IPSec Pass Through on ASA
I have a third party firewall behind a Cisco ASA. The Cisco ASA is doing PAT as there are no other IP addresses available. The third party firewall is attempting to build an IPSec tunnel to another firewall. The IPSec tunnel is not coming up. When I do a capture on the Cisco ASA firewall I see traffic hit the inside interface and leave the outside interface. I then see the reply traffic return and hit the outside interface of my Cisco ASA but it is not being allowed to pass through to the inside interface.I have enabled NAT-T on the thrid party firewall but it still does not get the reply traffic becuase it gets stopped at the Cisco ASA.
Any thoughts?
Is your third party FW attached directly to your ASA? If not, do you have a route to that device on your ASA?
Please perform a packet-tracer to see why the return traffic is not reaching the third party FW..
packet-tracer input outside udp 500 500 detail
If the packet-tracer shows traffic going through successfully, perhaps it is your third party FW that is blocking the traffic?
Please reply with packet-tracer results.
Kind Regards,
Kevin
**Please remember to rate helpful posts as well as mark the question as 'answered' once your issue is resolved. This will help others to find your solution faster.
Similar Messages
-
IPSec pass-through in IOS router
Is there any command need to enable IPSec pass-through on 2800 router?
Assuming there are no ACLs on the interfaces, no. If there are ACL's on the interface(s) then you will need to allow it through via the ACL.
HTH and please rate. -
Does the airport extreme base support ipsec pass-through for the Cisco VPN client?
ie Can I create a VPN from a workstation connected to the base?
Thanks.Hello dweldon. Welcome to the Apple Discussions!
Try the following...
802.11n AirPort Extreme Base Station (AEBSn) – Cisco VPN Setup
- Run the Admin Utility
- Click on Internet
- Click on DHCP
- Add a DHCP reservation for the IP address that is assigned to the machine you are connecting via VPN
- Click on NAT
- Check the option Enable Default Host At and enter the IP Address that you made a reservation for in the previous step.
- Click on Advanced (Main menu at top)
- Click on Ports
- Click the add button (bottom left)
- Service=DO NOT CHANGE
- Public UDP Port(s) = 1723,1701
- Public TCP Port(s) = BLANK
- Private IP address = Use address from Step 4
- Private UDP Port(s) = 1723,1701
- Private TCP Port(s) = BLANK
- Click Continue
- Give your setup a name, like Cisco VPN (call it what you want)
- Click DONE
- Click UPDATE -
RV042G cannot support more than 2-3 IPSec Pass through connections
Hi,
I'm trying to figure out what the max number of IPSec VPN pass through connections the RV042G can handle. We bought an RV042G router to replace our old RV042 box which was running into connection limitations. There are approximately 15 people in the office and anywhere from 5-8 of them need to vpn to a single client site. There seems to be an issue with UPNP where it creates the proper port forwarding but doesn't associate it with an internal IP address. Giving each workstation a static internal IP doesn't solve this issue. The remote site we are connecting to does have NAT-T turned on. What ends up happening is that after a while, users cannot vpn. Sometimes it happens with fewer than three users. Clearing the UPNP and rebooting the router helps but eventually if you connect and disconnect, a few times, you're hosed. The UPNP doesn't release the setting it makes in a timely fashion. Is there any way to fix this besides turning off UPNP which we need for other software to work?Lenovo support (for me in Canada at least) is based in Atlanta, so I'm surprised you found a tech with bad English...
Your problems sound like windows problems, not hardware problems -- are you running XP or Windows7? If you google based on your OS, there are threads to be found on slowing down the start menu behaviors. -
AAA Authentication for Traffic Passing through ASA
I am setting up AAA authentication for traffic that will pass through my ASA. I am having difficulty enabling 'aaa authentication secure-http-client'. Without secure communications enabled access functions as expected. When I enable access, I get prompted for a username/password. The username/password is entered. Authentication passes (show uauth). The requested page (http://www.cisco.com) switches to https://x.x.x.x (a resolved IP address for the site). Eventually (5 seconds), I am asked to accept or deny a certificated. Interestingly, the certificate is for the ASA and not the requested site (http://www.cisco.com).
Am I missing something?
firewall# show run aaa
aaa authentication http console TACACS+ LOCAL
aaa authentication telnet console TACACS+ LOCAL
aaa authentication serial console TACACS+ LOCAL
aaa authentication ssh console TACACS+ LOCAL
aaa authentication enable console TACACS+ LOCAL
aaa authentication match guestnetwork_access guestnetwork RADIUS
aaa authentication secure-http-client
firewall# show access-li guestnetwork_access
access-list guestnetwork_access; 2 elements
access-list guestnetwork_access line 1 extended deny udp 10.255.255.0 255.255.255.0 any eq domain (hitcnt=33)
access-list guestnetwork_access line 2 extended permit ip 10.255.255.0 255.255.255.0 any (hitcnt=412)
firewall# show run aaa-s
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host 192.168.250.14
key xxxxx
firewall# show run http
http server enableyour definition for the aaa-server is different to the aaa authentication server-group
try
aaa authentication http console RADIUS LOCAL
aaa authentication telnet console RADIUS LOCAL -
Hi Guys,
This is a little bit of an odd request however I need to allow a sync routing due to some legacy routing to pass through my ASA.
I have allowed IP any any between the particular hosts involved to allow for high ports etc..
However the ASA is tearing down the session as it never see's the ACK.
Hence is there a way to turn off the ip inspection or some other way to get this traffic through the firewall.
Thanks
ScottOn an iPad I don't believe that you can. If you made the iPad tunnel through your laptop or desktop computer is may be possible to specify what traffic you want sent through the VPN or otherwise. But I have a feeling that would be very complicated to setup and keep working well.
-
Cisco ASA 5505 L2TP Pass through
I am having trouble with L2TP pass through on an ASA 5505 device.
L2TP server: OSX 10.6
I can connect with any OSX system and it works fine straight away.
When connecting with a windows computer I get a 789 error. "Error 789: The L2TP connection attempt failed because the security layer encountere a processing error during the initial negotiations with the remote computer."
I did not setup or configure the device to start with and apart from this issue its working fine so I am hessitant at trying to just mess around too much to try and find the problem.
I am using the ASDM 6.4 to manage the device.
Ports look to be forwarded correctly; 1701, 4500 & 500 UDP.
Im just looking for other common issues?
RobBelow is the commands you wanted.
Where you see: IPNOTWHATIWASEXPECTING
This is an IP I dont know. possible and old IP address.
and
default-domain value domain-notcorrect.local
This is an old domain from years ago.
Result of the command: "show run crypto"
crypto ipsec transform-set aes-sha esp-aes esp-sha-hmac
crypto ipsec transform-set aes-192-sha esp-aes-192 esp-sha-hmac
crypto ipsec transform-set aes-256-sha esp-aes-256 esp-sha-hmac
crypto ipsec transform-set 3des-sha esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set transform-amzn esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map map-dynamic 1 set pfs group5
crypto dynamic-map map-dynamic 1 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto dynamic-map map-dynamic 2 set pfs
crypto dynamic-map map-dynamic 2 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto dynamic-map map-dynamic 3 set pfs
crypto dynamic-map map-dynamic 3 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto dynamic-map map-dynamic 4 set transform-set aes-256-sha aes-192-sha aes-sha 3des-sha
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer IPNOTWHATIWASEXPECTING3
crypto map outside_map 1 set transform-set ESP-DES-SHA
crypto map outside_map 2 match address acl-amzn
crypto map outside_map 2 set pfs
crypto map outside_map 2 set peer IPNOTWHATIWASEXPECTING IPNOTWHATIWASEXPECTING
crypto map outside_map 2 set transform-set transform-amzn
crypto map outside_map 255 ipsec-isakmp dynamic map-dynamic
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto isakmp policy 2
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 3
authentication pre-share
encryption aes-256
hash sha
group 1
lifetime 86400
crypto isakmp policy 11
authentication pre-share
encryption aes-192
hash sha
group 5
lifetime 86400
crypto isakmp policy 12
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 13
authentication pre-share
encryption aes-192
hash sha
group 1
lifetime 86400
crypto isakmp policy 21
authentication pre-share
encryption aes
hash sha
group 5
lifetime 86400
crypto isakmp policy 22
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 23
authentication pre-share
encryption aes
hash sha
group 1
lifetime 86400
crypto isakmp policy 31
authentication pre-share
encryption 3des
hash sha
group 5
lifetime 86400
crypto isakmp policy 32
authentication rsa-sig
encryption des
hash sha
group 1
lifetime 86400
crypto isakmp policy 33
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp policy 34
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
Result of the command: "show run group-policy"
group-policy evertest internal
group-policy evertest attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy petero internal
group-policy petero attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy awsfilter internal
group-policy awsfilter attributes
vpn-filter value amzn-filter
group-policy vpnpptp internal
group-policy vpnpptp attributes
dns-server value 10.100.25.252
vpn-tunnel-protocol l2tp-ipsec
group-policy vanheelm internal
group-policy vanheelm attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy ciscoVPNuser internal
group-policy ciscoVPNuser attributes
dns-server value 10.100.25.10
vpn-idle-timeout 720
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy chauhanv2 internal
group-policy chauhanv2 attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy oterop internal
group-policy oterop attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
group-policy Oterop internal
group-policy Oterop attributes
dns-server value 10.100.25.252
vpn-idle-timeout 30
group-policy chauhanv internal
group-policy chauhanv attributes
dns-server value 10.100.25.252
vpn-idle-timeout 30
vpn-tunnel-protocol IPSec l2tp-ipsec
group-policy bnixon2 internal
group-policy bnixon2 attributes
dns-server value 10.100.25.252
vpn-idle-timeout 720
vpn-tunnel-protocol IPSec l2tp-ipsec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnsplittunnel
default-domain value domain-notcorrect.local
Result of the command: "show run tunnel-group"
tunnel-group ciscoVPNuser type remote-access
tunnel-group ciscoVPNuser general-attributes
address-pool vpnippool
default-group-policy ciscoVPNuser
tunnel-group ciscoVPNuser ipsec-attributes
pre-shared-key *****
tunnel-group petero type remote-access
tunnel-group petero general-attributes
address-pool vpnippool
default-group-policy petero
tunnel-group petero ipsec-attributes
pre-shared-key *****
tunnel-group oterop type remote-access
tunnel-group oterop general-attributes
address-pool vpnippool
default-group-policy oterop
tunnel-group oterop ipsec-attributes
pre-shared-key *****
tunnel-group vanheelm type remote-access
tunnel-group vanheelm general-attributes
address-pool vpnippool
default-group-policy vanheelm
tunnel-group vanheelm ipsec-attributes
pre-shared-key *****
tunnel-group chauhanv type remote-access
tunnel-group chauhanv general-attributes
default-group-policy chauhanv
tunnel-group Oterop type remote-access
tunnel-group Oterop general-attributes
default-group-policy Oterop
tunnel-group chauhanv2 type remote-access
tunnel-group chauhanv2 general-attributes
address-pool vpnippool
default-group-policy chauhanv2
tunnel-group chauhanv2 ipsec-attributes
pre-shared-key *****
tunnel-group bnixon2 type remote-access
tunnel-group bnixon2 general-attributes
address-pool vpnippool
default-group-policy bnixon2
tunnel-group bnixon2 ipsec-attributes
pre-shared-key *****
tunnel-group vpnpptp type remote-access
tunnel-group vpnpptp general-attributes
address-pool vpnippool
default-group-policy vpnpptp
tunnel-group IPNOTWHATIWASEXPECTING4 type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING4 ipsec-attributes
pre-shared-key *****
tunnel-group evertest type remote-access
tunnel-group evertest general-attributes
address-pool vpnippool
default-group-policy evertest
tunnel-group evertest ipsec-attributes
pre-shared-key *****
tunnel-group evertest ppp-attributes
authentication ms-chap-v2
tunnel-group IPNOTWHATIWASEXPECTING3 type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING3 ipsec-attributes
pre-shared-key *****
tunnel-group IPNOTWHATIWASEXPECTING2 type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING2 general-attributes
default-group-policy awsfilter
tunnel-group IPNOTWHATIWASEXPECTING2 ipsec-attributes
pre-shared-key *****
isakmp keepalive threshold 10 retry 3
tunnel-group IPNOTWHATIWASEXPECTING type ipsec-l2l
tunnel-group IPNOTWHATIWASEXPECTING general-attributes
default-group-policy awsfilter
tunnel-group IPNOTWHATIWASEXPECTING ipsec-attributes
pre-shared-key *****
isakmp keepalive threshold 10 retry 3
Result of the command: "show vpn-sessiondb detail remote filter protocol L2TPOverIPsec"
INFO: There are presently no active sessions of the type specified
Result of the command: "show vpn-sessiondb detail remote filter protocol L2TPOverIPsecOverNAT"
INFO: There are presently no active sessions of the type specified -
Passing Public IPs through multiple ASA's (Part 2) - Continued
This is the continuation of an issue posted on : https://supportforums.cisco.com/discussion/12463791/passing-public-ips-through-multiple-asas-part-1
Here is a Show Run from the 5510 (heavily filtered)
names
name 10.40.0.0 MCST-FW-Net
name 70.x.x.179 Masked_FW_Outside
name 70.x.x.185 Dummy description Placeholder for 182
name 10.40.128.25 EMAIL
name 10.40.0.4 OpenVPN
name 68.x.x.176 NEW_WAN
name 10.39.0.2 CORE-ASA
name 70.x.x.224 PublicIPs
dns-guard
interface Ethernet0/0
nameif outside
security-level 0
ip address 68.x.x.178 255.255.255.240
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.40.0.1 255.255.255.0
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
interface Management0/0
shutdown
no nameif
no security-level
no ip address
management-only
boot system disk0:/asa825-13-k8.bin
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
domain-name MASKED
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service TCP-Services tcp
port-object eq 10101
port-object eq 123
port-object range 15000 19999
port-object eq 2000
port-object eq 2195
port-object eq 2196
port-object eq 5038
port-object eq 5061
port-object eq 5228
port-object eq 5229
port-object eq 5230
port-object eq 5432
port-object eq h323
port-object eq www
port-object eq https
port-object eq kerberos
port-object eq ldap
port-object eq ldaps
port-object eq sip
port-object eq smtp
port-object eq ssh
port-object eq citrix-ica
port-object eq 943
port-object eq pptp
port-object eq imap4
object-group service UDP-Services udp
port-object eq 1718
port-object eq 1719
port-object eq 2727
port-object eq 3478
port-object eq 4500
port-object eq 4520
port-object eq 4569
port-object eq 5000
port-object range 50000 54999
port-object range 60000 61799
port-object eq 88
port-object eq domain
port-object eq sip
port-object eq syslog
port-object eq ntp
port-object eq 1194
port-object eq 8888
object-group protocol VPN-Traffic
protocol-object esp
protocol-object ah
object-group service TCP-Services-Inbound
service-object esp
service-object tcp eq 5228
service-object tcp eq 5229
service-object tcp eq 5230
service-object tcp eq 5432
service-object tcp eq ssh
object-group service UDP-Services-Inbound udp
port-object eq 4500
port-object eq domain
port-object eq isakmp
object-group network test
network-object 10.40.0.2 255.255.255.255
object-group service DM_INLINE_UDP_2 udp
port-object eq 4500
port-object eq isakmp
object-group icmp-type DM_INLINE_ICMP_1
icmp-object echo
icmp-object echo-reply
object-group icmp-type DM_INLINE_ICMP_2
icmp-object echo
icmp-object echo-reply
object-group service DM_INLINE_TCP_2 tcp
group-object Samsung_TCP_Ports
port-object eq www
port-object eq https
object-group network DM_INLINE_NETWORK_1
network-object MCST-FW-Net 255.255.0.0
network-object 70.x.x.160 255.255.255.224
object-group service DM_INLINE_SERVICE_1
service-object tcp eq 1701
service-object udp eq 4500
service-object udp eq isakmp
service-object udp eq ntp
service-object tcp eq www
object-group service DM_INLINE_SERVICE_2
service-object tcp eq https
service-object udp eq 1194
service-object udp eq 8080
object-group service DM_INLINE_SERVICE_3
service-object icmp
service-object tcp eq https
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object udp
protocol-object tcp
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object udp
protocol-object tcp
object-group network publicips
access-list inside_access_in extended permit ip PublicIPs 255.255.255.240 any
access-list inside_access_in extended permit ip host 70.x.x.225 any
access-list inside_access_in extended permit ip host 70.x.x.236 any
access-list inside_access_in extended permit udp MCST-FW-Net 255.255.0.0 any object-group UDP-Services log
access-list inside_access_in extended permit tcp MCST-FW-Net 255.255.0.0 any object-group TCP-Services log
access-list inside_access_in extended permit esp MCST-FW-Net 255.255.0.0 any log
access-list inside_access_in extended permit udp MCST-FW-Net 255.255.0.0 any object-group DM_INLINE_UDP_2 log
access-list inside_access_in extended permit tcp MCST-FW-Net 255.255.0.0 any object-group DM_INLINE_TCP_2 log
access-list inside_access_in extended permit icmp MCST-FW-Net 255.255.0.0 any log
access-list inside_access_in extended permit tcp 10.10.10.0 255.255.255.0 any eq 873 inactive
access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 host OpenVPN any
access-list inside_access_in extended permit udp host 70.x.x.182 any eq 1194
access-list inside_access_in extended permit tcp host 70.x.x.182 any eq ssh
access-list inside_access_in extended permit ip host 70.x.x.231 any log
access-list inside_access_in extended permit ip host 70.x.x.232 any
access-list inside_access_in extended permit ip host 70.x.x.233 any log
access-list inside_access_in extended permit ip NEW_WAN 255.255.255.248 interface inside inactive
access-list inside_access_in extended deny ip any any log
access-list inside extended permit tcp 70.x.x.240 255.255.255.240 72.x.x.64 255.255.255.224 object-group TCP-Services
access-list inside extended permit udp 70.x.x.240 255.255.255.240 72.x.x.64 255.255.255.224 object-group UDP-Services
access-list outside extended permit udp 72.x.x.64 255.255.255.224 70.x.x.240 255.255.255.240 object-group UDP-Services
access-list outside extended permit tcp 72.x.x.64 255.255.255.224 70.x.x.240 255.255.255.240 object-group TCP-Services
access-list outside_access_in remark STEALTH RULE
access-list outside_access_in extended deny ip any host Masked_FW_Outside log
access-list outside_access_in extended permit ip any PublicIPs 255.255.255.240
access-list outside_access_in extended permit ip any host 70.x.x.225
access-list outside_access_in extended permit ip any host 70.x.x.231 log
access-list outside_access_in extended permit ip any host 70.x.x.232
access-list outside_access_in extended permit ip any host 70.x.x.233 log
access-list outside_access_in extended permit ip any host 70.x.x.236 log
access-list outside_access_in extended permit esp any 70.x.x.160 255.255.255.224 log
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any 70.x.x.160 255.255.255.224 log
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any 70.x.x.160 255.255.255.224
access-list outside_access_in extended permit udp any host 70.x.x.182 eq 1194
access-list outside_access_in extended permit tcp any host 70.x.x.182 eq ssh
access-list outside_access_in remark Ping
access-list outside_access_in extended permit icmp any host 10.40.0.33 inactive
access-list outside_access_in extended permit tcp any 70.x.x.160 255.255.255.224 object-group TCP-Services inactive
access-list outside_access_in extended permit udp any 70.x.x.160 255.255.255.224 object-group UDP-Services inactive
access-list outside_access_in extended permit ip PublicIPs 255.255.255.240 NEW_WAN 255.255.255.248 inactive
access-list outside_access_in extended deny ip any any log
access-list Mobility_Infrastructure_access_in remark Ping Test
access-list inside_access_out extended permit ip any any log
access-list inside_access_out extended permit esp any object-group DM_INLINE_NETWORK_1 log
access-list inside_access_out extended permit icmp any any
access-list Inside2_access_in extended permit ip 10.39.0.0 255.255.255.0 any
access-list Inside2_access_in extended permit ip any 10.39.0.0 255.255.255.0
pager lines 24
logging enable
logging timestamp
logging console debugging
logging monitor informational
logging buffered debugging
logging trap informational
logging history critical
logging asdm warnings
logging device-id hostname
mtu outside 1500
mtu inside 1500
ip verify reverse-path interface outside
ip verify reverse-path interface inside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-647.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 70.x.x.182 10.40.0.7 netmask 255.255.255.255
static (inside,outside) 70.x.x.180 10.40.0.2 netmask 255.255.255.255
static (inside,outside) 70.x.x.181 10.40.0.17 netmask 255.255.255.255
static (outside,inside) 10.40.0.7 70.x.x.182 netmask 255.255.255.255
static (outside,inside) 10.40.0.2 70.x.x.180 netmask 255.255.255.255
static (outside,inside) 10.40.0.17 70.x.x.181 netmask 255.255.255.255
static (inside,outside) PublicIPs PublicIPs netmask 255.255.255.240
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
route outside 0.0.0.0 0.0.0.0 68.101.41.177 1
route inside 10.40.64.0 255.255.192.0 10.40.0.17 1
route inside 10.40.128.0 255.255.192.0 10.40.0.17 1
route inside 10.50.0.0 255.255.255.0 10.40.0.21 1
route inside 10.50.0.11 255.255.255.255 10.40.0.21 1
route inside 10.50.112.0 255.255.255.0 10.40.0.21 1
route inside 10.60.0.233 255.255.255.255 10.40.0.21 1
route inside PublicIPs 255.255.255.224 10.40.0.21 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
http server enable
http server session-timeout 10
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no sysopt connection permit-vpn
sysopt noproxyarp inside
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
console timeout 30
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
webvpn
service-type nas-prompt
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
service-policy global_policy global
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:bd962a8c0dd6b27b5b024778602f8b60
: end -
Tracing a route passing through ASA
Hi Everyone,
Need help on tracing a route IP 192.168.27.0 that is passing through ASA
i did sh route on ASA
S 192.168.27.0 255.255.255.0 [1/0] via 192.168.101.14, Xnet
so this means that this ASA is learning this route statically through int Xnet right ?
when i do sh int on ASA it shows Xnet as interface.
what should be my next step?
also i am able to ping this IP from ASA but whne i do sh arp it does not show this IP 192.168.27.251 and mac address
Thanks
Mahesh
Message was edited by: mahesh parmarSo I presume you have ASA5550 or you have bought addiotional 4 GigabitEthernet module.
When you look at the ASA from the side where the physical ports are
The usual ports (without the module) should be in the Right side
The modules ports should be on the Left side
The module should contain 8 ports
4 Ports are for SFP slots (usually for fiber connections)
4 Ports are for basic Ethernet connectivity
The configuration should have some line "media-type" which defines which type is used "rj45" of "sfp"
rj45 for Ethernet
sfp for SFP module
So GigabitEthernet 1/2 port should be to my understanding either the Third Ethernet or Third SFP port of the module depending on the above port configuration mentioned (media-type rj45/sfp)
The ports GigabitEthernet0/0 - x are the ports that are in every ASA, Ports GigabitEthernet1/0 - x are the expansion modules ports
Hope this helps. Hopefully I remembered that right.
- Jouni -
Cisco ASA - Pass Through QoS Traffic
Hi Sirs,
Given the following topology:
Switch - IP Phone (Branch) |----| Router |----| MPLS |----| Router |----| ASA |----| Switch - Voice Network (Head Office)
My question, the ASA can impact the QoS traffic to pass through it?
Thank you!
Rafael TrujilhoHi Andrew,
I want the ASA does NOT take any markings, NOT impacting the quality applied to voice traffic.
Regards,
Trujilho -
Slow SFTP throughput when passed through ASA 55xx
I have an interesting scenario. I have setup two test boxes for SFTP. One in a DMZ behind an ASA inteface, and the other on our external switch. If I send a file to the one on the external switch, I get 40 Mbps on a transfer from a remote location. When I try the same transfer but using a machine in the same DMZ, I get 100 Mbps while connected to a FastEthernet switchport. When I try the same transfer from the remote location previously mentioned, to the same server even, but using SFTP, my throughput goes down to 670 KB/s. I get that same low speed even on the machine on the external switch to the DMZ. It should be much faster since there is no latency involved. It just goes to the switch to the ASA interface to the SFTP server. I even tried this across two different ASA, same result. One was a 5505, the other a 5520.
So, it seems the only limiting factor here is the ASA. Does anyone have any observations or suggestions that might help?
Thanks!Sorry, I should have been more clear. The throughput is only reduced when the ASA is in the picture and SFTP is used. I can FTP to the same server, same application, just different protocol, and get full throughput. As soon as I select SFTP instead of FTP, the throughput drops dramatically.
I know it is not the over head on the server, because I tested an SFTP transfer from a client machine on the same LAN, and got full throughput. It is only when going through the ASA that the SFTP throughput drops by a factor of 7 -
Considerations for an IPSEC tunnel through another IPSEC tunnel
Hi,
I am trying to ipmlement a IPSEC "tunnel through a tunnel" as follows:
ASA-1 ( inside network 10.10.10.0 /24 - outside network 1.1.1.1/30) to ASA-2 (outside network 1.1.1.2/30 - inside network 20.20.20.0/24)
This tunnel is fully functional.
Created a DMZ interface (2.2.2.1/30) on ASA-1
Created a DMZ interface (2.2.2.2/30) on ASA-2
Attached ASA-A outside interface to ASA-1 DMZ interface - inside network 30.30.30.0/24
Attached ASA-B outside interface to ASA-2 DMX interface - inside network 40.40.40.0/24
Created an ACL on ASA-1 and ASA-2 DMZ interfaces allowing ESP,IKE traffic
2nd tunnel not working!
Questions
Should I add the DMZ /30's to the crypto map of ASA-1 and ASA-2 (I did, and it did still not work)
Should there be a route statement for the /30's on ASA-1 and ASA-2, or should the default GW be sufficient?
Any and all help will be appreciated!
Davepost config for review
-
Data has changed after passing through FIFO?
Dear experts,
I am currently working on a digital triangular shaping using the 7966R FPGA + 5734 AI. I am using LabView 2012 SP1.
Some days ago I have encountered a problem with my FIFOs that I have not been able to solve since. I'd be glad if somebody could point out a solution/ my error.
Short description:
I am writing U16 variables between ~32700-32800 to a U16 configured FIFO. The FIFO output does not coincide with the data I have been writing to the FIFO but is rather bit-shifted or something is added. This problem does not occure if I execute the VI on the dev. PC with simulated input.
What I have done so far:
I am reading all 4 channels of the 5734 inside a SCTL. The data is stored in 4 feedback nodes I am applying a triangular shaping to channel 0 and 1 by using 4 FIFOs that have been prefilled with a predefined number of zeros to serve as buffers. So it's something like (FB = Feedback node):
A I/O 1 --> FB --> FIFO 1 --> FB --> FIFO 2 --> FB --> Do something
A I/O 2 --> FB --> FIFO 3 --> FB --> FIFO 4 --> FB --> Do something
This code shows NO weird behaviour and works as expected.
The Problem:
To reduce the amount of FIFOs needed I then decided to interleave the data and to use only 2 FIFOs instead of 4. You can see the code in the attachment. As you can see I have not really changed anything to the code structure in general.
The input to the FIFO is a U16. All FIFOs are configured to store U16 data.
The data that I am writing to the FIFO can be seen in channel 0 of the output attachment.
The output after passing through the two FIFOs can be seen in channel 2 of the same picture.
The output after passing through the first FIFO (times 2) can be seen in channel 3 of the picture.
It looks like the output is bit-shifted and truncated as it enters Buffer 1. Yet the difference between the input and output is not exactly a factor of 2. I also considered the possibility that the FIFO adds both write operations (CH0 + CH1) but that also does not account for the value of the output.
The FIFOs are all operating normally, i.e. none throws a timeout. I also tried several different orders of reading/writing to the FIFOs and different ways of ensuring this order (i.e. case strucutres, flat and stacked sequence). The FIFOs are also large enough to store the amount of data buffered no matter if I write or read first.
Thank you very much,
Bjorn
Attachments:
FPGA-code.png 61 KB
FPGA-output.png 45 KBDuring the last couple of days I tried the following:
1. Running the FPGA code on the development PC with simulated I/O. The behavior was normal, i.e. like I've intended the code to perform.
2. I tested the code on the development PC with the square and sine wave generation VI as 'simulated' I/O. The code performed normal.
3. I replaced the FIFOs with queues and ran my logic on the dev. PC. The logic performed totally normal.
4. Right now the code is compiling with constants as inputs like you suggested...
I am currently trying to get LabView 2013 on the development machine. It seems like my last real hope is that the issue is a bug in the XILINX 13.4 compiler tools and that the 14.4 tools will just make it disappear...
Nevertheless I am still open for suggestions. Some additional info about my FIFOs of concerne:
Buffer 1 and 2:
- Type: Target Scoped
- Elements Requested: 1023
- Implementation: Block Memory
- Control Logic: Target Optimal
- Data Type: U16
- Arbitrate for Read: Never Arbitrate
- No. Elements Per Read: 1
- Arbitrate for Write: Never Arbitrate
- No. Elements Per Write: 1
The inputs from the NI 5734 are U16 so I am wirering the right data type to the FIFOs. I also don't have any coercion dots within my FPGA VI. And so far it has only occured after the VI has been compiled onto the FPGA. Could some of the FIFOs/block memory be corrupted because we have written stuff onto the FPGA too often? -
How can I have each pass through a for loop communicate with a new indicator?
Hello,
I am using 16 color boxes to indicate how 16 channels are behaving. If a color box is blue, its respective channel is running correctly, red means it has failed etc. I am continuously checking each channel using a loop, and I wanted to update the channel colors every loop. I have made an array of 16 numbers corresponding to the color I wish to have (which are blue = running, red = failed, green = completed, black = not in use). However, I cannot find a way to pull these 16 numbers out of the array and to the color boxes short of 16 index arrays connected to the color boxes.
I understand how to convert each individual number to a color, I just don't know how to use a 16 times for loop to communicate with a different color box each pass through. Is there any way to do this or should I just go for brute force?
Thank you.
Solved!
Go to Solution.Sorry I keep making new posts. Attached is an example i wrote up. There are three cases in the disabled structure, each has a different implementation of what i belive your specs are.
Tim Elsey
LabVIEW 2010, 2012
Certified LabVIEW Architect
Attachments:
update color box.vi 24 KB -
New events in iCal are entered on my iMac. These events pass through correctly to my other computers and iPhone. However, each new event shows up twice on my iPads. The clutter is distracting. Anyone have suggestion as to correcting this annoyance?
New events in iCal are entered on my iMac. These events pass through correctly to my other computers and iPhone. However, each new event shows up twice on my iPads. The clutter is distracting. Anyone have suggestion as to correcting this annoyance?
Maybe you are looking for
-
Project Settings vs. Encoding and Encore Resolution for BR
I am editing HDV footage from a Canon HV20. When I setup my project in Pr Pro I used the recommended default HDV project settings. Hopefully these are correct. I will be burning a Blu-Ray disc for the project. I assume like other products I have u
-
Problem in MRP Run (MD01)
hi experts, There were some MRP controllers were assigned for User exit in SPRO for planning run (T code :- MD01 ). Now i have defined additional MRP controllers and also assigned them for user exit (in SPRO) for planning run. With old
-
External LCD monitors - important specs???
Hi, I'm looking at getting an external 20" - 22" LCD monitor to go with my 15"MBP C2D. Looking at the specs of various models, I'm wondering how important the contrast ratio is - it seems to vary from 500:1 to 800:1. I'm using the comp for video edit
-
Hello guys, Database: Oracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Beta Apex: Application Express 4.1.0.00.29 I was able to login to the development console without any problem. But now 1. When I try to access a workspace with the c
-
I can't remove firefox either though the control panel or manually
I have updated Firefox and now have versions 4,6, &7 and cannot remove any of them. I have a problem with Microsoft Silverlight also that is associated with Mozzila and I can uninstall it either. I would like to uninstall Mozilla & then start with a