DfltCustomization File is missing in Cisco ASA 5580

I wanted to perform the customization of the SSL WebVPN page. But When I tried to create a new Customization object is is not happening as the
DfltCustomization object is not available.
We are having so many webvpn configuration and objects that i cant issue "revert webvpn all" command.
Can I able to import the File from any location or anyone can provide me the default customization object file so the I can export it into the ASA and create new custmixed object accordingly.
Or what other steps I can take to have customization happening in my Cisco ASA 5580. 8.2 (5) and ASDM 6.4.
With Regards,
Faizul

Hi Faizul,
I am including the DfltCustomization file, which has been exported from an active ASA.
Please try to upload it and let me know.
Portu.
Please rate any posts you find helpful.

Similar Messages

  • Upgrading license for more context cisco asa 5580

    Hi guys:
    This is the situation I got to firewalls with failover and I need to upgrade the license so I can get more context (right now I have 5 context and I need 10) so I was looking at the procedure and I'm not sure If I need to restart the device or not. I was looking at this procedure:
    Upgrading the License for a Failover using ASDM (No Reload Required)
    Use the following procedure using ASDM if your new license does not require you to reload. This procedure ensures that there is no downtime.
    •1.       On the active unit, choose Configuration > Device Management > High Availability > Failover > Setup, and uncheck the Enable Failover check box. Now click Apply. The standby unit remains in a pseudo-standby state. Deactivating failover on the active unit prevents the standby unit from attempting to become active during the period when the licenses do not match.
    •2.       Choose Configuration > Device Management > Licensing > Activation Key, and enter the new activation key that you obtained with the active unit serial number. Now click Update Activation Key.
    •3.       Log into the standby unit by double-clicking its address in the Device List. If the device is not in the Device List, click Add to add the device. You might be prompted for credentials to log in.
    •4.       Choose Configuration > Device Management > Licensing > Activation Key, and enter the new activation key that you obtained with the standby unit serial number. Now click Update Activation Key.
    •5.       Log into the active unit again by double-clicking its address in the Device List. Choose Configuration > Device Management > High Availability > Failover > Setup, and re-check the Enable Failover check box.
    •6.       Click Apply. This completes the procedure.
    link: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00806b1c0f.shtml#norelasdm
    But then I checked on the cisco web page that there are some license that need to reload I see this:
    All models
    Downgrading any license (for example, going from 10 contexts to 2 contexts).
    Note If a temporary license expires, and the permanent license is a downgrade, then you do not need to immediately reload the security appliance; the next time you reload, the permanent license is restored.
    link: https://www.cisco.com/en/US/docs/security/asa/asa81/license/license81.html
    So I just want to know if I'm UPGRADING from 5 to 10 context the reload applies to my situation or not?
    Regards

    No reload is required when you are upgrading from 5 to 10 security context license.
    Reload is only required on the following feature:
    http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/license.html#wp1361750
    Hope this helps.

  • Cisco ASA 5580 Arp Collision Errors

    Dears,
    I am receiving allot of Errors "%ASA-4-405001: received ARP collision from IP/MAC on interface dmz1 with existing ARP Entry IP/MAC
    When i checked this MAC address in the same firewall it shows too many IP Addresses.
    What could be the reason ?
    Thanks...

    Hello Richard,
    My first though is why is the ASA receiving this traffic is this is traffic that should not reach the default-gateway.
    Anyway try the following
    same-security-traffic permit intra-interface
    Let me know how it goes
    Julio

  • Show conn in cisco asa

    Hi Team,
    Does the show conn count includes both tcp + udp + embryonic connections.
    Because when i do a calculation in excel from the output of show conn, i got the below output.
    It was extracted from the command "show local-host | include host|count/limit"
    (A):
       Total Sum of TCP embryonic count to host = 331
    (B):
         Total Sum of TCP flow count/limit = 102938
    (C):
         Total Sum of UDP flow count/limit = 3512505
    firewall#show conn count
    1912284 in use, 2000002 most used
    Please let me know how this is caluclated. If show conn count = A+B+C, then i am suspecting that old connection entries are not getting flushed out from the connection table in cisco asa 5580 with version 8.3.2.
    Really im in need of help...

    Hi Kimberly,
    My question was, the count of show conn & show local-host does not match... More over, as the show conn was showing that the max limit of 2 million will be reaching very soon... So, i would like to troubleshoot the output of show local-host | include host|count/limit, where in i could see that one of the webserver has lots of tcp connection (lets say 35000, then the other two servers are consuming udp connections 7lacs,5lacs & 3 lacs, as given below...
    local host: ,
        TCP flow count/limit = 35857/unlimited
        TCP embryonic count to host = 25
        UDP flow count/limit = 0/unlimited
    local host: ,
        TCP flow count/limit = 306/unlimited
        TCP embryonic count to host = 8
        UDP flow count/limit = 736807/unlimited
    local host: ,
        TCP flow count/limit = 246/unlimited
        TCP embryonic count to host = 2
        UDP flow count/limit = 582010/unlimited
    local host: ,
        TCP flow count/limit = 1/unlimited
        TCP embryonic count to host = 0
        UDP flow count/limit = 308412/unlimited
    can you pls let me know any other commands can be executed to know if any huge embryonic/virus attacks/too many broad casts...... Once i clear the local-host, the connections get reduced from a huge value to low value. i reallly do not know if these are geniue traffic or fake ? or do not know if the connection table is not flushing out old entries.. please help

  • ASA 5580-20 Security Contexts

    Hi,
       How many Contexts can a Cisco ASA 5580-20 provide. I have seen that ir is upto 250. Can someone confirm that.
    Please do tell me about the licensing part for the same. How many of then come as default with the box and what is the license conditions/specifications for additional contexts. Is it one extra license for every context.
    Rgds
    Rajesh

    Hi Rajesh,
    Please refer to this URl Link:-
    http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/license/license82.html
    Security Contexts
    2
    Optional licenses:
    5
    10
    20
    50
    Let me know if this answers your query.
    Thanks and Regards,
    Vibhor

  • Cisco ASA - Invert primary/secondary

    Hello
    This is my first post in this forum.
    I haven't found an answear to my issue, so I decided to open a new discussion
    We take care of 2 Cisco ASA 5580 (primary/secondary) working as usual (active/standby). Image version 8.2.5.
    Today I found that the firewall that has been supposed to rule as primary, actually has been the secondary and vice-versa.
    How can I configure (and what's the impact, as they are active im customer/business environment) to invert the situation: the primary become the secondary and the secondary become the primary.
    I'm not talking about to perform a failover, but a config to fix that confusion with roles.
    Regards
    Christian

    Hi,
    Welcome to the CSC
    Since we are talking about an Active/Standby ASA Failover environment then configuring the "primary" and "secondary" in the "failover" configurations of the ASAs doesnt to my understanding have much meaning to the firewall operation other than deciding which becomes Active WHEN they BOTH boot at the same time.
    If we for example have the below situation
    We have ASA1 and ASA2 in Active/Standby Failover
    ASA1 is configured as "primary" and ASA2 is configured as "secondary"
    ASA1 is originally the Active unit and ASA2 the Standby unit
    Now lets assume that either ASA1 boots or becomes Standby because of one of its interfaces failing THEN to my understanding there is NO mechanism in the Active/Standby Failover that would return the Active role back to the ASA1 when it becomes operational.
    However in the case of Active/Active Failover its possible to configure a "preempt" parameter that defines that the unit that you have decided as the Active unit will return to Active role after network outage after a configured perioid of time. This is NOT possible on Active/Standby.
    So in normal networking operation to my understanding the only way to really keep the preferred physical ASA as Active is to monitor the Failover and manually set the original physical ASA Active if there has been a failover.
    There doesnt seem to be any automatic mechanism for the Active role to return to the original Active physical ASA.
    IF you are just talking about changing the commands "failover lan unit primary" and "failover lan unit secondary" to the correct physical ASAs THEN sadly I can't say for sure (without testing) what effect configuring those commands have (when changing them around). I'd presume that changing these wont have any effect on the operation of the firewall as in production they DONT actually decide which unit STAYS Active
    According to the Command Reference of 8.2 software the default setting is Secondary
    I imagine you could possibly do the following (But cant say for 100% certainty without testing it myself)
    remove the possible configuration "failover lan unit secondary" from the other unit
    remove the "failover lan unit primary" from the other unit
    configure the "failover lan unit primary" on the correct unit
    And finally if you want configure the other unit with the "secondary" option (even though the default setting should be secondary according to the command reference)
    Maybe I'll try to check if I have a identical Failover pair of ASA (physical) to test this out for you.
    Heres link to the Command Reference for 8.2 software and the command "failover lan unit"
    http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/ef.html#wp1930580
    Hope the information was helpfull.
    - Jouni

  • ASA 5580 with EtherChannel 20Gbs, Does the Failover link must match the same Speed?

    Hello,
    I have an ASA 5580, I am plannning on setting two EtherChannels (inside and outside), each channel will include two TenGigabit interfaces.
    My questions is that if the links that I am gonig to use for the failover and link, should also be 20Gbs each, or it is ok to use 10Gbs for each link?
    According to the Configuration guide 8.4
    Use the following failover interface speed guidelines for the ASAs:
    • Cisco ASA 5510
    – Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due
    to the CPU speed limitation.
    • Cisco ASA 5520/5540/5550
    – Stateful link speed should match the fastest data link.
    • Cisco ASA 5580/5585
    – Use only non-management 1 Gigabit ports for the stateful link because management ports have
    lower performance and cannot meet the performance requirement for Stateful Failover.
    Thanks in advance

    Hi,
    I have 2x ASA5580-20 with 8x1GE interfaces and additional 2x 10GE interfaces each. Software version running is v8.4.4.1.
    I am planning to use them in multiple context (active/active) transparent mode. Taking into account the FW performance of 5Gbps real-world traffic per ASA5580-20, which on the following interface configurations would make the most sense?
    Option 1:
    2x10GE = 20GE Etherchannel for Data
    1x1GE LAN Failover
    1x1GE STATE Failover
    Option 2:
    1x 10GE Data
    1x 10GE LAN & STATE Failover
    Option 3:
    2x10GE = 20GE Etherchannel for Data
    4x1GE = 4GE Etherchannel for LAN/STATE Failover (possibly up to 8x1GE)
    (etherchannel for LAN/STATE Failover actually does not make much sense, since only one interface wll be used anyway)
    Option 4:
    1x10GE LAN & STATE Failover
    8x1GE = 8 GE Etherchannel for Data
    I have read several guides (e.g. link1, link2, link3). Some state that 1GE Failover interfaces would suffice for the ASA5580, others recommend a link as fast as the data link. Almost none of them account for higher bandwidth etherchannels.
    What is recommended in this case? Both Firewalls will be connected to one VSS Switch Pair, so it would make sense to cross-connect with at least 2 links on each VSS member.
    The ASA does not support connecting an EtherChannel to a switch stack. If the ASA EtherChannel is connected cross stack, and if the Master switch is powered down, then the EtherChannel connected to the remaining switch will not come up. (http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html)
    Thanks in advance for your feedback!

  • Unable to find out asdm image file cisco asa

    Hello,
    i am using cisco asa in gns 3 simulator ,unable find out the ASDM image or .bin file in
    ASA flash .If not how can i
    Uploade the ASDM image onto the ASA flash.
    Please help me out

    Follow this:
    http://www.xerunetworks.com/2012/03/asa-84-asdm-on-gns3-step-by-step-guide/
    For Networking Posts check my blog at http://laguiadelnetworking.com/
    Cheers,
    Julio Carvajal Segura

  • Cisco ASA 5505 - 2 internal Networks

    Hi new to ASA's,
    Been trying to get the following setup working for ages but can't see what I am missing:
    (Got image from another post but exactly what I want but cannot get working)
    I can get ping between subnets but nothing else and Lan 2 cannot get to internet.
    The reolution for this guy was the following I believe; (from his config he has ASA v8.2)
    same-security-traffic permit intra-interface
    access-list NONAT permit ip 192.168.50.0 255.255.255.0 10.0.50.0255.255.255.0
    access-list NONAT permit ip 10.0.50.0 255.255.255.0 192.168.50.0 255.255.255.0
    nat (inside) 0 access-list NONAT
    I have tried this but I have ASA v8.4 and whilst commands 1 - 3 work command 4 doesn't.
    I get a message about the command being deprecated. I couldn't find a new version I could understand.
    Hope nothing stupid and simple but any help greatly appreciated.
    BTW, I have reset my ASA back to defaults except internet access is working and internet LAN as I made some many changes I feared one my conflict with the other.
    Many thanks for any views or help.

    Hi Jumora,
    Thanks for the reply.
    The 192 network behind the ASA can access the internet but the 10 network past the 1841 router can't.
    I have setup tcp bypass already as that got me at least remote access to the PC's on the 10 network from the 192 network.
    I had the 1841 router set to use the interface on the 192 subnet as the route to the 0.0.0.0 0.0.0.0 network but I couldn't get out but have just changed this to go to the inside interface of the ASA and can now ping 8.8.8.8 for example but still not internet access.
    Also I have found that the ASA seems to occasionally when it feels like it block pings from the 10 subnet to devices in the 192 subnet...... annoying for testing! but I can still access shares even though the ping fails.
    e.g. as per above yesterday it stopped when I enabled icmp error inspection but when I switched that off it worked again. Then suddenly again today with no changes it has stopped working again, drives me nuts the inconsistency!
    I couldn't find an attach option for the show tech so it has made this post massive.... apologies for that....
    ASA5505# show tech
    Cisco Adaptive Security Appliance Software Version 8.4(4)1
    Device Manager Version 6.4(9)
    Compiled on Thu 14-Jun-12 11:20 by builders
    System image file is "disk0:/asa844-1-k8.bin"
    Config file at boot was "startup-config"
    ASA5505 up 8 days 23 hours
    Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash M50FW016 @ 0xfff00000, 2048KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
                                 Number of accelerators: 1
    0: Int: Internal-Data0/0    : address is 4403.a7a2.e7c7, irq 11
    1: Ext: Ethernet0/0         : address is 4403.a7a2.e7bf, irq 255
    2: Ext: Ethernet0/1         : address is 4403.a7a2.e7c0, irq 255
    3: Ext: Ethernet0/2         : address is 4403.a7a2.e7c1, irq 255
    4: Ext: Ethernet0/3         : address is 4403.a7a2.e7c2, irq 255
    5: Ext: Ethernet0/4         : address is 4403.a7a2.e7c3, irq 255
    6: Ext: Ethernet0/5         : address is 4403.a7a2.e7c4, irq 255
    7: Ext: Ethernet0/6         : address is 4403.a7a2.e7c5, irq 255
    8: Ext: Ethernet0/7         : address is 4403.a7a2.e7c6, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces       : 8              perpetual
    VLANs                             : 3              DMZ Restricted
    Dual ISPs                         : Disabled       perpetual
    VLAN Trunk Ports                  : 0              perpetual
    Inside Hosts                      : 50             perpetual
    Failover                          : Disabled       perpetual
    VPN-DES                           : Enabled        perpetual
    VPN-3DES-AES                      : Enabled        perpetual
    AnyConnect Premium Peers          : 2              perpetual
    AnyConnect Essentials             : Disabled       perpetual
    Other VPN Peers                   : 10             perpetual
    Total VPN Peers                   : 12             perpetual
    Shared License                    : Disabled       perpetual
    AnyConnect for Mobile             : Disabled       perpetual
    AnyConnect for Cisco VPN Phone    : Disabled       perpetual
    Advanced Endpoint Assessment      : Disabled       perpetual
    UC Phone Proxy Sessions           : 2              perpetual
    Total UC Proxy Sessions           : 2              perpetual
    Botnet Traffic Filter             : Disabled       perpetual
    Intercompany Media Engine         : Disabled       perpetual
    This platform has a Base license.
    Serial Number: JMX3434343T
    Running Permanent Activation Key: 0x8509ef7f 0x2cff5895 0xa4675895 0x7989798 0xc1323132
    Configuration register is 0x1
    Configuration last modified by enable_15 at 16:21:28.863 UTC Wed Oct 23 2013
    ------------------ show disk0: controller ------------------
    Flash Model: SMART CF
    ------------------ show clock ------------------
    04:43:59.822 UTC Thu Oct 24 2013
    ------------------ show crashinfo ------------------
    No crash file found.
    ------------------ show module ------------------
    Mod Card Type                                    Model              Serial No.
      0 ASA 5505 Adaptive Security Appliance         ASA5505            JMX3434343T
    Mod MAC Address Range                 Hw Version   Fw Version   Sw Version    
      0 1255.a3a4.e3bf to 1233.a4a4.e4c4  0.1          1.0(12)13    8.4(4)1
    Mod SSC Application Name           Status           SSC Application Version
    Mod Status             Data Plane Status     Compatibility
      0 Up Sys             Not Applicable        
    ------------------ show memory ------------------
    Free memory:         283382600 bytes (53%)
    Used memory:         253488312 bytes (47%)
    Total memory:        536870912 bytes (100%)
    ------------------ show conn count ------------------
    76 in use, 704 most used
    ------------------ show xlate count ------------------
    80 in use, 814 most used
    ------------------ show vpn-sessiondb summary ------------------
    No sessions to display.
    ------------------ show blocks ------------------
      SIZE    MAX    LOW    CNT
         0    400    399    400
    4    100     99     99
        80    347    332    347
       256    200    192    195
      1550   6374   6306   6371
      2048   1200   1199   1200
      2560    264    264    264
      4096    100     99    100
      8192    100     99    100
    16384    100     99    100
    65536     16     15     16
    CORE  LIMIT  ALLOC   HIGH    CNT       FAILED
       0  24576     26     26     25            0
    ------------------ show blocks queue history detail ------------------
    History buffer memory usage: 2832 bytes (default)
    History analysis time limit: 100 msec
    Please see 'show blocks exhaustion snapshot' for more information
    ------------------ show interface ------------------
    Interface Ethernet0/0 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7bf, MTU not set
    IP address unassigned
    8257648 packets input, 9051289473 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    6222 switch ingress policy drops
    6399241 packets output, 1011134108 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 3
    Interface config status is active
    Interface state is active
    Interface Ethernet0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c0, MTU not set
    IP address unassigned
    1330699 packets input, 312264395 bytes, 0 no buffer
    Received 63097 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    1738131 packets output, 637935280 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 4
    Interface config status is active
    Interface state is active
    Interface Ethernet0/2 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c1, MTU not set
    IP address unassigned
    5028958 packets input, 693527818 bytes, 0 no buffer
    Received 28835 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    1 switch ingress policy drops
    7782140 packets output, 8316018900 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 5
    Interface config status is active
    Interface state is active
    Interface Ethernet0/3 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c2, MTU not set
    IP address unassigned
    17048409 packets input, 21350059442 bytes, 0 no buffer
    Received 75081 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    18 switch ingress policy drops
    8319277 packets output, 5138543287 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 6
    Interface config status is active
    Interface state is active
    Interface Ethernet0/4 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex, Auto-Speed
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c3, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 7
    Interface config status is not active
    Interface state is active
    Interface Ethernet0/5 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex, Auto-Speed
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c4, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 8
    Interface config status is not active
    Interface state is active
    Interface Ethernet0/6 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex, Auto-Speed
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c5, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 9
    Interface config status is not active
    Interface state is active
    Interface Ethernet0/7 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    Available but not configured via nameif
    MAC address 4403.a7a2.e7c6, MTU not set
    IP address unassigned
    7293552 packets input, 4521902362 bytes, 0 no buffer
    Received 6520 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops
    0 switch ingress policy drops
    16232858 packets output, 21234947011 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 rate limit drops
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 10
    Interface config status is active
    Interface state is active
    Interface Internal-Data0/0 "", is up, line protocol is up
      Hardware is y88acs06, BW 1000 Mbps, DLY 10 usec
    (Full-duplex), (1000 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    MAC address 4403.a2a2.e2c2, MTU not set
    IP address unassigned
    15222257 packets input, 10134321711 bytes, 0 no buffer
    Received 173531 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 L2 decode drops, 0 demux drops
    15128507 packets output, 10256870512 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 input reset drops, 0 output reset drops, 0 tx hangs
    input queue (blocks free curr/low): hardware (512/487)
    output queue (blocks free curr/low): hardware (512/450)
      Control Point Interface States:
    Interface number is 2
    Interface config status is active
    Interface state is active
    Interface Internal-Data0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 1000 Mbps, DLY 10 usec
    (Full-duplex), (1000 Mbps)
    Input flow control is unsupported, output flow control is unsupported
    MAC address 0000.0003.0002, MTU not set
    IP address unassigned
    15128465 packets input, 10256855882 bytes, 0 no buffer
    Received 1967 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 pause input, 0 resume input
    0 switch ingress policy drops
    15222217 packets output, 10134318430 bytes, 0 underruns
    0 pause output, 0 resume output
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    0 switch egress policy drops
    0 input reset drops, 0 output reset drops
      Control Point Interface States:
    Interface number is 11
    Interface config status is active
    Interface state is active
    Interface Vlan1 "inside", is up, line protocol is up
      Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
    MAC address 4403.a7a2.e7c7, MTU 1500
    IP address 192.168.1.1, subnet mask 255.255.255.0
      Traffic Statistics for "inside":
    4183727 packets input, 523675346 bytes
    5702790 packets output, 5851485425 bytes
    142576 packets dropped
          1 minute input rate 22 pkts/sec,  2839 bytes/sec
          1 minute output rate 30 pkts/sec,  22751 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 33 pkts/sec,  3746 bytes/sec
          5 minute output rate 46 pkts/sec,  20906 bytes/sec
          5 minute drop rate, 1 pkts/sec
      Control Point Interface States:
    Interface number is 14
    Interface config status is active
    Interface state is active
    Interface Vlan2 "outside", is up, line protocol is up
      Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
    MAC address 4403.a7a2.e7c7, MTU 1492
    IP address 98.22.77.33, subnet mask 255.255.255.255
      Traffic Statistics for "outside":
    10541983 packets input, 11433817622 bytes
    3793777 packets output, 526586888 bytes
    13654 packets dropped
          1 minute input rate 47 pkts/sec,  41657 bytes/sec
          1 minute output rate 18 pkts/sec,  2802 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 80 pkts/sec,  38519 bytes/sec
          5 minute output rate 29 pkts/sec,  3749 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
    Interface number is 15
    Interface config status is active
    Interface state is active
    Interface Virtual0 "_internal_loopback", is up, line protocol is up
      Hardware is Virtual          MAC address 0000.0000.0000, MTU 1500
    IP address 127.0.0.1, subnet mask 255.255.255.0
      Traffic Statistics for "_internal_loopback":
    1 packets input, 28 bytes
    1 packets output, 28 bytes
    1 packets dropped
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
    Interface number is 12
    Interface config status is active
    Interface state is active
    ------------------ show cpu usage ------------------
    CPU utilization for 5 seconds = 12%; 1 minute: 8%; 5 minutes: 8%
    ------------------ show cpu hogging process ------------------
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 1, MAXHOG: 23, LASTHOG: 23
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853e1f4 (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 23, LASTHOG: 23
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853e1f4 (suspend)
    Call stack:   0x0853e1f4  0x0853ec36  0x0854182c  0x0869cc4b  0x08415ae7  0x0840ae40  0x0806e6cf
                  0x08aade2b  0x0806e6cf  0x084a0a44  0x0849986d  0x08499aac  0x08499dd6  0x084a0909
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 2, MAXHOG: 18, LASTHOG: 18
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853fb48 (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 2, MAXHOG: 18, LASTHOG: 18
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x0853fb48 (suspend)
    Call stack:   0x0853fb48  0x0853fd1d  0x0853e1bc  0x0853ec36  0x0854182c  0x0869cc4b  0x08415ae7
          0x0840ae40  0x0806e6cf  0x08aade2b  0x0806e6cf  0x084a0a44  0x0849986d  0x08499aac
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 2, MAXHOG: 24, LASTHOG: 24
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x084167d2 (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 2, MAXHOG: 24, LASTHOG: 24
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x084167d2 (suspend)
    Call stack:   0x08538afd  0x0853fa3a  0x0853fd1d  0x0853e1bc  0x0853ec36  0x0854182c  0x0869cc4b
                  0x08415ae7  0x0840ae40  0x0806e6cf  0x08aade2b  0x0806e6cf  0x084a0a44  0x0849986d
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 1, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x08ee9b4e (suspend)
    Process:      Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x08ee9b4e (suspend)
    Call stack:   0x08ee9e12  0x084a1032  0x0849986d  0x08499aac  0x08499dd6  0x084a0909  0x080689bc
    Process:      Dispatch Unit, PROC_PC_TOTAL: 2, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x081e208a (suspend)
    Process:      Dispatch Unit, NUMHOG: 2, MAXHOG: 12, LASTHOG: 12
    LASTHOG At:   06:01:57 UTC Oct 15 2013
    PC:           0x081e208a (suspend)
    Call stack:   0x081e208a  0x080689bc
    Process:      Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 180, LASTHOG: 180
    LASTHOG At:   07:24:33 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x08a8ebd7  0x08a8f7c8  0x08a914fa  0x080ddd6f  0x080df9db  0x080f4132
                  0x080f5b16  0x080dd956  0x080de0ef  0x080de876  0x080dea37  0xdd6e6c1c  0xdd6e71b5
    Process:      rtcli async executor process, NUMHOG: 14, MAXHOG: 94, LASTHOG: 82
    LASTHOG At:   07:28:06 UTC Oct 19 2013
    PC:           0x08f262e3 (suspend)
    Call stack:   0x0806a881  0x08f262e3  0x08f432a2  0x09064ba8  0x0903dfa9  0x0904f88d  0x0903ed70
                  0x09036221  0x0903d29b  0x0903d49f  0x09035ffa  0x09055321  0x0903dfa9  0x0904f88d
    Process:      rtcli async executor process, PROC_PC_TOTAL: 27, MAXHOG: 319, LASTHOG: 88
    LASTHOG At:   07:28:06 UTC Oct 19 2013
    PC:           0x08f4212d (suspend)
    Process:      rtcli async executor process, NUMHOG: 27, MAXHOG: 319, LASTHOG: 88
    LASTHOG At:   07:28:06 UTC Oct 19 2013
    PC:           0x08f4212d (suspend)
    Call stack:   0x08069faa  0x08f4212d  0x08f260b6  0x08f27b85  0x08f27c35  0xcb147b98
    Process:      rtcli async executor process, PROC_PC_TOTAL: 12, MAXHOG: 45, LASTHOG: 10
    LASTHOG At:   07:28:14 UTC Oct 19 2013
    PC:           0x08f2594b (suspend)
    Process:      rtcli async executor process, NUMHOG: 12, MAXHOG: 45, LASTHOG: 10
    LASTHOG At:   07:28:14 UTC Oct 19 2013
    PC:           0x08f2594b (suspend)
    Call stack:   0x0806a881  0x08f2594b  0x08f27b85  0x08f27c35  0xcb147b98
    Process:      Unicorn Admin Handler, NUMHOG: 4, MAXHOG: 11, LASTHOG: 11
    LASTHOG At:   07:28:14 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x08a8ebd7  0x08b9aa46  0x08b9ad0e  0x080dc76f  0xdd6e6961  0xdd6e71b5
                  0xdd6e7b07  0xdd6e8d5c  0xdd6e138d  0xdd6e247a  0x080dcb22  0x0849f899  0x084981c7
    Process:      rtcli async executor process, PROC_PC_TOTAL: 83, MAXHOG: 298, LASTHOG: 119
    LASTHOG At:   07:28:16 UTC Oct 19 2013
    PC:           0x08f262e3 (suspend)
    Process:      rtcli async executor process, NUMHOG: 47, MAXHOG: 298, LASTHOG: 119
    LASTHOG At:   07:28:16 UTC Oct 19 2013
    PC:           0x08f262e3 (suspend)
    Call stack:   0x0806a881  0x08f262e3  0x08f38fad  0x08f3acc0  0x0905a29e  0x0905b2ba  0x0903dfa9
                  0x0903ecb5  0x0904f6f5  0x0903ed70  0x09036221  0x0903d29b  0x0903d49f  0x09035ffa
    Process:      Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 180, LASTHOG: 180
    LASTHOG At:   07:28:16 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a881  0x0806a8c2  0x0816261b  0x095302a7  0x0954abef  0x0954acc3  0x0815aabe
                  0x08134da6  0x08c64632  0x08ea8079  0x08ea8481  0x08ea85f7  0x08f41adc  0x0806e6cf
    Process:      Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 15, LASTHOG: 15
    LASTHOG At:   07:28:20 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a881  0x0806a8c2  0x0947a399  0x0946d24d  0x0946d364  0x08c2b0e6  0x08c38f65
                  0x08ea810b  0x08ea8481  0x08ea85f7  0x08f41adc  0x0806e6cf  0x08f3cc48  0x092afca6
    Process:      Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 64, LASTHOG: 64
    LASTHOG At:   07:28:20 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a881  0x0806a8c2  0x0947a3e4  0x09479cf9  0x094750eb  0x08c3f645  0x08c3fcab
                  0x08c2b235  0x08c38f65  0x08ea810b  0x08ea8481  0x08ea85f7  0x08f41adc  0x0806e6cf
    Process:      IP Thread, NUMHOG: 4, MAXHOG: 14, LASTHOG: 14
    LASTHOG At:   07:28:24 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x0947a399  0x0946d24d  0x0946d364  0x08c2b0e6  0x08c38f65  0x08ea810b
                  0x08ea8481  0x08ea85f7  0x08ea5f86  0x090e086e  0x090e0b6e  0x090b9a99  0x090b6b00
    Process:      Unicorn Admin Handler, PROC_PC_TOTAL: 22, MAXHOG: 180, LASTHOG: 64
    LASTHOG At:   07:28:24 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Process:      IP Thread, NUMHOG: 4, MAXHOG: 64, LASTHOG: 64
    LASTHOG At:   07:28:24 UTC Oct 19 2013
    PC:           0x0806a8c2 (suspend)
    Call stack:   0x0806a8c2  0x0947a3e4  0x09479cf9  0x094750eb  0x08c3f645  0x08c3fcab  0x08c2b235
                  0x08c38f65  0x08ea810b  0x08ea8481  0x08ea85f7  0x08ea5f86  0x090e086e  0x090e0b6e
    CPU hog threshold (msec): 10.240
    Last cleared: None
    ------------------ show process ------------------
        PC       SP       STATE       Runtime    SBASE     Stack Process
    Lwe 0x08058ba4 0xc82baf84 0x0a345788          0 0xc82b7078 15760/16384 block_diag
    Mrd 0x081e1e11 0xc82ed54c 0x0a346144     430188 0xc82cd6e0 120548/131072 Dispatch Unit
    Msi 0x087509a4 0xc82fdcb4 0x0a3458b0        713 0xc82f9da8 15688/16384 WebVPN KCD Process
    Msi 0x09200c7b 0xc839b3d4 0x0a3458b0       3466 0xc83974c8 15688/16384 y88acs06 OneSec Thread
    Mwe 0x080718dd 0xc83a3804 0x0a3458b0          0 0xc839f948 15808/16384 Reload Control Thread
    Mwe 0x080849b9 0xc83ae79c 0x0a346e2c          0 0xc83aabe0 15256/16384 aaa
    Mwe 0x08f4212d 0xc8d3d1e4 0x0a3458b0          9 0xc83aed78 15056/16384 UserFromCert Thread
    Mwe 0x08f4212d 0xc9003fe4 0x0a3458b0         14 0xc83b2f50 14528/16384 aaa_shim_thread
    Mwe 0x080b477c 0xc83bfa1c 0x0a347eb4          0 0xc83bbb20 15760/16384 CMGR Server Process
    Mwe 0x080b6ded 0xc83c3b64 0x0a3458b0          0 0xc83bfcb8 15832/16384 CMGR Timer Process
    Lwe 0x081e0474 0xc83d83bc 0x0a3568e0          0 0xc83d44b0 15488/16384 dbgtrace
    Mwe 0x084de0ed 0xc83ef574 0x0a3458b0          0 0xc83e76d8 31680/32768 idfw_proc
    Mwe 0x084ea35b 0xc83f75b4 0x0a3458b0          0 0xc83ef708 32216/32768 idfw_service
    Mwe 0x084f5fc5 0xc83fb70c 0x0a3458b0          0 0xc83f78a0 15524/16384 idfw_adagent
    Mwe 0x085351b5 0xc84038dc 0x0a3458b0         89 0xc83ffbd0 11568/16384 eswilp_svi_init
    Mwe 0x08f4212d 0xc8770564 0x0a3458b0          0 0xc8433aa0 15280/16384 netfs_thread_init
    Mwe 0x09576795 0xc844c10c 0x0a3458b0          0 0xc8448290 15848/16384 Chunk Manager
    Msi 0x08ae10be 0xc84508ac 0x0a3458b0       3523 0xc844c9c0 15656/16384 PIX Garbage Collector
    Mwe 0x08ac328a 0xc8461a0c 0x0a1d5d24          0 0xc845db00 16104/16384 IP Address Assign
    Mwe 0x08d0477a 0xc85f7534 0x0a251838          0 0xc85f3628 16104/16384 QoS Support Module
    Mwe 0x08b5c32a 0xc85fb70c 0x0a1d6c88          0 0xc85f7800 16104/16384 Client Update Task
    Lwe 0x095d54f5 0xc860009c 0x0a3458b0     109750 0xc85fc1f0 14448/16384 Checkheaps
    Mwe 0x08d093ed 0xc861080c 0x0a3458b0        454 0xc86089a0 19328/32768 Quack process
    Mwe 0x08d8569d 0xc86189c4 0x0a3458b0        533 0xc8610b38 31952/32768 Session Manager
    Mwe 0x08ed964d 0xc8620cd4 0xcadf5b08          8 0xc861ce68 15464/16384 uauth
    Mwe 0x08e66621 0xc8624f0c 0x0a264a10          0 0xc8621000 15632/16384 Uauth_Proxy
    Msp 0x08ea87de 0xc86313d4 0x0a3458b0        561 0xc862d4c8 15688/16384 SSL
    Mwe 0x08ed72d4 0xc863554c 0x0a26bc14          0 0xc8631660 15708/16384 SMTP
    Mwe 0x08ed170c 0xc86396a4 0x0a26af38      23255 0xc86357f8 13608/16384 Logger
    Mwe 0x08ecfd1d 0xc863d80c 0x0a3458b0          0 0xc8639990 15784/16384  Syslog Retry Thread
    Mwe 0x08ecadf5 0xc86419d4 0x0a3458b0          0 0xc863db28 15600/16384 Thread Logger
    Mwe 0x08ed50b4 0xc866457c 0x0a26b5e0          0 0xc8660680 15464/16384 syslogd
    Mwe 0x09132032 0xc8681094 0x0a2a5688          0 0xc867d1a8 15328/16384 vpnlb_thread
    Mwe 0x092037ec 0xc86916c4 0x0a2aa9e8          0 0xc868d808 16024/16384 pci_nt_bridge
    Mwe 0x082beb95 0xc8756e44 0x0a3458b0          0 0xc8752fb8 15864/16384 TLS Proxy Inspector
    Msi 0x08da221c 0xc87d44a4 0x0a3458b0       2749 0xc87d0598 15688/16384 emweb/cifs_timer
    Mwe 0x08852cc4 0xc88291f4 0x0a1c4c44          0 0xc88252f8 15712/16384 netfs_mount_handler
    Msi 0x086b4248 0xc8316454 0x0a3458b0      27304 0xc8312568 15312/16384 arp_timer
    Mwe 0x086bc58e 0xc8447fb4 0x0a371110          0 0xc84440f8 16024/16384 arp_forward_thread
    Mwe 0x08eddb77 0xc8f2e27c 0x0a26c680          0 0xc8f2a380 15672/16384 tcp_fast
    Mwe 0x08ee69a8 0xc8f3229c 0x0a26c680          0 0xc8f2e3b0 15656/16384 tcp_slow
    Mwe 0x08f1df34 0xc8f42fac 0x0a2745d0          0 0xc8f3f0b0 16000/16384 udp_timer
    Mwe 0x0814110d 0xc8fb133c 0xc83ca8d0          4 0xc8fad4a0 15664/16384 IPsec message handler
    Mwe 0x087515c6 0xc8fdc834 0x0a376060          1 0xc8fd8958 16056/16384 Lic TMR
    Mwe 0x087513bc 0xc8fe0884 0x0a1c0ea0        242 0xc8fdc988 16088/16384 Lic HA
    Msi 0x08153267 0xc84270dc 0x0a3458b0      54986 0xc8423440 13872/16384 CTM message handler
    Mwe 0x0811bd2d 0xc843bb8c 0x0a3458b0          0 0xc8437ce0 15832/16384 CTCP Timer process
    Mwe 0x090d3d95 0xc843fbac 0x0a3458b0          0 0xc843bd10 15816/16384 L2TP data daemon
    Mwe 0x090d6605 0xc9b5b24c 0x0a3458b0          0 0xc9b573b0 15816/16384 L2TP mgmt daemon
    Mwe 0x090c2b27 0xc9b9339c 0x0a29a3ec       2228 0xc9b8f4e0 15480/16384 ppp_timer_thread
    Msi 0x0913239d 0xc9b973ec 0x0a3458b0       4093 0xc9b93510 15640/16384 vpnlb_timer_thread
    Mwe 0x081c7708 0xc9c67c84 0x0a13ef88       2899 0xc9c47f18 118548/131072 tmatch compile thread
    Mwe 0x08d38b2d 0xcac940cc 0x0a3458b0          0 0xcac90210 15848/16384 ICMP event handler
    Mwe 0x0908081d 0xcac98254 0x0a3458b0          0 0xcac943a8 15832/16384 Dynamic Filter VC Housekeeper
    Mwe 0x08a1b612 0xcacc47f4 0x0a3458b0        819 0xcacc0938 13860/16384 IP Background
    Mwe 0x08c26e63 0xcaed904c 0x0a3458b0          0 0xcaed51a0 15832/16384 Crypto CA
    Mwe 0x08c60c18 0xcaedd1e4 0x0a3458b0          0 0xcaed9338 15896/16384 CERT API
    Mwe 0x08c257d5 0xcaee6e24 0x0a3458b0          0 0xcaee2f58 15928/16384 Crypto PKI RECV
    Mwe 0x0878dd85 0xc862d1cc 0x0a3458b0        187 0xc8629330 15272/16384 ESW_MRVL switch interrupt service
    Mwe 0x08cae62c 0xc866c89c 0x0a1ea7e0          0 0xc86689b0 15832/16384 lina_int
    Mrd 0x0959948b 0xc8684f1c 0x0a346144   28493079 0xc8681340 13824/16384 esw_stats
    Lsi 0x08af3199 0xc86958bc 0x0a3458b0        152 0xc86919a0 15704/16384 uauth_urlb clean
    Lwe 0x08acbd76 0xc83ff8b4 0x0a3458b0       4432 0xc83fba38 14308/16384 pm_timer_thread
    Mwe 0x08555f8d 0xc8418b0c 0x0a3458b0          0 0xc8414c60 15832/16384 IKE Common thread
    Mwe 0x0858cecd 0xcaf8688c 0x0a3458b0          0 0xcaf82a60 15704/16384 IKE Timekeeper
    Mwe 0x0857bad1 0xcaf8ccc4 0x0a1bc678          1 0xcaf890e8 12116/16384 IKE Daemon
    Mwe 0x08629eb3 0xcaf90c64 0x0a3458b0        964 0xcaf8d118 14744/16384 IKEv2 Daemon
    Mwe 0x08628e7c 0xcaf94ff4 0x0a3458b0       1095 0xcaf91148 15640/16384 IKEv2 DPD Client Process
    Mwe 0x08e7d2e4 0xcafafd7c 0x0a2690f4          0 0xcafabe90 16072/16384 RADIUS Proxy Event Daemon
    Mwe 0x08e41f35 0xcafb3d74 0xcb07e358          7 0xcafb0028 14912/16384 RADIUS Proxy Listener
    Mwe 0x08e7ca0d 0xcafb806c 0x0a3458b0          0 0xcafb41c0 15832/16384 RADIUS Proxy Time Keeper
    Mwe 0x086a1e44 0xcafbc184 0x0a3710c8          0 0xcafb8358 15264/16384 Integrity FW Task
    Mrd 0x082c923a 0xcaffce54 0x0a346144          0 0xcaff8f98 14552/16384 CP Threat-Detection Processing
    Mwe 0x081fb74e 0xcb0cc4bc 0x09c4a8bc       2497 0xcb0acd60 122448/131072 ci/console
    Msi 0x08b0ea8c 0xcb0d0e14 0x0a3458b0     217583 0xcb0ccef8 14004/16384 update_cpu_usage
    Mwe 0x08ef5ff5 0xcb0d4ecc 0x0a3458b0         77 0xcb0d1090 15360/16384 npshim_thread
    Msi 0x08b0eb14 0xcb0e1224 0x0a3458b0          0 0xcb0dd428 13104/16384 NIC status poll
    Mwe 0x08dd5f2c 0xcb0e54bc 0x0a259ec8        228 0xcb0e15c0 15540/16384 SNMP Notify Thread
    Mwe 0x086aba0e 0xcb12ebe4 0x0a37170c     235813 0xcb126d08 25428/32768 IP Thread
    Mwe 0x086b31fe 0xcb132d9c 0x0a371100       9150 0xcb12eea0 9700/16384 ARP Thread
    Mwe 0x084be3ae 0xcb136f8c 0x0a3716c8       1743 0xcb1331b0 12696/16384 icmp_thread
    Mwe 0x08f1f443 0xcb13b1e4 0x0a3458b0        158 0xcb137348 15728/16384 udp_thread
    Mwe 0x08ee0f44 0xcb13f0bc 0x0a37178c          0 0xcb13b4e0 15288/16384 tcp_thread
    Mwe 0x08f4212d 0xcb1bccd4 0x0a3458b0      12848 0xcb13fd70 26600/32768 rtcli async executor process
    Mwe 0x090e408d 0xcb4dff64 0x0a3458b0          0 0xcb4dc0a8 14608/16384 PPPOE background daemon
    Mwe 0x090e53c4 0xcb4e3fb4 0x0a29aa4c          1 0xcb4e00d8 14656/16384 PPPOE CLI daemon
    Mwe 0x0824ff45 0xcb501e4c 0x0a3458b0        258 0xcb4fdf90 15624/16384 Timekeeper
    Mwe 0x08e41f35 0xcb89a6d4 0xcb89eb10          7 0xcb896998 15392/16384 EAPoUDP-sock
    Mwe 0x0822323d 0xcb89e544 0x0a3458b0          0 0xcb89a9c8 15016/16384 EAPoUDP
    Mwe 0x08204371 0xcb3df9dc 0x0a3458b0        149 0xcb3dbb20 15168/16384 DHCPD Timer
    Mwe 0x082066a1 0xcb3e6404 0x0a3458b0       1286 0xcb3e25a8 7172/16384 dhcp_daemon
    Mwe 0x0910dfd4 0xcbc3b4e4 0x0a2a5380          0 0xcbc335e8 32472/32768 vpnfol_thread_msg
    Msi 0x09116252 0xcbc3fac4 0x0a3458b0       2657 0xcbc3bbd8 15656/16384 vpnfol_thread_timer
    Mwe 0x09114882 0xcbc44074 0x0a2a53c0          0 0xcbc401c8 16008/16384 vpnfol_thread_sync
    Msi 0x09115fdc 0xcbc486b4 0x0a3458b0      11061 0xcbc447b8 15672/16384 vpnfol_thread_unsent
    Mwe 0x0869e365 0xc8689384 0x0a3458b0          0 0xc86854d8 15832/16384 Integrity Fw Timer Thread
    Msi 0x08852fd6 0xc868d55c 0x0a3458b0        206 0xc8689670 15656/16384 netfs_vnode_reclaim
    Mwe 0x08f4212d 0xcb2a1914 0x0a3458b0       1277 0xcbd38510 15008/16384 Unicorn Proxy Thread
    Mwe 0x0825afcb 0xcbc61254 0x0a3458b0        335 0xcbc5d788 14272/16384 emweb/https
    Mwe 0x08eef828 0xcbd4dd0c 0xcbd4fd7c          0 0xcbd49fd0 14888/16384 listen/telnet
    Mwe 0x08aac530 0xcbdbd754 0xcbd6c9fc        102 0xcbd9def8 127432/131072 Unicorn Admin Handler
    Mwe 0x08aab345 0xcbddd644 0x0a3458b0        105 0xcbdbdf28 123712/131072 Unicorn Admin Handler
    Mwe 0x08cd7c6f 0xcaf358cc 0x0a49edc8          0 0xcaf31bb0 15384/16384 qos_metric_daemon
    Mwe 0x08218c82 0xcb2693fc 0x0a3458b0          3 0xcb265560 13248/16384 DHCP Client
    Mwe 0x08f1d929 0xcb4bb0fc 0xc8f3ece4          0 0xcb4b3300 31552/32768 DHCPC Receiver
    M*  0x08a86f55 0xdcc1df2c 0x0a346144        274 0xcb34deb8 19696/32768 telnet/ci
    -           -          -          -          0          -      -      DATAPATH-0-455
    -           -          -          -  744377118          -      -      scheduler
    -           -          -          -  774156778          -      -      total elapsed
    ------------------ show kernel process ------------------
    PID PPID PRI NI      VSIZE      RSS      WCHAN STAT  RUNTIME COMMAND
      1    0  20  0    2080768      616 3725686580    S      630 init
      2    0  15 -5          0        0 3725738556    S        0 kthreadd
      3    2  15 -5          0        0 3725692956    S        0 ksoftirqd/0
      4    2  15 -5          0        0 3725728656    S        0 events/0
      5    2  15 -5          0        0 3725728656    S        0 khelper
    50    2  15 -5          0        0 3725728656    S        0 kblockd/0
    53    2  15 -5          0        0 3726777703    S        0 kseriod
    99    2  20  0          0        0 3725848262    S        0 pdflush
    100    2  20  0          0        0 3725848262    S        0 pdflush
    101    2  15 -5          0        0 3725861131    S        0 kswapd0
    102    2  15 -5          0        0 3725728656    S        0 aio/0
    103    2  15 -5          0        0 3725728656    S        0 nfsiod
    214    2  15 -5          0        0 3725728656    S        0 hid_compat
    215    2  15 -5          0        0 3725728656    S        0 rpciod/0
    240    1  16 -4    1789952      600 3725997327    S        4 udevd
    272  240  18 -2    1785856      564 3725997327    S        0 udevd
    277  240  18 -2    1785856      552 3725997327    S        0 udevd
    421    1  20  0    5201920     1600 4294967295    S       11 lwsmd
    423  421  20  0   16736256     3600 4294967295    S      102 lwregd
    448    1  20  0    2084864      512 3725686580    S        1 sh
    449  448  20  0   10186752      528 4294967295    S        2 lina_monitor
    451  449   0 -20  440270848    53000 4294967295    S 77713055 lina
    ------------------ show kernel cgroup-controller detail ------------------
    memory controller:
    memory.limit_in_bytes: unlimited
    memory.usage_in_bytes: 61665280   (11%)
    memory.max_usage_in_bytes: 64245760   (12%)
    memory.failcnt: 0
    tasks:
    group "normal"
      memory.limit_in_bytes: unlimited
      memory.usage_in_bytes: 77824   (0%)
      memory.max_usage_in_bytes: 544768   (0%)
      memory.failcnt: 0
      tasks:
           PID         RSS COMMAND                      
             1      630784 init                         
             2           0 kthreadd                     
             3           0 ksoftirqd/0                  
             4           0 events/0                     
             5           0 khelper                      
            50           0 kblockd/0                    
            53           0 kseriod                      
            99           0 pdflush                      
           100           0 pdflush                      
           101           0 kswapd0                      
           102           0 aio/0                        
           103           0 nfsiod                       
           214           0 hid_compat                   
           215           0 rpciod/0                     
           240      614400 udevd                        
           272      577536 udevd                        
           277      565248 udevd                        
           448      524288 sh                           
    group "privileged"
      memory.limit_in_bytes: unlimited
      memory.usage_in_bytes: 22327296   (4%)
      memory.max_usage_in_bytes: 22515712   (4%)
      memory.failcnt: 0
      tasks:
           PID         RSS COMMAND                      
           449      540672 lina_monitor                 
           450           0 lina_monitor                 
           451    54280192 lina                         
           452           0 lina                         
           453           0 lina                         
           454           0 lina                         
           455           0 lina                         
    group "restricted"
      memory.limit_in_bytes: 23068672   (4%)
      memory.usage_in_bytes: 1724416   (0%)
      memory.max_usage_in_bytes: 1900544   (0%)
      memory.failcnt: 0
      tasks:
           PID         RSS COMMAND                      
           421     1638400 lwsmd                        
           422           0 lwsmd                        
           423     3686400 lwregd                       
           425           0 lwregd                       
           426           0 lwregd                       
           427           0 lwregd                       
           428           0 lwregd                       
           429           0 lwregd                       
           430           0 lwsmd                        
           431           0 lwsmd                        
           432           0 lwsmd                        
           433           0 lwsmd                        
           434           0 lwsmd                        
    cpu controller:
    cpu.shares: 1024
    cpuacct.usage: 777015353084076
    tasks:
    group "normal"
      cpu.shares: 1024
      cpuacct.usage: 53525955783   (0%)
    tasks:
           PID         RSS COMMAND                      
             1      630784 init                         
             2           0 kthreadd                     
             3           0 ksoftirqd/0                  
             4           0 events/0                     
             5           0 khelper                      
            50           0 kblockd/0                    
            53           0 kseriod                      
            99           0 pdflush                      
           100           0 pdflush                      
           101           0 kswapd0                      
           102           0 aio/0                        
           103           0 nfsiod                       
           214           0 hid_compat                   
           215           0 rpciod/0                     
           240      614400 udevd                        
           272      577536 udevd                        
           277      565248 udevd                        
           448      524288 sh                           
           449      540672 lina_monitor                 
           450           0 lina_monitor                 
           451    54280192 lina                         
           452           0 lina                         
           453           0 lina                         
           454           0 lina                         
    group "privileged"
      cpu.shares: 16384
      cpuacct.usage: 776952528547140   (100%)
      tasks:
           PID         RSS COMMAND                      
           455           0 lina                         
    group "restricted"
      cpu.shares: 1024
      cpuacct.usage: 1291957168   (0%)
      tasks:
           PID         RSS COMMAND                      
           421     1638400 lwsmd                        
           422           0 lwsmd                        
           423     3686400 lwregd                       
           425           0 lwregd                       
           426           0 lwregd                       
           427           0 lwregd                       
           428           0 lwregd                       
           429           0 lwregd                       
           430           0 lwsmd                        
           431           0 lwsmd                        
           432           0 lwsmd                        
           433           0 lwsmd                        
           434           0 lwsmd                        
    ------------------ show traffic ------------------
    inside:
    received (in 422169.300 secs):
    4183910 packets          523687951 bytes
    9 pkts/sec          1006 bytes/sec
    transmitted (in 422169.300 secs):
    5702974 packets          5851550584 bytes
    3 pkts/sec          13006 bytes/sec
          1 minute input rate 22 pkts/sec,  2839 bytes/sec
          1 minute output rate 30 pkts/sec,  22751 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 33 pkts/sec,  3746 bytes/sec
          5 minute output rate 46 pkts/sec,  20906 bytes/sec
          5 minute drop rate, 1 pkts/sec
    outside:
    received (in 422169.300 secs):
    10542135 packets          11433861540 bytes
    4 pkts/sec          27002 bytes/sec
    transmitted (in 422169.300 secs):
    3793870 packets          526596330 bytes
    8 pkts/sec          1003 bytes/sec
          1 minute input rate 47 pkts/sec,  41657 bytes/sec
          1 minute output rate 18 pkts/sec,  2802 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 80 pkts/sec,  38519 bytes/sec
          5 minute output rate 29 pkts/sec,  3749 bytes/sec
          5 minute drop rate, 0 pkts/sec
    _internal_loopback:
    received (in 422168.950 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 422168.950 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Aggregated Traffic on Physical Interface
    Ethernet0/0:
    received (in 776992.730 secs):
    8257731 packets          9051312645 bytes
    5 pkts/sec          11002 bytes/sec
    transmitted (in 776992.730 secs):
    6399342 packets          1011145708 bytes
    2 pkts/sec          1002 bytes/sec
          1 minute input rate 26 pkts/sec,  24481 bytes/sec
          1 minute output rate 20 pkts/sec,  3472 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 40 pkts/sec,  20147 bytes/sec
          5 minute output rate 29 pkts/sec,  4280 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/1:
    received (in 776992.730 secs):
    1330771 packets          312271947 bytes
    1 pkts/sec          3 bytes/sec
    transmitted (in 776992.730 secs):
    1738316 packets          638003030 bytes
    2 pkts/sec          3 bytes/sec
          1 minute input rate 4 pkts/sec,  405 bytes/sec
          1 minute output rate 11 pkts/sec,  3333 bytes/sec
    <--- More --->
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 7 pkts/sec,  735 bytes/sec
          5 minute output rate 13 pkts/sec,  4410 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/2:
    received (in 776993.220 secs):
    5028958 packets          693527818 bytes
    0 pkts/sec          2 bytes/sec
    transmitted (in 776993.220 secs):
    7782202 packets          8316039741 bytes
    4 pkts/sec          10000 bytes/sec
          1 minute input rate 1 pkts/sec,  153 bytes/sec
          1 minute output rate 2 pkts/sec,  391 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 1 pkts/sec,  187 bytes/sec
          5 minute output rate 3 pkts/sec,  1011 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/3:
    received (in 776993.220 secs):
    17219822 packets          21609826615 bytes
    0 pkts/sec          27005 bytes/sec
    transmitted (in 776993.220 secs):
    8373382 packets          5142266559 bytes
    5 pkts/sec          6004 bytes/sec
    <--- More --->
          1 minute input rate 8384 pkts/sec,  12695156 bytes/sec
          1 minute output rate 2657 pkts/sec,  203156 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 8010 pkts/sec,  12112337 bytes/sec
          5 minute output rate 2525 pkts/sec,  188122 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/4:
    received (in 776993.680 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 776993.680 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/5:
    received (in 776993.690 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 776993.690 secs):
    <--- More --->
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/6:
    received (in 776994.140 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
    transmitted (in 776994.140 secs):
    0 packets          0 bytes
    0 pkts/sec          0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/7:
    received (in 776994.140 secs):
    7328915 packets          4524298170 bytes
    <--- More --->
    3 pkts/sec          5004 bytes/sec
    transmitted (in 776994.140 secs):
    16345245 packets          21405489647 bytes
    4 pkts/sec          27001 bytes/sec
          1 minute input rate 2330 pkts/sec,  158045 bytes/sec
          1 minute output rate 7422 pkts/sec,  11264540 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 2481 pkts/sec,  168427 bytes/sec
          5 minute output rate 7977 pkts/sec,  12105867 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/0:
    received (in 776994.640 secs):
    15222548 packets          10134365294 bytes
    3 pkts/sec          13004 bytes/sec
    transmitted (in 776994.640 secs):
    15128813 packets          10256961010 bytes
    2 pkts/sec          13001 bytes/sec
          1 minute input rate 45 pkts/sec,  24860 bytes/sec
          1 minute output rate 49 pkts/sec,  26647 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 73 pkts/sec,  24918 bytes/sec
          5 minute output rate 75 pkts/sec,  26334 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/1:
    <--- More --->
    received (in 776994.640 secs):
    15128721 packets          10256943282 bytes
    2 pkts/sec          13001 bytes/sec
    transmitted (in 776994.640 secs):
    15222455 packets          10134357062 bytes
    3 pkts/sec          13004 bytes/sec
          1 minute input rate 48 pkts/sec,  26530 bytes/sec
          1 minute output rate 45 pkts/sec,  24826 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 75 pkts/sec,  26323 bytes/sec
          5 minute output rate 73 pkts/sec,  24908 bytes/sec
          5 minute drop rate, 0 pkts/sec
    ------------------ show perfmon ------------------
    PERFMON STATS:                     Current      Average
    Xlates                                0/s          0/s
    Connections                           0/s          0/s
    TCP Conns                             0/s          0/s
    UDP Conns                             0/s          0/s
    URL Access                            0/s          0/s
    URL Server Req       

  • Cisco ASA 5505 Password Problem

    I recently ran into a telnet, console, and enable password issue that was unexpected and I am hoping someone can explain what happened. 
    I had two working Cisco ASA 5505's that were two end-points of a Site-to-Site VPN.  I had used the ASDM file management tools to copy disk0 startup-config.cfg to a file named old-startup-config.cfg on disk0, on both ASA systems, and I wanted those two files to function as good working startup-config backups that I could return to, right there on the firewall, if I had to.  I also used the ASDM file management tools to make configuration "zip" backups to my local computer.  I am aware that the actual startup-config file is some type of hidden file.
    I had made some changes to both Cisco ASA 5505s, but no password changes, and everything was working great and was reloading great.  Then, I suddenly found that I needed to revert back to the old working configurations that I had backed up previously.  I used the ASDM file management tools to copy old-startup-config.cfg back to startup-config.cfg on disk0 on both machines.  I think I may have also issued the CLI command copy old-startup-config.cfg startup-config.  I asked both systems to reload without writing the running-config's to memory.
    When the systems reloaded, the console, telnet, and enable passwords were no longer recognized on the CLI and Web interface.  The interfaces loaded normally, but the passwords didn't work and the cisco default passwords didn't work either.  I had to go to each unit's physical location and perform a power cycle and console password recovery.
    I am not sure why that happened.  Is the startup-config.cfg file on disk0 an altered version of the actual startup-config configuration with missing or encrypted password credentials?  I would have never guessed in a million years that my procedure would have knocked out the enable password.
    Instead of copy startup-config.cfg old-startup-config.cfg, should I have issued the command copy startup-config old-startup-config.cfg to make a local backup of a working configuration?
    I have one more semi-related question.  If one uses ASDM file management to create a zip backup of a startup-config or running-config and then proceeds to restore a running-config, when does the restored running-config take effect? 

    If password recovery is disabled then you are locked out hard. You have to sacrifice the config to "re-admin" the appliance. Sorry for the bad news but that's the way it is by design. If there was a "back door" it would hardly be a security appliance would it?

  • A possible bug related to the Cisco ASA "show access-list"?

    We encountered a strange problem in our ASA configuration.
    In the "show running-config":
    access-list inside_access_in remark CM000067 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:http_access
    access-list inside_access_in remark CM000458 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:https_access
    access-list inside_access_in remark test 11111111111111111111111111 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security
    access-list inside_access_in extended permit tcp host 1.1.1.1 host 192.168.20.86 eq 81 log
    access-list inside_access_in remark CM000260 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:netbios-dgm
    access-list inside_access_in remark CM006598 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:netbios-ns
    access-list inside_access_in remark CM000220 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:netbios-ssn
    access-list inside_access_in remark CM000223 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:tcp/445
    access-list inside_access_in extended permit tcp 172.31.254.0 255.255.255.0 any eq www log
    access-list inside_access_in extended permit tcp 172.31.254.0 255.255.255.0 any eq https log
    access-list inside_access_in extended permit udp 172.31.254.0 255.255.255.0 any eq netbios-dgm log
    access-list inside_access_in extended permit udp 172.31.254.0 255.255.255.0 any eq netbios-ns log
    access-list inside_access_in extended permit tcp 172.31.254.0 255.255.255.0 any eq netbios-ssn log
    access-list inside_access_in extended permit tcp 172.31.254.0 255.255.255.0 any eq 445 log
    access-list inside_access_in remark CM000280 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:domain
    access-list inside_access_in extended permit tcp object 172.31.254.2 any eq domain log
    access-list inside_access_in extended permit udp object 172.31.254.2 any eq domain log
    access-list inside_access_in remark CM000220 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:catch_all
    access-list inside_access_in extended permit ip object 172.31.254.2 any log
    access-list inside_access_in remark CM0000086 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:SSH_internal
    access-list inside_access_in extended permit tcp 172.31.254.0 255.255.255.0 interface inside eq ssh log
    access-list inside_access_in remark CM0000011 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:PortRange
    access-list inside_access_in extended permit object TCPPortRange 172.31.254.0 255.255.255.0 host 192.168.20.91 log
    access-list inside_access_in remark CM0000012 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:FTP
    access-list inside_access_in extended permit tcp object inside_range range 1024 45000 host 192.168.20.91 eq ftp log
    access-list inside_access_in remark CM0000088 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:PortRange
    access-list inside_access_in extended permit ip 192.168.20.0 255.255.255.0 any log
    access-list inside_access_in remark CM0000014 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:DropIP
    access-list inside_access_in extended permit ip object windowsusageVM any log
    access-list inside_access_in extended permit ip any object testCSM-object
    access-list inside_access_in extended permit ip 172.31.254.0 255.255.255.0 any log
    access-list inside_access_in remark CM0000065 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:IP
    access-list inside_access_in extended permit ip host 172.31.254.2 any log
    access-list inside_access_in remark CM0000658 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security
    access-list inside_access_in extended permit tcp host 192.168.20.95 any eq www log
    In the "show access-list":
    access-list inside_access_in line 1 remark CM000067 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:http_access
    access-list inside_access_in line 2 remark CM000458 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:https_access
    access-list inside_access_in line 3 remark test 11111111111111111111111111 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security
    access-list inside_access_in line 4 extended permit tcp host 1.1.1.1 host 192.168.20.86 eq 81 log informational interval 300 (hitcnt=0) 0x0a                                                           3bacc1
    access-list inside_access_in line 5 remark CM000260 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:netbios-dgm
    access-list inside_access_in line 6 remark CM006598 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:netbios-ns
    access-list inside_access_in line 7 remark CM000220 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:netbios-ssn
    access-list inside_access_in line 8 remark CM000223 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:tcp/445
    access-list inside_access_in line 9 extended permit tcp 172.31.254.0 255.255.255.0 any eq www log informational interval 300 (hitcnt=0) 0x06                                                           85254a
    access-list inside_access_in line 10 extended permit tcp 172.31.254.0 255.255.255.0 any eq https log informational interval 300 (hitcnt=0) 0                                                           x7e7ca5a7
    access-list inside_access_in line 11 extended permit udp 172.31.254.0 255.255.255.0 any eq netbios-dgm log informational interval 300 (hitcn                                                           t=0) 0x02a111af
    access-list inside_access_in line 12 extended permit udp 172.31.254.0 255.255.255.0 any eq netbios-ns log informational interval 300 (hitcnt                                                           =0) 0x19244261
    access-list inside_access_in line 13 extended permit tcp 172.31.254.0 255.255.255.0 any eq netbios-ssn log informational interval 300 (hitcn                                                           t=0) 0x0dbff051
    access-list inside_access_in line 14 extended permit tcp 172.31.254.0 255.255.255.0 any eq 445 log informational interval 300 (hitcnt=0) 0x7                                                           b798b0e
    access-list inside_access_in line 15 remark CM000280 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:domain
    access-list inside_access_in line 16 extended permit tcp object 172.31.254.2 any eq domain log informational interval 300 (hitcnt=0) 0x6c416                                                           81b
      access-list inside_access_in line 16 extended permit tcp host 172.31.254.2 any eq domain log informational interval 300 (hitcnt=0) 0x6c416                                                           81b
    access-list inside_access_in line 17 extended permit udp object 172.31.254.2 any eq domain log informational interval 300 (hitcnt=0) 0xc53bf                                                           227
      access-list inside_access_in line 17 extended permit udp host 172.31.254.2 any eq domain log informational interval 300 (hitcnt=0) 0xc53bf                                                           227
    access-list inside_access_in line 18 remark CM000220 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:catch_all
    access-list inside_access_in line 19 extended permit ip object 172.31.254.2 any log informational interval 300 (hitcnt=0) 0xd063707c
      access-list inside_access_in line 19 extended permit ip host 172.31.254.2 any log informational interval 300 (hitcnt=0) 0xd063707c
    access-list inside_access_in line 20 remark CM0000086 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:SSH_internal
    access-list inside_access_in line 21 extended permit tcp 172.31.254.0 255.255.255.0 interface inside eq ssh log informational interval 300 (hitcnt=0) 0x4951b794
    access-list inside_access_in line 22 remark CM0000011 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:PortRange
    access-list inside_access_in line 23 extended permit object TCPPortRange 172.31.254.0 255.255.255.0 host 192.168.20.91 log informational interval 300 (hitcnt=0) 0x441e6d68
      access-list inside_access_in line 23 extended permit tcp 172.31.254.0 255.255.255.0 host 192.168.20.91 range ftp smtp log informational interval 300 (hitcnt=0) 0x441e6d68
    access-list inside_access_in line 24 remark CM0000012 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:FTP
    access-list inside_access_in line 25 extended permit tcp object inside_range range 1024 45000 host 192.168.20.91 eq ftp log informational interval 300 0xe848acd5
      access-list inside_access_in line 25 extended permit tcp range 12.89.235.2 12.89.235.5 range 1024 45000 host 192.168.20.91 eq ftp log informational interval 300 (hitcnt=0) 0xe848acd5
    access-list inside_access_in line 26 extended permit ip 192.168.20.0 255.255.255.0 any log informational interval 300 (hitcnt=0) 0xb6c1be37
    access-list inside_access_in line 27 remark CM0000014 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:DropIP
    access-list inside_access_in line 28 extended permit ip object windowsusageVM any log informational interval 300 (hitcnt=0) 0x22170368
      access-list inside_access_in line 28 extended permit ip host 172.31.254.250 any log informational interval 300 (hitcnt=0) 0x22170368
    access-list inside_access_in line 29 extended permit ip any object testCSM-object (hitcnt=0) 0xa3fcb334
      access-list inside_access_in line 29 extended permit ip any host 255.255.255.255 (hitcnt=0) 0xa3fcb334
    access-list inside_access_in line 30 extended permit ip 172.31.254.0 255.255.255.0 any log informational interval 300 (hitcnt=0) 0xe361b6ed
    access-list inside_access_in line 31 remark CM0000065 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:IP
    access-list inside_access_in line 32 extended permit ip host 172.31.254.2 any log informational interval 300 (hitcnt=0) 0xed7670e1
    access-list inside_access_in line 33 remark CM0000658 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security
    access-list inside_access_in line 34 extended permit tcp host 192.168.20.95 any eq www log informational interval 300 (hitcnt=0) 0x8d07d70b
    There is a comment in the running config: (line 26)
    access-list inside_access_in remark CM0000088 EXP:1/16/2014 OWN:IT_Security BZU:Network_Security JST:PortRange
    This comment is missing in "show access-list". So in the access list, for all the lines after this comment, the line number is no longer correct. This causes problem when we try to use line number to insert a new rule.
    Has anybody seen this problem before? Is this a known problem? I am glad to provide more information if needed.
    Thanks in advance.
    show version:
    Cisco Adaptive Security Appliance Software Version 8.4(4)1
    Device Manager Version 7.1(3)
    Compiled on Thu 14-Jun-12 11:20 by builders
    System image file is "disk0:/asa844-1-k8.bin"
    Config file at boot was "startup-config"
    fmciscoasa up 1 hour 56 mins
    Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash M50FW016 @ 0xfff00000, 2048KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
                                 Number of accelerators: 1

    Could be related to the following bug:
    CSCtq12090: ACL remark line is missing when range object is configured in ACL
    Fixed in 8.4(6), so update to a newer version and observe it again.
    Don't stop after you've improved your network! Improve the world by lending money to the working poor:
    http://www.kiva.org/invitedby/karsteni

  • Internet Connection Became Slow after Introduction of Cisco ASA 5505 to the Network

    I configured a Cisco ASA 5505 (Version Cisco Adaptive Security Appliance Software Version 7.2(3)
    Device Manager Version 5.2(3)
    in transparent firewall mode and inserted after Cisco 1700 router. However, the internet connection became very slow and users are compaining that they cannot load any pages.
    My setup looks like:
    Internet --> Cisco 1700 --> Cisco ASA 5505 --> LAN
    The license information is:
    Licensed features for this platform:
    Maximum Physical Interfaces : 8
    VLANs                       : 3, DMZ Restricted
    Inside Hosts                : Unlimited
    Failover                    : Disabled
    VPN-DES                     : Enabled
    VPN-3DES-AES                : Enabled
    VPN Peers                   : 10
    WebVPN Peers                : 2
    Dual ISPs                   : Disabled
    VLAN Trunk Ports            : 0
    This platform has a Base license.
    The flash activation key is the SAME as the running key.
    My running-config looks like:
    ASA Version 7.2(3)
    firewall transparent
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password 8Ry2YjIyt7RRXU24 encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    no shut
    interface Vlan2
    nameif outside
    security-level 0
    no shut
    interface Ethernet0/0
    switchport access vlan 2
    no shut
    interface Ethernet0/1
    no shut
    interface Ethernet0/2
    no shut
    interface Ethernet0/3
    no shut
    interface Ethernet0/4
    no shut
    interface Ethernet0/5
    no shut
    interface Ethernet0/6
    no shut
    interface Ethernet0/7
    no shut
    passwd 2KFQnbNIdI.2KYOU encrypted
    regex urllist1 ".*\.([Ee][Xx][Ee]|[Cc][Oo][Mm]|[Bb][Aa][Tt]) HTTP/1.[01]"
    regex urllist2 ".*\.([Pp][Ii][Ff]|[Vv][Bb][Ss]|[Ww][Ss][Hh]) HTTP/1.[01]"
    regex urllist3 ".*\.([Dd][Oo][Cc]|[Xx][Ll][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]"
    regex urllist4 ".*\.([Zz][Ii][Pp]|[Tt][Aa][Rr]|[Tt][Gg][Zz]) HTTP/1.[01]"
    regex domainlist1 "\.facebook\.com"
    regex domainlist2 "\.diretube\.com"
    regex domainlist3 "\.youtube\.com"
    regex domainlist4 "\.vimeo\.com"
    regex applicationheader "application/.*"
    regex contenttype "Content-Type"
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_in extended permit ip any any
    access-list inside_mpc extended permit tcp any any eq www
    access-list inside_mpc extended permit tcp any any eq 8080
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address 192.168.1.254 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    access-group outside_in in interface outside
    route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    class-map type regex match-any DomainBlockList
    match regex domainlist1
    match regex domainlist2
    match regex domainlist3
    match regex domainlist4
    class-map type inspect http match-all BlockDomainsClass
    match request header host regex class DomainBlockList
    class-map type regex match-any URLBlockList
    match regex urllist1
    match regex urllist2
    match regex urllist3
    match regex urllist4
    class-map inspection_default
    match default-inspection-traffic
    class-map type inspect http match-all AppHeaderClass
    match response header regex contenttype regex applicationheader
    class-map httptraffic
    match access-list inside_mpc
    class-map type inspect http match-all BlockURLsClass
    match request uri regex class URLBlockList
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map type inspect http http_inspection_policy
    parameters
      protocol-violation action drop-connection
    class AppHeaderClass
      drop-connection log
    match request method connect
      drop-connection log
    class BlockDomainsClass
      reset log
    class BlockURLsClass
      reset log
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    policy-map inside-policy
    class httptraffic
      inspect http http_inspection_policy
    service-policy global_policy global
    service-policy inside-policy interface inside
    prompt hostname context
    Cryptochecksum:8ab1a53df6ae3c202aee236d6080edfd
    : end
    Could the slow internet connection be due to license limitations? Or is there something wrong with my configuration?
    Please see the configuration and help.
    Thanks

    I have re-configured the ASA 5505 yesterday and so far it's working fine. I am not sure if the problem will re-appear later on. Anyways here is my sh tech-support
    ciscoasa# sh tech-support
    Cisco Adaptive Security Appliance Software Version 7.2(3)
    Device Manager Version 5.2(3)
    Compiled on Wed 15-Aug-07 16:08 by builders
    System image file is "disk0:/asa723-k8.bin"
    Config file at boot was "startup-config"
    ciscoasa up 14 hours 16 mins
    Hardware:   ASA5505, 256 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash M50FW080 @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CNlite-MC-Boot-Cisco-1.2
                                 SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
    0: Int: Internal-Data0/0    : address is 001f.9ee8.ffa2, irq 11
    1: Ext: Ethernet0/0         : address is 001f.9ee8.ff9a, irq 255
    2: Ext: Ethernet0/1         : address is 001f.9ee8.ff9b, irq 255
    3: Ext: Ethernet0/2         : address is 001f.9ee8.ff9c, irq 255
    4: Ext: Ethernet0/3         : address is 001f.9ee8.ff9d, irq 255
    5: Ext: Ethernet0/4         : address is 001f.9ee8.ff9e, irq 255
    6: Ext: Ethernet0/5         : address is 001f.9ee8.ff9f, irq 255
    <--- More --->
    7: Ext: Ethernet0/6         : address is 001f.9ee8.ffa0, irq 255
    8: Ext: Ethernet0/7         : address is 001f.9ee8.ffa1, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces : 8        
    VLANs                       : 3, DMZ Restricted
    Inside Hosts                : Unlimited
    Failover                    : Disabled
    VPN-DES                     : Enabled  
    VPN-3DES-AES                : Enabled  
    VPN Peers                   : 10       
    WebVPN Peers                : 2        
    Dual ISPs                   : Disabled 
    VLAN Trunk Ports            : 0        
    This platform has a Base license.
    Serial Number: JMX1211Z2N4
    Running Activation Key: 0xaf0ed046 0xbcf18ebf 0x80b38508 0xba785cc0 0x05250493
    Configuration register is 0x1
    Configuration has not been modified since last system restart.
    <--- More --->
    ------------------ show clock ------------------
    18:32:58.254 UTC Tue Nov 26 2013
    ------------------ show memory ------------------
    Free memory:       199837144 bytes (74%)
    Used memory:        68598312 bytes (26%)
    Total memory:      268435456 bytes (100%)
    ------------------ show conn count ------------------
    1041 in use, 2469 most used
    ------------------ show xlate count ------------------
    0 in use, 0 most used
    ------------------ show blocks ------------------
      SIZE    MAX    LOW    CNT
         0    100     68    100
    <--- More --->
         4    300    299    299
        80    100     92    100
       256    100     94    100
      1550   6174   6166   6174
      2048   1124    551    612
    ------------------ show blocks queue history detail ------------------
    History buffer memory usage: 2136 bytes (default)
    ------------------ show interface ------------------
    Interface Internal-Data0/0 "", is up, line protocol is up
      Hardware is y88acs06, BW 1000 Mbps
    (Full-duplex), (1000 Mbps)
    MAC address 001f.9ee8.ffa2, MTU not set
    IP address unassigned
    18491855 packets input, 11769262614 bytes, 0 no buffer
    Received 213772 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops, 0 demux drops
    18185861 packets output, 11626494317 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    <--- More --->
    0 input reset drops, 0 output reset drops
    input queue (curr/max packets): hardware (0/0) software (0/0)
    output queue (curr/max packets): hardware (0/55) software (0/0)
      Control Point Interface States:
    Interface number is unassigned
    Interface Internal-Data0/1 "", is administratively down, line protocol is up
      Hardware is 88E6095, BW 1000 Mbps
    (Full-duplex), (1000 Mbps)
    MAC address 0000.0003.0002, MTU not set
    IP address unassigned
    18184216 packets input, 11625360131 bytes, 0 no buffer
    Received 206655 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 switch ingress policy drops
    18490057 packets output, 11768078777 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Loopback0 "_internal_loopback", is up, line protocol is up
      Hardware is VirtualMAC address 0000.0000.0000, MTU 1500
    IP address 127.1.0.1, subnet mask 255.255.0.0
    <--- More --->
      Traffic Statistics for "_internal_loopback":
    1 packets input, 28 bytes
    1 packets output, 28 bytes
    1 packets dropped
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
    Interface number is 28
    Interface config status is active
    Interface state is active
    Interface Vlan1 "inside", is up, line protocol is up
      Hardware is EtherSVI
    MAC address 001f.9ee8.ffa2, MTU 1500
    IP address 192.168.1.254, subnet mask 255.255.255.0
      Traffic Statistics for "inside":
    7742275 packets input, 903584114 bytes
    10645034 packets output, 10347291114 bytes
    184883 packets dropped
          1 minute input rate 320 pkts/sec,  35404 bytes/sec
          1 minute output rate 325 pkts/sec,  313317 bytes/sec
    <--- More --->
          1 minute drop rate, 17 pkts/sec
          5 minute input rate 399 pkts/sec,  59676 bytes/sec
          5 minute output rate 483 pkts/sec,  503200 bytes/sec
          5 minute drop rate, 9 pkts/sec
      Control Point Interface States:
    Interface number is 1
    Interface config status is active
    Interface state is active
    Interface Vlan2 "outside", is up, line protocol is up
      Hardware is EtherSVI
    MAC address 001f.9ee8.ffa3, MTU 1500
    IP address 192.168.1.254, subnet mask 255.255.255.0
      Traffic Statistics for "outside":
    10750090 packets input, 10432619059 bytes
    7541331 packets output, 870613684 bytes
    109911 packets dropped
          1 minute input rate 328 pkts/sec,  313770 bytes/sec
          1 minute output rate 301 pkts/sec,  32459 bytes/sec
          1 minute drop rate, 2 pkts/sec
          5 minute input rate 485 pkts/sec,  503789 bytes/sec
          5 minute output rate 387 pkts/sec,  57681 bytes/sec
          5 minute drop rate, 2 pkts/sec
      Control Point Interface States:
    Interface number is 2
    <--- More --->
    Interface config status is active
    Interface state is active
    Interface Ethernet0/0 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9a, MTU not set
    IP address unassigned
    10749794 packets input, 10630700889 bytes, 0 no buffer
    Received 2506 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    3 switch ingress policy drops
    7541070 packets output, 1028190148 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    <--- More --->
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9b, MTU not set
    IP address unassigned
    7741977 packets input, 1064586806 bytes, 0 no buffer
    Received 211282 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    10644663 packets output, 10543362751 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/2 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9c, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    <--- More --->
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/3 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9d, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    <--- More --->
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/4 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9e, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    <--- More --->
    Interface number is unassigned
    Interface Ethernet0/5 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9f, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/6 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    <--- More --->
    MAC address 001f.9ee8.ffa0, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/7 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ffa1, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    <--- More --->
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    ------------------ show cpu usage ------------------
    CPU utilization for 5 seconds = 12%; 1 minute: 11%; 5 minutes: 11%
    ------------------ show cpu hogging process ------------------
    Process:      Dispatch Unit, NUMHOG: 1, MAXHOG: 133, LASTHOG: 140
    LASTHOG At:   04:45:59 UTC Nov 26 2013
    PC:           8be0f7
    Traceback:    8bed19  8bf553  302b87  3030a5  2fad69  7674bf  75ca16
                  c6251d  c62a4c  c62f6c  75c653  767820  797f64  769c85
    <--- More --->
    ------------------ show process ------------------
        PC       SP       STATE       Runtime    SBASE     Stack Process
    Mwe 00c9bb24 01bb8700 013e3250          0 01733fc8 15616/16384 emweb/cifs
    Lwe 001072ac 0176f9c4 013e32d0          0 0176d9f0 8132/8192 block_diag
    Mrd 00223a67 01783d5c 013e33b0     314854 0177be18 25752/32768 Dispatch Unit
    Msi 00f82847 01b07b84 013e3250        229 01b05bc0 7984/8192 y88acs06 OneSec Thread
    Mwe 0011b1a5 01b09cfc 013e3250          0 01b07d88 7864/8192 Reload Control Thread
    Mwe 00120606 01b1260c 013e5258          0 01b10988 7256/8192 aaa
    Mwe 001486aa 01b19404 013e5ae8          0 01b15450 16020/16384 CMGR Server Process
    Mwe 0014c3c5 01b1b4d4 013e3250          0 01b19570 7968/8192 CMGR Timer Process
    Lwe 002227a1 01b239b4 013ee360          0 01b219f0 7524/8192 dbgtrace
    Mwe 004e1ba5 01b29c34 013e3250        157 01b27d50 6436/8192 eswilp_svi_init
    Mwe 01064b1d 01b4a7f4 013e3250          0 01b48890 7848/8192 Chunk Manager
    Msi 008b61b6 01b52d54 013e3250        230 01b50da0 7856/8192 PIX Garbage Collector
    Lsi 00ecb6ac 01b54e94 013e3250         12 01b52ec0 7552/8192 route_process
    Mwe 008a5ddc 01b5dc04 0133b430          0 01b5bc40 8116/8192 IP Address Assign
    Mwe 00acb779 01b60604 01346e10          0 01b5e640 8116/8192 QoS Support Module
    Mwe 0091eba9 01b6275c 0133c530          0 01b60798 8116/8192 Client Update Task
    Lwe 01083c8e 01b656d4 013e3250     123088 01b63770 7840/8192 Checkheaps
    Mwe 00acfd7d 01b6b824 013e3250        623 01b69ad0 3476/8192 Quack process
    Mwe 00b2a260 01b6dad4 013e3250         22 01b6bbf0 7364/8192 Session Manager
    Mwe 00c55efd 01b78564 031d0478          4 01b74a50 14768/16384 uauth
    <--- More --->
    Mwe 00be3c9e 01b7aaec 0135c010          0 01b78b28 7524/8192 Uauth_Proxy
    Mwe 00c52759 01b80e0c 01361770          0 01b7ee88 7712/8192 SMTP
    Mwe 00c3f7b9 01b82eec 01361710          0 01b80fa8 7412/8192 Logger
    Mwe 00c3fd26 01b8502c 013e3250          0 01b830c8 7492/8192 Thread Logger
    Mwe 00f62272 01b9596c 013ac520          0 01b939c8 7188/8192 vpnlb_thread
    Msi 00b4097c 01c598c4 013e3250        190 01c578f0 8000/8192 emweb/cifs_timer
    Msi 005bd338 017a909c 013e3250      25855 017a7108 7412/8192 arp_timer
    Mwe 005c76bc 01b486e4 013fba50      20643 01b46770 7348/8192 arp_forward_thread
    Mwe 00c5a919 023fa5fc 013619e0          0 023f8648 7968/8192 tcp_fast
    Mwe 00c5a6e5 023fc624 013619e0          0 023fa670 7968/8192 tcp_slow
    Mwe 00c754d1 0240d42c 013628a0          0 0240b478 8100/8192 udp_timer
    Mwe 0019cb17 01b404a4 013e3250          0 01b3e530 7984/8192 CTCP Timer process
    Mwe 00efe8b3 0308c15c 013e3250          0 0308a208 7952/8192 L2TP data daemon
    Mwe 00efef23 0308e194 013e3250          0 0308c230 7968/8192 L2TP mgmt daemon
    Mwe 00eea02b 030c62ac 013a5c10         43 030c2338 16244/16384 ppp_timer_thread
    Msi 00f62d57 030c82f4 013e3250        264 030c6360 7924/8192 vpnlb_timer_thread
    Mwe 001b96e6 01b7cbbc 01b1e9c8          1 01b7ac48 7728/8192 IPsec message handler
    Msi 001c9bac 01b8d4dc 013e3250       2917 01b8b548 7648/8192 CTM message handler
    Mwe 00af93b8 031465b4 013e3250          0 03144640 7984/8192 ICMP event handler
    Mwe 00831003 0314a724 013e3250        387 031467b0 16100/16384 IP Background
    Mwe 0021b267 031a83c4 013123c0         31 03188450 123488/131072 tmatch compile thread
    Mwe 009f2405 03290044 013e3250          0 0328c0c0 16072/16384 Crypto PKI RECV
    Mwe 009f305a 03294144 013e3250          0 032901e0 16040/16384 Crypto CA
    Mwe 0064d4fd 01b3e24c 013e3250          8 01b3c2f8 7508/8192 ESW_MRVL switch interrupt service
    <--- More --->
    Msi 00646f5c 032c134c 013e3250    3059378 032bf448 7184/8192 esw_stats
    Lsi 008cbb80 032dc704 013e3250          3 032da730 7908/8192 uauth_urlb clean
    Lwe 008afee7 034a0914 013e3250        197 0349e9b0 6636/8192 pm_timer_thread
    Mwe 0052f0bf 034a35ac 013e3250          0 034a1648 7968/8192 IKE Timekeeper
    Mwe 00520f6b 034a8adc 0132e2b0          0 034a4e38 15448/16384 IKE Daemon
    Mwe 00bf5c78 034ac7ac 01360680          0 034aa7f8 8100/8192 RADIUS Proxy Event Daemon
    Mwe 00bc32de 034ae79c 034dcbe0          0 034ac918 7208/8192 RADIUS Proxy Listener
    Mwe 00bf5e0f 034b099c 013e3250          0 034aea38 7968/8192 RADIUS Proxy Time Keeper
    Mwe 005aac4c 034b3154 013fb980          0 034b1250 7492/8192 Integrity FW Task
    M*  008550a5 0009fefc 013e33b0       3183 034e3b20 24896/32768 ci/console
    Msi 008eb694 034ed9d4 013e3250       2370 034ebc40 6176/8192 update_cpu_usage
    Msi 008e6415 034f7dac 013e3250       1096 034f5eb8 6124/8192 NIC status poll
    Mwe 005b63e6 03517d1c 013fbd10       1963 03515d78 7636/8192 IP Thread
    Mwe 005becbe 03519e4c 013fbcb0          3 03517e98 7384/8192 ARP Thread
    Mwe 004c2b36 0351befc 013fbae0          0 03519fe8 7864/8192 icmp_thread
    Mwe 00c7722e 0351e06c 013e3250          0 0351c108 7848/8192 udp_thread
    Mwe 00c5d126 0352008c 013fbd00          0 0351e228 7688/8192 tcp_thread
    Mwe 00bc32de 03a6982c 03a5ee18          0 03a679b8 7512/8192 EAPoUDP-sock
    Mwe 00266c15 03a6b614 013e3250          0 03a699e0 7032/8192 EAPoUDP
    Mwe 005a6728 01b27b94 013e3250          0 01b25c30 7968/8192 Integrity Fw Timer Thread
    -     -        -         -      47686621    -         -     scheduler
    -     -        -         -      51253819    -         -     total elapsed
    ------------------ show failover ------------------
    <--- More --->
    ERROR: Command requires failover license
    ------------------ show traffic ------------------
    inside:
    received (in 51429.740 secs):
    7749585 packets905087345 bytes
    67 pkts/sec17013 bytes/sec
    transmitted (in 51429.740 secs):
    10653162 packets10355908020 bytes
    40 pkts/sec201026 bytes/sec
          1 minute input rate 412 pkts/sec,  51803 bytes/sec
          1 minute output rate 475 pkts/sec,  522952 bytes/sec
          1 minute drop rate, 24 pkts/sec
          5 minute input rate 399 pkts/sec,  59676 bytes/sec
          5 minute output rate 483 pkts/sec,  503200 bytes/sec
          5 minute drop rate, 9 pkts/sec
    outside:
    received (in 51430.240 secs):
    10758403 packets10441440193 bytes
    42 pkts/sec203021 bytes/sec
    transmitted (in 51430.240 secs):
    7548339 packets872053854 bytes
    <--- More --->
    63 pkts/sec16037 bytes/sec
          1 minute input rate 479 pkts/sec,  523680 bytes/sec
          1 minute output rate 387 pkts/sec,  46796 bytes/sec
          1 minute drop rate, 3 pkts/sec
          5 minute input rate 485 pkts/sec,  503789 bytes/sec
          5 minute output rate 387 pkts/sec,  57681 bytes/sec
          5 minute drop rate, 2 pkts/sec
    _internal_loopback:
    received (in 51430.740 secs):
    1 packets28 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51430.740 secs):
    1 packets28 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Aggregated Traffic on Physical Interface
    <--- More --->
    Ethernet0/0:
    received (in 51431.740 secs):
    10758462 packets10640075825 bytes
    42 pkts/sec206042 bytes/sec
    transmitted (in 51431.740 secs):
    7548383 packets1029818127 bytes
    63 pkts/sec20023 bytes/sec
          1 minute input rate 485 pkts/sec,  537048 bytes/sec
          1 minute output rate 395 pkts/sec,  54546 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 485 pkts/sec,  511723 bytes/sec
          5 minute output rate 387 pkts/sec,  65495 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/1:
    received (in 51433.570 secs):
    7749780 packets1066328930 bytes
    67 pkts/sec20064 bytes/sec
    transmitted (in 51433.570 secs):
    10653359 packets10552787020 bytes
    40 pkts/sec205006 bytes/sec
          1 minute input rate 419 pkts/sec,  59621 bytes/sec
          1 minute output rate 480 pkts/sec,  533950 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 399 pkts/sec,  67618 bytes/sec
    <--- More --->
          5 minute output rate 482 pkts/sec,  511073 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/2:
    received (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/3:
    received (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
    <--- More --->
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/4:
    received (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/5:
    received (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    <--- More --->
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/6:
    received (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/7:
    received (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51435.010 secs):
    <--- More --->
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/0:
    received (in 51435.510 secs):
    18513901 packets11784250044 bytes
    25 pkts/sec229023 bytes/sec
    transmitted (in 51435.510 secs):
    18207269 packets11641332179 bytes
    19 pkts/sec226078 bytes/sec
          1 minute input rate 891 pkts/sec,  595715 bytes/sec
          1 minute output rate 863 pkts/sec,  588935 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 885 pkts/sec,  584035 bytes/sec
          5 minute output rate 870 pkts/sec,  580393 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/1:
    received (in 51436.010 secs):
    18207323 packets11641364184 bytes
    <--- More --->
    19 pkts/sec226076 bytes/sec
    transmitted (in 51436.010 secs):
    18513954 packets11784281987 bytes
    25 pkts/sec229022 bytes/sec
          1 minute input rate 855 pkts/sec,  575808 bytes/sec
          1 minute output rate 884 pkts/sec,  582339 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 869 pkts/sec,  578350 bytes/sec
          5 minute output rate 883 pkts/sec,  581924 bytes/sec
          5 minute drop rate, 0 pkts/sec
    ------------------ show perfmon ------------------
    PERFMON STATS:    Current      Average
    Xlates               0/s          0/s
    Connections         17/s          6/s
    TCP Conns            8/s          2/s
    UDP Conns            7/s          2/s
    URL Access           0/s          0/s
    URL Server Req       0/s          0/s
    TCP Fixup            0/s          0/s
    TCP Intercept        0/s          0/s
    HTTP Fixup           0/s          0/s
    <--- More --->
    FTP Fixup            0/s          0/s
    AAA Authen           0/s          0/s
    AAA Author           0/s          0/s
    AAA Account          0/s          0/s
    ------------------ show counters ------------------
    Protocol     Counter                     Value   Context
    IP           IN_PKTS                  168960   Summary
    IP           OUT_PKTS                 169304   Summary
    IP           TO_ARP                       61   Summary
    ------------------ show history ------------------
    ------------------ show firewall ------------------
    Firewall mode: Transparent
    ------------------ show running-config ------------------
    <--- More --->
    : Saved
    ASA Version 7.2(3)
    firewall transparent
    hostname ciscoasa
    enable password
    names
    interface Vlan1
    nameif inside
    security-level 100
    interface Vlan2
    nameif outside
    security-level 0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    <--- More --->
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd
    regex domain1 ".facebook\.com"
    regex domain2 ".fb\.com"
    regex domain3 ".youtube\.com"
    ftp mode passive
    access-list ACL_IN extended permit ip any any
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    ip address 192.168.1.254 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    <--- More --->
    arp timeout 14400
    access-group ACL_IN in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    class-map type regex match-any DomainBlockList
    match regex domain1
    match regex domain2
    match regex domain3
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    <--- More --->
      message-length maximum 512
    match domain-name regex class DomainBlockList
      drop-connection log
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:bb5115ea1d14ee42e7961ef0c9aaed86
    : end
    <--- More --->
    ------------------ show startup-config errors ------------------
    INFO: No configuration errors
    ------------------ console logs ------------------
    Message #1 : Message #2 : Message #3 : Message #4 : Message #5 : Message #6 : Message #7 : Message #8 : Message #9 : Message #10 : Message #11 : Message #12 : Message #13 : Message #14 :
    Total SSMs found: 0
    Message #15 :
    Total NICs found: 10
    Message #16 : 88E6095 rev 2 Gigabit Ethernet @ index 09Message #17 :  MAC: 0000.0003.0002
    Message #18 : 88E6095 rev 2 Ethernet @ index 08Message #19 :  MAC: 001f.9ee8.ffa1
    Message #20 : 88E6095 rev 2 Ethernet @ index 07Message #21 :  MAC: 001f.9ee8.ffa0
    Message #22 : 88E6095 rev 2 Ethernet @ index 06Message #23 :  MAC: 001f.9ee8.ff9f
    Message #24 : 88E6095 rev 2 Ethernet @ index 05Message #25 :  MAC: 001f.9ee8.ff9e
    Message #26 : 88E6095 rev 2 Ethernet @ index 04Message #27 :  MAC: 001f.9ee8.ff9d
    Message #28 : 88E6095 rev 2 Ethernet @ index 03Message #29 :  MAC: 001f.9ee8.ff9c
    Message #30 : 88E6095 rev 2 Ethernet @ index 02Message #31 :  MAC: 001f.9ee8.ff9b
    Message #32 : 88E6095 rev 2 Ethernet @ index 01Message #33 :  MAC: 001f.9ee8.ff9a
    Message #34 : y88acs06 rev16 Gigabit Ethernet @ index 00 MAC: 001f.9ee8.ffa2
    Message #35 :
    Licensed features for this platform:
    Message #36 : Maximum Physical Interfaces : 8        
    <--- More --->
    Message #37 : VLANs                       : 3, DMZ Restricted
    Message #38 : Inside Hosts                : Unlimited
    Message #39 : Failover                    : Disabled
    Message #40 : VPN-DES                     : Enabled  
    Message #41 : VPN-3DES-AES                : Enabled  
    Message #42 : VPN Peers                   : 10       
    Message #43 : WebVPN Peers                : 2        
    Message #44 : Dual ISPs                   : Disabled 
    Message #45 : VLAN Trunk Ports            : 0        
    Message #46 :
    This platform has a Base license.
    Message #47 :
    Message #48 : Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
    Message #49 :                              Boot microcode   : CNlite-MC-Boot-Cisco-1.2
    Message #50 :                              SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
    Message #51 :                              IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
    Message #52 :   --------------------------------------------------------------------------
    Message #53 :                                  .            .                            
    Message #54 :                                  |            |                            
    Message #55 :                                 |||          |||                           
    Message #56 :                               .|| ||.      .|| ||.                         
    Message #57 :                            .:||| | |||:..:||| | |||:.                      
    Message #58 :                             C i s c o  S y s t e m s                       
    Message #59 :   --------------------------------------------------------------------------
    <--- More --->
    Message #60 :
    Cisco Adaptive Security Appliance Software Version 7.2(3)
    Message #61 :
    Message #62 :   ****************************** Warning *******************************
    Message #63 :   This product contains cryptographic features and is
    Message #64 :   subject to United States and local country laws
    Message #65 :   governing, import, export, transfer, and use.
    Message #66 :   Delivery of Cisco cryptographic products does not
    Message #67 :   imply third-party authority to import, export,
    Message #68 :   distribute, or use encryption. Importers, exporters,
    Message #69 :   distributors and users are responsible for compliance
    Message #70 :   with U.S. and local country laws. By using this
    Message #71 :   product you agree to comply with applicable laws and
    Message #72 :   regulations. If you are unable to comply with U.S.
    Message #73 :   and local laws, return the enclosed items immediately.
    Message #74 :
    Message #75 :   A summary of U.S. laws governing Cisco cryptographic
    Message #76 :   products may be found at:
    Message #77 :   http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    Message #78 :
    Message #79 :   If you require further assistance please contact us by
    Message #80 :   sending email to [email protected].
    Message #81 :   ******************************* Warning *******************************
    Message #82 :
    <--- More --->
    Message #83 : Copyright (c) 1996-2007 by Cisco Systems, Inc.
    Message #84 :                 Restricted Rights Legend
    Message #85 : Use, duplication, or disclosure by the Government is
    Message #86 : subject to restrictions as set forth in subparagraph
    Message #87 : (c) of the Commercial Computer Software - Restricted
    Message #88 : Rights clause at FAR sec. 52.227-19 and subparagraph
    Message #89 : (c) (1) (ii) of the Rights in Technical Data and Computer
    Message #90 : Software clause at DFARS sec. 252.227-7013.
    Message #91 :                 Cisco Systems, Inc.
    Message #92 :                 170 West Tasman Drive
    Message #93 :                 San Jose, California 95134-1706
    ciscoasa#   

  • Setting up site to site vpn with cisco asa 5505

    I have a cisco asa 5505 that needs to be set up for site to site vpn to a cisco asa 5500. The 5505 is the remote office and the 5500 is the main office.
    IP of remote office router is 71.37.178.142
    IP of the main office firewall is 209.117.141.82
    Can someone tell me if my config is correct, this is the first time I am setting this up and it can not be tested until I set it up at the remote office. I would rather know its correct before I go.
    ciscoasa# show run
    : Saved
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password TMACBloMlcBsq1kp encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip host 71.37.178.142 host 209.117.141.82
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group5
    crypto map outside_map 1 set peer 209.117.141.82
    crypto map outside_map 1 set transform-set ESP-AES-256-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn username [email protected] password ********* store-local
    dhcpd auto_config outside
    dhcpd address 192.168.1.2-192.168.1.129 inside
    dhcpd enable inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:7e338fb2bf32a9ceb89560b314a5ef6c
    : end
    ciscoasa#
    Thanks!

    Hi Mandy,
    By using following access list define Peer IP as source and destination
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    you are not defining the interesting traffic / subnets from both ends.
    Make some number ACL 101 as you do not have to write the extended keyword then if you like as follows, or else NAME aCL will also work:
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=4 access-list 101 remark IPSEC Rule
    !.1..source subnet(called local encryption domain) at your end  192.168.200.0
    !..2.and destination subnet(called remote encryption domain)at other end 192.168.100.0 !.3..I mean you have to define what subnets you need to communicate between which are behind these firewalls
    !..4...Local Subnets behind IP of the main office firewall is 209.117.141.82 say
    !...at your end  192.168.200.0
    !..5.Remote Subnets behind IP of remote office router is 71.37.178.142 say
    !...at other end 192.168.100.0
    Please use Baisc Steps as follows:
    A. Configuration in your MAIN office  having IP = 209.117.141.82  (follow step 1 to 6)
    Step 1.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    Step 2.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 3.
    Define Preshared key or PKI which you will use with other side Peer address 71.37.178.142, either key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 2 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 71.37.178.142
    or , but not both
    crypto isakmp key 6 CISCO123 address71.37.178.142
    step 4.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 5.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 6.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Configure the same but just change ACL on other end in step one  by reversing source and destination
    and also set the peer IP of this router in other end.
    So other side config should look as follows:
    B.  Configuration in oyur Remote PEER IP having IP = 71.37.178.142 (follow step 7 to 12)
    Step 7.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
    Step 8.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 9.
    Define Preshared key or PKI which you will use with other side Peer address key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 8 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 209.117.141.82
    or , but not both
    crypto isakmp key 6 CISCO123 address 209.117.141.82
    step 10.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 11.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map    ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set, only one is permissible
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 12.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Now initite a ping
    Here is for your summary:
    IPSec: Site to Site - Routers
    Configuration Steps
    Phase 1
    Step 1: Configure Mirrored ACL/Crypto ACL       for Interesting Traffic
    Step 2: Configure ISAKMP Policy
    Step 3: Configure ISAKMP Key
    Phase 2
    Step 4: Configure Transform Set
    Step 5: Configure Crypto Map
    Step 6: Apply Crypto Map to an Interface
    To debug for Phase 1 and Phase 2. Store it in buffer without displaying logs on terminal.
    Router#debug crpyto isakmp
    Router#debug crpyto ipsec
    Router(config)# logging buffer 7
    Router(config)# logging buffer 99999
    Router(config)# logging console 6
    Router# clear logging
    Configuration
    In R1:
    (config)# access-list 101 permit ipo host 10.1.1.1 host      10.1.2.1
    (config)# crypto isakmp policy 10
    (config-policy)# encryption 3des
    (config-policy)# authentication pre-share
    (config-policy)# group 2
    (config-policy)# hash sha1
    (config)# crypto isakmp key 0 cisco address 2.2.2.1
    (config)# crypto ipsec transform-set TSET esp-3des      sha-aes-hmac
    (config)# crypto map CMAP 10 ipsec-isakmp
    (config-crypto-map)# set peer 2.2.2.1
    (config-crypto-map)# match address 101
    (config-crypto-map)# set transform-set TSET
    (config)# int f0/0
    (config-if)# crypto map CMAP
    Similarly in R2
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Change to Transport Mode, add the following command in Step 4:
    (config-tranform-set)# mode transport
    Even after  doing this change, the ipsec negotiation will still be done through  tunnel mode if pinged from Loopback to Loopback. To overcome this we  make changes to ACL.
    Change to Aggressive Mode, replace the Step 3 command with these commands in R1:
    (config)# crypto isakmp peer address 2.2.2.1
    (config-peer)# set aggressive-mode password cisco
    (config-peer)# set aggressive-mode clien-endpoint       ipv4-address 2.2.2.1
    Similarly on R2.
    The below process is for the negotiation using RSA-SIG (PKI) as authentication type
    Debug Process:
    After  we debug, we can see the negotiation between the two peers. The first  packet of the interesting traffic triggers the ISAKMP (Phase1)  negotiation. Important messages are marked in BOLD and explanation in  RED
    R2(config)#do ping 10.1.1.1 so lo0 // Interesting Traffic
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
    Packet sent with a source address of 2.2.2.2
    Mar  2 16:18:42.939: ISAKMP:(0): SA request profile is (NULL) //  Router tried to find any IPSec SA matching the outgoing connection but  no valid SA has been found in Security Association Database (SADB)
    Mar  2 16:18:42.939: ISAKMP: Created a peer struct for 20.1.1.10, peer port 500
    Mar  2 16:18:42.939: ISAKMP: New peer created peer = 0x46519678 peer_handle = 0x8000000D
    Mar  2 16:18:42.939: ISAKMP: Locking peer struct 0x46519678, refcount 1 for isakmp_initiator
    Mar  2 16:18:42.939: ISAKMP: local port 500, remote port 500
    Mar  2 16:18:42.939: ISAKMP: set new node 0 to QM_IDLE    
    Mar  2 16:18:42.939: ISAKMP:(0):insert sa successfully sa = 4542B818
    Mar  2 16:18:42.939: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. // Not an error. By default it is configured for Main Mode
    Mar  2 16:18:42.939: ISAKMP:(0):No pre-shared key with 20.1.1.10! // Since we are using RSA Signature, this message. If we use pre-share, this is where it would indicate so!
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-07 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-03 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-02 ID
    Mar  2 16:18:42.939: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    Mar  2 16:18:42.939: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    Mar  2 16:18:42.943: ISAKMP:(0): beginning Main Mode exchange
    Mar  2 16:18:42.943: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.943: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.943: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.947: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.947: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    Mar  2 16:18:42.947: ISAKMP:(0): processing SA payload. message ID = 0
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch // Do not worry about this! Not an ERROR!
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947:.!!!!
    Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
    R2(config)# ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.947: ISAKMP : Scanning profiles for xauth ...
    Mar  2 16:18:42.947: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    Mar  2 16:18:42.947: ISAKMP:      encryption 3DES-CBC
    Mar  2 16:18:42.947: ISAKMP:      hash SHA
    Mar  2 16:18:42.947: ISAKMP:      default group 2
    Mar  2 16:18:42.947: ISAKMP:      auth RSA sig
    Mar  2 16:18:42.947: ISAKMP:      life type in seconds
    Mar  2 16:18:42.947: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    Mar  2 16:18:42.947: ISAKMP:(0):atts are acceptable. Next payload is 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:actual life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa vpi_length:4
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    Mar  2 16:18:42.947: ISAKMP:(0):Returning Actual lifetime: 86400
    Mar  2 16:18:42.947: ISAKMP:(0)::Started lifetime timer: 86400.
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    Mar  2 16:18:42.951: ISAKMP (0): constructing CERT_REQ for issuer cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:42.951: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_SA_SETUP // Sending Key Exchange Information to peer
    Mar  2 16:18:42.951: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    Mar  2 16:18:42.955: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_SA_SETUP // Receive key exchange information from peer
    Mar  2 16:18:42.955: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.955: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    Mar  2 16:18:42.959: ISAKMP:(0): processing KE payload. message ID = 0
    Mar  2 16:18:43.003: ISAKMP:(0): processing NONCE payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): processing CERT_REQ payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants cert issued by cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:43.007:  Choosing trustpoint CA_Server as issuer
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is Unity
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID seems Unity/DPD but major 180 mismatch
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is XAUTH
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): speaking to another IOS box!
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008):vendor ID seems Unity/DPD but hash mismatch
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): His hash no match - this node outside NAT
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): No NAT Found for self or peer
    Mar  2 16:18:43.007: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.007: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM4
    Mar  2 16:18:43.011: ISAKMP:(1008):Send initial contact
    Mar  2 16:18:43.011: ISAKMP:(1008):My ID configured as IPv4 Addr, but Addr not in Cert!
    Mar  2 16:18:43.011: ISAKMP:(1008):Using FQDN as My ID
    Mar  2 16:18:43.011: ISAKMP:(1008):SA is doing RSA signature authentication using id type ID_FQDN
    Mar  2 16:18:43.011: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : R2
              protocol     : 17
              port         : 500
              length       : 10
    Mar  2 16:18:43.011: ISAKMP:(1008):Total payload length: 10
    Mar  2 16:18:43.019: ISAKMP (1008): constructing CERT payload for hostname=R2+serialNumber=FHK1502F2H8
    Mar  2 16:18:43.019: ISAKMP:(1008): using the CA_Server trustpoint's keypair to sign
    Mar  2 16:18:43.035: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Mar  2 16:18:43.035: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.035: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.035: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM5
    Mar  2 16:18:43.047: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_KEY_EXCH
    // "MM_KEY_EXCH" indicates that the peers have exchanged DH Public keys and generated a shared secret!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing ID payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : ASA1
              protocol     : 0
              port         : 0
              length       : 12
    Mar  2 16:18:43.047: ISAKMP:(0):: peer matches *none* of the profiles // Normal Message! Not an error!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing CERT payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP:(1008): processing a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.051: ISAKMP:(1008): peer's pubkey isn't cached
    Mar  2 16:18:43.059: ISAKMP:(1008): Unable to get DN from certificate!
    Mar  2 16:18:43.059: ISAKMP:(1008): Cert presented by peer contains no OU field.
    Mar  2 16:18:43.059: ISAKMP:(0):: peer matches *none* of the profiles
    Mar  2 16:18:43.063: ISAKMP:(1008): processing SIG payload. message ID = 0
    Mar  2 16:18:43.067: ISAKMP:received payload type 17
    Mar  2 16:18:43.067: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.067: ISAKMP:(1008): vendor ID is DPD
    Mar  2 16:18:43.067: ISAKMP:(1008):SA authentication status:
              authenticated
    Mar  2 16:18:43.067: ISAKMP:(1008):SA has been authenticated with 20.1.1.10
    Mar  2 16:18:43.067: ISAKMP: Trying to insert a peer 40.1.1.1/20.1.1.10/500/,  and inserted successfully 46519678. // SA inserted into SADB
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM5  New State = IKE_I_MM6
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_I_MM6
    Mar  2 16:18:43.071: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):beginning Quick Mode exchange, M-ID of -1523793378
    Mar  2 16:18:43.071: ISAKMP:(1008):QM Initiator gets spi
    Mar  2 16:18:43.075: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.075: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.075: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
    Mar  2 16:18:43.075: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.079: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) QM_IDLE // IPSec Policies
    Mar  2 16:18:43.079: ISAKMP:(1008): processing HASH payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing SA payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008):Checking IPSec proposal 1
    Mar  2 16:18:43.079: ISAKMP: transform 1, ESP_3DES
    Mar  2 16:18:43.079: ISAKMP:   attributes in transform:
    Mar  2 16:18:43.079: ISAKMP:      SA life type in seconds
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (basic) of 3600
    Mar  2 16:18:43.079: ISAKMP:      SA life type in kilobytes
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    Mar  2 16:18:43.079: ISAKMP:      encaps is 1 (Tunnel)
    Mar  2 16:18:43.079: ISAKMP:      authenticator is HMAC-SHA
    Mar  2 16:18:43.079: ISAKMP:(1008):atts are acceptable. // IPSec attributes are acceptable!
    Mar  2 16:18:43.079: ISAKMP:(1008): processing NONCE payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.083: ISAKMP:(1008): Creating IPSec SAs
    Mar  2 16:18:43.083:         inbound SA from 20.1.1.10 to 40.1.1.1 (f/i)  0/ 0
              (proxy 1.1.1.1 to 2.2.2.2)
    Mar  2 16:18:43.083:         has spi 0xA9A66D46 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083:         outbound SA from 40.1.1.1 to 20.1.1.10 (f/i) 0/0
              (proxy 2.2.2.2 to 1.1.1.1)
    Mar  2 16:18:43.083:         has spi  0x2B367FB4 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.083: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.083: ISAKMP:(1008):deleting node -1523793378 error FALSE reason "No Error"
    Mar  2 16:18:43.083: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    Mar  2 16:18:43.083: ISAKMP:(1008):Old State = IKE_QM_I_QM1  New State = IKE_QM_PHASE2_COMPLETE // At this point tunnels are up and ready to pass traffic!
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Kindly rate if you find the explanation useful !!
    Best Regards
    Sachin Garg

  • Cisco ASA 5505 not able to access flash

    Hi All:
    I have searched and searched all over the net for an answer to this question and have decided to just post it. I have a 5505 that was given to me by my job to use for working on my CCNA Sec. cert and did the following:
    I plugged it in and booted it up just fine. Made config changes as I followed along with the examples in my CCNA Security book. Got to the point in chapter 14 where the initial setup happens to configure it for working with ASDM. I never did a write mem on it and decided to take it back to square one by unplugging it to allow it to lose the changes that I made. This is where things got ugly.
    When it booted back up it got stuck in a bootup loop and couldn't find an IOS. After following all kinds of steps to boot to rommon and tftp another IOS and such (several times) I decided to follow another posting that said that the flash could be corrupted and to just delete it and start anew. Did that and through rommon as it would not boot up normally any more. After trying this over and over for the last couple hours I realized that it would boot from tftp so I did that in hopes of fixing the flash issue.
    I've tried deleting it, and re-initializing it and formating it. But the thing is that it no longer SEES the disk0: mount point. I've used two different flash cards...the one that came with it and the one that I already had. With the cover off I can see that there is no activity light next to the flash drive when I issue a delete or initialize or format command.
    Here is a copy of some of the output file. Any help or suggestions are greatly appreciated.
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Boot interrupted.                              
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Use ? for help.
    rommon #0> format disk0:
    Invalid or incorrect command.  Use 'help' for help.
    rommon #0> ADDRESS=10.10.10.110
    rommon #1> GATEWAY=10.10.10.1
    rommon #2> SERVER=10.10.10.98
    rommon #3> IMAGE=asa914-k8.bin
    rommon #4> tftp
    ROMMON Variable Settings:
      ADDRESS=10.10.10.110
      SERVER=10.10.10.98
      GATEWAY=10.10.10.1
      PORT=Ethernet0/0
      VLAN=untagged
      IMAGE=asa914-k8.bin
      CONFIG=
      LINKTIMEOUT=20
      PKTTIMEOUT=4
      RETRY=20
    tftp [email protected] via 10.10.10.1
    Received 27076608 bytes
    Launching TFTP Image...
    Cisco Security Appliance admin loader (3.0) #0: Thu Dec  5 19:38:43 PST 2013
    Platform ASA5505
    Loading...
    IO memory blocks requested from bigphys 32bit: 9956
    Àdosfsck 2.11, 12 Mar 2005, FAT32, LFN
    Currently, only 1 or 2 FATs are supported, not 42.
    dosfsck(/dev/hda1) returned 1
    mount: mounting /dev/hda1 on /mnt/disk0 failed: Invalid argument
    mount: mounting /dev/hda1 on /mnt/disk0 failed: Invalid argument
    Processor memory 343932928, Reserved memory: 62914560
    Total SSMs found: 0
    Total NICs found: 10
    88E6095 rev 2 Gigabit Ethernet @ index 09 MAC: 0000.0003.0002
    88E6095 rev 2 Ethernet @ index 08 MAC: 0023.339e.2a90
    88E6095 rev 2 Ethernet @ index 07 MAC: 0023.339e.2a8f
    88E6095 rev 2 Ethernet @ index 06 MAC: 0023.339e.2a8e
    88E6095 rev 2 Ethernet @ index 05 MAC: 0023.339e.2a8d
    88E6095 rev 2 Ethernet @ index 04 MAC: 0023.339e.2a8c
    88E6095 rev 2 Ethernet @ index 03 MAC: 0023.339e.2a8b
    88E6095 rev 2 Ethernet @ index 02 MAC: 0023.339e.2a8a
    88E6095 rev 2 Ethernet @ index 01 MAC: 0023.339e.2a89
    y88acs06 rev16 Gigabit Ethernet @ index 00 MAC: 0023.339e.2a91
    INFO: Unable to read firewall mode from flash
           Writing default firewall mode (single) to flash
    INFO: Unable to read cluster interface-mode from flash
           Writing default mode "None" to flash
    Verify the activation-key, it might take a while...
    Failed to retrieve permanent activation key.
    Running Permanent Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
    The Running Activation Key is not valid, using default settings:
    Licensed features for this platform:
    Maximum Physical Interfaces       : 8              perpetual
    VLANs                             : 3              DMZ Restricted
    Dual ISPs                         : Disabled       perpetual
    VLAN Trunk Ports                  : 0              perpetual
    Inside Hosts                      : 10             perpetual
    Failover                          : Disabled       perpetual
    Encryption-DES                    : Enabled        perpetual
    Encryption-3DES-AES               : Disabled       perpetual
    AnyConnect Premium Peers          : 2              perpetual
    AnyConnect Essentials             : Disabled       perpetual
    Other VPN Peers                   : 10             perpetual
    Total VPN Peers                   : 12             perpetual
    Shared License                    : Disabled       perpetual
    AnyConnect for Mobile             : Disabled       perpetual
    AnyConnect for Cisco VPN Phone    : Disabled       perpetual
    Advanced Endpoint Assessment      : Disabled       perpetual
    UC Phone Proxy Sessions           : 2              perpetual
    Total UC Proxy Sessions           : 2              perpetual
    Botnet Traffic Filter             : Disabled       perpetual
    Intercompany Media Engine         : Disabled       perpetual
    Cluster                           : Disabled       perpetual
    This platform has a Base license.
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode        : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2_05
                                 IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.09
    Cisco Adaptive Security Appliance Software Version 9.1(4)
      ****************************** Warning *******************************
      This product contains cryptographic features and is
      subject to United States and local country laws
      governing, import, export, transfer, and use.
      Delivery of Cisco cryptographic products does not
      imply third-party authority to import, export,
      distribute, or use encryption. Importers, exporters,
      distributors and users are responsible for compliance
      with U.S. and local country laws. By using this
      product you agree to comply with applicable laws and
      regulations. If you are unable to comply with U.S.
      and local laws, return the enclosed items immediately.
      A summary of U.S. laws governing Cisco cryptographic
      products may be found at:
      http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
      If you require further assistance please contact us by
      sending email to [email protected].
      ******************************* Warning *******************************
    This product includes software developed by the OpenSSL Project
    for use in the OpenSSL Toolkit (http://www.openssl.org/)
    Copyright (C) 1995-1998 Eric Young ([email protected])
    All rights reserved.
    Copyright (c) 1998-2011 The OpenSSL Project.
    All rights reserved.
    This product includes software developed at the University of
    California, Irvine for use in the DAV Explorer project
    (http://www.ics.uci.edu/~webdav/)
    Copyright (c) 1999-2005 Regents of the University of California.
    All rights reserved.
    Busybox, version 1.16.1, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    Busybox comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    DOSFSTOOLS, version 2.11, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111-1307
    675 Mass Ave, Cambridge, MA 02139
    DOSFSTOOLS comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    grub, version 0.94, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111-1307
    grub comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    libgcc, version 4.3, Copyright (C) 2007 Free Software Foundation, Inc.
    libgcc comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenseSee User Manual (''Licensing'') for details.
    libstdc++, version 4.3, Copyright (C) 2007 Free Software Foundation, Inc.
    libstdc++ comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    Linux kernel, version 2.6.29.6, Copyright (C) 1989, 1991 Free Software
    Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    Linux kernel comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    module-init-tools, version 3.10, Copyright (C) 1989, 1991 Free Software
    Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
    module-init-tools comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    numactl, version 2.0.3, Copyright (C) 2008 SGI.
    Author: Andi Kleen, SUSE Labs
    Version 2.0.0 by Cliff Wickman, Chritopher Lameter and Lee Schermerhorn
    numactl comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    pciutils, version 3.1.4, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    pciutils comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    readline, version 5.2, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111 USA
    readline comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    udev, version 146, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    udev comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    Cisco Adapative Security Appliance Software, version 9.1,
    Copyright (c) 1996-2013 by Cisco Systems, Inc.
    Certain components of Cisco ASA Software, Version 9.1 are licensed under the GNU
    Lesser Public License (LGPL) Version 2.1.  The software code licensed under LGPL
    Version 2.1 is free software that comes with ABSOLUTELY NO WARRANTY.  You can
    redistribute and/or modify such LGPL code under the terms of LGPL Version 2.1
    (http://www.gnu.org/licenses/lgpl-2.1.html).  See User Manual for licensing
    details.
                    Restricted Rights Legend
    Use, duplication, or disclosure by the Government is
    subject to restrictions as set forth in subparagraph
    (c) of the Commercial Computer Software - Restricted
    Rights clause at FAR sec. 52.227-19 and subparagraph
    (c) (1) (ii) of the Rights in Technical Data and Computer
    Software clause at DFARS sec. 252.227-7013.
                    Cisco Systems, Inc.
                    170 West Tasman Drive
                    San Jose, California 95134-1706
    Insufficient flash space available for this request:
      Size info: request:32 free:0  delta:32
    Could not initialize system files in flash.
    config_fetcher: channel open failed
    ERROR: MIGRATION - Could not get the startup configuration.
    INFO: Power-On Self-Test in process.
    INFO: Power-On Self-Test complete.
    INFO: MIGRATION - Saving the startup errors to file 'flash:upgrade_startup_errors_200804300128.log'
    Pre-configure Firewall now through interactive prompts [yes]? n
    Type help or '?' for a list of available commands.
    ciscoasa> en
    Password:
    ciscoasa# format disk0:
    Format operation may take a while. Continue? [confirm]
    Format operation will destroy all data in "disk0:".  Continue? [confirm]
    Initializing partition - done!
    Creating FAT16 filesystem
    mkdosfs 2.11 (12 Mar 2005)
    System tables written to disk
    Format of disk0 complete
    ciscoasa# format disk:
                     ^
    ERROR: % Invalid input detected at '^' marker.
    ciscoasa# format flash:
    Format operation may take a while. Continue? [confirm]
    Format operation will destroy all data in "flash:".  Continue? [confirm]
    Initializing partition - done!

    Yeah...I think I found that one out the hard way already. I'll cross that bridge when I get to it. I want to get this issue fixed before I start thinking about the license issue.
    ciscoasa#
    ciscoasa#
    ciscoasa#
    ciscoasa# sh flash
    --#--  --length--  -----date/time------  path
    2403  0           Apr 30 2008 02:00:56  test
    2285  196         Apr 30 2008 01:28:20  upgrade_startup_errors_200804300128.log
    2283  0           Apr 30 2008 01:28:20  coredumpinfo
    2284  59          Apr 30 2008 01:28:20  coredumpinfo/coredump.cfg
    2280  0           Apr 30 2008 01:27:56  crypto_archive
    2267  0           Apr 30 2008 01:27:38  log
    0 bytes total (0 bytes free)
    ciscoasa#
    ciscoasa#
    ciscoasa#
    ciscoasa# sh disk0
    --#--  --length--  -----date/time------  path
    2403  0           Apr 30 2008 02:00:56  test
    2285  196         Apr 30 2008 01:28:20  upgrade_startup_errors_200804300128.log
    2283  0           Apr 30 2008 01:28:20  coredumpinfo
    2284  59          Apr 30 2008 01:28:20  coredumpinfo/coredump.cfg
    2280  0           Apr 30 2008 01:27:56  crypto_archive
    2267  0           Apr 30 2008 01:27:38  log
    0 bytes total (0 bytes free)
    ciscoasa#

  • Cisco ASA 5505 doesn't forware incoming connection to LAN

    Hello everybody.
    I just got a Cisco asa 5505 with the next OS and ASDM info
    ASA 5505 OS 8.4(3) ASDM 6.47
    I configured and enter all rules to allow incoming traffic to LAN but it's not working also, I have one host inside that is configured in a second IP and create the rule to allow traffic to it but it doesn't work too.
    Problem 1
    I have VNC running in port 5900 tcp and I want to connect from Internet using port 6001 and this has to forware the connection to the real VNC port. In the configuration I have a few host with the same configuration but I use different outside port to get it.
    Problem 2.
    I have a second IP with services: SMTP, HTTP, HTTPS and port 444 all TCP forwarding to a server in the LAN.
    Facts:
    SMTP.
    Every time that I do telnet to the second IP looking for the SMTP port, the firewall doesn't let the incoming connection goes through and the LOGGING screen doesn't how that connection.
    PORT 6001 (outside)
    this port is configured to work with the IP in the outside internface and it was to send the incoming connection to a host inside to the real port 5900.
    Can any one check my configuration if I'm missing anything? for sure I'm but I didn't find it. Bellow is the configuration, I masked the Public IPs just left the last number in the IP, also I left the LAN network to see better the configuration.
    I will appreciate any help.
    Thanks a lot..
    CONFIGURATION.
    : Saved
    ASA Version 8.4(3)
    hostname saturn1
    domain-name mydominio.com
    enable password SOMEPASS encrypted
    passwd SOMEPASS encrypted
    names
    name 192.168.250.11 CAPITOLA-LAN
    name 192.168.250.15 OBIi110-LAN
    name 192.168.250.21 DRP1260-LAN
    name 192.168.250.22 HPOJ8500-LAN
    name 192.168.250.30 AP-W77-NG-LAN
    name 192.168.250.97 AJ-DTOP-PC-LAN
    name 192.168.250.96 SWEETHEART-PC-LAN
    name 192.168.250.94 KIDS-PC-LAN
    name XX.YY.ZZ.250 EXTERNALIP
    name XX.YY.ZZ.251 EXTERNALIP2
    name XX.YY.ZZ.1 GTWAY
    dns-guard
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.250.2 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address EXTERNALIP 255.255.255.0
    boot system disk0:/asa843-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name mydominio.com
    object network CAPITOLA-LAN
    host 192.168.250.11
    object network EXTERNALIP
    host XX.YY.ZZ.250
    description Created during name migration
    object network CAPITOLA-PUBLIC
    host XX.YY.ZZ.251
    object network capitola-int
    host 192.168.250.11
    object network capitola-int-vnc
    host 192.168.250.11
    object network aj-dtop-int-vnc
    host 192.168.250.97
    object network sweetheart-int-vnc
    host 192.168.250.96
    object network kids-int-vnc
    host 192.168.250.94
    object network VPNNetwork
    subnet 10.10.20.0 255.255.255.0
    object network InsideNetwork
    subnet 192.168.250.0 255.255.255.0
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network capitola-int-smtp
    host 192.168.250.11
    object-group service capitola-int-smtp-service tcp
    port-object eq smtp
    object-group service capitola-int-services tcp
    port-object eq smtp
    port-object eq https
    port-object eq www
    port-object eq 444
    object-group service capitola-int-vnc-service tcp
    port-object eq 6001
    object-group service aj-dtop-int-vnc-service tcp
    port-object eq 6002
    object-group service sweetheart-int-vnc-service tcp
    port-object eq 6003
    object-group service kids-int-vnc-service tcp
    port-object eq 6004
    access-list incoming extended permit icmp any any
    access-list incoming extended permit tcp any object capitola-int object-group capitola-int-services
    access-list incoming extended permit tcp any object capitola-int-vnc object-group capitola-int-vnc-service
    access-list incoming extended permit tcp any object aj-dtop-int-vnc object-group aj-dtop-int-vnc-service
    access-list incoming extended permit tcp any object sweetheart-int-vnc object-group sweetheart-int-vnc-service
    access-list incoming extended permit tcp any object kids-int-vnc object-group kids-int-vnc-service
    access-list incoming extended permit tcp any object capitola-int-smtp object-group capitola-int-smtp-service
    access-list split-tunnel standard permit 192.168.250.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any object VPNNetwork
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool vpnpool 10.10.20.1-10.10.20.50 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,any) source static any any destination static VPNNetwork VPNNetwork no-proxy-arp
    object network capitola-int
    nat (any,any) static XX.YY.ZZ.251
    object network capitola-int-vnc
    nat (inside,outside) static interface service tcp 5900 6001
    object network aj-dtop-int-vnc
    nat (inside,outside) static interface service tcp 5900 6002
    object network sweetheart-int-vnc
    nat (inside,outside) static interface service tcp 5900 6003
    object network kids-int-vnc
    nat (inside,outside) static interface service tcp 5900 6004
    object network obj_any
    nat (inside,outside) dynamic interface
    object network capitola-int-smtp
    nat (any,outside) static interface service tcp smtp smtp
    access-group incoming in interface outside
    route outside 0.0.0.0 0.0.0.0 GTWAY 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http server idle-timeout 2
    http server session-timeout 1
    http 192.168.1.0 255.255.255.0 inside
    http CAPITOLA-LAN 255.255.255.255 inside
    http AJ-DTOP-PC-LAN 255.255.255.255 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    telnet timeout 5
    ssh CAPITOLA-LAN 255.255.255.255 inside
    ssh AJ-DTOP-PC-LAN 255.255.255.255 inside
    ssh timeout 15
    console timeout 0
    vpn-addr-assign local reuse-delay 2
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username admin password SOMEPASS encrypted privilege 15
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect pptp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:036b82d3eb5cffc1c65a3b381246d043
    : end
    asdm image disk0:/asdm-647.bin
    no asdm history enable

    Jose, your fix to problem 1 allows all access from the outside, assuming you applied the extended list to the outside interface.  Try to be more restrictive than an '...ip any any' rule for outside_in connections.  For instance, this is what I have for incoming VOIP (access list and nat rules):
    access list rule:
    access-list outside_access_in extended permit udp any object server range 9000 9049 log errors
    nat rule:
    nat (inside,outside) source static server interface service voip-range voip-range
    - 'server' is a network object *
    - 'voip-range' is a service group range
    I'd assume you can do something similar here in combination with my earlier comment:
    access-list incoming extended permit tcp any any eq 5900
    Can you explain your forwarding methodology a little more?  I'm by no means an expert on forwarding, but the way I read what you're trying to do is that you have an inbound VNC request coming in on 5900 and you want the firewall to figure out which host the request should go to.  Or is it vice-versa, the inbound VNC request can be on port 6001-6004 ?

Maybe you are looking for

  • How can i remove a card from iTunes ?

    How can i remove a card from iTunes ?

  • SAP F&R: replenishment priorities for locations?

    Hi! Could anyone help  to find a solution please. There's an often business case that stock is very limited, and currently (w\o SAP F&R) business distributes the total amount manually b/w the locations, according to certain location prioritization. A

  • I find myself unable to pinch to home screen while using iPad Air..it  hapenned twice

    While I was opening some applications and then I wanted to pinch to home screen but I found it doesn't work then I tried closing the opened applications then I tried pinching ..finally it works.. This happened twice ..is it just an incident or there

  • Accessing of Forms6i Through Portal

    What is the procedure to access Forms and Reports which are developed in Developer2000 through portal3.0.7. Is it possible in Portal,or tell me any othere alternatives. Thanks,

  • Software Crush ???

    hi guys...i have read all related topic to X6 problem and i figured out mine is same too.. after i dwnload software from ovi store my phone start to crash..when i want to turn on it freeze at nokia word...no shaking hand then suddenly it switching of