
    : end

    Hi Fredrik,
    I see your acl "outside_nat0_outbound" set on inside interface for no nat, but I do not see, the acl is being defined anywhere on your config.
    I also strongly recommand create your vpn-pool to be different subnet rather being as same as your inside ip of your ASA.
    so, let assume your vpn pool is 192.168.255.1-254/24
    so, your no-nat for inside will look like this below.
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.255.0 255.255.255.0
    Let me know, if this helps.
    thanks

  • ASA 5505 - 2 Internet Connections, Problems with the Default Route

    Hey there,
    i have a Problem at a Customer Site at the moment. The customer uses an ASA 5505 with two internet connections attached to it. On the first connection (which is the only one in use at the moment) he has some Static-PAT's from Outside to Inside where he translates different services to the internal servers. He also has a site-2-site VPN terminating there and AnyConnect.
    He now wants to switch the Internet Traffic from Inside to the new Internet Connection. Therefore changing the default route to that new ISPs Gateway. The problem now is, that no traffic recieved on the old "outside" Interface is transmitted back out of that old "outside" Interface. And this happens although the "same-security permit intra-interface" command is set.
    Can you tell me what's wrong here? For every Static-PAT from outside to inside there is also a dynamic PAT from inside to outside. But the ASA seems to ignore this. I have not looked into the Logs yet, was too busy finding the problem because i had no real time window to test on the productive ASA.
    Can it be achieved in any way? Having a default route on the ASA which leads any traffic to the second internet connection while still having connections on the first internet connection where no explicit route can be set? Because connections arrive from random IPs?
    Many thanks for your help in advance!
    Steffen

    Phillip, indeed , I have as well read may comments,it all depends on your environment as they all differ from one another, you best bet is to have a good solid plan for upgrade and fall back. You do have a justification to upgrade for features needed, so I would suggest the following:
    1- Do a search again in forum for ASA code upgrades and look at comments from users that have gone through this process and note their impact in fuctionality if any. I believe this is good resource to collect information .
    2- Very important , look into release notes for a particular version. For example version 8.0, look into open CAVEATS usually at the end of the link page, reading the open bugs gives you clues what has not yet been resolved for that particular code and if in fact could impact you in your environment, it is possible that a particular bug does not realy apply to your environment becuase you have yet not implemented that particualr configuration. Usually we all try to aim towards a GD (General Deployment) code which is what we all understand is most stable but not necesarily means you have to be stack in that code waiting for another GD release, in my personal experience I have upgraded our firewall from 7.2 to 8.0(3) long ago and had no issues, and recently upgraded to 8.0(4)when it was first release in August this year.
    Release notes
    http://www.cisco.com/en/US/products/ps6120/prod_release_notes_list.html
    3- AS a good practice precaution -
    a-Backup firewall configs in clear text as well as via tftp code.
    b-Backup running code and ASDM version code currently running in firewall.
    c- Save the output of " show version " to have as reference for all the feature licenses you currently have running as asll as activation keys - good info to have to compare with after upgrade.
    d- Ensure that the code you will be using to upgrade also uses correct ASDM version code.
    I think with thorough assesment and preparation you can indeed minimize impact.
    Rgds
    Jorge

  • Vpn-asa 5505 - connects fine, can't use resources

    Using Remote Client VPN to access internal Lan behind an ASA 5505 device.  The connection is working fine. But once I connect, I can't access any computer shared folders etc.   The only thing I can do is access the ASA 5505 through the ASDM 7.1    I can only ping the device 10.0.0.1  but nothing else.    The funny thing is that this was working fine,  then in an attempt to speed up the VPN ACCESS (it is pretty slow),  I went into the ASDM configuration software to look around.   Didn't think I changed anything, but now,  it's not working.   Here is a copy of the backup cpg. 
    Any ideas.   Please respond with  ASDM COMMANDS.. I'm a novice at the command line stuff.
    Thanks.
    -brett
    config:
    : Saved
    : Written by enable_15 at 09:19:26.379 UTC Sat Feb 15 2014
    ASA Version 9.1(4)
    hostname ciscoasa
    domain-name hnedu.com
    enable password mnpTCRVkk1.ZjiWJ encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPNUsers 10.0.0.80-10.0.0.99 mask 255.255.0.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    speed 100
    duplex full
    interface Ethernet0/2
    speed 100
    duplex full
    interface Ethernet0/3
    speed 100
    duplex full
    interface Ethernet0/4
    speed 100
    duplex full
    interface Ethernet0/5
    speed 100
    duplex full
    interface Ethernet0/6
    speed 100
    duplex full
    interface Ethernet0/7
    speed 100
    duplex full
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.0.0
    interface Vlan2
    description External Connection
    no forward interface Vlan1
    nameif outside
    security-level 0
    ip address 209.117.123.226 255.255.255.224
    boot system disk0:/asa914-k8.bin
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 10.0.0.2
    name-server 10.0.0.4
    domain-name hnedu.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj-10.0.0.0
    subnet 10.0.0.0 255.255.0.0
    object network obj-10.0.0.64
    subnet 10.0.0.64 255.255.255.192
    object network obj-10.0.0.6
    host 10.0.0.6
    object network obj-10.0.3.48
    host 10.0.3.48
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network NETWORK_OBJ_10.0.0.64_26
    subnet 10.0.0.64 255.255.255.192
    object-group network RDP_static
    object-group service RemoteDesktop tcp-udp
    description Windows Remote Desktop Access
    port-object eq 3389
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    access-list inside_access_in extended permit ip any4 any4
    access-list Napoleons_splitTunnelAcl standard permit 10.0.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.0.0 10.0.0.64 255.255.255.192
    access-list outside_access_in extended permit tcp any4 host 10.0.0.6 eq www
    access-list outside_access_in remark remote desktop to cproom desktop
    access-list outside_access_in extended permit object-group TCPUDP any4 host 10.0.3.48 eq 3389
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-715-100.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,any) source static obj-10.0.0.0 obj-10.0.0.0 destination static obj-10.0.0.64 obj-10.0.0.64 no-proxy-arp route-lookup
    object network obj-10.0.0.6
    nat (inside,outside) static 209.117.123.227
    object network obj-10.0.3.48
    nat (inside,outside) static 209.117.123.228
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group inside_access_in in interface inside control-plane
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 209.117.123.225 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 10.0.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca trustpool policy
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
        308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
        0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
        30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
        13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
        0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
        20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
        65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
        65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
        30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
        30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
        496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
        74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
        68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
        3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
        63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
        0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
        a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
        9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
        7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
        15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
        63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
        18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
        4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
        81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
        db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
        ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
        45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
        2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
        1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
        03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
        69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
        02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
        6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
        c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
        69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
        1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
        551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
        1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609
        2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
        4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
        b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
        6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
        481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
        b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
        5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
        6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
        6c2527b9 deb78458 c61f381e a4c4cb66
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    management-access inside
    vpn-addr-assign local reuse-delay 5
    vpn-sessiondb max-other-vpn-limit 10
    vpn-sessiondb max-anyconnect-premium-or-essentials-limit 2
    dhcp-client update dns server none
    dhcpd dns 10.0.0.2 10.0.0.4
    dhcpd wins 10.0.0.2 10.0.0.4
    dhcpd domain hnedu.com
    dhcpd option 5 ip 10.0.0.2 10.0.0.4 interface inside
    dhcpd option 6 ip 10.0.0.2 10.0.0.2 interface inside
    dhcprelay server 10.0.0.2 inside
    dhcprelay server 10.0.0.4 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy Napoleons internal
    group-policy Napoleons attributes
    wins-server value 10.0.0.2 10.0.0.4
    dns-server value 10.0.0.2 10.0.0.4
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Napoleons_splitTunnelAcl
    default-domain value hnedu.com
    group-policy Napoleon internal
    group-policy Napoleon attributes
    wins-server value 10.0.0.2 10.0.0.4
    dns-server value 10.0.0.2 10.0.0.4
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Napoleons_splitTunnelAcl
    default-domain value hnedu.com
    username bpenza password LTg/b/c3kPWfC8KM encrypted privilege 0
    username bpenza attributes
    vpn-group-policy Napoleons
    username baudette password nPZIRfshkE7WcaDQ encrypted
    username baudette attributes
    vpn-group-policy Napoleons
    tunnel-group Napoleons type remote-access
    tunnel-group Napoleons general-attributes
    address-pool VPNUsers
    default-group-policy Napoleons
    tunnel-group Napoleons ipsec-attributes
    ikev1 pre-shared-key Holyname12
    tunnel-group Napoleon type remote-access
    tunnel-group Napoleon general-attributes
    address-pool VPNUsers
    default-group-policy Napoleon
    tunnel-group Napoleon ipsec-attributes
    ikev1 pre-shared-key Holyname12
    policy-map global-policy
    class class-default
      user-statistics accounting
    service-policy global-policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:eb9d34735b125eb61d8f7d93247ad9b7
    : end

    You need to discuss this issue with your network administrator. I suspect the network ports that allow VPN access to the system you want to use may be closed.
    You also need to confirm that the VPN software you are using is compatible with the network you are trying to access. Where I work, the VPN software that comes with Mac OS X is not
    compatible with the network so I have to use VPN software that was provided by my employer. You might be in the same situation.

  • E4200 GigE speed reduction

    Just installed the E4200. Strange behavior noticed on switched GigE ports. When connecting directly to my cable modem I get 4.5 mbps upload speed when going through the E4200 I get 1.7 mbps. I have a E3000 and do not see this type of speed reduction when I repeated the test.
    Any thougths or ideas? 

    If you have enable QoS feature on your Router that will reduce the speed because it will not allow the enough signal to pass from your router to the computer. But its good that you have figured out yourself and it has solved your problem.

  • Asa 5505 vpn

    Hello, i have asa 5505. Users can connect to inside network (192.168.1.0) throught L2TP VPN and can ping inside network. Need to allow vpn users (192.168.2.0) to ping each other.
    interface Vlan1 
    nameif inside 
    security-level 100 
    ip address 192.168.1.1 255.255.255.0 
    interface Vlan2 
    nameif outside 
    security-level 0 
    ip address dhcp setroute 
    same-security-traffic permit inter-interface 
    access-list Local_LAN_Access remark VPN Client Local LAN Access 
    access-list Local_LAN_Access standard permit 192.168.1.0 255.255.255.0 
    access-list Inside_nat0_outbound extended permit ip any 192.168.3.0 255.255.255.0 
    access-list Inside_nat0_outbound extended permit ip any 192.168.2.0 255.255.255.0 
    access-list Inside_nat0_outbound extended permit ip any 192.168.4.0 255.255.255.0 
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.4.0 255.255.255.0 
    access-list vpn extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0 
    access-list Local_LAN_Access_l2tp remark l2tp Client Local LAN Access 
    access-list Local_LAN_Access_l2tp standard permit 192.168.1.0 255.255.255.0 
    access-list Local_LAN_Access_l2tp standard permit 192.168.2.0 255.255.255.0 
    access-list vpn_l2tp extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 
    access-list split-tunnel standard permit 192.168.1.0 255.255.255.0 
    access-list split-tunnel remark match Anyconn client to tunnel traffic 
    ip local pool l2tp-ipsec_address 192.168.2.100-192.168.2.114 mask 255.255.255.0 
    nat-control 
    global (inside) 2 192.168.1.101 
    global (inside) 3 192.168.1.102 
    global (outside) 1 interface 
    nat (inside) 0 access-list Inside_nat0_outbound 
    nat (inside) 1 192.168.1.0 255.255.255.0 
    nat (outside) 2 access-list vpn 
    nat (outside) 3 access-list vpn_l2tp 
    crypto ipsec transform-set trans esp-3des esp-sha-hmac 
    crypto ipsec transform-set trans mode transport 
    crypto dynamic-map dyno 10 set transform-set trans 
    crypto map vpn 65535 ipsec-isakmp dynamic dyno 
    crypto map vpn interface outside 
    crypto isakmp enable outside 
    crypto isakmp policy 1 
    authentication pre-share 
    encryption 3des 
    hash sha 
    group 2 
    lifetime 43200 
    crypto isakmp policy 10 
    authentication rsa-sig 
    encryption 3des 
    hash sha 
    group 2 
    lifetime 86400 
    crypto isakmp nat-traversal 30 
    vpn-addr-assign local reuse-delay 5 
    group-policy l2tp-ipsec_policy internal 
    group-policy l2tp-ipsec_policy attributes 
    dns-server value 192.168.1.10 
    vpn-tunnel-protocol l2tp-ipsec 
    split-tunnel-policy tunnelspecified 
    split-tunnel-network-list value Local_LAN_Access_l2tp

    Hello,
    You will have to configure hair pinning / u turning to get this working. Make sure the vpn pool is allowed in the split access-list for L2TP clients.
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml
    Hope this helps.
    Regards,
    Dinesh Moudgil
    P.S. Please rate helpful posts.

  • ASA 5505 Slow download speed

    Hello, as the title states, I have an ASA 5505 at one facility that is only getting around 16mb down on a 100mb circuit. No errors on either interface, and we've tried manually setting port speed and duplex, and auto, (both sides show it negotiating at 100 / full).
    Here is the sanitized config:
    : Saved
    : Written by mlsysadmin at 05:43:12.139 CST Fri Mar 6 2015
    ASA Version 8.2(5) 
    hostname fw01
    domain-name domain.com
    enable password xxxxxxxx encrypted
    passwd xxxxxxxx encrypted
    names
    name x.x.x.x WindStream-External-3100
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 172.16.5.254 255.255.255.0 
    interface Vlan2
     nameif outside
     security-level 0
     ip address WindStream-External-3100 255.255.255.248 
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns server-group DefaultDNS
     domain-name materialogic.com
    same-security-traffic permit intra-interface
    object-group network obj-SrcNet
    object-group network obj-amzn
    access-list inside_access_in extended permit ip any any 
    access-list inside_access_in extended permit tcp any any 
    access-list inside_access_in extended permit tcp 172.16.5.0 255.255.255.0 172.17.5.0 255.255.255.0 
    access-list outside_access_in extended permit ip x.x.x.x 255.255.255.248 172.16.5.0 255.255.255.0 
    access-list outside_access_in extended permit icmp any any 
    access-list outside_access_in extended permit ip 10.10.200.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list outside_access_in extended permit icmp 10.10.0.0 255.255.0.0 172.16.5.0 255.255.255.0 
    access-list outside_access_in extended permit tcp 172.16.5.0 255.255.255.0 172.17.5.0 255.255.255.0 
    access-list outside_access_in extended permit tcp interface outside 172.16.5.0 255.255.255.0 
    access-list acl-amzn extended permit ip any 10.10.0.0 255.255.0.0 
    access-list acl-amzn extended permit ip 172.16.5.0 255.255.255.0 172.16.3.0 255.255.255.0 
    access-list acl-amzn extended permit ip 172.16.5.0 255.255.255.0 172.16.4.0 255.255.255.0 
    access-list acl-amzn extended permit ip 172.16.3.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list acl-amzn extended permit ip 172.16.4.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list acl-amzn extended permit ip 172.16.2.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list acl-amzn extended permit ip 172.16.5.0 255.255.255.0 172.16.2.0 255.255.255.0 
    access-list amzn-filter extended permit ip 10.10.0.0 255.255.0.0 172.16.5.0 255.255.255.0 
    access-list amzn-filter extended permit icmp 10.10.0.0 255.255.0.0 172.16.5.0 255.255.255.0 
    access-list amzn-filter extended permit ip any any 
    access-list <outside_access_in> extended permit ip host 54.240.217.164 host WindStream-External-3100 
    access-list <outside_access_in> extended permit ip host 72.21.209.193 host WindStream-External-3100 
    access-list inside_mpc extended permit ip 172.16.0.0 255.255.0.0 172.16.0.0 255.255.0.0 
    access-list NORAND extended permit ip 172.16.0.0 255.255.0.0 172.16.0.0 255.255.0.0 
    access-list outside_cryptomap extended permit ip any 10.10.0.0 255.255.0.0 
    access-list outside_cryptomap extended permit ip 172.16.5.0 255.255.255.0 172.16.4.0 255.255.255.0 
    access-list outside_cryptomap extended permit ip 172.16.4.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list outside_cryptomap extended permit ip 172.16.3.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list outside_cryptomap extended permit ip 172.16.5.0 255.255.255.0 172.16.3.0 255.255.255.0 
    access-list inside_nat0_outbound extended permit ip 172.16.5.0 255.255.255.0 172.17.5.0 255.255.255.0 
    access-list inside_nat0_outbound extended permit ip 172.17.5.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list inside_nat0_outbound extended permit tcp 172.17.5.0 255.255.255.0 172.16.5.0 255.255.255.0 
    access-list inside_nat0_outbound extended permit tcp 172.16.5.0 255.255.255.0 172.17.5.0 255.255.255.0 
    pager lines 24
    logging enable
    logging timestamp
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 0 access-list acl-amzn
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 40.139.91.233 1
    route inside 172.16.2.0 255.255.255.0 172.16.5.1 1
    route inside 172.16.3.0 255.255.255.0 172.16.5.1 1
    route inside 172.16.4.0 255.255.255.0 172.16.5.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL 
    aaa authentication http console LOCAL 
    http server enable
    http server idle-timeout 1440
    http 192.168.1.0 255.255.255.0 inside
    http 172.16.0.0 255.255.0.0 inside
    http 216.43.24.82 255.255.255.255 outside
    http 64.199.141.26 255.255.255.255 outside
    snmp-server host inside 10.10.10.20 community mlogic
    snmp-server location 3100 Communications room
    no snmp-server contact
    snmp-server community mlogic
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection timewait
    sysopt connection tcpmss 1387
    sla monitor 1
     type echo protocol ipIcmpEcho 10.10.0.1 interface outside
     frequency 5
    sla monitor schedule 1 life forever start-time now
    crypto ipsec transform-set transform-amzn esp-aes esp-sha-hmac 
    crypto ipsec security-association lifetime seconds 3600
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec security-association replay window-size 128
    crypto ipsec df-bit clear-df outside
    crypto map amzn_vpn_map 1 match address acl-amzn
    crypto map amzn_vpn_map 1 set pfs 
    crypto map amzn_vpn_map 1 set peer 54.240.217.164 72.21.209.193 
    crypto map <amzn_vpn_map> 1 match address acl-amzn
    crypto map <amzn_vpn_map> 1 set pfs 
    crypto map <amzn_vpn_map> 1 set peer 54.240.217.164 72.21.209.193 
    crypto map <amzn_vpn_map> 1 set transform-set transform-amzn
    crypto map <amzn_vpn_map> interface outside
    crypto isakmp identity address 
    crypto isakmp enable outside
    crypto isakmp policy 201
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 28800
    telnet timeout 5
    ssh 172.16.0.0 255.255.0.0 inside
    ssh x.x.x.x 255.255.255.255 outside
    ssh x.x.x.x 255.255.255.255 outside
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 216.171.120.36 source outside
    webvpn
    group-policy filter internal
    group-policy filter attributes
     vpn-filter value amzn-filter
    username mlsysadmin password E9OpTNVP3nVbSPSb encrypted privilege 15
    username mlsysadmin attributes
     vpn-group-policy DfltGrpPolicy
     vpn-access-hours none
     vpn-simultaneous-logins 3
     vpn-idle-timeout 30
     vpn-session-timeout none
     vpn-filter none
     ipv6-vpn-filter none
     vpn-tunnel-protocol IPSec l2tp-ipsec svc 
     password-storage disable
     group-lock none
    tunnel-group 54.240.217.164 type ipsec-l2l
    tunnel-group 54.240.217.164 general-attributes
     default-group-policy filter
    tunnel-group 54.240.217.164 ipsec-attributes
     pre-shared-key IySxccNmUch6G3dVSgEwBjjGX7bOAcO3
     isakmp keepalive threshold 10 retry 3
    tunnel-group 72.21.209.193 type ipsec-l2l
    tunnel-group 72.21.209.193 general-attributes
     default-group-policy filter
    tunnel-group 72.21.209.193 ipsec-attributes
     pre-shared-key vy.pOkCV01pEtmxe.QNk96xK6Uo_2tD.
     isakmp keepalive threshold 10 retry 3
    class-map NORAND
     match access-list inside_mpc
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map 
      inspect ftp 
      inspect h323 h225 
      inspect h323 ras 
      inspect rsh 
      inspect rtsp 
      inspect esmtp 
      inspect sqlnet 
      inspect skinny  
      inspect sunrpc 
      inspect xdmcp 
      inspect sip  
      inspect netbios 
      inspect tftp 
      inspect ip-options 
    policy-map NORAND
     class NORAND
      set connection random-sequence-number disable
      set connection advanced-options tcp-state-bypass
    policy-map TRAFFIC_SHAPING
     class class-default
      shape average 100000000
    service-policy global_policy global
    service-policy NORAND interface inside
    service-policy TRAFFIC_SHAPING interface outside
    smtp-server 206.225.164.242
    prompt hostname context 
    no call-home reporting anonymous
    : end
    Here are show interface command outputs:
    fw01# show interface ethernet 0/0
    Interface Ethernet0/0 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
            Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
            Input flow control is unsupported, output flow control is unsupported
            Available but not configured via nameif
            MAC address fc5b.397f.dbd5, MTU not set
            IP address unassigned
            23888810 packets input, 6278082364 bytes, 0 no buffer
            Received 7728 broadcasts, 0 runts, 0 giants
            0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
            0 pause input, 0 resume input
            0 L2 decode drops
            35886 switch ingress policy drops
            42947220 packets output, 57958727970 bytes, 0 underruns
            0 pause output, 0 resume output
            0 output errors, 0 collisions, 0 interface resets
            0 late collisions, 0 deferred
            0 rate limit drops
            0 switch egress policy drops
            0 input reset drops, 0 output reset drops
    fw01# show interface ethernet 0/1
    Interface Ethernet0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
            Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
            Input flow control is unsupported, output flow control is unsupported
            Available but not configured via nameif
            MAC address fc5b.397f.dbd6, MTU not set
            IP address unassigned
            59448427 packets input, 58925402473 bytes, 0 no buffer
            Received 547758 broadcasts, 0 runts, 0 giants
            0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
            0 pause input, 0 resume input
            0 L2 decode drops
            58718 switch ingress policy drops
            37419921 packets output, 8188660665 bytes, 0 underruns
            0 pause output, 0 resume output
            0 output errors, 0 collisions, 0 interface resets
            0 late collisions, 0 deferred
            0 rate limit drops
            0 switch egress policy drops
            0 input reset drops, 0 output reset drops
    When we connect a laptop to the router directly, we are able to get the expected speeds. When we connect through the ASA, download speed is topping out around 16mb, while upload is a consistent 75mb+

    Have you tried running without the "service-policy TRAFFIC_SHAPING interface outside" ? Just to check.

  • Internet Connection Became Slow after Introduction of Cisco ASA 5505 to the Network

    I configured a Cisco ASA 5505 (Version Cisco Adaptive Security Appliance Software Version 7.2(3)
    Device Manager Version 5.2(3)
    in transparent firewall mode and inserted after Cisco 1700 router. However, the internet connection became very slow and users are compaining that they cannot load any pages.
    My setup looks like:
    Internet --> Cisco 1700 --> Cisco ASA 5505 --> LAN
    The license information is:
    Licensed features for this platform:
    Maximum Physical Interfaces : 8
    VLANs                       : 3, DMZ Restricted
    Inside Hosts                : Unlimited
    Failover                    : Disabled
    VPN-DES                     : Enabled
    VPN-3DES-AES                : Enabled
    VPN Peers                   : 10
    WebVPN Peers                : 2
    Dual ISPs                   : Disabled
    VLAN Trunk Ports            : 0
    This platform has a Base license.
    The flash activation key is the SAME as the running key.
    My running-config looks like:
    ASA Version 7.2(3)
    firewall transparent
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password 8Ry2YjIyt7RRXU24 encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    no shut
    interface Vlan2
    nameif outside
    security-level 0
    no shut
    interface Ethernet0/0
    switchport access vlan 2
    no shut
    interface Ethernet0/1
    no shut
    interface Ethernet0/2
    no shut
    interface Ethernet0/3
    no shut
    interface Ethernet0/4
    no shut
    interface Ethernet0/5
    no shut
    interface Ethernet0/6
    no shut
    interface Ethernet0/7
    no shut
    passwd 2KFQnbNIdI.2KYOU encrypted
    regex urllist1 ".*\.([Ee][Xx][Ee]|[Cc][Oo][Mm]|[Bb][Aa][Tt]) HTTP/1.[01]"
    regex urllist2 ".*\.([Pp][Ii][Ff]|[Vv][Bb][Ss]|[Ww][Ss][Hh]) HTTP/1.[01]"
    regex urllist3 ".*\.([Dd][Oo][Cc]|[Xx][Ll][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]"
    regex urllist4 ".*\.([Zz][Ii][Pp]|[Tt][Aa][Rr]|[Tt][Gg][Zz]) HTTP/1.[01]"
    regex domainlist1 "\.facebook\.com"
    regex domainlist2 "\.diretube\.com"
    regex domainlist3 "\.youtube\.com"
    regex domainlist4 "\.vimeo\.com"
    regex applicationheader "application/.*"
    regex contenttype "Content-Type"
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_in extended permit ip any any
    access-list inside_mpc extended permit tcp any any eq www
    access-list inside_mpc extended permit tcp any any eq 8080
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address 192.168.1.254 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    access-group outside_in in interface outside
    route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    class-map type regex match-any DomainBlockList
    match regex domainlist1
    match regex domainlist2
    match regex domainlist3
    match regex domainlist4
    class-map type inspect http match-all BlockDomainsClass
    match request header host regex class DomainBlockList
    class-map type regex match-any URLBlockList
    match regex urllist1
    match regex urllist2
    match regex urllist3
    match regex urllist4
    class-map inspection_default
    match default-inspection-traffic
    class-map type inspect http match-all AppHeaderClass
    match response header regex contenttype regex applicationheader
    class-map httptraffic
    match access-list inside_mpc
    class-map type inspect http match-all BlockURLsClass
    match request uri regex class URLBlockList
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map type inspect http http_inspection_policy
    parameters
      protocol-violation action drop-connection
    class AppHeaderClass
      drop-connection log
    match request method connect
      drop-connection log
    class BlockDomainsClass
      reset log
    class BlockURLsClass
      reset log
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    policy-map inside-policy
    class httptraffic
      inspect http http_inspection_policy
    service-policy global_policy global
    service-policy inside-policy interface inside
    prompt hostname context
    Cryptochecksum:8ab1a53df6ae3c202aee236d6080edfd
    : end
    Could the slow internet connection be due to license limitations? Or is there something wrong with my configuration?
    Please see the configuration and help.
    Thanks

    I have re-configured the ASA 5505 yesterday and so far it's working fine. I am not sure if the problem will re-appear later on. Anyways here is my sh tech-support
    ciscoasa# sh tech-support
    Cisco Adaptive Security Appliance Software Version 7.2(3)
    Device Manager Version 5.2(3)
    Compiled on Wed 15-Aug-07 16:08 by builders
    System image file is "disk0:/asa723-k8.bin"
    Config file at boot was "startup-config"
    ciscoasa up 14 hours 16 mins
    Hardware:   ASA5505, 256 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash M50FW080 @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CNlite-MC-Boot-Cisco-1.2
                                 SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
    0: Int: Internal-Data0/0    : address is 001f.9ee8.ffa2, irq 11
    1: Ext: Ethernet0/0         : address is 001f.9ee8.ff9a, irq 255
    2: Ext: Ethernet0/1         : address is 001f.9ee8.ff9b, irq 255
    3: Ext: Ethernet0/2         : address is 001f.9ee8.ff9c, irq 255
    4: Ext: Ethernet0/3         : address is 001f.9ee8.ff9d, irq 255
    5: Ext: Ethernet0/4         : address is 001f.9ee8.ff9e, irq 255
    6: Ext: Ethernet0/5         : address is 001f.9ee8.ff9f, irq 255
    <--- More --->
    7: Ext: Ethernet0/6         : address is 001f.9ee8.ffa0, irq 255
    8: Ext: Ethernet0/7         : address is 001f.9ee8.ffa1, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces : 8        
    VLANs                       : 3, DMZ Restricted
    Inside Hosts                : Unlimited
    Failover                    : Disabled
    VPN-DES                     : Enabled  
    VPN-3DES-AES                : Enabled  
    VPN Peers                   : 10       
    WebVPN Peers                : 2        
    Dual ISPs                   : Disabled 
    VLAN Trunk Ports            : 0        
    This platform has a Base license.
    Serial Number: JMX1211Z2N4
    Running Activation Key: 0xaf0ed046 0xbcf18ebf 0x80b38508 0xba785cc0 0x05250493
    Configuration register is 0x1
    Configuration has not been modified since last system restart.
    <--- More --->
    ------------------ show clock ------------------
    18:32:58.254 UTC Tue Nov 26 2013
    ------------------ show memory ------------------
    Free memory:       199837144 bytes (74%)
    Used memory:        68598312 bytes (26%)
    Total memory:      268435456 bytes (100%)
    ------------------ show conn count ------------------
    1041 in use, 2469 most used
    ------------------ show xlate count ------------------
    0 in use, 0 most used
    ------------------ show blocks ------------------
      SIZE    MAX    LOW    CNT
         0    100     68    100
    <--- More --->
         4    300    299    299
        80    100     92    100
       256    100     94    100
      1550   6174   6166   6174
      2048   1124    551    612
    ------------------ show blocks queue history detail ------------------
    History buffer memory usage: 2136 bytes (default)
    ------------------ show interface ------------------
    Interface Internal-Data0/0 "", is up, line protocol is up
      Hardware is y88acs06, BW 1000 Mbps
    (Full-duplex), (1000 Mbps)
    MAC address 001f.9ee8.ffa2, MTU not set
    IP address unassigned
    18491855 packets input, 11769262614 bytes, 0 no buffer
    Received 213772 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops, 0 demux drops
    18185861 packets output, 11626494317 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    <--- More --->
    0 input reset drops, 0 output reset drops
    input queue (curr/max packets): hardware (0/0) software (0/0)
    output queue (curr/max packets): hardware (0/55) software (0/0)
      Control Point Interface States:
    Interface number is unassigned
    Interface Internal-Data0/1 "", is administratively down, line protocol is up
      Hardware is 88E6095, BW 1000 Mbps
    (Full-duplex), (1000 Mbps)
    MAC address 0000.0003.0002, MTU not set
    IP address unassigned
    18184216 packets input, 11625360131 bytes, 0 no buffer
    Received 206655 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 switch ingress policy drops
    18490057 packets output, 11768078777 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Loopback0 "_internal_loopback", is up, line protocol is up
      Hardware is VirtualMAC address 0000.0000.0000, MTU 1500
    IP address 127.1.0.1, subnet mask 255.255.0.0
    <--- More --->
      Traffic Statistics for "_internal_loopback":
    1 packets input, 28 bytes
    1 packets output, 28 bytes
    1 packets dropped
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
    Interface number is 28
    Interface config status is active
    Interface state is active
    Interface Vlan1 "inside", is up, line protocol is up
      Hardware is EtherSVI
    MAC address 001f.9ee8.ffa2, MTU 1500
    IP address 192.168.1.254, subnet mask 255.255.255.0
      Traffic Statistics for "inside":
    7742275 packets input, 903584114 bytes
    10645034 packets output, 10347291114 bytes
    184883 packets dropped
          1 minute input rate 320 pkts/sec,  35404 bytes/sec
          1 minute output rate 325 pkts/sec,  313317 bytes/sec
    <--- More --->
          1 minute drop rate, 17 pkts/sec
          5 minute input rate 399 pkts/sec,  59676 bytes/sec
          5 minute output rate 483 pkts/sec,  503200 bytes/sec
          5 minute drop rate, 9 pkts/sec
      Control Point Interface States:
    Interface number is 1
    Interface config status is active
    Interface state is active
    Interface Vlan2 "outside", is up, line protocol is up
      Hardware is EtherSVI
    MAC address 001f.9ee8.ffa3, MTU 1500
    IP address 192.168.1.254, subnet mask 255.255.255.0
      Traffic Statistics for "outside":
    10750090 packets input, 10432619059 bytes
    7541331 packets output, 870613684 bytes
    109911 packets dropped
          1 minute input rate 328 pkts/sec,  313770 bytes/sec
          1 minute output rate 301 pkts/sec,  32459 bytes/sec
          1 minute drop rate, 2 pkts/sec
          5 minute input rate 485 pkts/sec,  503789 bytes/sec
          5 minute output rate 387 pkts/sec,  57681 bytes/sec
          5 minute drop rate, 2 pkts/sec
      Control Point Interface States:
    Interface number is 2
    <--- More --->
    Interface config status is active
    Interface state is active
    Interface Ethernet0/0 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9a, MTU not set
    IP address unassigned
    10749794 packets input, 10630700889 bytes, 0 no buffer
    Received 2506 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    3 switch ingress policy drops
    7541070 packets output, 1028190148 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    <--- More --->
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9b, MTU not set
    IP address unassigned
    7741977 packets input, 1064586806 bytes, 0 no buffer
    Received 211282 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    10644663 packets output, 10543362751 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/2 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9c, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    <--- More --->
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/3 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9d, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    <--- More --->
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/4 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9e, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    <--- More --->
    Interface number is unassigned
    Interface Ethernet0/5 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9f, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/6 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    <--- More --->
    MAC address 001f.9ee8.ffa0, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/7 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ffa1, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    <--- More --->
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    ------------------ show cpu usage ------------------
    CPU utilization for 5 seconds = 12%; 1 minute: 11%; 5 minutes: 11%
    ------------------ show cpu hogging process ------------------
    Process:      Dispatch Unit, NUMHOG: 1, MAXHOG: 133, LASTHOG: 140
    LASTHOG At:   04:45:59 UTC Nov 26 2013
    PC:           8be0f7
    Traceback:    8bed19  8bf553  302b87  3030a5  2fad69  7674bf  75ca16
                  c6251d  c62a4c  c62f6c  75c653  767820  797f64  769c85
    <--- More --->
    ------------------ show process ------------------
        PC       SP       STATE       Runtime    SBASE     Stack Process
    Mwe 00c9bb24 01bb8700 013e3250          0 01733fc8 15616/16384 emweb/cifs
    Lwe 001072ac 0176f9c4 013e32d0          0 0176d9f0 8132/8192 block_diag
    Mrd 00223a67 01783d5c 013e33b0     314854 0177be18 25752/32768 Dispatch Unit
    Msi 00f82847 01b07b84 013e3250        229 01b05bc0 7984/8192 y88acs06 OneSec Thread
    Mwe 0011b1a5 01b09cfc 013e3250          0 01b07d88 7864/8192 Reload Control Thread
    Mwe 00120606 01b1260c 013e5258          0 01b10988 7256/8192 aaa
    Mwe 001486aa 01b19404 013e5ae8          0 01b15450 16020/16384 CMGR Server Process
    Mwe 0014c3c5 01b1b4d4 013e3250          0 01b19570 7968/8192 CMGR Timer Process
    Lwe 002227a1 01b239b4 013ee360          0 01b219f0 7524/8192 dbgtrace
    Mwe 004e1ba5 01b29c34 013e3250        157 01b27d50 6436/8192 eswilp_svi_init
    Mwe 01064b1d 01b4a7f4 013e3250          0 01b48890 7848/8192 Chunk Manager
    Msi 008b61b6 01b52d54 013e3250        230 01b50da0 7856/8192 PIX Garbage Collector
    Lsi 00ecb6ac 01b54e94 013e3250         12 01b52ec0 7552/8192 route_process
    Mwe 008a5ddc 01b5dc04 0133b430          0 01b5bc40 8116/8192 IP Address Assign
    Mwe 00acb779 01b60604 01346e10          0 01b5e640 8116/8192 QoS Support Module
    Mwe 0091eba9 01b6275c 0133c530          0 01b60798 8116/8192 Client Update Task
    Lwe 01083c8e 01b656d4 013e3250     123088 01b63770 7840/8192 Checkheaps
    Mwe 00acfd7d 01b6b824 013e3250        623 01b69ad0 3476/8192 Quack process
    Mwe 00b2a260 01b6dad4 013e3250         22 01b6bbf0 7364/8192 Session Manager
    Mwe 00c55efd 01b78564 031d0478          4 01b74a50 14768/16384 uauth
    <--- More --->
    Mwe 00be3c9e 01b7aaec 0135c010          0 01b78b28 7524/8192 Uauth_Proxy
    Mwe 00c52759 01b80e0c 01361770          0 01b7ee88 7712/8192 SMTP
    Mwe 00c3f7b9 01b82eec 01361710          0 01b80fa8 7412/8192 Logger
    Mwe 00c3fd26 01b8502c 013e3250          0 01b830c8 7492/8192 Thread Logger
    Mwe 00f62272 01b9596c 013ac520          0 01b939c8 7188/8192 vpnlb_thread
    Msi 00b4097c 01c598c4 013e3250        190 01c578f0 8000/8192 emweb/cifs_timer
    Msi 005bd338 017a909c 013e3250      25855 017a7108 7412/8192 arp_timer
    Mwe 005c76bc 01b486e4 013fba50      20643 01b46770 7348/8192 arp_forward_thread
    Mwe 00c5a919 023fa5fc 013619e0          0 023f8648 7968/8192 tcp_fast
    Mwe 00c5a6e5 023fc624 013619e0          0 023fa670 7968/8192 tcp_slow
    Mwe 00c754d1 0240d42c 013628a0          0 0240b478 8100/8192 udp_timer
    Mwe 0019cb17 01b404a4 013e3250          0 01b3e530 7984/8192 CTCP Timer process
    Mwe 00efe8b3 0308c15c 013e3250          0 0308a208 7952/8192 L2TP data daemon
    Mwe 00efef23 0308e194 013e3250          0 0308c230 7968/8192 L2TP mgmt daemon
    Mwe 00eea02b 030c62ac 013a5c10         43 030c2338 16244/16384 ppp_timer_thread
    Msi 00f62d57 030c82f4 013e3250        264 030c6360 7924/8192 vpnlb_timer_thread
    Mwe 001b96e6 01b7cbbc 01b1e9c8          1 01b7ac48 7728/8192 IPsec message handler
    Msi 001c9bac 01b8d4dc 013e3250       2917 01b8b548 7648/8192 CTM message handler
    Mwe 00af93b8 031465b4 013e3250          0 03144640 7984/8192 ICMP event handler
    Mwe 00831003 0314a724 013e3250        387 031467b0 16100/16384 IP Background
    Mwe 0021b267 031a83c4 013123c0         31 03188450 123488/131072 tmatch compile thread
    Mwe 009f2405 03290044 013e3250          0 0328c0c0 16072/16384 Crypto PKI RECV
    Mwe 009f305a 03294144 013e3250          0 032901e0 16040/16384 Crypto CA
    Mwe 0064d4fd 01b3e24c 013e3250          8 01b3c2f8 7508/8192 ESW_MRVL switch interrupt service
    <--- More --->
    Msi 00646f5c 032c134c 013e3250    3059378 032bf448 7184/8192 esw_stats
    Lsi 008cbb80 032dc704 013e3250          3 032da730 7908/8192 uauth_urlb clean
    Lwe 008afee7 034a0914 013e3250        197 0349e9b0 6636/8192 pm_timer_thread
    Mwe 0052f0bf 034a35ac 013e3250          0 034a1648 7968/8192 IKE Timekeeper
    Mwe 00520f6b 034a8adc 0132e2b0          0 034a4e38 15448/16384 IKE Daemon
    Mwe 00bf5c78 034ac7ac 01360680          0 034aa7f8 8100/8192 RADIUS Proxy Event Daemon
    Mwe 00bc32de 034ae79c 034dcbe0          0 034ac918 7208/8192 RADIUS Proxy Listener
    Mwe 00bf5e0f 034b099c 013e3250          0 034aea38 7968/8192 RADIUS Proxy Time Keeper
    Mwe 005aac4c 034b3154 013fb980          0 034b1250 7492/8192 Integrity FW Task
    M*  008550a5 0009fefc 013e33b0       3183 034e3b20 24896/32768 ci/console
    Msi 008eb694 034ed9d4 013e3250       2370 034ebc40 6176/8192 update_cpu_usage
    Msi 008e6415 034f7dac 013e3250       1096 034f5eb8 6124/8192 NIC status poll
    Mwe 005b63e6 03517d1c 013fbd10       1963 03515d78 7636/8192 IP Thread
    Mwe 005becbe 03519e4c 013fbcb0          3 03517e98 7384/8192 ARP Thread
    Mwe 004c2b36 0351befc 013fbae0          0 03519fe8 7864/8192 icmp_thread
    Mwe 00c7722e 0351e06c 013e3250          0 0351c108 7848/8192 udp_thread
    Mwe 00c5d126 0352008c 013fbd00          0 0351e228 7688/8192 tcp_thread
    Mwe 00bc32de 03a6982c 03a5ee18          0 03a679b8 7512/8192 EAPoUDP-sock
    Mwe 00266c15 03a6b614 013e3250          0 03a699e0 7032/8192 EAPoUDP
    Mwe 005a6728 01b27b94 013e3250          0 01b25c30 7968/8192 Integrity Fw Timer Thread
    -     -        -         -      47686621    -         -     scheduler
    -     -        -         -      51253819    -         -     total elapsed
    ------------------ show failover ------------------
    <--- More --->
    ERROR: Command requires failover license
    ------------------ show traffic ------------------
    inside:
    received (in 51429.740 secs):
    7749585 packets905087345 bytes
    67 pkts/sec17013 bytes/sec
    transmitted (in 51429.740 secs):
    10653162 packets10355908020 bytes
    40 pkts/sec201026 bytes/sec
          1 minute input rate 412 pkts/sec,  51803 bytes/sec
          1 minute output rate 475 pkts/sec,  522952 bytes/sec
          1 minute drop rate, 24 pkts/sec
          5 minute input rate 399 pkts/sec,  59676 bytes/sec
          5 minute output rate 483 pkts/sec,  503200 bytes/sec
          5 minute drop rate, 9 pkts/sec
    outside:
    received (in 51430.240 secs):
    10758403 packets10441440193 bytes
    42 pkts/sec203021 bytes/sec
    transmitted (in 51430.240 secs):
    7548339 packets872053854 bytes
    <--- More --->
    63 pkts/sec16037 bytes/sec
          1 minute input rate 479 pkts/sec,  523680 bytes/sec
          1 minute output rate 387 pkts/sec,  46796 bytes/sec
          1 minute drop rate, 3 pkts/sec
          5 minute input rate 485 pkts/sec,  503789 bytes/sec
          5 minute output rate 387 pkts/sec,  57681 bytes/sec
          5 minute drop rate, 2 pkts/sec
    _internal_loopback:
    received (in 51430.740 secs):
    1 packets28 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51430.740 secs):
    1 packets28 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Aggregated Traffic on Physical Interface
    <--- More --->
    Ethernet0/0:
    received (in 51431.740 secs):
    10758462 packets10640075825 bytes
    42 pkts/sec206042 bytes/sec
    transmitted (in 51431.740 secs):
    7548383 packets1029818127 bytes
    63 pkts/sec20023 bytes/sec
          1 minute input rate 485 pkts/sec,  537048 bytes/sec
          1 minute output rate 395 pkts/sec,  54546 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 485 pkts/sec,  511723 bytes/sec
          5 minute output rate 387 pkts/sec,  65495 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/1:
    received (in 51433.570 secs):
    7749780 packets1066328930 bytes
    67 pkts/sec20064 bytes/sec
    transmitted (in 51433.570 secs):
    10653359 packets10552787020 bytes
    40 pkts/sec205006 bytes/sec
          1 minute input rate 419 pkts/sec,  59621 bytes/sec
          1 minute output rate 480 pkts/sec,  533950 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 399 pkts/sec,  67618 bytes/sec
    <--- More --->
          5 minute output rate 482 pkts/sec,  511073 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/2:
    received (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/3:
    received (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
    <--- More --->
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/4:
    received (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/5:
    received (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    <--- More --->
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/6:
    received (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/7:
    received (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51435.010 secs):
    <--- More --->
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/0:
    received (in 51435.510 secs):
    18513901 packets11784250044 bytes
    25 pkts/sec229023 bytes/sec
    transmitted (in 51435.510 secs):
    18207269 packets11641332179 bytes
    19 pkts/sec226078 bytes/sec
          1 minute input rate 891 pkts/sec,  595715 bytes/sec
          1 minute output rate 863 pkts/sec,  588935 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 885 pkts/sec,  584035 bytes/sec
          5 minute output rate 870 pkts/sec,  580393 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/1:
    received (in 51436.010 secs):
    18207323 packets11641364184 bytes
    <--- More --->
    19 pkts/sec226076 bytes/sec
    transmitted (in 51436.010 secs):
    18513954 packets11784281987 bytes
    25 pkts/sec229022 bytes/sec
          1 minute input rate 855 pkts/sec,  575808 bytes/sec
          1 minute output rate 884 pkts/sec,  582339 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 869 pkts/sec,  578350 bytes/sec
          5 minute output rate 883 pkts/sec,  581924 bytes/sec
          5 minute drop rate, 0 pkts/sec
    ------------------ show perfmon ------------------
    PERFMON STATS:    Current      Average
    Xlates               0/s          0/s
    Connections         17/s          6/s
    TCP Conns            8/s          2/s
    UDP Conns            7/s          2/s
    URL Access           0/s          0/s
    URL Server Req       0/s          0/s
    TCP Fixup            0/s          0/s
    TCP Intercept        0/s          0/s
    HTTP Fixup           0/s          0/s
    <--- More --->
    FTP Fixup            0/s          0/s
    AAA Authen           0/s          0/s
    AAA Author           0/s          0/s
    AAA Account          0/s          0/s
    ------------------ show counters ------------------
    Protocol     Counter                     Value   Context
    IP           IN_PKTS                  168960   Summary
    IP           OUT_PKTS                 169304   Summary
    IP           TO_ARP                       61   Summary
    ------------------ show history ------------------
    ------------------ show firewall ------------------
    Firewall mode: Transparent
    ------------------ show running-config ------------------
    <--- More --->
    : Saved
    ASA Version 7.2(3)
    firewall transparent
    hostname ciscoasa
    enable password
    names
    interface Vlan1
    nameif inside
    security-level 100
    interface Vlan2
    nameif outside
    security-level 0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    <--- More --->
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd
    regex domain1 ".facebook\.com"
    regex domain2 ".fb\.com"
    regex domain3 ".youtube\.com"
    ftp mode passive
    access-list ACL_IN extended permit ip any any
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    ip address 192.168.1.254 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    <--- More --->
    arp timeout 14400
    access-group ACL_IN in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    class-map type regex match-any DomainBlockList
    match regex domain1
    match regex domain2
    match regex domain3
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    <--- More --->
      message-length maximum 512
    match domain-name regex class DomainBlockList
      drop-connection log
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:bb5115ea1d14ee42e7961ef0c9aaed86
    : end
    <--- More --->
    ------------------ show startup-config errors ------------------
    INFO: No configuration errors
    ------------------ console logs ------------------
    Message #1 : Message #2 : Message #3 : Message #4 : Message #5 : Message #6 : Message #7 : Message #8 : Message #9 : Message #10 : Message #11 : Message #12 : Message #13 : Message #14 :
    Total SSMs found: 0
    Message #15 :
    Total NICs found: 10
    Message #16 : 88E6095 rev 2 Gigabit Ethernet @ index 09Message #17 :  MAC: 0000.0003.0002
    Message #18 : 88E6095 rev 2 Ethernet @ index 08Message #19 :  MAC: 001f.9ee8.ffa1
    Message #20 : 88E6095 rev 2 Ethernet @ index 07Message #21 :  MAC: 001f.9ee8.ffa0
    Message #22 : 88E6095 rev 2 Ethernet @ index 06Message #23 :  MAC: 001f.9ee8.ff9f
    Message #24 : 88E6095 rev 2 Ethernet @ index 05Message #25 :  MAC: 001f.9ee8.ff9e
    Message #26 : 88E6095 rev 2 Ethernet @ index 04Message #27 :  MAC: 001f.9ee8.ff9d
    Message #28 : 88E6095 rev 2 Ethernet @ index 03Message #29 :  MAC: 001f.9ee8.ff9c
    Message #30 : 88E6095 rev 2 Ethernet @ index 02Message #31 :  MAC: 001f.9ee8.ff9b
    Message #32 : 88E6095 rev 2 Ethernet @ index 01Message #33 :  MAC: 001f.9ee8.ff9a
    Message #34 : y88acs06 rev16 Gigabit Ethernet @ index 00 MAC: 001f.9ee8.ffa2
    Message #35 :
    Licensed features for this platform:
    Message #36 : Maximum Physical Interfaces : 8        
    <--- More --->
    Message #37 : VLANs                       : 3, DMZ Restricted
    Message #38 : Inside Hosts                : Unlimited
    Message #39 : Failover                    : Disabled
    Message #40 : VPN-DES                     : Enabled  
    Message #41 : VPN-3DES-AES                : Enabled  
    Message #42 : VPN Peers                   : 10       
    Message #43 : WebVPN Peers                : 2        
    Message #44 : Dual ISPs                   : Disabled 
    Message #45 : VLAN Trunk Ports            : 0        
    Message #46 :
    This platform has a Base license.
    Message #47 :
    Message #48 : Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
    Message #49 :                              Boot microcode   : CNlite-MC-Boot-Cisco-1.2
    Message #50 :                              SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
    Message #51 :                              IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
    Message #52 :   --------------------------------------------------------------------------
    Message #53 :                                  .            .                            
    Message #54 :                                  |            |                            
    Message #55 :                                 |||          |||                           
    Message #56 :                               .|| ||.      .|| ||.                         
    Message #57 :                            .:||| | |||:..:||| | |||:.                      
    Message #58 :                             C i s c o  S y s t e m s                       
    Message #59 :   --------------------------------------------------------------------------
    <--- More --->
    Message #60 :
    Cisco Adaptive Security Appliance Software Version 7.2(3)
    Message #61 :
    Message #62 :   ****************************** Warning *******************************
    Message #63 :   This product contains cryptographic features and is
    Message #64 :   subject to United States and local country laws
    Message #65 :   governing, import, export, transfer, and use.
    Message #66 :   Delivery of Cisco cryptographic products does not
    Message #67 :   imply third-party authority to import, export,
    Message #68 :   distribute, or use encryption. Importers, exporters,
    Message #69 :   distributors and users are responsible for compliance
    Message #70 :   with U.S. and local country laws. By using this
    Message #71 :   product you agree to comply with applicable laws and
    Message #72 :   regulations. If you are unable to comply with U.S.
    Message #73 :   and local laws, return the enclosed items immediately.
    Message #74 :
    Message #75 :   A summary of U.S. laws governing Cisco cryptographic
    Message #76 :   products may be found at:
    Message #77 :   http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    Message #78 :
    Message #79 :   If you require further assistance please contact us by
    Message #80 :   sending email to [email protected].
    Message #81 :   ******************************* Warning *******************************
    Message #82 :
    <--- More --->
    Message #83 : Copyright (c) 1996-2007 by Cisco Systems, Inc.
    Message #84 :                 Restricted Rights Legend
    Message #85 : Use, duplication, or disclosure by the Government is
    Message #86 : subject to restrictions as set forth in subparagraph
    Message #87 : (c) of the Commercial Computer Software - Restricted
    Message #88 : Rights clause at FAR sec. 52.227-19 and subparagraph
    Message #89 : (c) (1) (ii) of the Rights in Technical Data and Computer
    Message #90 : Software clause at DFARS sec. 252.227-7013.
    Message #91 :                 Cisco Systems, Inc.
    Message #92 :                 170 West Tasman Drive
    Message #93 :                 San Jose, California 95134-1706
    ciscoasa#   

  • ASA 5505 Connection Limit and TIME_WAIT Freezing Device

    My little ASA 5505 is working great and I am quite happy with the purchase now that I've solved a number of the issues we had, thank you all very much for the help.
    The next issue I have is rather annoying.  The device appears to be artificially crippled and limited to 10,000 connections.  This isn't a "CPU limit" it's just some fake limit in the device as far as I can tell.
    The problem we have is that we are only using around 500-600 connections and CPU usage is only like 25%, and yet the connection count is pegged at 10,000 and locks us out of our network.
    I am pretty sure this is because there are a lot of "dead" TIME_WAIT connections hanging around not being used.  In our application we only have the couple hundred connections but they do move around a bit every now and then.
    Is there anyway to get the device to ignore the "dead" connections and not count them towards the artificial limit on the device given that it's pretty clear the CPU / etc., is not utilized sufficiently.  These aren't real connections, we only have a couple 100 established, they do just move around a bit however.
    We are really only using 500-700 connections according to our servers, the others are just sitting in TIME_WAIT doing nothing.
    Anyone had this issue before or can offer solutions or workarounds?

    Hello,
    Have you checked the output of 'show conn' and 'show local-host' at a time when the connection count is maxed out? If the ASA is not removing idle connections, you should open a TAC case to have this investigated. Otherwise, the above commands should show you which hosts are maxing out the connections and you can take steps to remediate those problem hosts.
    -Mike

  • ASA 5505 not connecting to the internet

    My ASA 5505 9.1 previously worked but I recently swapped out my modem (different issue).  The new modem is bridged so my ASA gets an IP address from the ISP.
    Internet ------ SB6141 modem ---------- ASA ---------- rest of network (direct connection or router)
    I have no issues connecting to the ASA and when I remove the ASA my router properly connects to the internet.  
    Things I have tried
    Setting static address for ASA outside interface
    Pinging 8.8.8.8 from ASDM (ping fails in ASDM but works in CLI)
    Modifying the NAT
    Successful packet trace
    Reading multiple other forum entries
    I can't figure out what is blocking the traffic to the outside.  Below is my running-config.
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    xlate per-session deny tcp any4 any4
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.1.0 Wireless
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0 
    interface Vlan2
     nameif outside
     security-level 0
     ip address dhcp setroute 
    boot system disk0:/asa914-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup inside
    object network obj-192.168.2.0
     subnet 192.168.2.0 255.255.255.248
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    object network Wireless
     subnet 10.0.1.0 255.255.255.0
     description Created during name migration
    object network NETWORK_OBJ_192.168.2.0_29
     subnet 192.168.2.0 255.255.255.248
    object network obj_any_1
     subnet 0.0.0.0 0.0.0.0
     description Outside
    object-group protocol TCPUDP
     protocol-object udp
     protocol-object tcp
    object-group service DM_INLINE_TCP_1 tcp
     port-object eq www
     port-object eq https
    object-group service DM_INLINE_TCP_2 tcp
     port-object eq 4444
     port-object eq 4445
     port-object eq 4446
    object-group service Wemo tcp-udp
     port-object eq 3478
    object-group service DM_INLINE_SERVICE_1
     service-object udp destination eq 1701 
     service-object tcp destination eq pptp 
     service-object udp destination eq 4500 
     service-object udp destination eq isakmp 
     service-object tcp destination eq 50 
     service-object tcp destination eq 51 
     service-object tcp destination eq 44000 
    object-group service DM_INLINE_TCP_3 tcp
     port-object eq 4444
     port-object eq 4445
     port-object eq 4446
     port-object eq 5900
     port-object eq 5901
    object-group network DM_INLINE_NETWORK_1
     network-object host 217.79.189.135
     network-object host 24.197.239.70
    object-group service DM_INLINE_TCP_4 tcp
     port-object eq 5900
     port-object eq 5901
    object-group service DM_INLINE_TCP_5 tcp
     port-object eq www
     port-object eq https
    access-list inside_access_in extended permit object-group TCPUDP object Wireless any 
    access-list inside_access_in extended permit icmp object Wireless any 
    access-list inside_access_in extended permit ip object Wireless any 
    access-list inside_access_in extended permit object-group TCPUDP 192.168.1.0 255.255.255.0 any 
    access-list inside_access_in extended permit icmp 192.168.1.0 255.255.255.0 any 
    access-list inside_access_in extended permit tcp 192.168.1.0 255.255.255.0 any object-group DM_INLINE_TCP_5 
    access-list inside_access_in extended permit ip 192.168.1.0 255.255.255.0 any 
    access-list inside_access_in extended permit icmp 192.168.2.0 255.255.255.0 any 
    access-list inside_access_in extended permit ip 192.168.2.0 255.255.255.0 any 
    access-list inside_access_in extended permit object-group TCPUDP 192.168.2.0 255.255.255.0 any 
    access-list inside_nat0_outbound extended permit ip any4 192.168.2.0 255.255.255.248 
    access-list inside_nat0_outbound extended permit tcp any4 192.168.2.0 255.255.255.248 
    access-list inside_nat0_outbound_1 extended permit ip any4 192.168.2.0 255.255.255.248 
    access-list outside_access_in extended permit tcp any object AppleRouter object-group DM_INLINE_TCP_2 
    access-list outside_access_in remark VNC
    access-list outside_access_in extended permit tcp any object AppleRouter object-group DM_INLINE_TCP_4 
    access-list outside_access_in extended deny tcp object-group DM_INLINE_NETWORK_1 any object-group DM_INLINE_TCP_3 
    access-list outside_access_in remark Migration, ACE (line 2) expanded: permit tcp any4 interface outside object-group DM_INLINE_TCP_1
    access-list outside_access_in extended permit tcp any4 0.0.0.0 0.0.0.0 eq www 
    access-list outside_access_in extended permit tcp any4 0.0.0.0 0.0.0.0 eq https 
    access-list outside_access_in remark ICMP config
    access-list outside_access_in extended permit icmp any4 0.0.0.0 0.0.0.0 
    access-list outside_access_in extended permit tcp any4 object AppleRouter object-group Wemo 
    access-list outside_access_in extended permit udp any4 object AppleRouter object-group Wemo 
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 interface outside 
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-715-100.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,any) source static any any destination static obj-192.168.2.0 obj-192.168.2.0 no-proxy-arp route-lookup inactive
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_29 NETWORK_OBJ_192.168.2.0_29 no-proxy-arp route-lookup inactive
    object network AppleRouter-4500
     nat (inside,outside) static interface service tcp 4500 4500 
    object network AppleRouter-4444
     nat (inside,outside) static interface service tcp 4444 4444 
    object network AppleRouter-5901
     nat (inside,outside) static interface service tcp 5901 5901 
    object network AppleRouter-5900
     nat (inside,outside) static interface service tcp 5900 5900 
    object network AppleRouter-4445
     nat (inside,outside) static interface service tcp 4445 4445 
    object network AppleRouter-4446
     nat (inside,outside) static interface service tcp 4446 4446 
    object network Wemo-tcp
     nat (inside,outside) static interface service tcp 3478 3478 
    object network Wemo-udp
     nat (inside,outside) static interface service udp 3478 3478 
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    telnet 192.168.1.0 255.255.255.0 inside
    telnet Wireless 255.255.255.0 inside
    telnet timeout 10
    ssh 192.168.1.0 255.255.255.0 inside
    ssh Wireless 255.255.255.0 inside
    ssh timeout 10
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcp-client client-id interface outside
    dhcpd auto_config outside
    dhcpd address 192.168.1.5-192.168.1.254 inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside

    First lets eliminate the ASA as the problem, Connect a PC directly to one of the "inside" ports on the ASA and make sure it recieves an IP in the 192.168.1.0/24 range.
    add this command to the ASA
    object network obj_any
      nat (inside,outside) dynamic interface
    now try to ping 8.8.8.8 or 4.2.2.2
    If ping works, now add the router back into the loop and see if you are able to reach the internet again.
    Please remember to select a correct answer and rate helpful posts

Maybe you are looking for

  • Please help. USB-DeskTop software question

    Hi, Im in a crunch really bad and a freind told me about this and so far ive seen some AUSOME info and ausome generosity of helpen each other any way have 2 questions one complicated  . and i give thanks in much much much thanx in advance, ill even m

  • Printing Times in Month View

    When I print a calendar in month view, some of the event times print, but some of them only print as an elipsis "..." This seems to happen arbitrarily, without any correlation to the length of the event description. So, some short descriptions have a

  • Component failure on the DB server

    My SCCM 2012 DB servers has a red cross but no alerts .. My compmon.log show Checking components ... SMS_COMPONENT_MONITOR 5/24/2012 5:30:12 PM 3764 (0x0EB4) Failed to read the required Operations Management component registry key values on local com

  • How can i capture 6 differential analog in lines using PFI0 as a clock?

    Alright here's my setup, i've got labVIEW 8.6.1; i'm using a PXI-6259 i've got 7 diff. analog in lines and a parity line sending parallel data into the 6259. I also have a "strobe" line, which is to be used as the clock. When sending the data on the

  • Inline popup - close icon null pointer issue

    Hi all, I have a taskflow which is opened as inline popup dialog. Taskflow is in pageFlowScope. The popup has OK, Cancel. On click of OK and Cancel of dialog it returns a value. However when I click on Close icon "x" of dialog and return to the calli