Does ASA 5520 support PKCS#11 ?

Hey.
does ASA 5520 VPN Plus (Cisco Adaptive Security Appliance Software Version 8.4(3) Device Manager Version 6.4(7))
support PKCS#11 ?
Thank you for answering;)

You can purchase an AIP-SSM module for an ASA 5510 or 5520 to enable IDS/IPS functionality on the platform. 
http://www.cisco.com/en/US/customer/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/product_data_sheet0900aecd80404916_ps6120_Products_Data_Sheet.html

Similar Messages

  • Does ASA 5520 do layer 7 firewall

                       Hi everyone,
    Need to know if ASA  5520 does Layer 7 firewall or  not?
    thanks
    Mahesh

    Hello Mahesh,
    Yes, any of the ASA platafforms can perfom a deep packet inspection over layer 7
    Hope I could help,
    Regards,

  • Does ASA 5520 and 5510 support IDS?

    Hi experts,
    If so how to enable it?
    Thanks a lot in advance.
    Regards,

    You can purchase an AIP-SSM module for an ASA 5510 or 5520 to enable IDS/IPS functionality on the platform. 
    http://www.cisco.com/en/US/customer/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/product_data_sheet0900aecd80404916_ps6120_Products_Data_Sheet.html

  • Does ASA ezVPN support reactive primary vpn server feature

    hi,
    i am going to configure asa5505 as the azvpn client . and configre primay and secondary vpn server in the list.
    i find some feature that is support by ios ROUTER  ezvpn, not sure it will be support on ASA ezVPN???
    Question? will the ezvpn   fall back to the primary vpn server , if primary back on line,  on ASA ?
    Reactivate Primary Peer
    The Reactivate Primary Peer feature allows a default primary peer to be defined. The default primary peer (a server) is one that is considered better than other peers for reasons such as lower cost, shorter distance, or more bandwidth. With this feature configured, if Easy VPN fails over during Phase 1 SA negotiations from the primary peer to the next peer in its backup list, and if the primary peer is again available, the connections with the backup peer are torn down and the connection is again made with the primary peer.

    No, the Primary peer won't be tried again until the phase 1 tunnel is torn down and reactivated. Re-keys do not count. Hope this helps.

  • Does asa 5505 support h.323 v6?

    we've been told that our firewall must support version 6 to connect to a newer unit. more precisely, we've been told that that we're currently doing intelligent packet inspecting which is part of the problem

    This feature allows you to change the default configuration values used for H.323 application inspection.
    H.323 inspection supports RAS, H.225, and H.245, and its functionality translates all embedded IP addresses and ports. It performs state tracking and filtering and can do a cascade of inspect function activation. H.323 inspection supports phone number filtering, dynamic T.120 control, H.245 tunneling control, protocol state tracking, H.323 call duration enforcement, and audio and video control.

  • Does ASA Support Android Hybird RSA Authentication ?

    Dear all
    Does ASA Support Android Hybird RSA Authentication  ?
    I should be such as to set the ASA firewall, let him support Android VPN Hybrid mode under my settings
    tunnel-group IPsec_Hybird_Tunnel general-attributes
    default-group-policy Android_Hybird
    authorization-required
    tunnel-group Android_Hybird_Tunnel ipsec-attributes
    ikev1 pre-shared-key **********
    chain
    ikev1 trust-point CA
    ikev1 user-authentication hybrid
    tunnel-group Android_Hybird_Tunnel ppp-attributes
    authentication ms-chap-v2
    crypto ikev1 policy 10
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    when i debug find this message
    %ASA-7-713906: IP = 1.1.1.1, All SA proposals found unacceptable

    I've managed to configure IPSEC hybrid(Mutual group Authentication) with the Cisco VPN client, which uses a pre-shared key and CA certificate as well as Xauth. When using "IPSec Hyrbid RSA" on an an Android device, my attempts to configure it on the ASA have failed.
    Log message:
    3
    Jul 25 2013
    20:39:54
    713048
    IP = 192.168.7.76, Error processing payload: Payload ID: 1

  • ASA 5520 VPN load balancing with Active/Standby failover on 2 devices only...

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    This topic has been beat to death, but I did not see a real answer. Here is configuration:
    1) 2 x ASA 5520, running 8.2
    2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
    3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
    4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
    This sounds trivial, but I cannot find a clear answer (without testing this); and many people are confusing the issue. Here are some examples of confusion. These do not apply to my scenario.
    Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
    The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
    In any case, any experts out there that can answer question? TIA!

    Wow, some good info posted here (both questions and some answers). I'm in a similar situation with a couple of vpn load-balanced pairs... my goal was to get active-standby failover up and running in each pair- then I ran into this thread and saw the first post about the unique IP addr pools (and obviously we can't have unique pools in an active-standby failover rig where the complete config is replicated). So it would seem that these two features are indeed mutually exclusive. Real nice initial post to call this out.
    Now I'm wondering if the ASA could actually handle a single addr pool in an active-standby fo rig- *if* the code supported the exchange of addr pool status between the fo members (so they each would know what addrs have been farmed out from this single pool)? Can I get some feedback from folks on this? If this is viable, then I suppose we could submit a feature request to Cisco... not that this would necessarily be supported anytime soon, but it might be worth a try. And I'm also assuming we might need a vip on the inside int as well (not just on the outside), to properly flip the traffic on both sides if the failover occurs (note we're not currently doing this).
    Finally, if a member fails in a std load-balanced vpn pair (w/o fo disabled), the remaining member must take over traffic hitting the vip addr (full time)... can someone tell me how this works? And when this pair is working normally (with both members up), do the two systems coordinate who owns the vip at any time to load-balance the traffic? Is this basically how their load-balancing scheme works?
    Anyway, pretty cool thread... would really appreciate it if folks could give some feedback on some of the above.
    Thanks much,
    Mike

  • ASA 5520 Dual Active ISPs

    I inherited a network redesign project mid implementation and ran across an issue that I was not 100% sure able to be resolved.  Implementation is occurring in which the organization is changing over to a different ISP and we have some customers that will not be able to change their settings over to our new addresses from some time.  I have seen a lot of posts about fail over and dual ISP configurations, but I could not relate them to this particular scenario. 
    Theoretical Layout:
    ISP1 - Old
    ISP2 - New
    ISP1          ISP2
        2x ASA 5520 - DMZ
                |
           Internal
    ASA 5520s are on version 8.0 and running Active/Active
    We have an FTP server in our DMZ and a secondary server in our Internal LAN that customers communicate with.  The issue that I have been faced with is that some customers will be using ISP1 while others are using ISP2 until the full transition occurs.  Since the customers have explicit firewall rules that only accept communication from a certain source address, we cannot send out the traffic just on ISP2 until they change their settings.
    Any ideas or thoughts on how to configure to be able to make this happen?

    Hello,
    I think you are looking for load balancing implementation and unfortunately the ASA does not support that feature yet.
    There are some workarounds that are not supported by Cisco because as I told you this is supported yet, but you definitly can give it a try.
    Here is the link you can use to get more information about the workaround:
    https://supportforums.cisco.com/docs/DOC-15622
    Please rate helpful posts,.
    Kind regards,
    Julio

  • HA between a Cisco ASA 5520 and a Cisco ASA 5525-X

    Hi all!
    we have a couple of Cisco ASA 5520 running 8.4(3) software, and we want to improve throughput changing them with a couple of Cisco ASA 5525-X. Since software is theorically compatible, we are not going to upgrade it right now.
    We don't want to stop service, so we are thinking about switching off backup 5520 firewall, change it with a 5525-X and balance service to that one while we change the other 5520 fw. So the question is, has someone tried to make an active-pasive cluster with both technologies, Cisco ASA an Cisco ASA-X firewalls? We were said that it should be theorically compatible, but we'd like to know if someone tried before.
    Best regards for all,

    You cannot make a 5520 establish failover with the mate being a 5525-X.
    1. The configuration guide (here) states:
    The two units in a failover configuration must be the same model, have the same number and types of interfaces, the same SSMs installed (if any), and the same RAM installed.
    2. A 5525-X requires 8.6 software. 8.6 does not support non-X series ASAs. (Reference) Even if you wait until 9.0 is available (next month) for both you still fail on the model and RAM (X series has much more than the 5520) checks noted above.

  • ASA 5520 Upgrade From 8.2 to 9.1

    To All Pro's Out There,
    I have 2 x ASA 5520 in Active/Standby state (Routed, Single context) running 8.2(3) image. They are working great and everybody is happy. Now it's time for us to upgrade to the latest and greatest version: 9.1 and as you know there are some architectural changes Cisco made to NAT statements and Access Lists. As one can tell, we have a monster environment in terms of NAT statements and access list that are currently configured on the appliances.
    In order to make the upgrade process "less" painful, I was able to find a loaner ASA 5520 device so I can practice the upgrade process offline and if needed, I use it in production (in conjunction with existing Primary and Secondary devices) should it be helpful. I currently don't have any plans on how to move forward with these 3 devices and put together an smooth upgrade. I am asking advice from experts that perhaps have done this in the past and know some Do's and Don’ts and can provide me some options toward getting best result: Minimum downtime and Smooth upgrade.
    I appreciate all the help in advance.

    Hi,
    My personal approach from the start has been to learn the new NAT configuration format on the ASA CLI and manually convert the configurations for the new ASA software. I am under the impression that the automatic conversion that the ASA does by rebooting straight into a new software level causes quite a lot of configurations and they arent really optimal.
    In your case it seems that you have a pretty much better situation than most people that dont have the chance to use a test device to test out the setup before actually putting it in production.
    What you can basically do is
    Insert the 8.2 configuration to the test ASA and boot it straight to the higher software levels and see what the conversion has done to the ASA configurations.
    You can use "packet-tracer" command to test if correct NAT rules are still hit after the conversion
    So far I have been lucky in the sense that most of the upgrades I have done have involved new hardware which has basically let me configure everything ready and just switch devices for the customer. So far everything has went really well and there has been only a 1-2 mistakes in NAT configurations because of misstyping some IP address or interface name which basically resulted from a lot of copy/paste when building the configurations. And these couple of mistakes have been from around 150 firewall migrations (of which most from FWSM Security Context to a ASA Security Context)
    If you have time to put into this then I would suggest you try to learn the new NAT format and write your NAT configurations yourself. Converting the existing configurations should essentially give you the tools to then maintain that firewall configuration easily in the future and apply that knowledge elsewhere.
    If you want to read a bit about the new NAT configuration format then I would suggest having a look at the NAT 8.3+ document I made:
    https://supportforums.cisco.com/docs/DOC-31116
    My personal approach when starting to convert NAT configurations for the upgrade is
    Collect all NAT configurations from the current ASA including any ACLs associated with the Policy type NATs and NAT0 configurations
    Divide NAT configurations based on type   
    Dynamic NAT/PAT
    Static NAT
    Static PAT
    NAT0
    All Policy Dynamic/Static NAT/PAT
    Learn the basic configuration format for each type of NAT configuration
    Start by converting the easiest NAT configurations   
    Dynamic NAT/PAT
    Static NAT/PAT
    Next convert the NAT0 configurations
    And finally go through the Policy NAT/PAT configurations
    Finally go through the interface ACLs and change them to use the real IP address as the destination in all cases since the NAT IP address is not used anymore. In most common screnarios this basically usually only involves modifying the "outside" interfaces ACL but depending if the customer has some other links to external resourses then its highly likely that same type of ACL changes are required on those interfaces also.
    The most important thing is to understand how the NAT is currently working and then configure the new NAT configuration to match that. Again, the "packet-tracer" command is a great tool to confirm that everything is working as expected.
    One very important thing to notice also is that you might have a very large number of Identity NAT configurations between your local networks interfaces of the ASA.
    For example
    static (inside,dmz) 10.10.10.0 10.10.10.0 netmask 255.255.255.0
    In the new software you can pretty much leave all of these out. If you dont need to perform NAT between your local interfaces then you simply leave out all NAT configurations.
    Naturally you can also use these forums to ask help with NAT configuration conversions. Even though its a very common topic, I dont personally mind helping out with those.
    So to summarize
    Try out the ASAs automatic configuration conversion when simply booting to new software levels on the test ASA you have
    Learn the new NAT configuration format
    Ask for help here on CSC about NAT configuration formats and help with converting old to new configurations.
    Personally if I was looking at a samekind of upgrade (which I will probably be looking at again soon) I would personally do the following
    Convert the configurations manually
    Lab/test the configurations on an test ASA
    During Failover pairs upgrade I would remove the Standby device from network, erase its configurations, reboot it to new software, insert manually written configurations.
    Put the upgraded ASA to the device rack and have cables ready connected to the customer devices if possible (or use existing ones)
    Disconnect currently active ASA running 8.2 and connect the new ASA to the network while clearing ARP on the connected routers to avoid any problems with traffic forwarding.
    Test connectivity and monitor ASAs connection and xlate tables to confirm everything is working
    Will add more later if anything comes to mind as its getting quite late here
    Hope this helps
    - Jouni

  • Multiple Public IP's on ASA 5520

    Hi,
    I have ASA 5520 with Ver 8.2.
    Outside interface is directly connected to ISP's router(TelePacific) and is assigned one of public IP:198.24.210.226.
    There are two servers inside the network with the private IP's:192.168.1.20 for DB Server, and 192.168.1.91 for Web Server.
    I did Static NAT 198.24.210.226 to 192.168.1.20  and 198.24.210.227 to 192.168.1.91.
    When I access DB Server(198.24.210.226) it's working OK but when I access Web Server(198.24.210.227) there is no response at all.
    I checked the inside traffic, it even did not get into the firewall.
    Is this the problem with ISP's router?  How can we route all of our public IP's to the outside interface(198.24.210.226)?
    interface GigabitEthernet0/1
    nameif inside
    ip address 192.168.1.1 255.255.255.0
    security-level 100
    no shutdown
    interface GigabitEthernet0/0
    nameif outside
    ip address 198.24.210.226 255.255.255.248
    security-level 0
    no shutdown
    route outside 0.0.0.0 0.0.0.0  198.24.210.225
    nat (inside) 1 192.168.1.0 255.255.255.0
    global (outside) 1 198.24.210.226 255.255.255.255
    static (inside,outside) tcp 198.24.210.226 3389 192.168.1.10 3389 netmask 255.255.255.255 dns
    static (inside,outside) tcp 198.24.210.226 9070 192.168.1.10 9070 netmask 255.255.255.255 dns
    static (inside,outside) tcp 198.24.210.227 3389 192.168.1.20 3389 netmask 255.255.255.255 dns
    static (inside,outside) tcp 198.24.210.227 80   192.168.1.20 80   netmask 255.255.255.255 dns
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.226 eq 3389
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.226 eq 9070
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.227 eq 3389
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.227 eq 80
    access-group OUTSIDE-IN in interface outside

    Also,
    You seen to have an /29 public subnet. You should be able to use IP addresses from this subnet to configure NAT on your firewall. I dont think you need any specific configurations to allow the usage of the whole subnet as NAT IP addresses.
    You can naturally check the following
    show run sysopt
    Check that you DONT have the following
    sysopt noproxyarp outside
    At the moment you are not actually configuring Static NAT but rather Static PAT.
    You are only forwarding some ports from certain public IP addresses to the local IP address. If you were doing Static NAT, then you would actually be staticly binding the public IP addresses to the local IP address. So it would apply to any TCP/UDP port and you would only need to use the ACL to allow traffic.
    Though in that case you would have to replace the .226 IP address with something else as its the firewall interface IP address and it should not be assigned to be used by a single host on the LAN usually.
    If you wanted to staticly assing public IPs to both of these servers you could do
    static (inside,outside) 198.24.210.227 192.168.1.91 netmask 255.255.255.255
    static (inside,outside) 198.24.210.228 192.168.1.10 netmask 255.255.255.255
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.228 eq 3389
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.228 eq 9070
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.227 eq 3389
    access-list OUTSIDE-IN extended permit tcp any  host 198.24.210.227 eq 80
    - Jouni

  • Cisco ASA 5520 (asa 8.2) hairpinning

    Hi All,
    We have a ASA 5520 (redundant) in our network which we are using for different customers. For every new customer we create a new VLAN and place their servers in this VLAN. On the ASA we create a new subinterface for every customer which is connected to the corresponding VLAN.
    Most customers get a private ip-range (e.g. 192.168.x.x/24) on which they should configure their servers. Because most customers don't need to be to access eachothers server all VLAN interfaces have the same security-level of 50. I haven't enable the "same-security-traffic permit inter-interface" option, so traffic between those interfaces is blocked, as expected.
    Some customers (e.g. customer A) need public webmail of smtp access to there servers. So we use both NAT and PAT to make that happen.
    So, recently we've got a customer (customer B) who placed their webservers behind our ASA. Because we didn't want to use NAT statements all the time, we dediced to configure a public /29 subnet on their VLAN. Because the website on this customer's servers need to be visible for everybody, we've lowered the security-level of this VLAN interface to 40 (instead of 50) and applied some ACL's. So other customers (e.g. customer A) are also able to reach the websites of customer B. So everything is just working fine.
    Now, customer A decided that they want to run their website on their own servers as well. So, I created a static PAT for TCP 80. So the website is accessible from the outside world. But.....customer B is not able to reach customer A's website on the translated address. So, I've created a second PAT (using the same public address) but this time to customer B's interface. But still, we're not able to reach customer A's website.
    I've also enabled the "same-security-traffic permit intra-interface", but still the website is unreachable to customer B.
    Here's a small drawing of the situation:
    The ip-addresses are, of course, not real.
    Can anybody place help me with this issue?

    That's a very cool command that I didn't know about.
    I see that the packet is drop at phase 7 (NAT-EXEMPT).
    Phase: 7
    Type: NAT-EXEMPT
    Subtype: rpf-check
    Result: DROP
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x74455b60, priority=6, domain=nat-exempt-reverse, deny=false
            hits=61, user_data=0x744558f0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
            src ip=Cust_B_LAN, mask=255.255.255.240, port=0
            dst ip=Cust_A_LAN, mask=255.255.255.0, port=0, dscp=0x0
    Result:
    input-interface: Cust_B
    input-status: up
    input-line-status: up
    output-interface: Cust_A
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    I seemed that I had a nonat rule messing the communication between these interfaces. After removing it, the traffic was flowing just fine.
    Thanks for your support.
    Ron

  • Cisco ASA 5520 Failover with DMZ

    I have a pair of Cisco ASA 5520s running as a primary/standby. Everything is working properly with the primary ASA, however when I trigger a failover, everything works except for the DMZ interface on the standby ASA. I've poured over the configs, but perhaps I have been staring at them too long because I am just not seeing anything.
    Below is the output of the sh run failover, sh failover, and sh run interface commands for each unit...
    PRIMARY ASA
    Primary-ASA# sh run failover
    failover
    failover lan unit primary
    failover lan interface stateful1 GigabitEthernet0/3
    failover key *****
    failover link stateful1 GigabitEthernet0/3
    failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
    Primary-ASA# sh failover
    Failover On
    Failover unit Primary
    Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 160 maximum
    Version: Ours 8.2(5), Mate 8.2(5)
    Last Failover at: 20:39:23 CDT Sep 3 2013
    This host: Primary - Active
    Active time: 69648 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
         Interface outside (184.61.38.254): Normal
         Interface inside (192.168.218.252): Normal
         Interface dmz (192.168.215.254): Normal (Waiting)
         Interface management (192.168.1.1): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Other host: Secondary - Standby Ready
    Active time: 2119 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.253): Normal
    Interface inside (192.168.218.253): Normal
    Interface dmz (192.168.215.252): Normal (Waiting)
    Interface management (192.168.1.2): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
    IPS, 6.0(3)E1, Up
    Primary-ASA# sh run interface
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
    ospf cost 10
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
    ospf cost 10
    interface GigabitEthernet0/2
    nameif dmz
    security-level 50
    ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
    ospf cost 10
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
    ospf cost 10
    management-only
    STANDBY ASA
    Standby-ASA# sh run failover
    failover
    failover lan unit secondary
    failover lan interface stateful1 GigabitEthernet0/3
    failover key *****
    failover link stateful1 GigabitEthernet0/3
    failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
    Standby-ASA# sh failover
    Failover On
    Failover unit Secondary
    Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 160 maximum
    Version: Ours 8.2(5), Mate 8.2(5)
    Last Failover at: 20:39:23 CDT Sep 3 2013
    This host: Secondary - Standby Ready
    Active time: 2119 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.253): Normal
    Interface inside (192.168.218.253): Normal
    Interface dmz (192.168.215.252): Normal (Waiting)
    Interface management (192.168.1.2): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Other host: Primary - Active
    Active time: 70110 (sec)
          slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.254): Normal
    Interface inside (192.168.218.252): Normal
    Interface dmz (192.168.215.254): Normal (Waiting)
    Interface management (192.168.1.1): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Standby-ASA# sh run interface
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
    ospf cost 10
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
    ospf cost 10
    interface GigabitEthernet0/2
    nameif dmz
    security-level 50
    ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
    ospf cost 10
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
    ospf cost 10
    management-only
    Does anyone see something I might be missing? I am at a loss...

    I'll just answer my own question...the configs are correct, but it the interface on the standby ASA was plugged into an improperly configured switchport. That'll do it everytime.

  • Asa 5520 "loosing" code after code has been put in and operating

    Sorry to ask this if it has all ready been covered.  We have an asa 5520 running 8.3.2(1) code.  Three times now I have entered code and rules in our asa and had things working, only to have the code "dissapear" and thus things stop working.  We upgraded to 8.3.2(1) back in January of 2011, and have not had this problem until the last month.  I was wondering if there is a bug with 8.3.2(1) code that has decided to show itself for whatever reason now.  We have also had some other things relating to the VPN that were "working" and at some point just stopped working.  We do have a second asa 5520 that is the failover/standby.  We also have two 6509 with firewall services modules, one primary and the other standby.  Just wondering how to troubleshoot something like this.  I have putty logs of me putting the code in and doing a write mem saving the changes, yet on three occations those things stopped working, and I had to put the code in again.
    **update** as I was typing this, we realised there was a problem with the two ASA's.  For some reason, failover had stopped working, and both ASA's were trying to be the primary and causing issues.  After several reboots, we wound up turning failover back on  on the second ASA, and things seem to be normal now.  No idea what would have caused the failover to break.  Not sure how long this had been going on, it may have had to do with my code seeming to dissapear?

    Here is the output of the show ver.  I removed the serial number.
    ACH-2nd-EXT-ASA01#sh ver
    Cisco Adaptive Security Appliance Software Version 8.3(2)1
    Device Manager Version 6.4(7)
    Compiled on Wed 04-Aug-10 21:41 by builders
    System image file is "disk0:/asa832-1-k8.bin"
    Config file at boot was "startup-config"
    ACH-2nd-EXT-ASA01 up 4 days 22 hours
    failover cluster up 4 days 22 hours
    Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz
    Internal ATA Compact Flash, 256MB
    BIOS Flash M50FW080 @ 0xfff00000, 1024KB
    Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
    0: Ext: GigabitEthernet0/0  : address is 001d.a298.c41c, irq 9
    1: Ext: GigabitEthernet0/1  : address is 001d.a298.c41d, irq 9
    2: Ext: GigabitEthernet0/2  : address is 001d.a298.c41e, irq 9
    3: Ext: GigabitEthernet0/3  : address is 001d.a298.c41f, irq 9
    4: Ext: Management0/0       : address is 001d.a298.c420, irq 11
    5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
    6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
    Licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited      perpetual
    Maximum VLANs                  : 150            perpetual
    Inside Hosts                   : Unlimited      perpetual
    Failover                       : Active/Active  perpetual
    VPN-DES                        : Enabled        perpetual
    VPN-3DES-AES                   : Enabled        perpetual
    Security Contexts              : 2              perpetual
    GTP/GPRS                       : Disabled       perpetual
    SSL VPN Peers                  : 10             perpetual
    Total VPN Peers                : 750            perpetual
    Shared License                 : Disabled       perpetual
    AnyConnect for Mobile          : Enabled        perpetual
    AnyConnect for Cisco VPN Phone : Disabled       perpetual
    AnyConnect Essentials          : Enabled        perpetual
    Advanced Endpoint Assessment   : Disabled       perpetual
    UC Phone Proxy Sessions        : 2              perpetual
    Total UC Proxy Sessions        : 2              perpetual
    Botnet Traffic Filter          : Disabled       perpetual
    Intercompany Media Engine      : Disabled       perpetual
    This platform has an ASA 5520 VPN Plus license.
    Failover cluster licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited      perpetual
    Maximum VLANs                  : 150            perpetual
    Inside Hosts                   : Unlimited      perpetual
    Failover                       : Active/Active  perpetual
    VPN-DES                        : Enabled        perpetual
    VPN-3DES-AES                   : Enabled        perpetual
    Security Contexts              : 4              perpetual
    GTP/GPRS                       : Disabled       perpetual
    SSL VPN Peers                  : 20             perpetual
    Total VPN Peers                : 750            perpetual
    Shared License                 : Disabled       perpetual
    AnyConnect for Mobile          : Enabled        perpetual
    AnyConnect for Cisco VPN Phone : Disabled       perpetual
    AnyConnect Essentials          : Enabled        perpetual
    Advanced Endpoint Assessment   : Disabled       perpetual
    UC Phone Proxy Sessions        : 4              perpetual
    Total UC Proxy Sessions        : 4              perpetual
    Botnet Traffic Filter          : Disabled       perpetual
    Intercompany Media Engine      : Disabled       perpetual
    This platform has an ASA 5520 VPN Plus license.
    Serial Number: xxxxxxxxxxx
    Running Permanent Activation Key: 0xf730cf7a 0x0449cabf 0xc922e5d4 0xc7bc5cb0 0x851ed6bb
    Configuration register is 0x1
    Configuration has not been modified since last system restart.
    ACH-2nd-EXT-ASA01#

  • ASA 5520 k8 model

    I have asa 5520 k8 model presently i am running with IOS version 8.0(4) i am upgrading to 8.2(5) is ? any license required from cisco to upgrade to this IOS, and also let me know how many site to site vpn can be configure on this device.
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled
    VPN-3DES-AES                 : Enabled
    Security Contexts            : 2
    GTP/GPRS                     : Disabled
    VPN Peers                    : 750
    WebVPN Peers                 : 2
    AnyConnect for Mobile        : Disabled
    AnyConnect for Linksys phone : Disabled
    Advanced Endpoint Assessment : Disabled
    UC Proxy Sessions            : 2
    This platform has an ASA 5520 VPN Plus license.
    Serial Number: JMX1051K2S5

    Hi,
    There is no license needed for the software upgrade
    To my understanding the device should support the mentioned 750 IPsec peers. Totally other thing is how this is in practice. Depends on other things also.
    The command "show vpn-sessiondb detail" gives a nice information on the VPN connections and limits also
    - Jouni

Maybe you are looking for