Interactive Commands in NetConfig for Cisco ASA

Hi,
Maybe anyone knows, does CiscoWorks LMS supports this feature for Cisco ASA or I'm doing something wrong? I've sent interactive command "copy tftp: flash: <R>ip_address<R>asa841-k8.bin<R><R>"  to my ASA using netconfig tool and recived error "Command(s) failed on the device Insufficient no. of interactive responses(or timeout) for command: copy tftp: flash: ." For Cisco Catalyst it works fine. I have a last version of CiscoWorks 4.0.1.

No, SWIM doesn't support ASDM upgrades, but what you're doing here is a system software upgrade.  What you might try doing is to increase the telnet timeout for this device.  Unfortunately, that feature is hidden in LMS 4.0, but see this document on how to do that:
https://supportforums.cisco.com/docs/DOC-15162
The document talks about inventory collection, but the interface to adjust the telnet timeout is in the same location as the SNMP timeout.  You'll want to time the transfer to know how long to make the timeout.

Similar Messages

  • How we archieve configuration for Cisco ASA 5500 series appliances

    Hi,
    We need to archieve configuration for Cisco ASA 5500 series appliances.
    We have Cisco works LMS 3.0.1.
    Device package installed is 4.2
    Any help would be appricated.
    Thanks in advance.
    Samir

    Hi ,
    Thanks for your answer.
    Right now we are using TACAS to login in to the ASA. That means we need single username and password to login via
    Cisoworks. Am I correct ?
    Waiting for your reply.
    thanks,
    Samir

  • Is it recommend to have a vulnerability scan for Cisco ASA device.

    Dear everyone. 
    I have a doubt on vulnerability scan for Cisco ASA device. Currently we have a vulnerability for network devices include firewall. But after run the vulnerability scan for cisco ASA, found nothing show in the scan report. 
    Is it recommend to have a vulnerability scan for Cisco ASA and will it be defeat the purpose of firewall?

    Do I understand are you asking can you configure the ASA to allow an external user run a scan against the internal network?
    If so, the answer is generally no. The ASA will, by default, not allow any inbound connections (or attempted connections) that are not explicitly allowed in an inbound access-list (applied to the outside interface). In most cases there would also need to be network address translation (NAT) rules configured.
    If you had a remote access VPN, you could allow the external scanner to log in via that, Then they would then have the necessary access to scan the internal systems (assuming the VPN granted access to all the internal networks)

  • Security monitoring tool for Cisco ASA

    Please suggest a checp and best security monitoring tool for Cisco ASA devices.

    You can use ossec, open source tool installed on linux:
    http://www.ossec.net/

  • Port Forwarding for Cisco ASA 5505 VPN

    This is the Network
    Linksys E2500 ---> Cisco ASA 5505 ---> Server
    I beleive I need to forward some ports to the asa to use the IPsec VPN I just setup. I had the SSL VPN working but only needed to forward 443 for that....I assume that IPsec tunnel is a specific port.
    Thank You

    For IPSec VPN, you need to port forward UDP/500 and UDP/4500, and remember to enable NAT-T on the ASA.
    Command to enable NAT-T on ASA:
    crypto isakmp nat-traversal 30

  • Maximum number of connection profiles and group policies for Cisco ASA

    Hi,
    We have a Cisco ASA 5520 running 8.0(2) that we use only for Remote Access VPN.
    Does anyone know how many connection profiles and group policies that are supported on the box? I have not been able to find this in the manual.
    Thanks in advance for your help!
    Best regards,
    Harry

    There is no limit for connection profiles or group policies that can be configured on ASA. However the numbers do depend upon the memory available in the device as the profiles are stored in memory during execution.

  • Manually start RADIUS, Authentication and groups for Cisco ASAs

    I am testing moving a 10.7 server to 10.8.
    We have used RADIUS to authenticate VPN traffic on our Cisco ASAs in the past.  In the past Server Admin allowed for our ASAs to be added manually to the list of devices using the service.  With Server Admin being removed and the limited funtionality of automated addition of Airports to the system I have no GUI method to get our ASAs into the service.  The ability to tell RADIUS which groups are using the service is no longer available in the GUI as well.
    I have found the clients file in /etc/raddb and added our ASAs to the clients list.  I believe I have done this correctly in accordance with the instructions on the freeRADIUS website.
    I need help with:
    1- I was hoping someone knows how to manually tell RADIUS which groups are permitted to use the service.
    2- Can anyone tell me how to turn on RADIUS?  radiusconfig -start appears to only tell the system to keep it on after a restart if i understand the manual page.
    Thanks

    With David's suggestion I was able to get RADIUS running.  The following assumes that you are comfortable with Terminal and would be able to back up any files you edit.  Here is what I did to our fresh installation of 10.8 Server:
    In Terminal enter "sudo radiusd -Xx" which tries to turn RADIUS on and runs it with full logging of activity in the window.  The last line after this entry should be something similar to "Ready to process records."  In our new installtion there were errors relating to "instantiating" sql and the ready message never came.
    In Terminal enter "sudo pico /etc/raddb/radiusd.conf" and authenticate as needed.  Scroll down in the file to the section where there are "instantiate" items.  I commented out the SQL setup, by putting a # before the line that says "sql".  Save the file by pressing Control-O, press return to save in the default location, and press Control-X to get out of the editor.  I redid step number 1 twice and eventually RADIUS was running.  Removing SQL from RADIUS will assure that problems will arise if you plan to use Server.app to add AirPorts to the network in the future.  OS X Server adds its clients in an SQL database according to the programming notes in the .conf files.  I will only be using our Cisco ASAs so SQL is not relevant to our setup.
    Testing the running RADIUS server was easy as well.  In Terminal enter "sudo pico /etc/raddb/users" and authenticate as needed.  This file contains details for users if you wanted to add them manually to the RADIUS server.  For testing purposes I removed the # before a line referring to a user "steve."  I had to get RADIUS restarted to take up the new information about Steve.  I killed the process using Activity Monitor and reran step number 1.
    In Terminal I opened a new tab and entered "sudo radtest steve testing localhost 0 testing123 -t".  You should get back a positive authentication message.  Switching back to the original tab will show the output of the RADIUS server.
    Reverse the entry in step 3 by adding back the # to comment out the line about steve in the users file.
    RADIUS is now running and authenticating against its own users file.
    Now we need to add our ASAs to the RADIUS server so it knows that it can authenticate for them.  In Terminal enter "sudo pico /etc/raddb/clients.conf".  We added lines for our ASAs, following the samples in the code.  The information in the lines we added included a generic name for each ASA or device needing RADIUS type authentication, its IP address, and the shared secret for device authentication.
    Following David's advice from above I created the RADIUS sacl by entering in Terminal "sudo dseditgroup -q -o create -u <admin user> -P <admin password> -n . com.apple.access_radius".  This created the sacl for the service.  Editing of the associated users and groups permitted to use the service was able to be done in Server.  Be sure to select from the View menu "Show system accounts".  Selecting "Groups" from the left margin of the Server window will show all of the SACLs along with any groups you have created.  The RADIUS sacl can then have groups and users added to it.
    To ensure that RADIUS is running and stays running enter the following in Terminal.  First, "sudo radiusd.conf" will start RADIUS without logging in the Terminal window.  Then, "sudo radiusconfig -start" to tell the system to keep it running and also run after a reboot.
    I made no changes to our ASA settings and found that I was able to authenticate the "Steve" user from the RADIUS test in the ASA.  I was also able to authenticate a user which had been added to the "Users" in Server.  It appears that the ASA will be permitted to authenticate Open Directory users without additional setup.
    I now need to set up our user groups to match those we use in our 10.7 server and add them to the RADIUS SACL and we should be set.
    Once I have everything running properly, I will add a post here to close this discussion.
    If anyone can shorten this procedure please let us know what you suggest.
    -Erich

  • Cisco internet filtering for cisco asa 5515x

    hi all,
    i know either websense or smartfilter (btw, mcaffee is now not selling smart filter anymore) can be used in 5515x internet filtering but does cisco have it's own filtering software for its product?  please don't give an appliance, my company is small.
    I'm tempting to use the default CLI command but there's no reporting on it i think.  Can it provide reporting for user access?  If it yes, please provide on how to do that.
    thanks!

    I just installed the ASA CX (http://www.cisco.com/en/US/products/ps12521/index.html) onto my software module on the ASA 5512-X. All it required was a SSD and license for the software. If you know anything about the Ironport Web Security Appliances, ASA CX is basically the IronPort WSA running on the sw-module of the ASA.
    The on-box version of the reporting/configuration engine (Cisco Prime Security Manager "PRSM") is simple but effective. Longer-term storage and drill-down reports requires an appliance or VMware virtual machine with the full-blown PRSM.
    The neat thing about the CX is the ability to block not just domains, but drill down and block specific application features. Say you want to block Facebook Games but not Facebook itself, it is a simple configuration on the ASA CX.
    I believe there is also a cloud version of it you can purchase, but I'm not sure of the details.
    Good luck!

  • EIGRP SHA Authentication for Cisco ASA

    Hi,
    I was just wondering if anyone knew if Cisco was going to implement EIGRP SHA authentication in to the ASAs? My organization is migrating from classic to named EIGRP for SHA authentication and right now I'm stuck at the ASA's. Static routing everything just to remove MD5 authentication doesn't sound very fun, if you know what I mean. :)
    Thanks!

    Hello Mohammad,
    I would recommend you to advertise them via EIGRP, better funcionality, escalability,etc,etc,etc.
    Regards

  • TACACS+ configuration for Cisco ASA

    I tired configuring TACACS+ configuration for ASA but unable to complete it. I have ACS 3.3 for all other Cisco Routers and Switches

    Leo,
    I was looking around and come across this post. It's very late, however, wanted to add my inputs for other community members.
    RSA Token/One-Time-Password support available with ASDM only in SINGLE ROUTED MODE. If you are in Single Routed Mode, you can do OTP with ASDM if you are running ASA 8.2+  with ASDM 6.2+.
    If the firewall is running in multi-context and transparent mode. It won't work. Below is the enhancement request that was filed for the same feature to be supported.
    CSCtf23419    ASDM OTP authentication support in multi-context and transparent modes
    With WLC is yet not possible and there is a enhancement request filed.
    CSCuf61598    WLC: Need ability to support multiple sessions via OTP authentication
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • Can anyone provide me details and fix for Shell Shock vulnerability for Cisco ASA version 5?

    We came to know frm our compliance team that we are running into shell shock vulnerabity therefore wanted to know the fix and document..

    Hi James,
    We do have a PSIRT filed for shell shock vulnerability, please refer details below:
    CSCur00511    ACS evaluation for CVE-2014-6271 and CVE-2014-7169
    https://tools.cisco.com/bugsearch/bug/CSCur00511/?reffering_site=dumpcr
    Here is the fixed code information for individual versions:
    Fixed Code:
    Patch for DDTS CSCur00511 is ready and available on CCO.
    The patch is included in all cumulative patches from version 5.4.0.46.7/5.5.0.46.6/5.6.0.22.1 and later. We recommend that you download the latest cumulative patches.
    Download from: CCO / Support / Download Software http://www.cisco.com/cisco/pub/software/portal/select.html?i=!y
    Select: Security / Identity Management / Cisco Secure Access Control System / Cisco Secure Access Control System 5.4 / 5.4.0.46.0
    Patch filename: 5-4-0-46-.tar.gpg
    Readme and installaion instructions: Acs-5-4-0-46--Readme.txt
    Download from: CCO / Support / Download Software http://www.cisco.com/cisco/pub/software/portal/select.html?i=!y
    Select: Security / Identity Management / Cisco Secure Access Control System / Cisco Secure Access Control System 5.5 / 5.5.0.46
    Patch filename: 5-5-0-46-.tar.gpg
    Readme and installaion instructions: Acs-5-5-0-46--Readme.txt
    Download from: CCO / Support / Download Software http://www.cisco.com/cisco/pub/software/portal/select.html?i=!y
    Select: Security / Identity Management / Cisco Secure Access Control System / Cisco Secure Access Control System 5.6 / 5.6.0.22
    Patch filename: 5-6-0-22-.tar.gpg
    Readme and installaion instructions: Acs-5-6-0-22--Readme.txt
    Download from: CCO / Support / Download Software http://www.cisco.com/cisco/pub/software/portal/select.html?i=!y
    Select: Security / Identity Management / Cisco Secure Access Control System / Cisco Secure Access Control System 5.3 / 5.3.0.40
    Patch filename: 5-3-0-40-.tar.gpg
    Readme and installaion instructions: Acs-53-Readme.txt
    Regards,
    Tushar Bangia
    Please do rate the post if you find it helpful!!

  • Azure Site to Site VPN with Cisco ASA 5505

    I have got Cisco ASA 5505 device (version 9.0(2)). And i cannot connect S2S with azure (azure network alway in "connecting" state). In my cisco log:
    IP = 104.40.182.93, Keep-alives configured on but peer does not support keep-alives (type = None)
    Group = 104.40.182.93, IP = 104.40.182.93, QM FSM error (P2 struct &0xcaaa2a38, mess id 0x1)!
    Group = 104.40.182.93, IP = 104.40.182.93, Removing peer from correlator table failed, no match!
    Group = 104.40.182.93, IP = 104.40.182.93,Overriding Initiator's IPSec rekeying duration from 102400000 to 4608000 Kbs
    Group = 104.40.182.93, IP = 104.40.182.93, PHASE 1 COMPLETED
    I have done all cisco s2s congiguration over standard wizard cos seems your script for 8.x version of asa only?
    (Does azure support 9.x version of asa?)
    How can i fix it?

    Hi,
    As of now, we do not have any scripts for Cisco ASA 9x series.
    Thank you for your interest in Windows Azure. The Dynamic routing is not supported for the Cisco ASA family of devices.
    Unfortunately, a dynamic routing VPN gateway is required for Multi-Site VPN, VNet to VNet, and Point-to-Site.
    However, you should be able to setup a site-to-site VPN with Cisco ASA 5505 series security appliance as
    demonstrated in this blog:
    Step-By-Step: Create a Site-to-Site VPN between your network and Azure
    http://blogs.technet.com/b/canitpro/archive/2013/10/09/step-by-step-create-a-site-to-site-vpn-between-your-network-and-azure.aspx
    You can refer to this article for Cisco ASA templates for Static routing:
    http://msdn.microsoft.com/en-us/library/azure/dn133793.aspx
    Did you download the VPN configuration file from the dashboard and copy the content of the configuration
    file to the Command Line Interface of the Cisco ASDM application? It seems that there is no specified IP address in the access list part and maybe that is why the states message appeared.
    According to the
    Cisco ASA template, it should be similar to this:
    access-list <RP_AccessList>
    extended permit ip object-group
    <RP_OnPremiseNetwork> object-group <RP_AzureNetwork>
    nat (inside,outside) source static <RP_OnPremiseNetwork>
    <RP_OnPremiseNetwork> destination static <RP_AzureNetwork>
    <RP_AzureNetwork>
    Based on my experience, to establish
    IPSEC tunnel, you need to allow the ESP protocol and UDP Port 500. Please make sure that the
    VPN device cannot be located behind a NAT. Besides, since Cisco ASA templates are not
    compatible for dynamic routing, please make sure that you chose the static routing.
    Since you configure the VPN device yourself, it's important that you would be familiar with the device and its configuration settings.
    Hope this helps you.
    Girish Prajwal

  • Azure multiple site-to-site VPNs (dynamic gateway) with Cisco ASA devices

    Hello
    I've been experimenting with moving certain on-premise servers to Azure however they would need a site-to-site VPN link to our many branch sites e.g. monitoring of nodes.
    The documentation says I need to configure a dynamic gateway to have multiple site-to-site VPNs. This is not a problem for our typical Cisco ISR's. However three of our key sites use Cisco ASA devices which are listed as 'Not Compatible' with dynamic routing.
    So I am stuck...
    What options are available to me? Is there any sort of tweak-configuration to make a Cisco ASA work with Azure and dynamic routing?
    I was hoping Azure's VPN solution would be very flexible.
    Thanks

    Hello RTF_Admin,
    1. Which is the Series of CISCO ASA device you are using?
    Thank you for your interest in Windows Azure. The Dynamic routing is not supported for the Cisco ASA family of devices.
    Unfortunately, a dynamic routing VPN gateway is required for Multi-Site VPN, VNet to VNet, and Point-to-Site.
    However, you should be able to setup a site-to-site VPN with Cisco ASA 5505 series security appliance as demonstrated in this blog:
    Step-By-Step: Create a Site-to-Site VPN between your network and Azure
    http://blogs.technet.com/b/canitpro/archive/2013/10/09/step-by-step-create-a-site-to-site-vpn-between-your-network-and-azure.aspx
    You can refer to this article for Cisco ASA templates for Static routing:
    http://msdn.microsoft.com/en-us/library/azure/dn133793.aspx
    If your requirement is only for Multi-Site VPN then there is no option but to upgrade the device as Multisite VPN requires dyanmic routing and unfortunately there is no tweak or workaround due to hardware compatibility issue.
    I hope that this information is helpful
    Thanks,
    Syed Irfan Hussain

  • Link State Tracking in Cisco ASA

    Dear ASA Guru,
    Is there any feature like Link State Tracking in Catalyst for Cisco ASA. I want to shutdown another interface if one interface is down in Cisco ASA.
    Best Regards,
    Rizal Ferdiyan

    AFAIK - this is not an available feature.
    HTH>

  • CISCO ASA RECOMMENDATION

    Dears,
    Please provide a recommendation for CISCO ASA as below
    Firewall + Licenses with function below:
    - Work as proxy server
    - Load Balancer
    - Router with support at least 4 server.

    Anyone? ??
    Sent from Cisco Technical Support Android App

Maybe you are looking for

  • Photoshop elements 10 wont open

    I have uninstalled and reinstalled the program.  I can't get it to run or open or anything.  Sometimes there is a quick flash but usually it will not do anything

  • Settlement to cost center posted for statistical WBS element

    We have the following scenario Statistical WBS elements with assigned Cost center posted for actual postings Network assigned to statistical WBSE and settlement rule on the same WBSE On settlement run CJ88  the network costs are transferred from netw

  • XML loader and UTF-16 - throws Content is not allowed in prolog

    Hi, Our ECC system is updated to unicode system recently. Now the iDoc downloaded from ECC is having a tag <?xml version="1.0" encoding="utf-16"?>. The XML Loader in the transaction throws an exception "Cannot perform action on XML document Content i

  • Using 2 internal HD's

    On my G5 Dual 2.5 with OS 10.5.1 startup on the 160gig HD....I have just added a 500gig internal HD (465gig actual) and it is desk mounted. I want to keep the OS and all my applications on the 160gig HD and all my files/docs (lots of music files) on

  • Retrieving original admin password from sleep mode

    Just set up my computer running OS X, put the computer to sleep and either I typed my password incorrectly originally or I forgot my password. How do I reset or retrieve my password?