ASA Context v/s EIGRP

Hello,
Please let me know if ASA with multiple context supports a routing protocol ? I wanted to run EIGRP in each firewall context as a requirement.
Kindly help.
Regards,
Amol.

Amol,
Im sure that you found the answer already, but no, it is not supported.
Some features are not supported, which include VPN and dynamic routing protocols.
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808d2b63.shtml
Mike.

Similar Messages

Allocate-interface to an existing ASA context

We have a active/active context firewall and would like to add an sub-interface to the exisitng context. Can someone share the link on how to do this?
All cisco documentation is for creating a context and allocating interface from scratch but I could not find any document for adding an interface to an exisiting context.
-Mohan

Ah, now I understand your question better.
Yes, you can just add the "allocate-interface " to the Context configurations while its in production. All that this command will do at this point is add another interface under the Context.
After you have added the interface with the "allocate-interface" command under the Context and move to the Context with the command "changeto context ", you will only see a interface with blank configuration and ALL of the configuration you had there before adding the new interface.
After this you simply start configuring the interface with "description", "nameif", "security-level", "ip address" and so on and start creating rules for it.
The situation that the Cisco quote above refers to is the following situation
You have a ready made configuration file for your ASA context
You load that file to the Flash of the ASA
You want to apply the configuration on the Flash to the Context you created One reason for having a ready configuration might be that your previous ASA has broken down and you are now in the process of recovery with a replacement device and have all the configuration backups and are loading them to the ASA and creating all the Context that were on the previous ASA
IF you were to create the Context and immediately issue the "config-url" thats configuration refers to certain interfaces THEN naturally the ASA couldnt insert those old backup configurations to the Context as it didnt have those interfaces attached yet.
This is why that in the above case you would first attach the interfaces to the context and THEN insert the Flash filesystem path where the already ready configuration would be located that the Context could use to fully configure and restore the Context.
Now consider the more typical situation while configuring Contexts
You already have an Context with a "config-url" set where the Context configuration gets saved.
When you add a new interface to the Context, nothing happens to the current configuration or firewall operation
Because the current configuration doesnt refer to the new interface in any way it wont naturally get any configurations when you attach it to the Context.
When you move under the Context, you can just start configuring the interface settings and configuration related to that interface
AFTER you issue "write mem" command and save the configuration, it will be saved to the file/path configured in the "config-url" configuration and will after this naturally contain the new interfaces (and all related configurations) in its configurations.
So in shorts
If you are adding new interfaces to production firewalls you can just use the "allocate-interface" command.
If you have a ready made configuration before creating the actual context THEN you will have to make sure that the context has the interfaces attached BEFORE you attach the "config-url" configuration witth the ready made file OR IF NOT it will only apply configuration for the interfaces which are attached before this. And naturally the global configurations that dont apply to any specific interface
Hopefully I wasnt too complex with the writing. Im pretty tired at the moment and hard to concentrate
Please rate if you have found the information helpfull And also ask more if needed.
- Jouni

ASA context mode

Hi All
I am trying to change the ASDM listening port number within a context but getting the following error:
DMZwebcon(config)#http server enable 444
^
ERROR: % Invalid Hostname
Is this commad only available in the admin/system context or a software issue???
Any help welcome
Regards MJ

Hi MJ,
Please refer to
http server enable
To enable the adaptive security appliance HTTP server, use the http server enable command in global configuration mode. To disable the HTTP server, use the no form of this command.
http server enable [port]
Syntax Descriptionno http server enable [port]
port
The port to use for HTTP connections. The range is 1-65535. The default port is 443.
Defaults
The HTTP server is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Command Mode Firewall Mode Security Context
Routed Transparent Single Multiple
Context System
Global configuration
Located at
http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/gh.html#wp1781150
Basically, since the VPN functionality is lost when you pass to multiple context, there is no real need to change the default SSL port on the ASA, hence the command is not supported on that specific mode.
Let me know if you have any further questions.
Mike

ASA Context Aware Security (CX) Vs URL filetering (websense)

Fellas,
I'm new to ASA and PIX. I have PIX with websense for URL filtering. We are upgrading to ASA 5585-X wih CX context aware module. Will I still be needing Websense, since we have CX. What would be the best soultions? Thanks in Advance.
Happy New Year!

This is not a popular thing for a reseller like me to say, but I am not a fan of the CX module. It does a little bit of a lot of things, but doesn't do particularly well at any of them; that is to say, it is not for example a replacement for a proper e-mail filter or web filter or IPS.
I would stick with Websense versus moving to the CX module. I have had a lot of clients try - against my suggestion - to use just the CX module and every one of them has come back to their URL filtering boxes. With that said, I might recommend trying IronPort instead - it may sound a bit biased coming from someone on the Cisco forums, but I really have found it to be a substantially suprerior platform for most (not all, but most) installations.

ASA Context

I have an ASA that wont allow internal users to vpn into the ouside interface. The guest wireless is terminated at L3 switch but i want to create a new virtual contex to terminate the guest wireless, so it doesn't have to use private DNS server.
I have gotten mixed answers but will all VPN funtionality stop if i create a Context to terminate the wireless vlan but also able for guest to jump on the vpn to access the private network.
Thanks

Hi,
It depends what version of code you are running in multiple conext mode.
8.2 - VPN is not supported:
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html
8.4 - VPN failover is not supprted:
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_active_active.html
Sean

ASA Context Design

Hello All,
Can we share an interface with more than 1 context. Say if I want to use interface Gig0/0 as DMZ/Extranet interface can I use the same interface in more than 1 context.

Yes you can share an interface across multiple contexts. You may just have to statically configure unique MAC addresses for each context. Note that you cannot share interfaces on a transparent firewall.
Refer to this Cisco article for more information: http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/mode_contexts.html#wp1388020

ASA write mem error in context

ASA# (this is system context)
context context
allocate-interface Port-channel2.1 INSIDE
config-url disk0:/configs/context.cfg
join-failover-group 1
i get following error in the context:
ASA/context# wr mem
Building configuration...
Cryptochecksum: 572d8a11 d1d409a0 ff1f3f82 16b31d26
%Error opening disk0:/configs/context.cfg (No such file or directory)
Error executing command
[FAILED]
how to resolve it?

Hi,
I very rarely have to play around with the Files and Folders of the ASA firewalls since once you originally set them up you dont really need to do anything more.
Only thing that came to mind fast is that you have:
Configured the context
Configured the "config-url" under the context
BUT you have NOT created the folder beforehand to the disk0:/
I don't remember if the "config-url" created the said folder but this might be something to check (as the error message states)
Check the Flash memory with
dir disk0:
Create the folder if need with
mkdir disk0:/configs/
Hope this helps
- Jouni

Moving contexts between ASA firewalls

Is there a recommended process to move ASA contexts from one firewall to another with the minimal amount of downtime? Can the configuration file be moved from one firewall to another, and the context created on the destination firewall specifying the copied configuration file in the context creation phase (assuming interface are named similarly)? An ARP clear of the upstream router may also be required to restore connectivity if the ASA goesn't grat-arp for interfaces and NAT addresses.

Hi,
This kind of a change does need some downtime, you can copy and paste the configuration from one ASA to another and that should not be an issue and yes you would need to clear the arp entries on the upstream device on the new ASA. It should not create any issues.
Thanks,
Varun Rao
Security Team,
Cisco TAC

CPU usage per context on ASA

Hi Everyone,
I am currently working with ASA 5585 with several contexts and I would like to have an idea of what is the percentage of the CPU used per context.
I already have the opportunity to do it for the whole ASA (context admin) using the SNMP mib CISCO-PROCES but, unfortunalty, this mib doesn't allow us to know the percentage of used CPU per context.
I was able to know the number of core used per context but not the percentage of the CPU used.
Do you know if it is possible ?
Thank you for your help.
François.

Dear Francois,
Here's the answer for the snmp part:
CPU usage on ASA
The CPU usage is displayed per context (prior to 8.1) when queried by SNMP.
For example:
show cpu output:
shweta-asa-5520/coke(config)# show cpu
CPU utilization for 5 seconds = 33.3%; 1 minute: 25.8%; 5 minutes: 8.7%
snmpwalk output:
root@sw8-ilinux root]# snmpwalk -OS -c public -v 2c 10.7.14.61 cpmCPUTotalTable
CISCO-PROCESS-MIB::cpmCPUTotalPhysicalIndex.1 = 1
CISCO-PROCESS-MIB::cpmCPUTotal5sec.1 = Gauge32: 33
CISCO-PROCESS-MIB::cpmCPUTotal1min.1 = Gauge32: 26
CISCO-PROCESS-MIB::cpmCPUTotal5min.1 = Gauge32: 9
The output displayed here is information specific to the coke context.
Prior to 8.1 release, it is not possible to get the total CPU usage of the ASA using SNMP. This is because there is no SNMP agent in the system context. You can get CPU usage for each context present on the ASA.
To get the entire CPU usage you can run the command: show cpu context all on the CLI.
shweta-asa-5520(config)# show cpu context all
5 sec 1 min 5 min Context Name
3.2%   3.2%   3.1% system
0.0%   0.0%   0.0% admin
33.0% 33.1% 29.4% coke
0.0%   0.0%   0.0% pepsi
The sum of all the user context and system context gives the total CPU usage.
However, we did add change this behavior in 8.1 release and will also be present in the 8.2 release. With this change, you will be able to obtain aggregate device CPU load via the admin context. i.e. by polling the admin context, the customer will get the total cpu usage.

ASA Iphone, Ipad VPN client pre-shared key (PSK) special characters bug

I ran into this in a deployment of IPSec clients with apple ipad and iphone native vpn client. Here are details:
Cisco ASA 8.2.5 OS
Ipad, running 5.0.1
Iphone i4S, running OS 5.0.1
Special characters make your pre-shared key more secure, so i used a password generator app to make one that coincidently included a " (quotation mark). After configuring this PSK on a Ipad, i was unable to connect. I saw nothing in the ASA logs, indicating the Ipad didnt even try to connect.
The Ipad generated the following error message:
VPN Connection
A configuration error occured
OK Button
After searching for quite some time, i found this somewhat obscure reference to the bug:
http://blogs.oreilly.com/iphone/2008/07/strong-passwords-can-hurt.html
Special thx to this guy!
So i started to test special characters to see what would work, adding in 1 character at a time. Here is where I stopped:
pre-shared-key !@#$%^&*()_-+=;:'<>,.
These characters worked in the PSK. If you are curious, and want to play, have fun. I assume the alphnumerics will work since those are pretty standard.
As a side note, here are a few more interesting items:
1) The " (quote mark) does work when you run the real cisco vpn client. This was successful on a Windows 7 laptop with 5.X VPN Client.
2) The ? (question mark) doesnt work as well, but that is a little easier to figure out because when you configure it on the ASA, context-sensitive help kicks in and knocks you off the config line.
3) Iphone I4S suffers from the same issue - doesnt like quotes.
4) Android is probably not affected by this bug, but I tested on an open source TUN driver- enabled adroid - not the bionic.
Hope that saves someone some time, sometime!
W

Thanks for the tip.
Help stamp out special characters in passwords. Their "strength" is a myth!
Explained nicely here: http://xkcd.com/936/

Airplay not working with an ASA in the middle

Hi All
This is my case: In the lab I could configure mDNS on my 5508 with the global multicast and igmp snooping disabled. Only I needed was Global mDNS multicast enabled (based on Cisco Guide) and it worked fine under the following scenarios:
All the services connected wireless
IPAD on subnet A and Apple TV on subnet B, no Firewall in the middle. Peer to Peer Blocking in the WLC was any DROP or DISABLED and it worked fine.
BUT, when I moved into production environment, the only way that it works is by having both Apple Devices in the same subnet with the Peer to Peer bloking DISABLED. I have a firewall ASA in the middle so I do not know what should I check in the firewall to allow Airplay to work.
However, there is something really weird. in the IPAD, I can see the AIRPLAY icon at the bottom of the screen, when I click on it, I can see MIRRORING button and I moved it to the right to activated it BUT nothing happens on the AppleTV connected to an screen. I mean, looks like the request for MIRRORING from the IPAD to the Apple TV device is not reaching the last one. A few seconds after activating MIRRORING in the IPAD looks like the request is dropped since that the mirroring is not active.
Is there any particular multicast configuration required in the ASA including ports (like 5353 udp)?
I have an open case with TAC but any ideas are welcomed.
By the way, I am running v 7.6 in the WLC in order to implement mDNS (traffic between ssid's subnet managed by the WLC - Bonjour Gateway is not neccesary)
thanks
Abraham

Hi David,
Let me share with you my findings. Apple TV requires more than 5353 port opened. Please see the following link and include in your ASA those additional ports/range. I mean, 7000, 7100, 5000 (udp/tcp), etc etc.
http://community.arubanetworks.com/t5/Unified-Wired-Wireless-Access/apple-macbook-airplay-appletv-firewall-port-findings/td-p/55048
After opening those ports, the service is working BUT with significant LATENCY/SLOWNESS which we are trying to solve.
We took some packets captures on the ASA ingress/egress interfaces for both contexts (see pictures attached) and I could see many retransmissions and duplicated ACK so I tried something else that worked (see Apple TV Works attached file) BUT this is not the final solution we need so we are still working on this issue in order to check if there is something wrong with our routing/switching process in the 6500 LAN SW.
I created static routes in the ASA contexts to communicate the IPAD to the APPLE TV (ports already opened in the ASA as indicated before) without traversing the Wireless 6500 SW (test performed on VLAN A and VLAN B) and it worked fine. However as I said, this is not the solution we want because the Wireless 6500 SW must manage inter-ASA-contexts traffic.
In addition to that I attached another picture/diagram that shows when Apple TV service fails-latency (traffic crossing the Wireless 6500 SW for communication between ASA contexts).
Important to say that I am NOT using MULTICAST or BROADCAST ENABLED in the WLC. I am based on mDNS as indicated in the Cisco Guide/Instructions for version 7.5 and above.
Hope this helps.

DHCP requests through ASA

Hi ,
I have ASA5585 in routed mode (Check the attached diagram) , and my DHCP client on the inside , while the DHCP server is on the outside.
I know that ASA can be configured as a DHCP relay , but there is a condition
“DHCP clients must be directly connected to the ASA and cannot send requests through another relay agent or a router”
Is this means that the setup in the attached diagram cannot work ?
Is there any other way to make it work , without changing the ASA to transparent mode?

Hi,
I think the text above refers to a situation where you are actually using the ASA to Relay DHCP messages.
You couldnt therefore use the ASA to relay DHCP messages that were relayed by another device behind the ASA. Though I dont know why the DHCP messages would need to be relayed twice.
But as we can see in this case the L3 Switch is the device that handles the relay of DHCP messages to the actual DHCP server and the ASA doesnt have to do anything related to DHCP other than pass the unicast UDP traffic. Therefore you wouldnt be confiuring any DHCP related settings on the ASA and the above quote/limitation wouldnt apply to your setup
So it seems to me that you can leave out all the DHCP/DHCP relay configurations from the ASA and just allow the traffic originating from the L3 Switch
I might be able to lab this for you at some point at my home network if needed (Though naturally with different ASA model). Though I think we have several environments at work already that use an ASA5585-X (multiple context mode) where the customer Router uses "ip helper-address" to relay DHCP messages to a DHCP server located on a DMZ inteface of the ASA context.
- Jouni

ASA CX / PRSM Active/Active Failover?

Hi everyone.
I've spent my last 2 days trying to find something on this matter, but I can't find anything conclusive about it.
I'm trying to find if a 2 ASAs+CX in Active/Active configuration is supported and how to do it.
On one side, on the PRSM configuration guide for 9.2, it says "Active-Standby is the only supported high availability configuration", but I don't understand if it's just for adding devices to PRSM or that an Active/Active configuration is not supported by the CX module.
On the other hand, this forum discussion says that they are using Active/Active with CX.
So, I need to know if it will work. I know that if I use Active/Active I should use contexts, which some are Active on one ASA and others are active on the other one. I would assume that the CX module configuration should be the same for both ASAs as to support all the networks policies, but I want to know if this will work (I don't want to tell the customer that it'll work and then be stuck with an unsupported and non-working configuration).
Any advice on this? Guides maybe?
Thanks in advance.

Yes, it can be done. Off-box PRSM manages an ASA context like a "separate" ASA. That's when it's managing the ASA configuration itself - distinct from managing the CX module features.
Note however that there is an unresolved bug with CX modules and HA ASA pairs: https://tools.cisco.com/bugsearch/bug/CSCud54665
The other thing to remember - as you had alluded to - is that the CX configuration is a common one despite there being multiple contexts (with potentially differing security policies with respect to the web filtering and IPS functions they want from the CX) on the box.

Connecting Cisco ASA TenGig to Nexus 7000

I am attempting to connect an ASA 5585 TenGig to a Nexus 7000 F2 TenGig port.
I am seeing the error message Transceiver validation failed when I insert the SFP into the port. I know that the error is removed when I enter the command switchport mode fex-fabric, and have tried the configuration, but am unable to get the link to come up.at either end. I am also aware that LACP is not supported when switchport mode fex-fabric is configured.
ASA is in multiple context mode with portchannel interfaces allocated to the relevant ASA context. Anyone know if I am overlooking something? Anyone run into this issue before?
Nexus 7000:
Eth1/1 1 eth access down Transceiver validation fa auto(D) 2
Eth1/2 1 eth access down Transceiver validation fa auto(D) 2
interface Ethernet1/1
switchport mode trunk
switchport trunk allowed vlan 1-10
channel-group 2 mode active
no shutdown
interface Ethernet1/2
switchport mode trunk
switchport trunk allowed vlan 2-10
channel-group 2 mode active
no shutdown
interface port-channel2
switchport mode trunk
switchport trunk allowed vlan 2-10
ASA5585:
interface TenGigabitEthernet0/6
channel-group 2 mode active
interface TenGigabitEthernet0/7
channel-group 2 mode active
interface Port-channel2
interface Port-channel2.2
vlan 2
interface Port-channel2.3
vlan 3
context inside
allocate-interface Port-channel2.1
allocate-interface Port-channel2.2
config-url disk0:/inside.cfg

In my case, I was getting this error on a interface of a Nexus C6001 with the FET-10G transceiver. I was able to clear it up by temorarily replacing and configuring a slower GLC-T which worked as expected. I then removed all the settings an got the FET-10G to link.

Does WCCP support traffic from different VLANs(mapped to VRFs)?

Hello,
I have the following scenario from the WAN to the Data Center and from the WAN to the Branch:
1. Router 2800/7200 with three (3) MPLS VRFs (VRF Lite)
2. Switch 3750 with three (3) WAN VLANs (one for each VRF) and three (3) LAN User Traffic VLANs (one for each ASA Context) and one WAE VLAN
3. WAE with WCCP enabled for one VLAN in the switch
4. ASA with three (3) Contexts
5. Three (3) Internal LANs (one for each Context)
In summary, there are three flows of traffic which are separated along the way from Branch to Data Center. WAEs are working for one VLAN(VRF1) and WCCP is enabled at the 3750 Switch to do the redirection (not in the router). The question is: does WCCP support traffic from different VLANs (similar to inline 802.1Q) and handle all three flows separate? If so, what should the configuration be at the switch and the WAE?
Thanks.

The VRF awareness for 12.4(T) is still probably 8-12 months out. VRF aware WCCP features are definitely in the pipeline, but nothing has been publically published on availability timelines.
It's now publically available on the forum... but , I've only found it on the 3750 and 3550 documentation.
at the 3750 you will need to place the redirect statement on each of the VLANs, ip wccp 61 redirect in
Kindly find here GRE Tunnel with VRF Configuration Example:
http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a00801e1294.shtml
I have gotten as far as the WAE registering the router:
"WCCP configuration for TCP Promiscuous service 61 and 62 succeeded.
WCCP configuration for TCP Promiscuous succeeded.Please remember to
configure WCCP service 61 and 62 on the corresponding router."
wae01#sh wccp router
Router Information for Service: TCP Promiscuous 61
Routers Configured and Seeing this Wide Area Engine(1)
Router Id Sent To Recv ID
0.0.0.0 209.1.1.1 0000022F
The router registers the WAE as a WCCP client:
router04#
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 61 acquired on WCCP
client 209.1.1.2"
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 62 acquired on WCCP
client 209.1.1.2"
The router however cannot figure out what its ID is and does not see
itself as a WCCP group router.
router04#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: -not yet determined-
Protocol Version: 2.0
Service Identifier: 61
Number of Service Group Clients: 1
Number of Service Group Routers: 0
Total Packets s/w Redirected: 0
Process: 0
Fast: 0
CEF: 0
Redirect access-list: ACCELERATED-TRAFFIC
Total Packets Denied Redirect: 0
Total Packets Unassigned: 25957
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
This is a short summary of important commands for working with VRF's.
View the VRF instances and the associated interfaces.
ml-mr-c6-gs#show ip vrf
Name Default RD Interfaces
blurvrf 100:2 Vlan215
Vlan326
tgvrf 100:1 Vlan132
Vlan325
TenGigabitEthernet1/1
ml-mr-c6-gs#
Show the routing table for a specific VRF.
ml-mr-c6-gs#show ip route vrf tgvrf
Routing Table: tgvrf
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external,
---More--
Gateway of last resort is 128.117.243.57 to network 0.0.0.0
O E2 192.52.106.0/24 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 192.168.150.0/24 [110/160] via 128.117.243.57, 1d19h, Vlan325
172.17.0.0/29 is subnetted, 3 subnets
O E2 172.17.1.16 [110/0] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.8 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.0 [110/1] via 128.117.243.57, 1d19h, Vlan325
--More--
Debugging should otherwise be similar to a regular switch or router.
Final Teragrid VRF Design and Diagrams
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/final.shtml
Teragrid Testbed Design
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/testbed.shtml
Cisco 4500 Series Switch Cisco IOS s/w config guide 12.1(20)EW
Configuring VRF-Lite
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/vrf.html
sachin garg

ASA Context v/s EIGRP

Similar Messages

Maybe you are looking for