Verification on the asa 8.4 5505 about PAT and port forwarding.

hi all
ihae topology as blow :
inside------------eth0/1-------asa---eth0/7---------outside-------------------internet
my goal is
i want to make pat of inside network (10.66.12.0/24) with outside interface when it request the internet
also ,
i need port forwaridng to following hosts :
10.66.12.122 to 3389
10.66.12.249 to http
10.66.12.249 to https
10.66.12.249 to citrix
=============================================================
just m i need somebody to check my config it is correct
=============================================================
i have asda 5505 with :
ASAAAAA(config)# sh version
Cisco Adaptive Security Appliance Software Version 8.4(2)
Device Manager Version 6.4(5)
Compiled on Wed 15-Jun-11 18:17 by builders
System image file is "disk0:/asa842-k8.bin"
Config file at boot was "startup-config"
ASAAAAA up 1 hour 32 mins
Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                             Boot microcode        : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.06
                             Number of accelerators: 1
0: Int: Internal-Data0/0    : address is d48c.b597.ce35, irq 11
1: Ext: Ethernet0/0         : address is d48c.b597.ce2d, irq 255
2: Ext: Ethernet0/1         : address is d48c.b597.ce2e, irq 255
3: Ext: Ethernet0/2         : address is d48c.b597.ce2f, irq 255
4: Ext: Ethernet0/3         : address is d48c.b597.ce30, irq 255
5: Ext: Ethernet0/4         : address is d48c.b597.ce31, irq 255
6: Ext: Ethernet0/5         : address is d48c.b597.ce32, irq 255
7: Ext: Ethernet0/6         : address is d48c.b597.ce33, irq 255
8: Ext: Ethernet0/7         : address is d48c.b597.ce34, irq 255
9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
10: Int: Not used            : irq 255
11: Int: Not used            : irq 255
Licensed features for this platform:
Maximum Physical Interfaces       : 8              perpetual
VLANs                             : 3              DMZ Restricted
Dual ISPs                         : Disabled       perpetual
VLAN Trunk Ports                  : 0              perpetual
Inside Hosts                      : 50             perpetual
Failover                          : Disabled       perpetual
VPN-DES                           : Enabled        perpetual
VPN-3DES-AES                      : Enabled        perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 10             perpetual
Total VPN Peers                   : 25             perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual
This platform has a Base license.
Serial Number: JMX162740GP
Running Permanent Activation Key: 0x6801f547 0xe81c57c4 0x20f339f4 0xaaf48040 0x
480e2fbc
Configuration register is 0x100003
Configuration last modified by enable_15 at 23:58:15.999 UTC Wed Jan 22 2014
ASAAAAA(config)# sh run
: Saved
ASA Version 8.4(2)
hostname ASAAAAA
enable password ffffCCSH encrypted
passwd 2KFfffff2KYOU encrypted
names
interface Ethernet0/0
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
switchport access vlan 2
interface Vlan1
nameif ins
security-level 100
ip address 10.66.12.1 255.255.255.0
interface Vlan2
nameif outside
security-level 50
ip address x.x.55.34 255.255.255.248
boot system disk0:/asa842-k8.bin
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj-0.0.0.0
host 0.0.0.0
object network localsubnet
subnet 10.66.12.0 255.255.255.0
description localsubnet
object network HTTP-Host
host 10.66.12.249
description web server
object network HTTPS-HOST
host 10.66.12.249
description Https
object network RDP-Host
host 10.66.12.122
description RDP host
object network citrix-host
host 10.66.12.249
description citrix
object service rdp
service tcp destination eq 3389
object service https
service tcp destination eq https
object service citrix
service tcp destination eq 2598
object service http
service tcp destination eq www
object-group network RDP-REDIRECT
object-group network HTTP-REDIRECT
object-group network HTTPS-REDIRECT
object-group network CITRIX-ICA-HDX-REDIRECTION
object-group network CITRIX-ICA-SESSION-RELIABILITY-REDIRECTION
object-group service CITRIX-ICA-HDX
object-group service CITRIX-SR
object-group service RDP
object-group network MY-insideNET
network-object 10.66.12.0 255.255.255.0
object-group service DM_INLINE_SERVICE_1
service-object object citrix
service-object object http
service-object object https
service-object object rdp
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 a
ny interface outside
pager lines 24
mtu ins 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
nat (ins,outside) source static RDP-Host interface service rdp rdp
nat (ins,outside) source static HTTP-Host interface service http http
nat (ins,outside) source static citrix-host interface service citrix citrix
object network obj_any
nat (ins,outside) dynamic obj-0.0.0.0
object network localsubnet
nat (ins,outside) dynamic interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.55.33 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 10.66.12.0 255.255.255.0 ins
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
    0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
    30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
    0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
    65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
    30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
    68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
    3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
    63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
    0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
    a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
    9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
    7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
    15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
    63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
    18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
    4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
    81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
    db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
    7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
    ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
    45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
    2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
    1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
    03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
    69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
    02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
    6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
    c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
    69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
    1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
    481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
    b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
    5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
    6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
    6c2527b9 deb78458 c61f381e a4c4cb66
quit
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username ADMIN password 5iEuCUW0P3ThngqY encrypted privilege 15
username cisco password eT0.bmvcLOAQcNEL encrypted privilege 15
prompt hostname context
call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DD
CEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:65c9b8c35749959d1159e162ff106166
: end
=======================================================
i configured PAT , PORTFORWARD and ACCESS RULES
just want to mae verification to my work
regards

Hi,
Dont think I can really give you an answer but thought I'd write anyway.
It does seem on the basis of the documentation of the ASA (8.4) that with Twice NAT you wont be able to do any modifications to the DNS replies.
Heres one quote from Configuration Guide
Gonfiguring Network Address Translation -> Information About NAT -> DNS and NAT
If you configure a twice NAT rule, you cannot configure DNS modification if you specify the sourceaddress as well as the destination address. These kinds of rules can potentially have a differenttranslation for a single address when going to A vs. B. Therefore, the ASA cannot accurately match theIP address inside the DNS reply to the correct twice NAT rule; the DNS reply does not containinformation about which source/destination address combination was in the packet that prompted theDNS request.
So if I'm not totally wrong I guess your options might be to either
Start doing changes to the local DNS server directly?
Separate the remote overlapping network from your current firewall with another firewall device?
I dont know the whole setup so this might be impossible
Thinking that if the NAT for the remote overlapping network was done on another firewall it could do the DNS reply changes before they arrived on your ASA from the remote DNS server?
I have not really had to tackle such a situation before. I most commonly run into situations where a customer has public IP configured with 1:1 Static NAT and there is no DNS parameter in the Static NAT configuration while the customer tries to use the DNS name to connect to their local server.
Just some of my thoughts. Maybe someone else might have more expirience with same type of situations.
- Jouni

Similar Messages

We have always used one iTunes account and I want to crate a new account for my daughter. What is the best way to go about this and will she need to download free apps again?

We have always used one iTunes account and I want to crate a new account for my daughter. What is the best way to go about this and will she need to download free apps again?

Not going to happen the way you want it to.
When you add a gift card balance to the Apple ID, it's available for the Apple ID.
Probably best to create unique Apple ID's for each... this will also make things easier in the future as purchases are eternally tied to the Apple ID they were purchased with.

ITunes store won't load. The progress bar freezes at about 50% and I get nothing but a white screen.

I'm running iTunes 10.5 beta 7 but this issue has been happening since I was running 9. One day I clicked on a link for an app I saw on techcrunch and it pulled up in iTunes as being in the UK store. I clicked ok and my iTunes hasn't worked since. I can log into my account but can't access anything in the store or Ping. I've googled this issue and found some similar sounding stories but none of the solutions have worked. I've uninstalled and reinstalled, turned of the itunes store in parental settings and checked "except for iTunes U", I've uninstalled apple aplication suport and installed safari and every other option I have found and nothing has worked.
Sometimes if I let it sit long enough what looks like an unstyled version of the store comes up but is completely unusable.
Just to be clear, this has been happening since before I was running any beta software or OS.
Any help would be greatly appreciated.

Thank you gchin.
I emailed apple support and they got back to me, I did what he said and it's fixed! SOLUTION found- see below.
I said:
"I can't access the iTunes Store. When I click on it the progress bar stops at 50% and I'm left with a blank white screen (no error msg). I have uninstalled and reinstalled, run the iTunes diagnostics (it said all was ok), gone through all of the online help material and I've tried turning off my firewall. Nothing works. I can't sync my iphone either (stops on verifying iPhone so I think it's getting stuck on trying to contact the store). Plzz help."
They replied:
"Greetings from Apple iTunes Store Customer Support! I am ########.
I understand that you have had issues accessing the iTunes Store. I know how eager you are to have this issue resolved. I will certainly assist you.
#########, for this, I recommend that you attempt to resolve this issue by once again uninstalling iTunes and QuickTime, and then reinstalling the latest version of each. To do this, first ensure that you are logged in to an Administrator user account on your computer, then follow the instructions in the appropriate article:
Removing and reinstalling iTunes, QuickTime, and other software components for Windows Vista:
http://support.apple.com/kb/HT1923
Note: Titles you purchased from the iTunes Store or imported from CDs are saved in your iTunes folder by default and are not deleted by uninstalling iTunes. Backing up your iTunes Library regularly is recommended.
After successfully uninstalling iTunes and QuickTime, please ensure you have upgraded to the latest Service Pack for Windows by installing all updates available to you on Microsoft Windows Update:
http://update.microsoft.com
Once you have the latest Service Pack for Windows installed, download and install iTunes for Windows (which includes QuickTime):
http://www.apple.com/itunes/download
If you continue to experience difficulty with this issue, you may wish to contact Apple technical support. A representative will be able to tell you about Apple's complimentary and fee-based support options and can help you determine which option might be most helpful.
Please find the appropriate phone number here:
http://www.apple.com/support/contact/phone_contacts.html
Thank you for contacting iTunes Store Support. Have a nice day!
Sincerely,"
AND IT WORKED happy customer.

I can't get my applications to open to full screen. The apps are opening at about 75% and I cant figure out how to get them to open to the full screen.

I cant get my applications to open to full screen. The apps are opening up to about 75% and i cant get them to extend to full screen.

Which applications are you talking about?
Example: Browser application - At the bottom right corner of a browser window you will see a small square with 3 diagnal lines. Place your cursor in that corner to stretch out your window to full screen. The next time you open your browser app, the window will be full screen.

About socket and port problem

hi,all.
i write a chat server use java socket. now is more than 2000 users connect to my server. but too many user make the chat message speed slow. now my server is open one port to listen the client connection. who can tell me if i change my server to open multi port to listen the client connection will rather than open one port. or it is same effect.
please give me some advice. thanks.

Maybe your machine is not strong enough to serve that many users at a time anyway. In that case using several ports won't help.

HT202696 I hve Apple care on 1 device but the person at the apple store just talked about replacing fried ports and did not answer my broken glass or component questions and nothing in detail is actually posted so im afraid its yet another insurance scam

I want to know what exactly Apple will fix on say my IPhone 6 plus. Like a dropped device with broken hardware or components or port issue, electrical broken glass etc.. I only have AppleCare on 1 device because I cant get straight answers about repair cost or if it will repair broken glass ,components etc. The person at Apple just said it will fix ports and did not answer the other question about a real broken device or broken glass.

Actually that's not entirely accurate Csound1... If you purchased AppleCare+ it not only extends your warranty an extra year but it also now covers up to two accidental damages (water damage included). Now every scenario is different when you're talking phone damages so it's best to set up a reservation with the Genius Bar if something happens and they'll assess the damage. Either way, as long as you're covered with AppleCare you'll receive a deductible price on parts. Certain instances you may not have to pay anything which are usually things like faulty software, faulty buttons, etc.
Hope this was helpful!

About notification and auto forward

Hi all,
i'm new on nw-bpm
1. (send a message to let the requester know if the task has finished successfully in the end)
Could BPM use u201CNotification" tab in UWL?
if yes, which element should i choose in process composer of NWDS?
or i have to do some coding to send one "Notification"?
2. Could i set auto forward to make my SMTP mailbox receive the Notification at the same time?
Thanks and Best regards,
Fisher

Hi Fisher,
1. BPM doesn't support UWL Notifications so far. What you could do is implementing a Web Service which creates UWL Notifications via UWL API ([Link|http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/802bfda2-8a85-2b10-9290-d67da32d0c01?quicklink=index&overridelayout=true]).
2. You could use static notifications to send eMails to potential owners of a task [Link|http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/70cd5f0c-74ab-2c10-f79e-98d7869db972?quicklink=index&overridelayout=true]
Best Regards
Andreas

About localhost and port number

following jdbc:microsoftLsqlserver:// , why is the host name localhost and the port number is 1433? how to change the port number into others? please help
thanks

"localhost" is usually but not always set up as a hostname for current host, and resolves to the IP address 127.0.0.1
You can connect to any host or port you want (that has a database running on that port), just change the values in the connection URL.
If your question is "how can I get SQL Server to run using a different port", you'll need to consult Microsoft's documentation for that.

How do I block pings from the outside to the ASA 5505 outside interface?

I was asked to block pings from the internet to the outside interface of our ASA-5505 firewall. I found a post that said to enter "icmp deny any outside", however that does not do it.
I created an ACL to try and do the trick, also to no avail:
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in in interface outside
access-group outside_in in interface outside
Anyone have a clue what I'm doing wrong? I'm not the firewall guy as you can tell. :/
Thanks in advance...
Block / Deny ICMP Echo (Ping) on Cisco ASA Outside Interface
Most networks that you protect with a Cisco ASA device, will probably want to deny ICMP (maybe not all ICMP types, but a lot of network admins will want to block ICMP Echo, etc.) on the outside interface. This will make the network harder to find through external enumeration, but not impossible.
ASA5505(config)#icmp deny any outside
You will deny ICMP on the outside interface, but if you include ICMP as a protocol in the default global policy map, you can ping from the inside to any host on the outside, and it will be permitted back through the ASA, as it knows about the previous ICMP “connection

You are allowing echo-reply, thus it will reply to a ping
try this ACL:
icmp deny any echo-reply outside
From:
https://supportforums.cisco.com/thread/223769
Eric

Browser hijacker about:blank. Firefox goes to about:home. Can we get rid of about:? And HOW?

slows computer, affects mouse use, about:blank is a web hijacker which I have avoided for 15 years. Now, suddenly, every computer has it. I am behind a router. The only changes I have made is to update firefox. Can you provide help for removing this? When I go to your app for which sets things back to default and pull up your page, in SAFE MODE, I get "about:home" in my address bar. I don't think it's safe to even install your fix at this point. I'd appreciate hearing back from you. Thank you.I am sending this from an OLD computer whose firefox is not updated but where about:home still appears.

hello,
Changing the Newtab Page
Go to about:config and search for this option "browser.newtab.url" and chande its value to a page that you want, for example, google.com
[https://support.cdn.mozilla.net/media/uploads/images/2014-01-04-19-39-42-943359.png]
Changing Home Page
Still on about:config search for this other option "browser.startup.homepage" and change for a page that you want
[https://support.cdn.mozilla.net/media/uploads/images/2014-01-04-19-39-34-b5e7d9.png]
*[http://kb.mozillazine.org/About:config about:config]

About MB22 and slg1

Hi all,
I want the below functionality to work ,
When user delete the reservation from MB22 the application log should get created ; which i am able to see on slg1. In this i have to use BADI MB_RESERVATION_BADI.
Can Anybody help me out in this.

I do not have a problem with the settings. I enter about:newtab and I get the error.

The black screen. Tried PRAM, SMC and Safe mode... what now?

Went to black sceen a couple of days ago. Tried restarting many times. It is running but nothing on the screen.

Hello jbtillinghast,
Thanks for using Apple Support Communities.
I'd like you to please try and reset the SMC and PRAM to troubleshoot this issue. The instructions for both processes can be found in the articles below.
Intel-based Macs: Resetting the System Management Controller (SMC)
About NVRAM and PRAM
Take care,
Alex H.

Cisco ASA 5505 performance issues on downloads - data into the ASA from the Internet

I have having serious issues with performance on my ASA 5505s that I am testing with 9.2.3 code.
I stripped the config and removed as much stuff as I could - no VPN etc. and I am ONLY getting about 30-40Mbps downloads from sites but 95Mbps uploads???? Anyone else seeing these problems? If I remove the firewall my PC can hit 300/300Mbps to the same sites using the same switch and cable.
I installed 1Gb of mem on the ASA 5505 but it made no difference. The ASA has a UL IP Security license but I am only using and inside and outside address for these tests, no other ports configured.
Is anyone else seeing this performance problem with the 9.2.3 code? I went to this from 8.2.5 to try to resolve QOS failure bugs that I found in the 8.2.5 code. I did not expect to have a performance hit though and it is only on downloads TO the ASA from the Internet from all speed test sites that I try. Uploading speeds seem fine. No access-lists on my interfaces either...barebones config.
My FIOS and switch interfaces are fine...no errors on any interfaces and the same switch interface hits 300/300Mbps when my laptop is directly attached.
Anyone have a barebones config on their ASA 5505 that flies...I will try it on mine and see if some command somewhere (hidden) is causing the issue. I even cleared the config and started with a clean slate just in case I was missing some command from the older configs that may have impacted performance.

After changing the switch with a high end switch my performance increased but I am still not happy with the throughput out of my ASA. I have about 50+ ASAs 5505s and a dozen 5510s. Most remote sites have 5505s. All my sites right now have 8.2.5-51 and I wanted to put 9.2.3 out there to solve issues I have uncovered on the 8.2.5 code with regards to QOS issues.
I get much better results using the Cisco 3750X attached to the FIOS (right around 300/300 with my laptop directly attached to the 3750x bypassing the ASA - my FIOS circuit rating is also 300/300). Going through the ASA to the same test site I get download speeds of 35 to 75. Changes randomly which really bothers me. My uploads speeds are ALWAYS faster then my download speeds. Example - best download I would ever get is 75Mb and my upload would usually hit 95Mb during the same test period.
I may have to live with it but the inconsistency is what really bothers me.
Here is the config I am currently using. Nothing going on during testing since only a single PC is attached. VPN tunnel to the main site can be up or down...doesn't seem to make any difference. PC does to site directly from outside interface of ASA...split tunneling. Even when I removed tunnels and tested with just the ASA as a firewall to the Internet I was still seeing the same inconsistencies.
Anything obviously missing - new command or anything? Xlates causing issues?

ASA 5505 Failure replaced and need to move the license key?

Can someone point me in the right direction? My ASA 5505 died due to a power surge and I swapped it with a spare. I had Security Plus and a 50 user license and need to move the license keys from the failed ASA 5505 to the new one. I kept both my emails with the activation keys, but not sure how I get this transferred? Thanks in advance.
Joe

I think this is totally unacceptable. For anyone else who uses a 5505 at home and has bought licenses and the hardware out of their own pocket, the idea here should be that you've already bought the hardware and the license. Seems obvious, right?
Yes I can see the license being device specific if not only because that's the way you've designed your licensing activation schema; but if I've just had your product fail and bought another replacement, there should be an understanding or agreement between Cisco and the user that we can reinstate any licenses we've already bought.
Do you really believe it's fair to make someone buy something from you twice, something that they've already bought from you? Do you actually believe that? I believe that the people in the Cisco Licensing department would agree with my viewpoint and I have a pending case with them for this issue right now. I will post my result here.
Make your products last and perhaps I can give credence to your licensing beliefs, until then your products fail and so does your licensing logic.

HT5622 Why do i asked for payment verification if the application i was about to download is FREE?? This happens after i change/reset my password.

Why do i asked for payment verification if the application i was about to download is FREE?? This happens after i change/reset my password.

Ive tried to complete the payment verification form but was declined due to my card has insufficient fund. But take note the app i was downloading is Free. Why am i charging for a Free app? Is this some kind of a bug or something? Need some help.

Verification on the asa 8.4 5505 about PAT and port forwarding.

Similar Messages

Maybe you are looking for