LMS 4.0 support for ASA firewall

I need to add ASA 5520 to LMS 4.0, mainly for configuration archiving. ASA seems to be supported on LMS 3.2 as per the below link.
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/3.2/device_support/table/lms32sdt.html
I had directly added the ASA to the DCR, with the right login credentials and SNMPv3 strings , but still LMS fails to detect the ASA.
Thanks in advance.

Thanks Nael for the reply, please find below the SNMP configuration on the ASA
snmp-server group SNMPGRP v3 auth
snmp-server user SNMPUSR SNMPGRP v3 encrypted auth md5 a9:ba:79:44:5b:b0:98:65:88:30:a1:8b:7b:69:a2:9c
snmp-server host inside 10.88.80.11 trap version 3 SNMPGRP
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
The show version is given below.
ASA5520# sh ver
Cisco Adaptive Security Appliance Software Version 8.2(3)
Compiled on Fri 06-Aug-10 07:51 by builders
System image file is "disk0:/asa823-k8.bin"
Config file at boot was "startup-config"
ASA5520 up 8 days 19 hours
failover cluster up 25 days 14 hours
Hardware:   ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
0: Ext: GigabitEthernet0/0  : address is 001f.9e50.8a24, irq 9
1: Ext: GigabitEthernet0/1  : address is 001f.9e50.8a25, irq 9
2: Ext: GigabitEthernet0/2  : address is 001f.9e50.8a26, irq 9
3: Ext: GigabitEthernet0/3  : address is 001f.9e50.8a27, irq 9
4: Ext: Management0/0       : address is 001f.9e50.8a28, irq 11
5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
Licensed features for this platform:
Maximum Physical Interfaces    : Unlimited
Maximum VLANs                  : 150
Inside Hosts                   : Unlimited
Failover                       : Active/Active
VPN-DES                        : Enabled
VPN-3DES-AES                   : Enabled
Security Contexts              : 2
GTP/GPRS                       : Disabled
SSL VPN Peers                  : 2
Total VPN Peers                : 750
Shared License                 : Disabled
AnyConnect for Mobile          : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials          : Disabled
Advanced Endpoint Assessment   : Disabled
UC Phone Proxy Sessions        : 2
Total UC Proxy Sessions        : 2
Botnet Traffic Filter          : Disabled
This platform has an ASA 5520 VPN Plus license.
Serial Number: JMXXXXX
Running Activation Key: XX
Configuration register is 0x1
Configuration last modified by enable_1 at 15:05:29.268 AST Sun Jun 12 2011
When I add the ASA to the LMS using SNMPv3, the Device Management shows a blue box with a question mark(shown below).
Is ASA supported on LMS 4.0 with SNMPv3? Doing a troubleshooting on the LMS shows that LMS might only support SNMPv1 & v2.

Similar Messages

  • Flash File for ASA Firewall

                       can you anyone  provide the link for Flash type learning for ASA Firewall 5505.

    Hi,
    To be honest I havent used that many online resources of the type you are after.
    I would imagine that the CCNP Security - Firewall certification book current version would have a lot of usefull information related to the Cisco firewalls.
    The CSC also has some videos related to firewalling
    https://supportforums.cisco.com/community/netpro/security/firewall?view=video
    There is also the Cisco Live 365 site which has all the documents from the Cisco Live events around the world. You will need to register to get access to my understanding. There are also videos of the presentations there (atleast for some). Naturally the documents dont go deep into theory but they do have some helpfull information
    https://www.ciscolive365.com/connect/publicDashboard.ww
    You can also find a lot of guide videos on Youtube for example like this one
    http://www.youtube.com/watch?v=Y0ZnRmgINgE
    Sadly I cant help you much in this case. I personally learnt most about the Cisco firewall the hard way, basically without any supporting material and education (we only had CCNA and CCNP Routing&Swithching wihtout any course on the PIX firewall that was in use at that time and ASAs were still new). Eventually I learned what I needed and nowadays I just tend to refresh information from documents and mostly refer to the ASA Configuration Guide and Command Reference if I need to check on some command or confirm how something worked.
    Hope this helps
    - Jouni

  • Cisco Prime LMS 4.1 - Support for Cisco Catalyst 3560-C Series Switches

    Hello together
    I have a customer which uses the following switch. Last year I have installed LMS 4.1 for him to manage the switches. Unfortunatly the switch model is not supported. According to the information found on the following site the switch is supported for most of the modules in LMS:
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.1/device_support/table/lms41sdt.html
    The oid object of the device is the following: 1.3.6.1.4.1.9.1.1465
    Supported Software: 12.2(55)EX (Customer has 12.2(55)EX3
    Version Support Type: Device Update
    So I updated all device updates I was able to find.
    Step 1: For that I went to Admin > System > Software Center > Schedule Device Downloads and created a job where I have downloaded the latest versions of all packages.
    Step 2: Installed the downloaded packages Admin > System > Software Center > Device Update and installed all the packages.
    Unfortunatly I don't see the same result like described in the Supported Device Table for LMS 4.1.
    - Cisco View -> works
    - Inventory and Config Collection -> works
    - Fault Monitor not working -> Error Code Unsupported
    - Network Topology Layer 2 Services -> Device Type ciscoProducts.1465, Symbol Question Mark
    - VLAN Management -> Doesn't work
    - User Tracking > seems also not to work
    When I open the report for supported devcies (Reports > System > Device Support) and search for C3560C... I find the following devices, but not mine which i need:
    C3560C-8PC-S     .1.3.6.1.4.1.9.1.1466
    C3560CG8PC         .1.3.6.1.4.1.9.1.1317
    C3560CCG8TC     .1.3.6.1.4.1.9.1.1318
    wsC3560CPD8ptS     .1.3.6.1.4.1.9.1.1368
    Does anybody have experience with the same switch type / model? Am I doing something wrong or is this type of switch not implemented correctly till now? Further the docuemntation supported devices would be wrong.
    Thanks for any feedback Erich

    Thanks but I just heard back from my Cisco SE and he assures me that an AP will NOT use up a license.
    I've asked him to verify his answer for me.
    Is your answer based on real world expereince (the best there is)?  That is, are you running Prime LMS 4.1 and does it indeed use up a license for each light-weight AP it discovers & manages?
    Thanks for mentioning options 1-3 but I do not wish to employ any of them.  I don't mind buying the additional licenses for APs ... I just need to know if I have to or not.
    Ian.

  • LMS 4.0, Support for Nexus VDC

    Hi everybody,
    Does LMS 4.0 support the management of Nexus 7000 VDCs?
    I don't need it do be able to do anything complex. I was just interested in syslog, polling, and config fetches. I can poll and ping the management IPs of the VDCs from the command line of the server itself, but it stays questioned and "UNKNOWN" in the device list.
    The admin context of the Nexus 7000s are being added just fine. We recently built 4.0, coming from LMS 2.6. LMS 2.6 appears to add the VDC to the DCR without issue, but 4.0 does not. I just want to make sure that I'm not missing something.
    Thanks for the help!
    Tim

    Hi everybody,
    Does LMS 4.0 support the management of Nexus 7000 VDCs?
    I don't need it do be able to do anything complex. I was just interested in syslog, polling, and config fetches. I can poll and ping the management IPs of the VDCs from the command line of the server itself, but it stays questioned and "UNKNOWN" in the device list.
    The admin context of the Nexus 7000s are being added just fine. We recently built 4.0, coming from LMS 2.6. LMS 2.6 appears to add the VDC to the DCR without issue, but 4.0 does not. I just want to make sure that I'm not missing something.
    Thanks for the help!
    Tim

  • Etherchannel support for ASA 5585X

    Hi there , Just trying to find out which all versions of ASA 5585X can support etherchannel features .
    Thanks
    Prabs

    Hi,
    To my understanding any ASA (except ASA5505) from 8.4(1) onwards can use EthernetChannel
    Quote from Cisco document
    Interface FeaturesEtherChannel support (ASA 5510 and higher)You can configure up to 48 802.3ad EtherChannels of eight active interfaces each.Note You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA 5550, as part of an EtherChannel.We introduced the following commands: channel-group, lacp port-priority, interface port-channel, lacp max-bundle, port-channel min-bundle, port-channel load-balance, lacp system-priority, clear lacp counters, show lacp, show port-channel.We introduced or modified the following screens:Configuration > Device Setup > InterfacesConfiguration > Device Setup > Interfaces > Add/Edit EtherChannel InterfaceConfiguration > Device Setup > Interfaces > Add/Edit InterfaceConfiguration > Device Setup > EtherChannel
    Source:
    http://www.cisco.com/en/US/docs/security/asa/roadmap/asa_new_features.html#wp43273
    Here is also a link to the "interface" command for Etherchannel
    http://www.cisco.com/en/US/docs/security/asa/command-reference/i3.html#wp1932200
    Hope this helps
    - Jouni

  • Ciscoworks LMS RME / ASA Firewall configuration pre-shared key savings

    Does anybody know the concept about saving pre-shared by Ciscoworks LMS /RME ?
    Is there a way to get the unencrypted values from Ciscoworks LMS /RME for an ASA Firewall ?
    ASA config. saved with RME
    pre-shared-key *
    ASA config. saved to TFTP from ASA
    pre-shared-key 1ZdmaKVwEkQ66nD37d9kA9fj9z75

    If you enable "shadow directory" (RME - Admin - Config Mgmt - Archive Mgmt - Archive Settings), you can find the raw configs in locations such as /var/adm/CSCOpx/files/rme/dcma/shadow/Security_and_VPN/PRIMARY on Solaris, or its Windows equivalent, after one requisite cycle of Periodic Polling and/or Periodic Collection. That's the same config one'd get saving to TFTP manually.
    However, I don't recall how to unscramble the "asterisks" in the RME GUI, if at all possible.

  • I Want Buy Cisco ASA Firewall Supporting SIP

    Hello Guys I want to buy cisco ASA Firewall , that support SIP and Session Border Controller  (SBC) So please can any one tell me the most power full that support this protocols ,, Than you guys

    Hi Vijay,
    If can be done but you need any network management software. I personally dont think you can ask your ask to send mails. ASA can trigger alert to a SNMP configured server which will intern send mail to you 
    HTH,

  • Cisco ASA support for PBR

    Does anyone know if Cisco has the PBR feature road mapped for future IOS releases or if they are building in new feature sets to load balance 2 different ISP connections much like F5. It seems more and more customers are asking for all in one functionality from their NextGen firewalls and the ASA seems to fall short in this category.

    As of right now, you can do PBR on the ASA when the ASA is in a cluster.  I am uncertain if there will be support for PBR or loadbalancing on a standalone ASA in the future.
    http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_cluster.html#pgfId-1943033
    Please remember to select a correct answer and rate helpful posts

  • Java 7 support for LMS 4.2?

    Any idea if LMS 4.2 is going to get support for Java 7?  Java 6 reaches end of Public Updates February 2013.
    http://www.oracle.com/technetwork/java/eol-135779.html

    I don't have any inside information but would strongly expect an update to LMS in 2013 that will introduce Java 7 support.
    For now, though, you are best advised to stick with the supported Java 6. LMS has gotten better in tolerating minor updates; but I have yet to see anyone get LMS working completely with Java 7.

  • Configure our own Public IP pool on Cisco ASA firewall

    Hey everyone,
    I need some assistance on the below requirement...Today we have only one internet circuit connected with our external firewall where we are using /26 public IP address for all external traffic. Now we managed to obtain our own subnet (/24) from ARIN and would like to configure on the firewall/internet router for all external services. Is my approach right in order to configure our own subnet on the firewall?
    1. Create a dedicated interface on the Cisco ASA firewall for new public pool...if there is no free interface; then virtual interface also should be fine.
    2. Make sure an appropriate route towards Internet router ( or create default route towards OUTSIDE interface)
    3. Speak to Internet service provider and explain that you are planning to use this specific public IP address on your n/w and ask them to publish in their BGP world with proper prefix#
    4.Implement one external static NAT and make sure everything works as expected.
    Thanks in advance Network Experts!!!
    Regards
    VGS

    You have the basics. but I do have a couple comments / questions
    1. What ASA are you running? If you do not have a free interface and plan to create subinterfaces, you will need to remove the configuration of one of the interfaces, then create subinterfaces and then re-apply the configuration you removed to one of the subinterfaces there...So, why not just overwrite the existing external interface?  Also, keep in mind that the ASA does not support two default routes.  (though I have heard some rumours that this might be added to the 9.3 release, but I have not had this confirmed)
    4. You don't really say what you are going to use this new setup for, but if you are using it for internet then adding just a static NAT will not be enough, you will also need a dynamic NAT.
    Please remember to select a correct answer and rate helpful posts

  • WMI query through ASA Firewall

    I'm a newbie - please be patient
    We have an ASA firewall that has several DMZ VLANs.
    A support company that responsible for the SQL Servers wants to use WMI to query server health.
    Their monitoring server currently on the internal lan, eight SQL servers on the internal lan and six of the SQL Servers are in the DMZ.
    Two of the SQL Servers in the DMZ are 2003x32 Standard Edition and four are 2008R2x64 Enterprise Edition
    The question is the ports that need to be open for Windows 2003 is concerningly large tcp/1025-65535, tcp/135
    What are everyone’s thoughts on opening up such a large range?
    Is there a better way of doing this – unfortunately getting the monitoring software rewritten is not an option and nor is going Linux
    Thanks
    PS - if this has already been asked can someone point me to the discussions

    Hi
    I would say that that is a No No
    But that depends on the environment, for some (most) i woulds say its not ok, but some might feel that they do not need that much security.
    WMI is a bit tough on firewalls.
    But there are ways to limit the ports used by WMI
    fx you can set it to use Fixed ports. and so on.
    Sure it makes the server guys a little less happy since it does not work from the start and they have to make some changes but the added security is well worth the fight.
    Here is a link to solarwinds for people with the same problem.and an answer that seems to work
    (i have not tested this) from ASH J Kent. (almost at the bottom)
    http://thwack.solarwinds.com/forums/68/application--server-management/21/server--application-monitor/16415/wmi-monitoring-through-firewal/
    Here is one from MSDN
    http://msdn.microsoft.com/en-us/library/windows/desktop/bb219447(v=vs.85).aspx
    Good luck
    HTH

  • ASA Firewall sending emails to Ironport Internal

    Hello I have a question about ASA firewall and Ironport devices.
    What I have found lately it that ironport is showing that firewall we have here is sending over 1000 emails in a hour which is causing ironport to stop all email traffic inside and outside.  How do I find out what is causing this issue. 
    IP Addresses 
    My Reports
    Sender IP Address
    Hostname
    Total Attempted
    Stopped by Reputation Filtering  
    Stopped as Invalid Recipients
    Spam Detected
    Virus Detected
    Stopped by Content Filter
    Total Threat
    Clean
    172.16.x.x
    xxx.xxx.xxx
    2,753
    1,047
    530
    623
    43
    0
    2,243
    510
    I have pasted a what i saw today 
    I know that .local is internal communication 

    Hello,
    So you see the IP address of the firewall as the source of the email traffic?
    This is a huge amount of emails so I doubt this is because of a feature such as smart-call home that allows your ASA to send traffic as an example.
    I would think about NAT taking place and then the packet being shown as your firewall IP address before going to the IronPort box.
    My recommendation is do captures on the interface where the Email Clients are and the interface where the IronPort sits.
    Does it makes sense?
    Regards,
    Jcarvaja
    CCIE 42930, 2xCCNP, JNCIS-SEC
    For inmediate support http://iNetworks.cr

  • How Can i Use two Different Public IP Addresses no my DMZ with ASA Firewall.

    How To Using Two Different Public IP Address on My DMZ with ASA 5520
    Postado por jorge decimo decimo em 28/Jan/2013 5:51:28
    Hi everyone out there.
    can any one please help me regarding this situation that im looking for a solution
    My old range of public ip address are finished, i mean (the 41.x.x.0 range)
    So now i still need to have in my DMZ another two servers that will bring some new services.
    Remember that those two server, will need to be accessable both from inside and from outside users (Internet users) as well.
    So as i said, my old range of public ip address is finished and we asked the ISP to gives some additional public
    ip address to address the need of the two new servers on DMZ. and the ISP gave us the range of 197.216.1.24/29
    So my quation is, on reall time world (on the equipment) how can i Use two different public ip address on the same DMZ
    on Cisco ASA 5520 v8??
    How my configuration should look like?
    I was told about implementing static nat with Sub Interfaces on both Router and ASA interface
    Can someone please do give me a help with a practical config sample please. i can as well be reached at [email protected]
    attached is my network diagram for a better understanding
    I thank every body in advance
    Jorge

    Hi,
    So looking at your picture you have the original public IP address range configured on the OUTSIDE and its used for NAT for different servers behind the ASA firewall.
    Now you have gotten a new public IP address range from the ISP and want to get it into use.
    How do you want to use this IP address range? You want to configure the public IP addresses directly on the servers or NAT them at the ASA and have private IP addresses on the actual servers (like it seems to be for the current server)?
    To get the routing working naturally the only thing needed between your Router and Firewall would be to have a static route for the new public network range pointing towards your ASA OUTSIDE IP address. The routing between your Router and the ISP core could either be handled with Static Routing or Dynamic Routing.
    So you dont really need to change the interface configuration between the Router and ASA at all. You just need a Static route pointing the new public IP address towards the ASA outside IP address.
    Now when the routing is handled between the ISP - ISP/Your Router - Your Firewall, you can then consider how to use those IP addresses.
    Do you want to use the public IP addresses DIRECTLY on the HOSTS behind the firewall?This would require you to either configure a new physical interface with the new public IP address range OR create a new subinterface with the new public IP addresses range AND then configure the LAN devices correspondingly to the chosen method on the firewall
    Do you want to use the public IP addresses DIRECLTY on the ASA OUTSIDE as NAT IP addresses?This would require for you to only start configuring Static NAT for the new servers between the inside/dmz and outside interface of the ASA. The format would be no different from the previous NAT configuration other than for the different IP addresses ofcourse
    Of the above ways
    The first way is good because the actual hosts will have the public IP addresses. Therefore you wont run into problems with DNS when the LAN users are trying to access the server.
    The second way is the one requiring the least amount of configurations/changes on the ASA. In this case though you might run into problem with DNS (to which I refer above) as the server actually has a private IP address but the public DNS might reply to the LAN hosts with a public IP address and therefore connections from LAN could fail. This is because LAN users cant connect to the servers OUTSIDE NAT IP address (unless you NAT the server to public IP address towards LAN also)
    Hopefully the above was helpfull. Naturally ask more specific questions and I'll answer them. Hopefully I didnt miss something. But please ask more
    I'm currently at Cisco Live! 2013 London so in the "worst case" I might be able to answer on the weekend at earliest.
    - Jouni

  • ASA firewall wont ping remote site

    We have remote office which I can ping while at the main office, but when I am connected to VPN from office or home, I cant ping the remote office.
    VPN gives me an ip 10.21.18.x
    remote site's IP is: 172.29.x.x
    i have the access-list information for the ASA firewall and router below:
    below is the multilayer:
    OFFICE-CORE-01#show ip access-lists
    Extended IP access list verizon-INTERNET-TRAFFIC
        10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
        20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
        30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
        40 permit ip 10.23.20.0 0.0.0.255 any
        50 permit ip 10.23.21.0 0.0.0.255 any
        60 permit ip 10.23.22.0 0.0.0.255 any
        70 permit ip 10.23.23.0 0.0.0.255 any
        80 permit ip 10.23.24.0 0.0.0.255 any
        90 permit ip 10.23.25.0 0.0.0.255 any
        100 permit ip 10.23.26.0 0.0.0.255 any
    Extended IP access list PAETEC-INTERNET-TRAFFIC
        10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
        20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
        30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
        40 permit ip 10.23.20.0 0.0.0.255 any
        50 permit ip 10.23.21.0 0.0.0.255 any
        60 permit ip 10.23.22.0 0.0.0.255 any
        70 permit ip 10.23.23.0 0.0.0.255 any
        80 permit ip 10.23.24.0 0.0.0.255 any
        90 permit ip 10.23.25.0 0.0.0.255 any
        100 permit ip 10.23.26.0 0.0.0.255 any
    Extended IP access list system-cpp-all-routers-on-subnet
        10 permit ip any host 224.0.0.2
    Extended IP access list system-cpp-all-systems-on-subnet
        10 permit ip any host 224.0.0.1
    Extended IP access list system-cpp-dhcp-cs
        10 permit udp any eq bootpc any eq bootps
    Extended IP access list system-cpp-dhcp-sc
        10 permit udp any eq bootps any eq bootpc
    Extended IP access list system-cpp-dhcp-ss
        10 permit udp any eq bootps any eq bootps
    Extended IP access list system-cpp-energywise-disc
        10 permit udp any eq any eq 0
    Extended IP access list system-cpp-hsrpv2
        10 permit udp any host 224.0.0.102
    Extended IP access list system-cpp-igmp
        10 permit igmp any 224.0.0.0 31.255.255.255
    Extended IP access list system-cpp-ip-mcast-linklocal
        10 permit ip any 224.0.0.0 0.0.0.255
    Extended IP access list system-cpp-ospf
        10 permit ospf any 224.0.0.0 0.0.0.255
    Extended IP access list system-cpp-pim
        10 permit pim any 224.0.0.0 0.0.0.255
    Extended IP access list system-cpp-ripv2
        10 permit ip any host 224.0.0.9
    ----------------------------------ASA ACCESS-LIST is below the brief version-------
    access-list CompanyName-vpn-maint_splitTunnelAcl line 10 standard permit 172.29.0.0 255.255.0.0 (hitcnt=0) 0x52bc4d4c
    -----------------------below is the ASA routes-----------------------
    Gateway of last resort is 53.138.58.129 to network 0.0.0.0
    S    192.168.10.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    C    172.17.21.0 255.255.255.0 is directly connected, dmz_tier2
    S    172.16.142.0 255.255.254.0 [1/0] via 53.138.58.129, outside
    C    172.16.21.0 255.255.255.0 is directly connected, dmz_tier1
    C    172.19.21.0 255.255.255.0 is directly connected, dmz_tier4
    S    172.23.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
    S    172.25.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.25.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.24.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    172.26.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.26.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.29.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
    S    172.29.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.28.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.28.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    192.168.20.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S    10.11.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    10.13.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    10.10.21.1 255.255.255.255 [1/0] via 10.21.0.1, inside
    S    10.10.21.2 255.255.255.255 [1/0] via 10.21.0.1, inside
    S    10.22.0.0 255.255.0.0 [1/0] via 53.138.58.129, outside
    S    10.23.3.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S    10.23.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S    10.21.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    10.10.21.10 255.255.255.255 [1/0] via 10.21.0.1, inside
    C    10.21.0.0 255.255.255.0 is directly connected, inside
    S    10.22.3.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    10.10.41.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    C    53.138.58.128 255.255.255.128 is directly connected, outside
    S    192.168.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S*   0.0.0.0 0.0.0.0 [1/0] via 53.138.58.129, outside
    S    0.0.0.0 0.0.0.0 [255/0] via 10.21.0.1, inside tunneled
    ------------------------------------below is the router's routes----------
    Gateway of last resort is 10.21.0.11 to network 0.0.0.0
         205.232.16.0/32 is subnetted, 1 subnets
    S       205.232.16.25 [1/0] via 10.21.0.11
         62.0.0.0/32 is subnetted, 1 subnets
    S       62.100.0.146 [1/0] via 10.21.0.12
         178.78.0.0/32 is subnetted, 1 subnets
    S       178.78.147.193 [1/0] via 10.21.0.12
    C    192.168.10.0/24 is directly connected, Vlan29
         172.16.0.0/16 is variably subnetted, 5 subnets, 3 masks
    S       172.16.141.0/24 [1/0] via 10.21.0.11
    S       172.16.142.0/23 [1/0] via 10.21.0.11
    S       172.16.40.1/32 [1/0] via 10.21.2.12
    S       172.16.40.10/32 [1/0] via 10.21.2.12
    S       172.16.21.0/24 [1/0] via 10.21.0.11
         172.19.0.0/24 is subnetted, 1 subnets
    S       172.19.21.0 [1/0] via 10.21.0.11
         172.18.0.0/24 is subnetted, 1 subnets
    S       172.18.21.0 [1/0] via 10.21.0.12
         172.23.0.0/24 is subnetted, 3 subnets
    S       172.23.186.0 [1/0] via 10.21.0.6
    S       172.23.184.0 [1/0] via 10.21.0.6
    S       172.23.181.0 [1/0] via 10.21.0.6
    S    172.25.0.0/16 [1/0] via 10.21.0.11
         172.24.0.0/24 is subnetted, 3 subnets
    C       172.24.181.0 is directly connected, Vlan31
    C       172.24.186.0 is directly connected, Vlan32
    C       172.24.187.0 is directly connected, Vlan33
    S    172.26.0.0/16 [1/0] via 10.21.0.11
         172.29.0.0/24 is subnetted, 3 subnets
    S       172.29.181.0 [1/0] via 10.21.0.6
    S       172.29.184.0 [1/0] via 10.21.0.6
    S       172.29.190.0 [1/0] via 10.21.0.6
    S    172.28.0.0/16 [1/0] via 10.21.0.11
    C    192.168.20.0/24 is directly connected, Vlan30
         10.0.0.0/8 is variably subnetted, 35 subnets, 4 masks
    S       10.11.0.0/16 [1/0] via 10.21.0.6
    C       10.21.28.0/24 is directly connected, Vlan28
    C       10.21.26.0/24 is directly connected, Vlan26
    C       10.21.25.0/24 is directly connected, Vlan25
    S       10.12.0.0/16 [1/0] via 10.21.0.6
    C       10.21.24.0/24 is directly connected, Vlan24
    S       10.13.0.0/16 [1/0] via 10.21.0.6
    C       10.21.23.0/24 is directly connected, Vlan23
    C       10.21.22.0/24 is directly connected, Vlan22
    C       10.21.21.0/24 is directly connected, Vlan21
    C       10.21.20.0/24 is directly connected, Vlan20
    C       10.21.19.0/24 is directly connected, Vlan19
    S       10.21.18.0/24 [1/0] via 10.21.0.12
    S       10.21.17.0/24 [1/0] via 10.21.0.11
    C       10.21.16.0/24 is directly connected, Vlan16
    C       10.21.15.0/24 is directly connected, Vlan15
    C       10.21.14.0/24 is directly connected, Vlan14
    C       10.21.13.0/24 is directly connected, Vlan13
    C       10.21.12.0/24 is directly connected, Vlan12
    C       10.21.11.0/24 is directly connected, Vlan11
    C       10.10.21.1/32 is directly connected, Loopback0
    S       10.31.0.0/16 [1/0] via 10.21.0.6
    D       10.10.21.2/32 [90/130816] via 10.21.252.10, 7w0d, Vlan999
    C       10.21.5.0/24 is directly connected, Vlan5
    C       10.21.4.0/24 is directly connected, Vlan4
    S       10.22.0.0/16 [1/0] via 10.21.0.11
    C       10.21.3.0/24 is directly connected, Vlan3
    C       10.21.2.0/24 is directly connected, Vlan2
    C       10.23.2.0/24 is directly connected, Vlan900
    S       10.22.3.0/24 [1/0] via 10.21.0.11
    C       10.21.0.0/24 is directly connected, Vlan1000
    S       10.41.0.0/16 [1/0] via 10.21.0.11
    S       10.10.41.0/24 [1/0] via 10.21.0.11
    S       10.51.0.0/16 [1/0] via 10.21.0.6
    C       10.21.252.8/30 is directly connected, Vlan999
         62.0.0.0/32 is subnetted, 1 subnets
    S       62.138.58.129 [1/0] via 10.21.0.11
    S    192.168.2.0/24 [1/0] via 10.21.0.12
    S*   0.0.0.0/0 [1/0] via 10.21.0.11

    We have remote office which I can ping while at the main office, but when I am connected to VPN from office or home, I cant ping the remote office.
    VPN gives me an ip 10.21.18.x
    remote site's IP is: 172.29.x.x
    i have the access-list information for the ASA firewall and router below:
    below is the multilayer:
    OFFICE-CORE-01#show ip access-lists
    Extended IP access list verizon-INTERNET-TRAFFIC
        10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
        20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
        30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
        40 permit ip 10.23.20.0 0.0.0.255 any
        50 permit ip 10.23.21.0 0.0.0.255 any
        60 permit ip 10.23.22.0 0.0.0.255 any
        70 permit ip 10.23.23.0 0.0.0.255 any
        80 permit ip 10.23.24.0 0.0.0.255 any
        90 permit ip 10.23.25.0 0.0.0.255 any
        100 permit ip 10.23.26.0 0.0.0.255 any
    Extended IP access list PAETEC-INTERNET-TRAFFIC
        10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
        20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
        30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
        40 permit ip 10.23.20.0 0.0.0.255 any
        50 permit ip 10.23.21.0 0.0.0.255 any
        60 permit ip 10.23.22.0 0.0.0.255 any
        70 permit ip 10.23.23.0 0.0.0.255 any
        80 permit ip 10.23.24.0 0.0.0.255 any
        90 permit ip 10.23.25.0 0.0.0.255 any
        100 permit ip 10.23.26.0 0.0.0.255 any
    Extended IP access list system-cpp-all-routers-on-subnet
        10 permit ip any host 224.0.0.2
    Extended IP access list system-cpp-all-systems-on-subnet
        10 permit ip any host 224.0.0.1
    Extended IP access list system-cpp-dhcp-cs
        10 permit udp any eq bootpc any eq bootps
    Extended IP access list system-cpp-dhcp-sc
        10 permit udp any eq bootps any eq bootpc
    Extended IP access list system-cpp-dhcp-ss
        10 permit udp any eq bootps any eq bootps
    Extended IP access list system-cpp-energywise-disc
        10 permit udp any eq any eq 0
    Extended IP access list system-cpp-hsrpv2
        10 permit udp any host 224.0.0.102
    Extended IP access list system-cpp-igmp
        10 permit igmp any 224.0.0.0 31.255.255.255
    Extended IP access list system-cpp-ip-mcast-linklocal
        10 permit ip any 224.0.0.0 0.0.0.255
    Extended IP access list system-cpp-ospf
        10 permit ospf any 224.0.0.0 0.0.0.255
    Extended IP access list system-cpp-pim
        10 permit pim any 224.0.0.0 0.0.0.255
    Extended IP access list system-cpp-ripv2
        10 permit ip any host 224.0.0.9
    ----------------------------------ASA ACCESS-LIST is below the brief version-------
    access-list CompanyName-vpn-maint_splitTunnelAcl line 10 standard permit 172.29.0.0 255.255.0.0 (hitcnt=0) 0x52bc4d4c
    -----------------------below is the ASA routes-----------------------
    Gateway of last resort is 53.138.58.129 to network 0.0.0.0
    S    192.168.10.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    C    172.17.21.0 255.255.255.0 is directly connected, dmz_tier2
    S    172.16.142.0 255.255.254.0 [1/0] via 53.138.58.129, outside
    C    172.16.21.0 255.255.255.0 is directly connected, dmz_tier1
    C    172.19.21.0 255.255.255.0 is directly connected, dmz_tier4
    S    172.23.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
    S    172.25.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.25.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.24.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    172.26.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.26.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.29.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
    S    172.29.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.28.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    172.28.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    192.168.20.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S    10.11.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    10.13.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    10.10.21.1 255.255.255.255 [1/0] via 10.21.0.1, inside
    S    10.10.21.2 255.255.255.255 [1/0] via 10.21.0.1, inside
    S    10.22.0.0 255.255.0.0 [1/0] via 53.138.58.129, outside
    S    10.23.3.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S    10.23.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S    10.21.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
    S    10.10.21.10 255.255.255.255 [1/0] via 10.21.0.1, inside
    C    10.21.0.0 255.255.255.0 is directly connected, inside
    S    10.22.3.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    S    10.10.41.0 255.255.255.0 [1/0] via 53.138.58.129, outside
    C    53.138.58.128 255.255.255.128 is directly connected, outside
    S    192.168.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
    S*   0.0.0.0 0.0.0.0 [1/0] via 53.138.58.129, outside
    S    0.0.0.0 0.0.0.0 [255/0] via 10.21.0.1, inside tunneled
    ------------------------------------below is the router's routes----------
    Gateway of last resort is 10.21.0.11 to network 0.0.0.0
         205.232.16.0/32 is subnetted, 1 subnets
    S       205.232.16.25 [1/0] via 10.21.0.11
         62.0.0.0/32 is subnetted, 1 subnets
    S       62.100.0.146 [1/0] via 10.21.0.12
         178.78.0.0/32 is subnetted, 1 subnets
    S       178.78.147.193 [1/0] via 10.21.0.12
    C    192.168.10.0/24 is directly connected, Vlan29
         172.16.0.0/16 is variably subnetted, 5 subnets, 3 masks
    S       172.16.141.0/24 [1/0] via 10.21.0.11
    S       172.16.142.0/23 [1/0] via 10.21.0.11
    S       172.16.40.1/32 [1/0] via 10.21.2.12
    S       172.16.40.10/32 [1/0] via 10.21.2.12
    S       172.16.21.0/24 [1/0] via 10.21.0.11
         172.19.0.0/24 is subnetted, 1 subnets
    S       172.19.21.0 [1/0] via 10.21.0.11
         172.18.0.0/24 is subnetted, 1 subnets
    S       172.18.21.0 [1/0] via 10.21.0.12
         172.23.0.0/24 is subnetted, 3 subnets
    S       172.23.186.0 [1/0] via 10.21.0.6
    S       172.23.184.0 [1/0] via 10.21.0.6
    S       172.23.181.0 [1/0] via 10.21.0.6
    S    172.25.0.0/16 [1/0] via 10.21.0.11
         172.24.0.0/24 is subnetted, 3 subnets
    C       172.24.181.0 is directly connected, Vlan31
    C       172.24.186.0 is directly connected, Vlan32
    C       172.24.187.0 is directly connected, Vlan33
    S    172.26.0.0/16 [1/0] via 10.21.0.11
         172.29.0.0/24 is subnetted, 3 subnets
    S       172.29.181.0 [1/0] via 10.21.0.6
    S       172.29.184.0 [1/0] via 10.21.0.6
    S       172.29.190.0 [1/0] via 10.21.0.6
    S    172.28.0.0/16 [1/0] via 10.21.0.11
    C    192.168.20.0/24 is directly connected, Vlan30
         10.0.0.0/8 is variably subnetted, 35 subnets, 4 masks
    S       10.11.0.0/16 [1/0] via 10.21.0.6
    C       10.21.28.0/24 is directly connected, Vlan28
    C       10.21.26.0/24 is directly connected, Vlan26
    C       10.21.25.0/24 is directly connected, Vlan25
    S       10.12.0.0/16 [1/0] via 10.21.0.6
    C       10.21.24.0/24 is directly connected, Vlan24
    S       10.13.0.0/16 [1/0] via 10.21.0.6
    C       10.21.23.0/24 is directly connected, Vlan23
    C       10.21.22.0/24 is directly connected, Vlan22
    C       10.21.21.0/24 is directly connected, Vlan21
    C       10.21.20.0/24 is directly connected, Vlan20
    C       10.21.19.0/24 is directly connected, Vlan19
    S       10.21.18.0/24 [1/0] via 10.21.0.12
    S       10.21.17.0/24 [1/0] via 10.21.0.11
    C       10.21.16.0/24 is directly connected, Vlan16
    C       10.21.15.0/24 is directly connected, Vlan15
    C       10.21.14.0/24 is directly connected, Vlan14
    C       10.21.13.0/24 is directly connected, Vlan13
    C       10.21.12.0/24 is directly connected, Vlan12
    C       10.21.11.0/24 is directly connected, Vlan11
    C       10.10.21.1/32 is directly connected, Loopback0
    S       10.31.0.0/16 [1/0] via 10.21.0.6
    D       10.10.21.2/32 [90/130816] via 10.21.252.10, 7w0d, Vlan999
    C       10.21.5.0/24 is directly connected, Vlan5
    C       10.21.4.0/24 is directly connected, Vlan4
    S       10.22.0.0/16 [1/0] via 10.21.0.11
    C       10.21.3.0/24 is directly connected, Vlan3
    C       10.21.2.0/24 is directly connected, Vlan2
    C       10.23.2.0/24 is directly connected, Vlan900
    S       10.22.3.0/24 [1/0] via 10.21.0.11
    C       10.21.0.0/24 is directly connected, Vlan1000
    S       10.41.0.0/16 [1/0] via 10.21.0.11
    S       10.10.41.0/24 [1/0] via 10.21.0.11
    S       10.51.0.0/16 [1/0] via 10.21.0.6
    C       10.21.252.8/30 is directly connected, Vlan999
         62.0.0.0/32 is subnetted, 1 subnets
    S       62.138.58.129 [1/0] via 10.21.0.11
    S    192.168.2.0/24 [1/0] via 10.21.0.12
    S*   0.0.0.0/0 [1/0] via 10.21.0.11

  • Hi, I am getting the following error while booting up cisco asa firewall .

    Hi,
    I'm getting the following error form console when booting up Cisco ASA firewall...
    How do we determine the issue if its hardware or software related?
    ERROR: Type:2; Severity:80; Class:1; Subclass:3; Operation: 3

    Dear Ravi,
    You are getting the message of time out because you must be loading huge volume of data and BW runs for a specific peroid of time and then it gives a dump with message as processing is overdue.what you can do is first you should drop the indexes of the cube and then you should manually load the data-packets.I think you can again load the failed data package.select the failed data package in the monitor screen.then go to edit(on upper left next to monitor).In Edit select Init update then select "settings for further update" now select that process should be run in the background.Now right click on the failed datapacket and select Manual update.
    Hope this works for you.
    With Regards,
    Prafulla

Maybe you are looking for

  • Enhancement trouble

    Kodo newbie seeks explanation of exception occurring during enhancement. My 'package.jdo' contains mappings for a dozen or so classes to an existing schema. Most of the classes contain no JDO code and get enhanced with no problem. Two of the classes

  • Call to R/3 transaction from CRM CIC0 Action Box

    Hi All, I configured in CRM the action box to call MySAP (transaction VA01), I used the method BOR with the object BUS2032 and the method CREATEWITHDIA, but I need to configure the action box to pass data from the transaction CIC0 into the R/3 system

  • Tab widget doesn't show first tab when site is loaded

    I have a website consisting of only one page. This page has a tab widget that consists of four tabs. Tab one holds an accordion widget, tab two holds a slideshow widget, tab three contains another accordion widget and tab four holds just a .jpg with

  • IPhoto lost files

    I had go pro footage in last import but when I imported next files it disappeared. Does not show up in last 12 months but deleted files from initial import are in the trash. Any suggestions?

  • Entourage takes forever to begin downloading my emails

    When I am in my office on a high speed network, it works great. However, it is painfully slow when I sign on at home with a VPN connection through Comcast cable modem (I am connecting through a Airport base station). Any ideas? thanks