VPN License question on 5505 ASA Firewall

Inherited a firewall project, it's getting a VPN running on a ASA 5505 Firewall for remote workers. Firewall was configured by someone else who isn't available.
Basic question on the License: The current license is good for 2 SSL VPN Peers, and 20 "Total VPN Peers". Can anyone elaborate on "Total VPN Peers"? Can I configure Clientless SSL VPN connections, or do I need to go IPSec to get the 20 VPN sessions?
Thank you in advance,
Jeff

Hi Linda,
The default IKE SA lifetime is 86,400 seconds and the default IPSEC SA lifetime is 28,800 seconds. However, these values are configurable so you'll need to check your 5505 configuration to answer these questions. You can look at the output of 'show run crypto' to see the configured values.
-Mike

Similar Messages

ASA 5505 VPN licensing question

I have three locations, that i want to connect via site-to-site vpn's deployed on three ASA 5505. How is the term "Peers" in the licensing text, affecting my scenario? Is each ASA one peer in a site-to-site solution, or is each user transmitting data in the established tunnels also counted?

Users transmitting across the site to site tunnel are not counted. Only the peers themselves.

Yet Another ASA VPN Licensing Question :)

I have a pretty good understanding of ASA VPN concepts, but not sure about this scenario. Two questions regarding 5525 VPN SSL Anyconnect Premium Licensing.
1. Assuming we already own a ASA 5525-x with 750 Anyconnect Essentials and Mobile ( p/n ASA5525VPN-EM750K9 ) and want the ability for 200 Clientless (Anyconnect Premium) VPN connections, including mobile devices, what part number do I need?
2. Assuming we do not yet own a ASA5525, but want the same 200 clientless VPN connections plus mobile device connectivity, what part number do I need? I'm assuming this is correct >> ASA5525VPN-PM250K9
Thanks!

It's no problem - I sometimes look for an answer to a question myself and find my own 2 year old post explaining the answer. As long as I don't find my 2 week old answer, I'm OK with that. :)
Anyhow, no there's not a SKU to upgrade Essentials to Premium. All the Premium upgrade SKUs are between Premium licensed user tiers (10-25, 25-50, 50-100 etc.).
If you're a persuasive customer and make a strong case with your reseller they may be able to get a deal with Cisco outside the normal channels to get some relief as a customer satisfaction issue. That's very much a case by case thing though and not the normal fulfillment method.

Asa failover & SSL vpn license question

with a failover pair, if you want to purchase an SSL license, do you have to purchase the same license for each one, or can they 'share' a license since only one will ever be active?

Steven,
You must purchase license for each and every device that you want to enable SSL Feature. It does not matter if the chassis is in active or standby mode in failover, you need a separate license.
Regards,
Arul
*Pls rate if it helps*

ASA IPSEC VPN Design Question; ARP Between ASA

I"ve a requirement to put two ASA between two sites. The second site has hosts within the same network as the first site (conflict of fundamental routing principles). Can you put an ASA inline between the router and distribution switch at each site, setup an IPSEC VPN and not have issue? I thought we could have the distro switch terminate in the DMZ interface setup as a layer 2 interface in a vlan with a vlan int in the same network as the vlan int on the ASA DMZ interface on the ASA at the other site. Will this work? I guess the biggest concern is how to get layer 2 (arp) to work so hosts/servers can find each other between buildings and not get dropped on a layer 3 interface that doesn't see the distant network on a different egress interface.
Thanks!
Matt

Matt,
AFAIK - what you are describing is layer 2 tunneling, providing layer 2 networks from two speperate locations.
The only way I am aware of how to provide this - does NOT invlove ASA's or VPN's suing layer 3. You could do this over MPLS or a transparent layer 2 pt-pt circuit.
Perhaps another netpro has done this or knows how - I did hear of someone bridging thru a GRE tunnel, not sure if that is a viable option or actually works.
HTH>

Cisco ASA 5505 Site to site VPN IPSEC tunnel to an Clavister Firewall

Hi,
I have weird problem with a Site to site VPN tunnel from a Cisco ASA 5505 to an Clavister Firewall.
When I restart the Cisco ASA 5505 the tunnel is up and down,up, down, down, and I get all strange messages when I see if the tunnel is up or down with the syntax: show crypto isakmp sa
After a while like 5-10 min the vpn site to site tunnel is up and here is the strange thing happening I have all accesslists and tunnel accesslists right I can only access one remote network (Main site Clavister Firewall) trought the vpn tunnel behind the Cisco ASA 5505, and I have 5 more remote networks that I want to access but only one remote network is working trought the vpn tunnel behind the Cisco ASA. I see that when I do this syntax in ASA: show crypto ipsec sa.
They had a Clavister Firewall before on that site before and now they have a Cisco ASA 5505 and all the rules on the main site thats have the big Clavister Firewall is intact so the problems are in the Cisco ASA 5505.
Here is some logs that ASDM give me about the tunnel issue, but like I said, the tunnel is up and only one remote network is reachable in that tunnel.....
3
Nov 21 2012
07:11:09
713902
Group = 195.149.180.254, IP = 195.149.169.254, Removing peer from correlator table failed, no match!
3
Nov 21 2012
07:11:09
713902
Group = 195.149.180.254, IP = 195.149.169.254, QM FSM error (P2 struct &0xc92462d0, mess id 0x1c6bf927)!
3
Nov 21 2012
07:11:09
713061
Group = 195.149.180.254, IP = 195.149.169.254, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 0.0.0.0/0.0.0.0/0/0 local proxy 0.0.0.0/0.0.0.0/0/0 on interface outside
5
Nov 21 2012
07:11:09
713119
Group = 195.149.180.254, IP = 195.149.169.254, PHASE 1 COMPLETED
Here is from the syntax: show crypto isakmp sa
Result of the command: "show crypto isakmp sa"
   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1   IKE Peer: 195.149.180.254
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE
Result of the command: "show crypto ipsec sa"
interface: outside
    Crypto map tag: CustomerCryptoMap, seq num: 10, local addr: 213.180.90.29
      access-list arvika_garnisonen permit ip 172.22.65.0 255.255.255.0 192.168.123.0 255.255.255.0
      local ident (addr/mask/prot/port): (172.22.65.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.123.0/255.255.255.0/0/0)
      current_peer:195.149.180.254
      #pkts encaps: 2188, #pkts encrypt: 2188, #pkts digest: 2188
      #pkts decaps: 2082, #pkts decrypt: 2082, #pkts verify: 2082
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 2188, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: 213.180.67.29, remote crypto endpt.: 195.149.180.254
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: E715B315
    inbound esp sas:
      spi: 0xFAC769EB (4207372779)
         transform: esp-aes-256 esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 5, }
         slot: 0, conn_id: 2879488, crypto-map: CustomerCryptoMap
         sa timing: remaining key lifetime (kB/sec): (38738/2061)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xE715B315 (3876958997)
         transform: esp-aes-256 esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 5, }
         slot: 0, conn_id: 2879488, crypto-map: CustomerCryptoMap
         sa timing: remaining key lifetime (kB/sec): (38673/2061)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
And here are my Accesslists and vpn site to site config:
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 84600
crypto isakmp nat-traversal 40
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map CustomerCryptoMap 10 match address VPN_Tunnel
crypto map CustomerCryptoMap 10 set pfs group5
crypto map CustomerCryptoMap 10 set peer 195.149.180.254
crypto map CustomerCryptoMap 10 set transform-set ESP-AES-256-SHA
crypto map CustomerCryptoMap interface outside
access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 192.168.123.0 255.255.255.0 -------> This is the only remote network I can reach behind the Cisco ASA and the other remote networks dont work..
access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 host 10.1.34.5
access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 host 10.1.20.76
access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 host 62.88.129.221
access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 172.22.71.0 255.255.255.0
access-list nonat extended permit ip 172.22.65.0 255.255.255.0 192.168.123.0 255.255.255.0
access-list nonat extended permit ip 172.22.65.0 255.255.255.0 host 10.1.34.5
access-list nonat extended permit ip 172.22.65.0 255.255.255.0 host 10.1.20.76
access-list nonat extended permit ip 172.22.65.0 255.255.255.0 host 62.88.129.221
access-list nonat extended permit ip 172.22.65.0 255.255.255.0 172.22.71.0 255.255.255.0
nat (inside) 0 access-list nonat
All these remote networks are at the Main Site Clavister Firewall.
Best Regards
Michael

Hi,
I'd start by getting the configuration of the remote site related to Local/Remote network configurations and go through them. Even though no changes have been made.
If they are mirror images of eachother already I'd say its probably some problem related to Cisco/Clavister setup
Seems especially wierd to me that one of the error messages includes 0.0.0.0 lines.
I have run into some problems with L2L VPN configurations when our Cisco device just doesnt want to work with the remote end device. In some cases we have confirmed that our networks defined for the L2L VPN are exactly the same and yet when checking debugs on the ASA side we can see the remote end device using totally wrong network masks for the VPN negotiaton and therefore it failed. That problem we corrected with changing the network masks a bit.
Maybe you could try to change the Encryption Domain configurations a bit and test it then.
You could also maybe take some debugs on the Phase2 and see if you get anymore hints as to what could be the problem when only one network is working for the L2L VPN.
- Jouni

CIsco ASA 5505 and VPN licenses

Hi,
Cisco ASA 5505 comes with 10 VPN licenses in a standard configuration.
How those licenses are counted? Will I need a license per one IPSec SA?
If I have two site connected with LAN-to-LAN VPN with 10 subnets at one site, how many licenses will be taken? 10 - one per IPSec SA or just 1 - one per point-to-point VPN?
Thank you.
Regards,
Alex

Alex,
In an ASA 5505, it should say something like this...when you do sh ver.
VPN Peers : 25
It means that you can have so many peers connecting to the ASA. Its not per IPSec SA.
Its a per tunnel license.
Rate this, if it helps!
Gilbert

Asa in active/active vpn solution licensing question

Hello All
I have a customer with the following requirements:
1) A Cisco VPN Solution that will be support SSL VPN and Cisco Client VPN - The solution will be a failover configuration running in an active-active set up. The solution offered will be fully supported (i.e. it will not go into End of Life or and lower level of support etc) by Cisco for the next 5 Years.
a. We would expect the devices to be similar to the ASA 5520 Appliance with SW,HA,$GE+1FE,£DES/AES (Including ASA 5500 Advanced Endpoint ASS)
2) User licenses for the above - Please quote for both the following
a. 500 appropriate SSL VPN User Licenses
b. 250 appropriate SSL VPN User Licenses
I am quoting them for the 500 ssl vpn bundle
ASA5520-SSL500-K9 and for the
ASA5520-BUN-K9.
Is it right that in active/active software 8.3 and above that the 500 ssl vpn licenses will be shared between the 2 asa's or will I need to have 250 licenses on each asa.
Also I have read that in active/active I cannot use shared licenses, is this relevant in a vpn solution?
http://www.cisco.com/en/US/docs/security/asa/asa84/license/license_management/license_86.html#wp2003381
Url above has this “The backup server mechanism is separate from, but compatible with, failover.
Shared licenses are supported only in single context mode, so Active/Active failover is not supported.”
Also “Failover Guidelines
•Shared licenses are not supported in Active/Active mode. See the "Failover and Shared Licenses" section for more information.
I also need to purchase the
ASA-ADV-END-SEC and
ASA-AC-M-5520 (any connect mobile) as the vpn client is eos/eol.
Do I need to buy this for both asa's or can they share them in active/active mode.
Thanks in advance.
Feisal

Hi Vibhor and thanks for the quick reply. We will be using version 9.3. I was aware that the ASA does not support PBR but I thought with the new code you could do some policy nat that could help influence the outbound flow?
So in this case we have 2x ISPs and 2x public address space, one from each ISP. How is the NAT and routing handled by the ASA in this design?
Can I not identify the guest subnet (192.168.0.0/22) and NAT this to a public address from ISP1 and also identify the corp subnets (10.x.x.x) and NAT them to ISP2?
My understanding (which is probably wrong) is that the NAT will select the egress interface rather than the routing table, so guest will be sent via ISP1 since the SVI interface of the ASA that connects to this ISP1 has an IP address from the same public address space..?
Is that incorrect?
Many thanks
Rays

How Can i Use two Different Public IP Addresses no my DMZ with ASA Firewall.

How To Using Two Different Public IP Address on My DMZ with ASA 5520
Postado por jorge decimo decimo em 28/Jan/2013 5:51:28
Hi everyone out there.
can any one please help me regarding this situation that im looking for a solution
My old range of public ip address are finished, i mean (the 41.x.x.0 range)
So now i still need to have in my DMZ another two servers that will bring some new services.
Remember that those two server, will need to be accessable both from inside and from outside users (Internet users) as well.
So as i said, my old range of public ip address is finished and we asked the ISP to gives some additional public
ip address to address the need of the two new servers on DMZ. and the ISP gave us the range of 197.216.1.24/29
So my quation is, on reall time world (on the equipment) how can i Use two different public ip address on the same DMZ
on Cisco ASA 5520 v8??
How my configuration should look like?
I was told about implementing static nat with Sub Interfaces on both Router and ASA interface
Can someone please do give me a help with a practical config sample please. i can as well be reached at [email protected]
attached is my network diagram for a better understanding
I thank every body in advance
Jorge

Hi,
So looking at your picture you have the original public IP address range configured on the OUTSIDE and its used for NAT for different servers behind the ASA firewall.
Now you have gotten a new public IP address range from the ISP and want to get it into use.
How do you want to use this IP address range? You want to configure the public IP addresses directly on the servers or NAT them at the ASA and have private IP addresses on the actual servers (like it seems to be for the current server)?
To get the routing working naturally the only thing needed between your Router and Firewall would be to have a static route for the new public network range pointing towards your ASA OUTSIDE IP address. The routing between your Router and the ISP core could either be handled with Static Routing or Dynamic Routing.
So you dont really need to change the interface configuration between the Router and ASA at all. You just need a Static route pointing the new public IP address towards the ASA outside IP address.
Now when the routing is handled between the ISP - ISP/Your Router - Your Firewall, you can then consider how to use those IP addresses.
Do you want to use the public IP addresses DIRECTLY on the HOSTS behind the firewall?This would require you to either configure a new physical interface with the new public IP address range OR create a new subinterface with the new public IP addresses range AND then configure the LAN devices correspondingly to the chosen method on the firewall
Do you want to use the public IP addresses DIRECLTY on the ASA OUTSIDE as NAT IP addresses?This would require for you to only start configuring Static NAT for the new servers between the inside/dmz and outside interface of the ASA. The format would be no different from the previous NAT configuration other than for the different IP addresses ofcourse
Of the above ways
The first way is good because the actual hosts will have the public IP addresses. Therefore you wont run into problems with DNS when the LAN users are trying to access the server.
The second way is the one requiring the least amount of configurations/changes on the ASA. In this case though you might run into problem with DNS (to which I refer above) as the server actually has a private IP address but the public DNS might reply to the LAN hosts with a public IP address and therefore connections from LAN could fail. This is because LAN users cant connect to the servers OUTSIDE NAT IP address (unless you NAT the server to public IP address towards LAN also)
Hopefully the above was helpfull. Naturally ask more specific questions and I'll answer them. Hopefully I didnt miss something. But please ask more
I'm currently at Cisco Live! 2013 London so in the "worst case" I might be able to answer on the weekend at earliest.
- Jouni

ASA firewall wont ping remote site

We have remote office which I can ping while at the main office, but when I am connected to VPN from office or home, I cant ping the remote office.
VPN gives me an ip 10.21.18.x
remote site's IP is: 172.29.x.x
i have the access-list information for the ASA firewall and router below:
below is the multilayer:
OFFICE-CORE-01#show ip access-lists
Extended IP access list verizon-INTERNET-TRAFFIC
    10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
    20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
    30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    40 permit ip 10.23.20.0 0.0.0.255 any
    50 permit ip 10.23.21.0 0.0.0.255 any
    60 permit ip 10.23.22.0 0.0.0.255 any
    70 permit ip 10.23.23.0 0.0.0.255 any
    80 permit ip 10.23.24.0 0.0.0.255 any
    90 permit ip 10.23.25.0 0.0.0.255 any
    100 permit ip 10.23.26.0 0.0.0.255 any
Extended IP access list PAETEC-INTERNET-TRAFFIC
    10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
    20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
    30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    40 permit ip 10.23.20.0 0.0.0.255 any
    50 permit ip 10.23.21.0 0.0.0.255 any
    60 permit ip 10.23.22.0 0.0.0.255 any
    70 permit ip 10.23.23.0 0.0.0.255 any
    80 permit ip 10.23.24.0 0.0.0.255 any
    90 permit ip 10.23.25.0 0.0.0.255 any
    100 permit ip 10.23.26.0 0.0.0.255 any
Extended IP access list system-cpp-all-routers-on-subnet
    10 permit ip any host 224.0.0.2
Extended IP access list system-cpp-all-systems-on-subnet
    10 permit ip any host 224.0.0.1
Extended IP access list system-cpp-dhcp-cs
    10 permit udp any eq bootpc any eq bootps
Extended IP access list system-cpp-dhcp-sc
    10 permit udp any eq bootps any eq bootpc
Extended IP access list system-cpp-dhcp-ss
    10 permit udp any eq bootps any eq bootps
Extended IP access list system-cpp-energywise-disc
    10 permit udp any eq any eq 0
Extended IP access list system-cpp-hsrpv2
    10 permit udp any host 224.0.0.102
Extended IP access list system-cpp-igmp
    10 permit igmp any 224.0.0.0 31.255.255.255
Extended IP access list system-cpp-ip-mcast-linklocal
    10 permit ip any 224.0.0.0 0.0.0.255
Extended IP access list system-cpp-ospf
    10 permit ospf any 224.0.0.0 0.0.0.255
Extended IP access list system-cpp-pim
    10 permit pim any 224.0.0.0 0.0.0.255
Extended IP access list system-cpp-ripv2
    10 permit ip any host 224.0.0.9
----------------------------------ASA ACCESS-LIST is below the brief version-------
access-list CompanyName-vpn-maint_splitTunnelAcl line 10 standard permit 172.29.0.0 255.255.0.0 (hitcnt=0) 0x52bc4d4c
-----------------------below is the ASA routes-----------------------
Gateway of last resort is 53.138.58.129 to network 0.0.0.0
S    192.168.10.0 255.255.255.0 [1/0] via 10.21.0.1, inside
C    172.17.21.0 255.255.255.0 is directly connected, dmz_tier2
S    172.16.142.0 255.255.254.0 [1/0] via 53.138.58.129, outside
C    172.16.21.0 255.255.255.0 is directly connected, dmz_tier1
C    172.19.21.0 255.255.255.0 is directly connected, dmz_tier4
S    172.23.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
S    172.25.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.25.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.24.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    172.26.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.26.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.29.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
S    172.29.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.28.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.28.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    192.168.20.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S    10.11.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    10.13.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    10.10.21.1 255.255.255.255 [1/0] via 10.21.0.1, inside
S    10.10.21.2 255.255.255.255 [1/0] via 10.21.0.1, inside
S    10.22.0.0 255.255.0.0 [1/0] via 53.138.58.129, outside
S    10.23.3.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S    10.23.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S    10.21.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    10.10.21.10 255.255.255.255 [1/0] via 10.21.0.1, inside
C    10.21.0.0 255.255.255.0 is directly connected, inside
S    10.22.3.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    10.10.41.0 255.255.255.0 [1/0] via 53.138.58.129, outside
C    53.138.58.128 255.255.255.128 is directly connected, outside
S    192.168.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S*   0.0.0.0 0.0.0.0 [1/0] via 53.138.58.129, outside
S    0.0.0.0 0.0.0.0 [255/0] via 10.21.0.1, inside tunneled
------------------------------------below is the router's routes----------
Gateway of last resort is 10.21.0.11 to network 0.0.0.0
     205.232.16.0/32 is subnetted, 1 subnets
S       205.232.16.25 [1/0] via 10.21.0.11
     62.0.0.0/32 is subnetted, 1 subnets
S       62.100.0.146 [1/0] via 10.21.0.12
     178.78.0.0/32 is subnetted, 1 subnets
S       178.78.147.193 [1/0] via 10.21.0.12
C    192.168.10.0/24 is directly connected, Vlan29
     172.16.0.0/16 is variably subnetted, 5 subnets, 3 masks
S       172.16.141.0/24 [1/0] via 10.21.0.11
S       172.16.142.0/23 [1/0] via 10.21.0.11
S       172.16.40.1/32 [1/0] via 10.21.2.12
S       172.16.40.10/32 [1/0] via 10.21.2.12
S       172.16.21.0/24 [1/0] via 10.21.0.11
     172.19.0.0/24 is subnetted, 1 subnets
S       172.19.21.0 [1/0] via 10.21.0.11
     172.18.0.0/24 is subnetted, 1 subnets
S       172.18.21.0 [1/0] via 10.21.0.12
     172.23.0.0/24 is subnetted, 3 subnets
S       172.23.186.0 [1/0] via 10.21.0.6
S       172.23.184.0 [1/0] via 10.21.0.6
S       172.23.181.0 [1/0] via 10.21.0.6
S    172.25.0.0/16 [1/0] via 10.21.0.11
     172.24.0.0/24 is subnetted, 3 subnets
C       172.24.181.0 is directly connected, Vlan31
C       172.24.186.0 is directly connected, Vlan32
C       172.24.187.0 is directly connected, Vlan33
S    172.26.0.0/16 [1/0] via 10.21.0.11
     172.29.0.0/24 is subnetted, 3 subnets
S       172.29.181.0 [1/0] via 10.21.0.6
S       172.29.184.0 [1/0] via 10.21.0.6
S       172.29.190.0 [1/0] via 10.21.0.6
S    172.28.0.0/16 [1/0] via 10.21.0.11
C    192.168.20.0/24 is directly connected, Vlan30
     10.0.0.0/8 is variably subnetted, 35 subnets, 4 masks
S       10.11.0.0/16 [1/0] via 10.21.0.6
C       10.21.28.0/24 is directly connected, Vlan28
C       10.21.26.0/24 is directly connected, Vlan26
C       10.21.25.0/24 is directly connected, Vlan25
S       10.12.0.0/16 [1/0] via 10.21.0.6
C       10.21.24.0/24 is directly connected, Vlan24
S       10.13.0.0/16 [1/0] via 10.21.0.6
C       10.21.23.0/24 is directly connected, Vlan23
C       10.21.22.0/24 is directly connected, Vlan22
C       10.21.21.0/24 is directly connected, Vlan21
C       10.21.20.0/24 is directly connected, Vlan20
C       10.21.19.0/24 is directly connected, Vlan19
S       10.21.18.0/24 [1/0] via 10.21.0.12
S       10.21.17.0/24 [1/0] via 10.21.0.11
C       10.21.16.0/24 is directly connected, Vlan16
C       10.21.15.0/24 is directly connected, Vlan15
C       10.21.14.0/24 is directly connected, Vlan14
C       10.21.13.0/24 is directly connected, Vlan13
C       10.21.12.0/24 is directly connected, Vlan12
C       10.21.11.0/24 is directly connected, Vlan11
C       10.10.21.1/32 is directly connected, Loopback0
S       10.31.0.0/16 [1/0] via 10.21.0.6
D       10.10.21.2/32 [90/130816] via 10.21.252.10, 7w0d, Vlan999
C       10.21.5.0/24 is directly connected, Vlan5
C       10.21.4.0/24 is directly connected, Vlan4
S       10.22.0.0/16 [1/0] via 10.21.0.11
C       10.21.3.0/24 is directly connected, Vlan3
C       10.21.2.0/24 is directly connected, Vlan2
C       10.23.2.0/24 is directly connected, Vlan900
S       10.22.3.0/24 [1/0] via 10.21.0.11
C       10.21.0.0/24 is directly connected, Vlan1000
S       10.41.0.0/16 [1/0] via 10.21.0.11
S       10.10.41.0/24 [1/0] via 10.21.0.11
S       10.51.0.0/16 [1/0] via 10.21.0.6
C       10.21.252.8/30 is directly connected, Vlan999
     62.0.0.0/32 is subnetted, 1 subnets
S       62.138.58.129 [1/0] via 10.21.0.11
S    192.168.2.0/24 [1/0] via 10.21.0.12
S*   0.0.0.0/0 [1/0] via 10.21.0.11

We have remote office which I can ping while at the main office, but when I am connected to VPN from office or home, I cant ping the remote office.
VPN gives me an ip 10.21.18.x
remote site's IP is: 172.29.x.x
i have the access-list information for the ASA firewall and router below:
below is the multilayer:
OFFICE-CORE-01#show ip access-lists
Extended IP access list verizon-INTERNET-TRAFFIC
    10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
    20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
    30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    40 permit ip 10.23.20.0 0.0.0.255 any
    50 permit ip 10.23.21.0 0.0.0.255 any
    60 permit ip 10.23.22.0 0.0.0.255 any
    70 permit ip 10.23.23.0 0.0.0.255 any
    80 permit ip 10.23.24.0 0.0.0.255 any
    90 permit ip 10.23.25.0 0.0.0.255 any
    100 permit ip 10.23.26.0 0.0.0.255 any
Extended IP access list PAETEC-INTERNET-TRAFFIC
    10 deny ip 10.21.0.0 0.0.255.255 10.0.0.0 0.255.255.255
    20 deny ip 10.21.0.0 0.0.255.255 172.16.0.0 0.15.255.255
    30 deny ip 10.21.0.0 0.0.255.255 192.168.0.0 0.0.255.255
    40 permit ip 10.23.20.0 0.0.0.255 any
    50 permit ip 10.23.21.0 0.0.0.255 any
    60 permit ip 10.23.22.0 0.0.0.255 any
    70 permit ip 10.23.23.0 0.0.0.255 any
    80 permit ip 10.23.24.0 0.0.0.255 any
    90 permit ip 10.23.25.0 0.0.0.255 any
    100 permit ip 10.23.26.0 0.0.0.255 any
Extended IP access list system-cpp-all-routers-on-subnet
    10 permit ip any host 224.0.0.2
Extended IP access list system-cpp-all-systems-on-subnet
    10 permit ip any host 224.0.0.1
Extended IP access list system-cpp-dhcp-cs
    10 permit udp any eq bootpc any eq bootps
Extended IP access list system-cpp-dhcp-sc
    10 permit udp any eq bootps any eq bootpc
Extended IP access list system-cpp-dhcp-ss
    10 permit udp any eq bootps any eq bootps
Extended IP access list system-cpp-energywise-disc
    10 permit udp any eq any eq 0
Extended IP access list system-cpp-hsrpv2
    10 permit udp any host 224.0.0.102
Extended IP access list system-cpp-igmp
    10 permit igmp any 224.0.0.0 31.255.255.255
Extended IP access list system-cpp-ip-mcast-linklocal
    10 permit ip any 224.0.0.0 0.0.0.255
Extended IP access list system-cpp-ospf
    10 permit ospf any 224.0.0.0 0.0.0.255
Extended IP access list system-cpp-pim
    10 permit pim any 224.0.0.0 0.0.0.255
Extended IP access list system-cpp-ripv2
    10 permit ip any host 224.0.0.9
----------------------------------ASA ACCESS-LIST is below the brief version-------
access-list CompanyName-vpn-maint_splitTunnelAcl line 10 standard permit 172.29.0.0 255.255.0.0 (hitcnt=0) 0x52bc4d4c
-----------------------below is the ASA routes-----------------------
Gateway of last resort is 53.138.58.129 to network 0.0.0.0
S    192.168.10.0 255.255.255.0 [1/0] via 10.21.0.1, inside
C    172.17.21.0 255.255.255.0 is directly connected, dmz_tier2
S    172.16.142.0 255.255.254.0 [1/0] via 53.138.58.129, outside
C    172.16.21.0 255.255.255.0 is directly connected, dmz_tier1
C    172.19.21.0 255.255.255.0 is directly connected, dmz_tier4
S    172.23.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
S    172.25.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.25.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.24.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    172.26.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.26.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.29.181.0 255.255.255.0 [1/0] via 10.21.0.1, outside
S    172.29.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.28.181.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    172.28.184.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    192.168.20.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S    10.11.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    10.13.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    10.10.21.1 255.255.255.255 [1/0] via 10.21.0.1, inside
S    10.10.21.2 255.255.255.255 [1/0] via 10.21.0.1, inside
S    10.22.0.0 255.255.0.0 [1/0] via 53.138.58.129, outside
S    10.23.3.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S    10.23.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S    10.21.0.0 255.255.0.0 [1/0] via 10.21.0.1, inside
S    10.10.21.10 255.255.255.255 [1/0] via 10.21.0.1, inside
C    10.21.0.0 255.255.255.0 is directly connected, inside
S    10.22.3.0 255.255.255.0 [1/0] via 53.138.58.129, outside
S    10.10.41.0 255.255.255.0 [1/0] via 53.138.58.129, outside
C    53.138.58.128 255.255.255.128 is directly connected, outside
S    192.168.2.0 255.255.255.0 [1/0] via 10.21.0.1, inside
S*   0.0.0.0 0.0.0.0 [1/0] via 53.138.58.129, outside
S    0.0.0.0 0.0.0.0 [255/0] via 10.21.0.1, inside tunneled
------------------------------------below is the router's routes----------
Gateway of last resort is 10.21.0.11 to network 0.0.0.0
     205.232.16.0/32 is subnetted, 1 subnets
S       205.232.16.25 [1/0] via 10.21.0.11
     62.0.0.0/32 is subnetted, 1 subnets
S       62.100.0.146 [1/0] via 10.21.0.12
     178.78.0.0/32 is subnetted, 1 subnets
S       178.78.147.193 [1/0] via 10.21.0.12
C    192.168.10.0/24 is directly connected, Vlan29
     172.16.0.0/16 is variably subnetted, 5 subnets, 3 masks
S       172.16.141.0/24 [1/0] via 10.21.0.11
S       172.16.142.0/23 [1/0] via 10.21.0.11
S       172.16.40.1/32 [1/0] via 10.21.2.12
S       172.16.40.10/32 [1/0] via 10.21.2.12
S       172.16.21.0/24 [1/0] via 10.21.0.11
     172.19.0.0/24 is subnetted, 1 subnets
S       172.19.21.0 [1/0] via 10.21.0.11
     172.18.0.0/24 is subnetted, 1 subnets
S       172.18.21.0 [1/0] via 10.21.0.12
     172.23.0.0/24 is subnetted, 3 subnets
S       172.23.186.0 [1/0] via 10.21.0.6
S       172.23.184.0 [1/0] via 10.21.0.6
S       172.23.181.0 [1/0] via 10.21.0.6
S    172.25.0.0/16 [1/0] via 10.21.0.11
     172.24.0.0/24 is subnetted, 3 subnets
C       172.24.181.0 is directly connected, Vlan31
C       172.24.186.0 is directly connected, Vlan32
C       172.24.187.0 is directly connected, Vlan33
S    172.26.0.0/16 [1/0] via 10.21.0.11
     172.29.0.0/24 is subnetted, 3 subnets
S       172.29.181.0 [1/0] via 10.21.0.6
S       172.29.184.0 [1/0] via 10.21.0.6
S       172.29.190.0 [1/0] via 10.21.0.6
S    172.28.0.0/16 [1/0] via 10.21.0.11
C    192.168.20.0/24 is directly connected, Vlan30
     10.0.0.0/8 is variably subnetted, 35 subnets, 4 masks
S       10.11.0.0/16 [1/0] via 10.21.0.6
C       10.21.28.0/24 is directly connected, Vlan28
C       10.21.26.0/24 is directly connected, Vlan26
C       10.21.25.0/24 is directly connected, Vlan25
S       10.12.0.0/16 [1/0] via 10.21.0.6
C       10.21.24.0/24 is directly connected, Vlan24
S       10.13.0.0/16 [1/0] via 10.21.0.6
C       10.21.23.0/24 is directly connected, Vlan23
C       10.21.22.0/24 is directly connected, Vlan22
C       10.21.21.0/24 is directly connected, Vlan21
C       10.21.20.0/24 is directly connected, Vlan20
C       10.21.19.0/24 is directly connected, Vlan19
S       10.21.18.0/24 [1/0] via 10.21.0.12
S       10.21.17.0/24 [1/0] via 10.21.0.11
C       10.21.16.0/24 is directly connected, Vlan16
C       10.21.15.0/24 is directly connected, Vlan15
C       10.21.14.0/24 is directly connected, Vlan14
C       10.21.13.0/24 is directly connected, Vlan13
C       10.21.12.0/24 is directly connected, Vlan12
C       10.21.11.0/24 is directly connected, Vlan11
C       10.10.21.1/32 is directly connected, Loopback0
S       10.31.0.0/16 [1/0] via 10.21.0.6
D       10.10.21.2/32 [90/130816] via 10.21.252.10, 7w0d, Vlan999
C       10.21.5.0/24 is directly connected, Vlan5
C       10.21.4.0/24 is directly connected, Vlan4
S       10.22.0.0/16 [1/0] via 10.21.0.11
C       10.21.3.0/24 is directly connected, Vlan3
C       10.21.2.0/24 is directly connected, Vlan2
C       10.23.2.0/24 is directly connected, Vlan900
S       10.22.3.0/24 [1/0] via 10.21.0.11
C       10.21.0.0/24 is directly connected, Vlan1000
S       10.41.0.0/16 [1/0] via 10.21.0.11
S       10.10.41.0/24 [1/0] via 10.21.0.11
S       10.51.0.0/16 [1/0] via 10.21.0.6
C       10.21.252.8/30 is directly connected, Vlan999
     62.0.0.0/32 is subnetted, 1 subnets
S       62.138.58.129 [1/0] via 10.21.0.11
S    192.168.2.0/24 [1/0] via 10.21.0.12
S*   0.0.0.0/0 [1/0] via 10.21.0.11

Tacacs+ access issue with ASA firewall after integrating with RSA SecureID

Hi,
In my earlier post, I raised the same question but let me rephrased it again. I have configured TACACS+ in cisco ASA firewall and able to access . But when I integrated it with RSA secure ID , I am not able to enter in enable mode. It is not accepting enable password nor RSA passcode. I have created enable_15 in ASA , ACS and RSA server but no luck.
Did any one face similar issue with ASA access ?
Rgds
Siddhesh

Hi Siddesh,
In order to help you here, I need to know few things:
1.] Show run | in aaa
2.] When you enter enable password on ASA CLI, what error do you see on ACS > Monitoring and reports > AAA protocols > tacacs authentication > "look for the error message"
3.] Turn on the debugs on ASA "debug tacacs" and "debug aaa authentication" before you duplicate the problem.
~BR
Jatin Katyal
**Do rate helpful posts**

VPN Licensing query

Hi All,
My company wants to place a Cisco Router on to a new lease line setup. With the requirement of
1) 3 site-to-site VPN to directors.
2) 30-40 client vpn from marketing team.
3) MPLS to other branch office
4) Also act as firewall.
I've suggested placing a Cisco 2951-HSEC/K9. It says recommended no. of users upto 150 and for 2921 its 100. Some forums suggest VPNs are part of the HSEC incense.
But am still not sure whether do I need to buy additional VPN licenses to cover-up all users or not. If yes, what kind of licenses shall we go for?
We have found FL-SSLVPN25-K9 compatible VPN license pack for Cisco 29XX but can we also use IPSec VPNs as well if we buy this pack. If not is there a pack that give us options to use both technologies. Are these licenses one-off or yearly subscription?
Also can Cisco 2921-HSEC/K9 do the job for us? We are use 1 LAN interface and 1 WAN along with HWIC ADSL for failover.
Thanks in advance.
Regards
Kuldeep

Hello Kuldeep,
Not sure if you found the answer in the meantime. For site to site VPN, you would need the security packets but for SSL VPN, staring from 15.0(1)M, you need a separate license as well. This link will explain it in more details:
http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/sec_ssl_vpn.html
When it comes to the license, I can only see licenses for 25 and 100 users:
http://www.cisco.com/en/US/prod/collateral/routers/ps10616/white_paper_c11_556985_ps10537_Products_White_Paper.html#wp9000798
Warm Regards,
Rose

Configure our own Public IP pool on Cisco ASA firewall

Hey everyone,
I need some assistance on the below requirement...Today we have only one internet circuit connected with our external firewall where we are using /26 public IP address for all external traffic. Now we managed to obtain our own subnet (/24) from ARIN and would like to configure on the firewall/internet router for all external services. Is my approach right in order to configure our own subnet on the firewall?
1. Create a dedicated interface on the Cisco ASA firewall for new public pool...if there is no free interface; then virtual interface also should be fine.
2. Make sure an appropriate route towards Internet router ( or create default route towards OUTSIDE interface)
3. Speak to Internet service provider and explain that you are planning to use this specific public IP address on your n/w and ask them to publish in their BGP world with proper prefix#
4.Implement one external static NAT and make sure everything works as expected.
Thanks in advance Network Experts!!!
Regards
VGS

You have the basics. but I do have a couple comments / questions
1. What ASA are you running? If you do not have a free interface and plan to create subinterfaces, you will need to remove the configuration of one of the interfaces, then create subinterfaces and then re-apply the configuration you removed to one of the subinterfaces there...So, why not just overwrite the existing external interface? Also, keep in mind that the ASA does not support two default routes. (though I have heard some rumours that this might be added to the 9.3 release, but I have not had this confirmed)
4. You don't really say what you are going to use this new setup for, but if you are using it for internet then adding just a static NAT will not be enough, you will also need a dynamic NAT.
Please remember to select a correct answer and rate helpful posts

License with anyconnect on asa 5520

Dear All,
We have a single ASA 5510 with version 7.2 (3) in our network and configured many IPSEC site to site, IPSEC - remote access vpn and webvpn with SSL. Everything is working well.
ASA-5510# sh ver
Cisco Adaptive Security Appliance Software Version 7.2(3)
Device Manager Version 5.2(2)
Compiled on Wed 15-Aug-07 16:08 by builders
System image file is "disk0:/asa723-k8.bin"
Config file at boot was "startup-config"
ASA-5510-1 up 86 days 11 hours
Hardware:   ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                             Boot microcode   : CNlite-MC-Boot-Cisco-1.2
                             SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
                             IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04
0: Ext: Ethernet0/0         : address is 0027.0d38.034e, irq 9
1: Ext: Ethernet0/1         : address is 0027.0d38.034f, irq 9
2: Ext: Ethernet0/2         : address is 0027.0d38.0350, irq 9
3: Ext: Ethernet0/3         : address is 0027.0d38.0351, irq 9
4: Ext: Management0/0       : address is 0027.0d38.0352, irq 11
5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs               : 100
Inside Hosts                : Unlimited
Failover                    : Active/Active
VPN-DES                     : Enabled
VPN-3DES-AES                : Enabled
Security Contexts           : 2
GTP/GPRS                    : Disabled
VPN Peers                   : 250
WebVPN Peers                : 25
This platform has an ASA 5510 Security Plus license.
===============================================================================================
As business improves we are now planning to upgrade our ASA 5510 to ASA 5520 ( 02 nos ver 8.2(5).     With the new ASA 5520 we would be planning to buy Any connect vpn license as well.
Finally we will need on the ASA 5520 IPSEC site to site vpn, IPSEC - remote access vpn , clientless vpn with SSL & Any connect vpn license. What are the licences should i purchase inorder to have all the above services on the box with version 8.2(5) ?
suppose if i need to have cisco desktop software which is the license i should have along with other services?
Thanks in advance

I am just away from office .. Will provide same tomorrow...
Meanwhile "L-ASA-SSL-50=ASA 5500 SSL VPN 50 Premium User License" this is the licence i have procured from cisco. I would need
both Anyconnect vpn & SSL clientless should be working on the system. Hope i would acheive with the above license.
Below is the output i got when generated the Licence key. please clarrify. thanks in advance
Failover                        : Enabled
Encryption-DES                  : Enabled
Encryption-3DES-AES             : Enabled
Security Contexts               : 2
GTP/GPRS                        : Disabled
AnyConnect Premium Peers        : 50
Other VPN Peers                 : 750
Advanced Endpoint Assessment    : Disabled
AnyConnect for Mobile           : Disabled
AnyConnect for Cisco VPN Phone : Disabled
Shared License                  : Disabled
UC Phone Proxy Sessions         : Default
Total UC Proxy Sessions         : Default
AnyConnect Essentials           : Disabled
Botnet Traffic Filter           : Disabled
Intercompany Media Engine       : Disabled

WMI query through ASA Firewall

I'm a newbie - please be patient
We have an ASA firewall that has several DMZ VLANs.
A support company that responsible for the SQL Servers wants to use WMI to query server health.
Their monitoring server currently on the internal lan, eight SQL servers on the internal lan and six of the SQL Servers are in the DMZ.
Two of the SQL Servers in the DMZ are 2003x32 Standard Edition and four are 2008R2x64 Enterprise Edition
The question is the ports that need to be open for Windows 2003 is concerningly large tcp/1025-65535, tcp/135
What are everyone’s thoughts on opening up such a large range?
Is there a better way of doing this – unfortunately getting the monitoring software rewritten is not an option and nor is going Linux
Thanks
PS - if this has already been asked can someone point me to the discussions

Hi
I would say that that is a No No
But that depends on the environment, for some (most) i woulds say its not ok, but some might feel that they do not need that much security.
WMI is a bit tough on firewalls.
But there are ways to limit the ports used by WMI
fx you can set it to use Fixed ports. and so on.
Sure it makes the server guys a little less happy since it does not work from the start and they have to make some changes but the added security is well worth the fight.
Here is a link to solarwinds for people with the same problem.and an answer that seems to work
(i have not tested this) from ASH J Kent. (almost at the bottom)
http://thwack.solarwinds.com/forums/68/application--server-management/21/server--application-monitor/16415/wmi-monitoring-through-firewal/
Here is one from MSDN
http://msdn.microsoft.com/en-us/library/windows/desktop/bb219447(v=vs.85).aspx
Good luck
HTH

VPN License question on 5505 ASA Firewall

Similar Messages

Maybe you are looking for