Two ASAs one webvpn licence in HA failover

What will happen in case when i have two ASAs in active/standby failover mode and on one of them ssl vpn licence for 50 user.Is the HA failover on ASA possible at all for ssl vpn? What will happen in this scenario if i put licence with 50 users on first ASA which is active, and if it failes, are the standby going to takeover everything or just two user in default settings, because standby does not have a licence for additional users.

Just saw your post while I was searching for an answer to another question. The answer is that HA will fail all together. I have been down this path with Cisco early on in the ASA life cycle and they have stuck to their Guns.
For 2 ASA to be in HA of any type the must have identical licenses, identical hardware and supposedly identical memory (although we have found that flash can be off by at least 64 MB as long as your image still fits.
Hope this helps you out.
http://www.staticnat.com

Similar Messages

  • Two ASAs together in network

    How can i install two ASAs one with AIP-SSM and other with CSC-SSM in the same network

    You'll have to put one of the firewalls in transparent mode.

  • Is it possible in IOS to have two static routes for the same subnet, one a higher priority and "failover" between the 2?

    Hi All
    Is it possible in IOS to have for a particular subnet:
    a) Two static routes?
    b) Make one static route a higher priority than the other?
    c) If one static router "goes down", failover to the lower priority static route?
    We have a l2tp/vpdn connection to a supplier which can be accessed via two vlans/routes. I would like to make one route the preferred one but the "route" to failover if the preferred route goes down.
    Again, many thanks in advance for all responses!
    Thanks
    John

    Hi John,
    Hope the below explaination will help you...
    R1(config)# ip route 0.0.0.0 0.0.0.0 2.2.2.2
    R1(config)# ip route 0.0.0.0 0.0.0.0 3.3.3.3 10
    If you notice the Administrative Distance for the secondary route pointing to ISP2 is increased to 10 so that it becomes the backup link.
    The above configuration with just two floating static routes partially accomplishes our requirement as it will work only in the scenario where the routers interfaces connected to the WAN link are in up/down or down/down status. But in a lot of situations we see that even though the links remain up but we are not able to reach the gateway, this usually happens when the issue is at the ISP side.
    In such scenarios, IP SLAs becomes an engineer's best friend. With around six additional IOS commands we can have a more reliable automatic failover environment.
    Using IP SLA the Cisco IOS gets the ability to use Internet Control Message Protocol (ICMP) pings to identify when a WAN link goes down at the remote end and hence allows the initiation of a backup connection from an alternative port. The Reliable Static Routing Backup using Object Tracking feature can ensure reliable backup in the case of several catastrophic events, such as Internet circuit failure or peer device failure.
    IP SLA is configured to ping a target, such as a publicly routable IP address or a target inside the corporate network or your next-hop IP on the ISP's router. The pings are routed from the primary interface only. Following a sample configuration of IP SLA to generate icmp ping targeted at the ISP1s next-hop IP.
    R1(config)# ip sla 1
    R1(config)# icmp-echo 2.2.2.2 source-interface FastEthernet0/0
    R1(config)# timeout 1000
    R1(config)# threshold 2
    R1(config)# frequency 3
    R1(config)# ip sla schedule 1 life forever start-time now
    The above configuration defines and starts an IP SLA probe.
    The ICMP Echo probe sends an ICMP Echo packet to next-hop IP 2.2.2.2 every 3 seconds, as defined by the “frequency” parameter.
    Timeout sets the amount of time (in milliseconds) for which the Cisco IOS IP SLAs operation waits for a response from its request packet.
    Threshold sets the rising threshold that generates a reaction event and stores history information for the Cisco IOS IP SLAs operation.
    After defining the IP SLA operation our next step is to define an object that tracks the SLA probe. This can be accomplished by using the IOS Track Object as shown below:
    R1(config)# track 1 ip sla 1 reachability
    The above command will track the state of the IP SLA operation. If there are no ping responses from the next-hop IP the track will go down and it will come up when the ip sla operation starts receiving ping response.
    To verify the track status use the use the “show track” command as shown below:
    R1# show track
    Track 1
    IP SLA 1 reachability
    Reachability is Down
    1 change, last change 00:03:19
    Latest operation return code: Unknown
    The above output shows that the track status is down. Every IP SLAs operation maintains an operation return-code value. This return code is interpreted by the tracking process. The return code may return OK, OverThreshold, and several other return codes.
    Different operations may have different return-code values, so only values common to all operation types are used. The below table shows the track states as per the IP SLA return code.
    Tracking
    Return Code
    Track State
    Reachability
    OK or over threshold
    (all other return codes)
    Up
    Down
    The Last step in the IP SLA Reliable Static Route configuration is to add the “track” statement to the default routes pointing to the ISP routers as shown below:
    R1(config)# ip route 0.0.0.0 0.0.0.0 2.2.2.2 track 1
    R1(config)# ip route 0.0.0.0 0.0.0.0 3.3.3.3 10
    The track number keyword and argument combination specifies that the static route will be installed only if the state of the configured track object is up. Hence if the track status is down the secondary route will be used to forward all the traffic.
    Please rate the helpfull posts.
    Regards,
    Naidu.

  • Site to Site VPN Between Two ASA 5505's Up But Not Passing Traffic

    hello,
    i am setting up a site to site vpn between two asa 5505's.  the tunnel is up but i cannot get it to pass traffic and i have run out of ideas at this point.  i am on site as i am posting this question and only have about 4 hours left to figure this out, so any help asap is greatly appreciated.  i'll post the configs below along with the output of sh crypto isakmp sa and sh ipsec sa.
    FYI the asa's are different versions, one is 9.2 the other is 8.2
    Note: 1.1.1.1 = public ip for Site A 2.2.2.2 = public ip for site B
    Site A running config:
    Result of the command: "sh run"
    : Saved
    ASA Version 8.2(2)
    hostname csol-asa
    enable password WI19w3dXj6ANP8c6 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.1.0 san_antonio_inside
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.2.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 1.1.1.1 255.255.255.248
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns domain-lookup inside
    dns server-group DefaultDNS
     name-server 24.93.41.125
     name-server 24.93.41.126
    object-group network NETWORK_OBJ_192.168.2.0_24
    access-list inside_access_out extended permit ip any any
    access-list outside_access_out extended permit ip any any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in_1 extended permit icmp any interface outside
    access-list outside_access_in_1 extended permit tcp any interface outside eq pop3
    access-list outside_access_in_1 extended permit tcp any interface outside eq 8100
    access-list outside_access_in_1 extended permit udp any interface outside eq 8100
    access-list outside_access_in_1 extended permit udp any interface outside eq 1025
    access-list outside_access_in_1 extended permit tcp any interface outside eq 1025
    access-list outside_access_in_1 extended permit tcp any interface outside eq 5020
    access-list outside_access_in_1 extended permit tcp any interface outside eq 8080
    access-list outside_access_in_1 extended permit tcp any interface outside eq www
    access-list outside_access_in_1 extended permit ip san_antonio_inside 255.255.255.0 any
    access-list outside_1_cryptomap extended permit ip 192.168.2.0 255.255.255.0 host san_antonio_inside
    access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 san_antonio_inside 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 san_antonio_inside 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (inside) 2 interface
    global (outside) 101 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 101 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface pop3 192.168.2.249 pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface 8100 192.168.2.161 8100 netmask 255.255.255.255
    static (inside,outside) udp interface 8100 192.168.2.161 8100 netmask 255.255.255.255
    static (inside,outside) udp interface 1025 192.168.2.161 1025 netmask 255.255.255.255
    static (inside,outside) tcp interface 5020 192.168.2.8 5020 netmask 255.255.255.255
    static (inside,outside) tcp interface 8080 192.168.2.251 8080 netmask 255.255.255.255
    static (inside,inside) tcp interface www 192.168.2.8 www netmask 255.255.255.255
    static (inside,outside) tcp interface 1025 192.168.2.161 1025 netmask 255.255.255.255
    access-group inside_access_out out interface inside
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 2.2.2.2 255.255.255.255 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map1 1 match address outside_1_cryptomap_1
    crypto map outside_map1 1 set peer 2.2.2.2
    crypto map outside_map1 1 set transform-set ESP-3DES-SHA
    crypto map outside_map1 interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.30-192.168.2.155 inside
    dhcpd dns 24.93.41.125 24.93.41.126 interface inside
    dhcpd domain corporatesolutionsfw.local interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
     anyconnect-essentials
    group-policy DfltGrpPolicy attributes
    tunnel-group 2.2.2.2 type ipsec-l2l
    tunnel-group 2.2.2.2 ipsec-attributes
     pre-shared-key *****
    prompt hostname context
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:021cf43a4211a99232849372c380dda2
    : end
    Site A sh crypto isakmp sa:
    Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: 2.2.2.2
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    Site A sh ipsec sa:
    Result of the command: "sh ipsec sa"
    interface: outside
        Crypto map tag: outside_map1, seq num: 1, local addr: 1.1.1.1
          access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (san_antonio_inside/255.255.255.0/0/0)
          current_peer: 2.2.2.2
          #pkts encaps: 1, #pkts encrypt: 1, #pkts digest: 1
          #pkts decaps: 239, #pkts decrypt: 239, #pkts verify: 239
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 1, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 1.1.1.1, remote crypto endpt.: 71.40.110.179
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: C1074C40
          current inbound spi : B21273A9
        inbound esp sas:
          spi: 0xB21273A9 (2987553705)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 1691648, crypto-map: outside_map1
             sa timing: remaining key lifetime (kB/sec): (3914989/27694)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0xC1074C40 (3238480960)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 1691648, crypto-map: outside_map1
             sa timing: remaining key lifetime (kB/sec): (3914999/27694)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
    Site B running config:
    Result of the command: "sh run"
    : Saved
    : Serial Number: JMX184640WY
    : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    ASA Version 9.2(2)4
    hostname CSOLSAASA
    enable password WI19w3dXj6ANP8c6 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 2.2.2.2 255.255.255.248
    ftp mode passive
    object network NETWORK_OBJ_192.168.1.0_24
     subnet 192.168.1.0 255.255.255.0
    object network mcallen_network
     subnet 192.168.2.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object NETWORK_OBJ_192.168.1.0_24 object mcallen_network
    access-list outside_access_in extended permit ip object mcallen_network 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-731-101.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static mcallen_network mcallen_network no-proxy-arp route-lookup
    nat (inside,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 2.2.2.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map3 1 match address outside_cryptomap
    crypto map outside_map3 1 set peer 1.1.1.1
    crypto map outside_map3 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map3 interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh stricthostkeycheck
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd address 192.168.1.200-192.168.1.250 inside
    dhcpd dns 24.93.41.125 24.93.41.126 interface inside
    dhcpd domain CSOLSA.LOCAL interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
     anyconnect-essentials
    group-policy DfltGrpPolicy attributes
     vpn-tunnel-protocol ikev1
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
     ikev1 pre-shared-key *****
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4e058021a6e84ac7956dca0e5a143b8d
    : end
    Site B sh crypto isakmp sa:
    Result of the command: "sh crypto isakmp sa"
    IKEv1 SAs:
       Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: 1.1.1.1
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    There are no IKEv2 SAs
    Site B sh ipsec sa:
    Result of the command: "sh ipsec sa"
    interface: outside
        Crypto map tag: outside_map3, seq num: 1, local addr: 71.40.110.179
          access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          current_peer: 1.1.1.1
          #pkts encaps: 286, #pkts encrypt: 286, #pkts digest: 286
          #pkts decaps: 1, #pkts decrypt: 1, #pkts verify: 1
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 286, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #TFC rcvd: 0, #TFC sent: 0
          #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 2.2.2.2/0, remote crypto endpt.: 1.1.1.1/0
          path mtu 1500, ipsec overhead 58(36), media mtu 1500
          PMTU time remaining (sec): 0, DF policy: copy-df
          ICMP error validation: disabled, TFC packets: disabled
          current outbound spi: B21273A9
          current inbound spi : C1074C40
        inbound esp sas:
          spi: 0xC1074C40 (3238480960)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, IKEv1, }
             slot: 0, conn_id: 28672, crypto-map: outside_map3
             sa timing: remaining key lifetime (kB/sec): (4373999/27456)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000003
        outbound esp sas:
          spi: 0xB21273A9 (2987553705)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, IKEv1, }
             slot: 0, conn_id: 28672, crypto-map: outside_map3
             sa timing: remaining key lifetime (kB/sec): (4373987/27456)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001

    Hi Keegan,
    Your tunnel is up and encrypting traffic one way, the other end is not able to encrypt the traffic.
    I would suggest to do a 'clear xlate'?  Sometimes if you setup the nonat configuration after you've attempted other configurations, you need to 'clear xlate' before the previous NAT configuration is cleared and the new one works.
    HTH
    "Please rate useful posts"

  • How do I use Cisco MARS to monitor two ASA (active/stby) with IPS modules?

    Hi
    The two ASA with IPS modules are in active/standby mode. When I try to add both the two IP (active/standby) into the MARS, the MARS will complain duplicated hostnames.
    How to setup MARS to monitor ASA with IPS with active standby topology?
    Thanks!

    Hi,
    The fundamental problem with this scenario is that you have non-failover capable modules in a failover chassis - think of the ASA failover pair as one device and the IPS modules as two completely separate devices.
    Then, as already mentioned, add only the primary ASA. (The secondary will never be passing traffic in standby mode so it's not actually needed in MARS) Then, with the first IPS module you can add it as a module of the ASA or as a standalone device (MARS doesn't care). With the second IPS module the only option is to add it as a separate device anyway.
    In a failover scenario the ASA's swap IP's but the IPS's don't so whereas you'll only ever get messages from the active ASA you'll get messages from both IPS IP's depending on which one happens to be in the active ASA at the time.
    Don't forget that you have to manually replicate all IPS configuration every time you make a change.
    HTH
    Andrew.

  • ASA 5520 - LU allocate xlate failed - Failover unit reloads

    We just had an issue with our failover unit reloading. In perusing the logs there were a number of %ASA-3-210007: LU allocate xlate failed, errors prior to the reload. These units had just had their OS upgraded to fix a DOS issue a few weeks ago. I have not seen the error since it reloaded. However, I was asked to report the issue just in case it is a bug in the new version of the OS.Two units in failover.
    Cisco Adaptive Security Appliance Software Version 8.0(5)9
    Device Manager Version 6.0(2)
    Compiled on Mon 01-Feb-10 10:36 by builders
    System image file is "disk0:/asa805-9-k8.bin"
    Config file at boot was "startup-config"
    CP-ASA up 17 days 21 hours
    failover cluster up 17 days 22 hours
    Hardware:   ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz
    Internal ATA Compact Flash, 256MB
    BIOS Flash M50FW080 @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                                 Boot microcode   :  CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode:  CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  :  CNlite-MC-IPSECm-MAIN-2.05
    0: Ext: GigabitEthernet0/0  : address is 0025.45d7.6e62, irq 9
    1: Ext: GigabitEthernet0/1  : address is 0025.45d7.6e63, irq 9
    2: Ext: GigabitEthernet0/2  : address is 0025.45d7.6e64, irq 9
    3: Ext: GigabitEthernet0/3  : address is 0025.45d7.6e65, irq 9
    4: Ext: Management0/0       : address is 0025.45d7.6e66, irq 11
    5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
    6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
    Licensed features for this platform:
    Maximum Physical Interfaces  : Unlimited
    Maximum VLANs                : 150      
    Inside Hosts                 : Unlimited
    Failover                     : Active/Active
    VPN-DES                      : Enabled  
    VPN-3DES-AES                 : Enabled  
    Security Contexts            : 2        
    GTP/GPRS                     : Disabled 
    VPN Peers                    : 750      
    WebVPN Peers                 : 2        
    AnyConnect for Mobile        : Disabled 
    AnyConnect for Linksys phone : Disabled 
    Advanced Endpoint Assessment : Disabled 
    UC Proxy Sessions            : 2       
    This platform has an ASA 5520 VPN Plus license.
    I noted a report on errors with verison 7 and a conflict between nat(0) and static commands. I don't show nat(0) being used on these units.
    nat (public) 0 access-list NO_NAT
    nat (public) 1 10.190.16.64 255.255.255.192
    nat (public) 1 172.16.22.0 255.255.255.0
    nat (dmz) 0 access-list NO_NAT
    nat (dmz) 1 0.0.0.0 0.0.0.0
    nat (csacelb) 0 access-list NO_NAT
    nat (csacelb) 1 0.0.0.0 0.0.0.0
    nat (app) 0 access-list NO_NAT
    nat (app) 1 0.0.0.0 0.0.0.0
    nat (db) 0 access-list NO_NAT
    nat (db) 1 0.0.0.0 0.0.0.0
    nat (internal) 0 access-list NO_NAT
    nat (internal) 1 0.0.0.0 0.0.0.0
    nat (management) 0 access-list NO_NAT
    nat (management) 1 0.0.0.0 0.0.0.0
    no crypto isakmp nat-traversal
    static (app,dmz) 10.190.15.0 10.190.15.0 netmask 255.255.255.192
    static (csacelb,public) 999.999.999.999 10.190.14.70 netmask 255.255.255.255 (The external address was replaced with 999.999.999.999 intentionally for this forum)
    static (db,app) 10.190.16.0 10.190.16.0 netmask 255.255.255.192

    Do you have any solution ? we have the same problem.
    Thanks .

  • Two separate L2L tunnels between same two ASA

    I have a large MPLS fully meshed network with two main locations, both of which have an ASA with internet access as well as the MPLS access.  I need to be able to provide a backup connection between the two main locations in the event one of the MPLS links to one or the other goes down.
    I am considering using a L2L IPSEC tunnel between the two ASA's but the interesting traffic for the tunnel is different depending on which of the links is down and there fore I would need two different tunnels.  I have my servers and remote desktop servers at one of the main sites and the other main site has another organization attached to it externally that the servers must be able to access.
    Is there a way of creating two separate L2L tunnels between the two ASA's?  Could I perhaps assign two public IP addresses to each of the ASA's and then create the tunnels between different endpoints on each ASA?
    Does anyone have another possible solution to the problem? 
    Gene

    You should be able to do what you want using IP SLA. Please see this excellent blog post which documents one way to accomplish it.
    Hope this helps.

  • Two Networks, One Server

    I have one Windows 2003 server with two NICs, one on the internal Lan the the other to run our Public Wireless Network.
    On our internal LAN the IP is 192.168.10.#.  That Lan can access the Internet through its own gateway.
    I have a virtual server running on the same server using a NIC with an IP of 192.168.103.#.  It also can access the Internet through its own gateway.
    Previously, I had the wireless running on a seperate Linux Box and I could NOT access the internal LAN.  Unfortunately, since I moved that to the Windows server I can access the Internal Lan using Remote Desktops etc...
    I do have a 5510 ASA device that both networks go through.
    How can I block the wireless network from accessing the internal lan?  I do need the internal Lan to be able to access the wireless Lan (Which it now can do).
    Thanks in Advance
    --Joe

    1.  Windows Server with 2 NICS
        A.  NIC 1 with IP of 192.168.10.### VLAN for Internal Network
        B.  NIC 2 with IP of 192.168.103.5 connects to the 192.168.103.0 VLAN (Wireless)
    2.  VMWARE's Virtual Server runs on the Windows 2003 Box and Host Linux Proxy Server with an IP of 192.168.103.8
         All wireless nodes use the proxy address of 192.168.103.8 to access the Internet.
    Problem:  Laptops connected to the wireless 192.168.103.0 network can Access the 192.168.10.0 network.  I need the Laptops isolated from the 192.168.10.0 network.
    Observation:  When the Proxy Server was running on it's own box, wireless nodes could not access the 192.168.10.0 Vlan.
    Thanks
    --Joe

  • Connecting Two ASAs together via local interface

    Hi
    I have two cisco ASA routers & wish to connect them together so that traffic between is permitted with out going outside interface.
    Two asa are located at in ONE office and two have separate internet connection (ISP) configured.
    So here is what I did so far.
    configure one of the interface on each ASA with some IP adddress.
    ASA 1  ------- interface 0/6   10.1.1.1  (ASA X 1512)
    ASA 2 --------- interface 0/5  10.2.2.2  (ASA 5055)
    now connected a Ethernet cable to these inferface.
    I was able to addd a route on asa 2.
    route add interface0/5 10.1.1.0/24  10.2.2.2
    but when I add route on ASA 1 I get the following error.
    route add interface0/6 10.2.2.2/24  10.1.1.1
    %invalid next hop address it belongs to one of our interface.

    Sorry if I was not clear
    I have two separate ISPs connecting two two separate ASAs.. Two asa are now connecting separate LANs.
    Now I want to communicate between LANs.
    So I connected an ethernet cable bw ASAs and trying to configure the route.
    But not able to establish
    Here is the configuration of ASA where I am faceing problem, while trying to add route
    route add voice-interface 10.1.1.1/24  255.255.255.0  10.2.2.2 1
    I get error says
    route already exsists
    interface GigabitEthernet0/0
    nameif outside0
    security-level 0
    ip address 0.2.5.2 255.255.255.252
    interface GigabitEthernet0/1
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/2
    nameif inside2
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface GigabitEthernet0/5
    nameif voice-interface
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    object network NETWORK_OBJ_12.1.3.0_2
    subnet 12.1.3.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object network OBJ_ALL_NETWORK
    subnet 0.0.0.0 0.0.0.0
    description Any Network
    object network voice-asa-network
    subnet 10.2.2.0 255.255.255.0
    object network 10.1.1.1
    host 10.1.1.1
    access-list outside0_cryptomap extended permit ip 192.168.1.0 255.255.255.0 12.1.3.0 255.255.255.0
    access-list inside2_access_in extended permit ip 192.168.1.0 255.255.255.0 any
    nat (inside2,outside0) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_12.1.3.0_24 NETWORK_OBJ_12.1.3.0_24 no-proxy-arp route-lookup
    object network OBJ_ALL_NETWORK
    nat (any,outside0) dynamic interface
    route outside0 0.0.0.0 0.0.0.0 0.2.5.2 1
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside0_map 1 match address outside0_cryptomap
    crypto map outside0_map 1 set pfs
    crypto map outside0_map 1 set peer 9.2.5.1
    crypto map outside0_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside0_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside0_map interface outside0
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    threat-detection basic-threat
    threat-detection scanning-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes128-sha1 3des-sha1
    group-policy GroupPolicy_6.2.5.1 internal
    group-policy GroupPolicy_6.2.5.1 attributes
    vpn-tunnel-protocol ikev1 ikev2
    class-map inspection_default
    match default-inspection-traffic

  • I cannot ping two ASA firewalls connected on the same swicth

    Any help please?
    I have two ASA firewalls connected to same layer 2 Switch and with different subnet on Inside interface .
                            ASA-1 ================>[ layer 2 Switch]<====================ASA-2
                                                                                 ||
                                                                                 ||
                                                                                 ||
                                                                         (DHCP-ROUTER)
    ASA- 1 :
    Public IP address;  100.100.1. 2x /32
    LAN ( Inside Interface) IP address; 10.10.41.1
    route outside 0.0.0.0 0.0.0.0 100.100.1.1x.
    route inside 10.10.42.0 255.255.255.0 10.10.10.2 ( DHCP-Router)
    =================================================================
    ASA-2:
    Public IP address; 200.200.1,2x /32
    LAN ( Inside Interface ) IP address ; 10.10.42. 1
    route outside 0.0.0.0  0.0.0.0  200.200.1.1x
    route inside 10.10.41.0 255.255.255.0 10.10.10.2 ( DHCP-Router)
    ================================================================
    DHCP Router ;
    ip dhcp pool ASA1_SUBNET
    network 10.10.41.0 255.255.255.0
    default-router 10.10.41.2
    domain-name me.com
    dns-server 10.10.41.10
    ip dhcp pool ASA2_SUBNET
    network 10.10.42.0 255.255.255.0
    default-router 10.10.42.2
    domain-name me.com
    dns-server 10.10.41.10
    ip route 0.0.0.0 0.0.0.0 10.10.41.1
    ip route 10.10.42.0  255.255.255.0 10.10.42.1
    =================================================
    LAYER 2 SWITCH;
    Int vlan 41
    Ip address 10.10.41.0 255.255.255.0
    no shut
    Int vlan 42
    Ip address 10.10.42.0 255.255.255.0
    no shut
    ip route 0.0.0.0 0.0.0.0 10.10.41.1
    ip route 10.10.42.0  255.255.255.0 10.10.42.1
    Any help please ?
    DaK

    Hi davy,
                                                                  Rtr     Rtr
                                                                   |         |
                                                                ASA   ASA   
                                                                   |       /
                                                               Switch ----> DHCP Rtr
                                                                    |
                                                             Vlan 41 & 42
    This would be your design right. As per my understanding you are not able to ping the ASA from one segment to the other from the LAN. Please correct me if my statement is wrong.
    10.10.41.1 (ASA 1 Inside) - 10.10.42.1 (ASA 2 Inside).
    Let me explain how we will make this communication.

  • I purchased one photoshop licence, how many computers can install it?

    I purchased one photoshop licence, how many computers can install it? And If you have a limit of computers that can be installed, how can i exceed it? for example, pay addition and ETC. I'm not company, but personal user.

    Two current activations.  If you need more, then you need to pay for a new license.  ISTR a poster in a similar position a month or so back.  I can't remember if he persauded Adobe to change his licens to a Teams Subscription.  What are you hoping to achieve?

  • We have two iPhones, one iMac, and one iTunes account. Can someone tell me an yeast way to manage each iPhone separately- that is -- when we connect each iPhone how do we keep our contacts separated? this is a real problem. Thanks

    We have two iphones , one imac , and one itunes account. Hope someone can tell me an easy way to synch each iphone so that our contacts stay separate. I would like to share itunes music etc but not synch the same contacts to each phone...major problem... Thanks!

    You have a few options which are detailed here:
    http://support.apple.com/kb/ht1495

  • Two phones one apple account how do I stop imessage from one going automatically to the other?

    two phones one apple account how do I stop imessage from one going automatically to the other?

    You need to setup iMessage on one of the two phones using a different AppleID.

  • Two iphones, one iTunes account, two icloud accounts

    Hi,
    I have two iPhones, one  privat, one from my company.
    I would like ...
    ... to have all music, apps, books bought via iTunes to be on both iPhones - use same Apple ID for iTunes account?
    ... seperate calender, contacts, todos - use different Apple IDs for iCloud?
    Is there still a way to have all pictures taken in one common photo stream?

    I have the same question.  My daughter and I share an apple account which is fine, but now I am getting some of her texts and each time I send her one I get a duplicate?  I thought I messed this up when we tried to Facetime each other and I have deleted all those options.  How do I fix it so I have my own texts and she has her own texts, I don't get duplicate texts but she can still access our I tunes account?  Please help

  • Two apple ids, two computers, one phone#-how to sync messages on on both computers

    Okay apple world, I'm a bit stumped with this one: I have two macbooks, one for work (a 2009 15" macbook pro) and a personal one (2014 13" macbook air) and two apple ids, one for work and one personal one. I also have a 5S iPhone, which I use for both work and personal use. The iPhone has been set up with my personal apple id and my iMessages sync perfectly with my personal macbook air. Now what I would like to do is sync my iMessages through my phone number with my work macbook pro. But when I try to add an additional account, I am only given the option to add a google account or I am told that my (personal) apple id is already in use. Has anyone encountered this issue and do you have any tips on how to trouble shoot through this?

    Sync is about synchronisation to Lightroom Mobile, the iPad/iPhone app, not about synchronising from one computer to another. There isn't really a way to sync two computers automatically, but you can use methods such as File>Export/import as Catalog, Dropbox, or copying through the operating system.

Maybe you are looking for