VPN Termination

My setup is ISP-2811-PIX 515E-LAN. Right now, I am doing a PAT for IPSEC tunnels to terminate on the PIX. Do you recommend I use the 2811 instead of PIX for VPN or keep things the way it is? Trying to determine the best box to use. Thanks!

i can't think of any cons of keeping it on the PIX as PIX is designed to terminate VPN and firewall capabilities.
But yes, you are right, if you need QoS capability for the traffic within the vpn tunnel then yes, move it to the 2811 router.

Similar Messages

  • VPN Termination IP address

    Hi,
    I am pretty sure that you can't do this in previous versions and don't think it has changed in version 9.X but though I would check in with the community before righting the idea off completely.
    We are an ISP that does Managed Services, I am looking at a way too ultimately conserve IP addressing so for our managed firewall customers we want to have a private p2p subnet between the ISP PE router and the ASA firewall and then we can configure /32 static routes on the PE as and when the customers need public IP addresses. As I'm sure most of you know this will work fine for outbound dynamic and inbound static NAT's.
    Can anyone confirm that in version 9.X whether there is anything we can do when it comes to l2l vpns (webvpn/Anyconnect as well but mainly IPsec l2l), can we use one of these routed public IP addresses to terminate a IPsec VPN?
    I hafve lab'd it up in GNS3 on 8.4 and can't see a way of doing it, I have also seen a couple of posts online that say you can't do it either although nothing about 9.X.
    Thanks in advance

    Hello,
    Not seen anything about it in release notes and you'd think it would get a mention if you could do it. Wish they would find a way to do it though, have the same problem and have to NAT the VPN through to a router behind the ASA, bit messy but it works.

  • Question about site to site VPN failover on an ASA

    Hello all. I am building a site to site VPN from our headquarters to a customer. I am using an ASA 5520. The customer is using Cisco 3945 routers. The customer has two VPN termination points. The customer requests that we make one of their termination points the primary VPN connection and make the other termination point the backup in the event that the primary VPN fails. How do I configure this on the ASA? Does the below configuration fulfill this goal?
    crypto map cccccc 10 set peer 2.2.2.2 1.3.3.3

    I have just encountered a similar situation.  It seems to work near enough, but I still consider it a hack.  
    Also if the second peer (887 router in this case) attempts to bring up the IPSec tunnel the ASA drops the the primary tunnel and restablishes it causing brief packet loss during the tunnel bounce.  A debug shows an error that it thinks the peer IP has changed, hence the tunnel should be dropped!!!
    Im just using HRSP on the access site between 2 x 887's tracking the WAN interface.  On the ASA side I have both peers defined in the same way "crypto map cccccc 10 set peer 2.2.2.2 1.3.3.3".
    The ASA feature set just hasnt improved in this space since the VPN3000 days, it may have actually gone backwards. Introduction of VTI interfaces and support for routing protocols over tunnels should have been introduced into the ASA years ago, but from what I understand has been put in the too hard basket.
    Cheers
    Kent.

  • Asa vpn ip question

    Hi all,
    I feel like this is a dumb question, but I can't seem to find the documentation fitting my scenario on cisco. I can setup VPN without any problems. My issue though is that, all the configuration examples rely on the outside interface IP as the "PEER IP" in L2L or target IP in RA. Is there any special configuration needed to use a public IP other that my outside interface?
    Example:
    outside interface (ASA) ip 1.1.1.1
    L2L vpn ip 1.1.1.2
    RA vpn ip 1.1.1.3
    Gateway ip 1.1.1.4
    I want to use 1.1.1.2 and 1.1.1.3 in my ASA configuration instead of using the outside interface, but im unsure as to where I define this parameter.....
    Any suggestions using this example?
    Tia,
    Fred

    Fred, you are right in stating all docs pertaining to l2l vpn points to outside interface as it is the most commonly setup scenario. I am not aware you could do what you are trying to do using a different IP as your vpn termination point instead of the actual IP address of the interface, if there is a was Im willing to learn it.
    You could however, not that I have tried it but will see if I could simulate this at some point in future would be to have three outside subinterfaces one sub for L2l 1.1.1.2 end termination point, one sub RA 1.1.1.3 and your outside physical with 1.1.1.1 . This is Just a thought , perhaps we could see some other comments.
    Rgds
    Jorge

  • Remote access VPN issues using Pix 501

    We have taken over a network where there was little to no documentation. I have a remote access VPN terminated on a Pix 501 that is having a connectivity issue. I can connect using Cisco VPN Client. There is a server on the inside network that is used for mail etc. It has an IP of 192.168.0.4. I cannot ping it from my VPN session but from the Pix itself, I can ping it. There are different source IP's as the IP pool for the VPN session is 172.16.x.x and the inside network is 192.168.x.x. I can ping other hosts on the same inside network that are in the ARP table of the Pix. I have attached the configuration of the Pix 501. After researching, I cannot figure out what the issue is. I was assuming it was the route inside 172.16.x.x was set incorrectly but I can ping some hosts on the 192.168.x.x network. Thanks

    Aru,
    Hi. Thanks for responding. I did try and remove that route inside command and I still could not ping the server. I also tried removing those static translations and did a clear xlate but still no luck. This one has me puzzled. Especially since I can ping other hosts on that network and also ping the server but only from the Pix. The source on the Pix would be different 192.168.0.x than when I am connected using the VPN 172.16.1.x. That is the biggest difference. If it was routing, I would assume I could not ping any host on the 192.168.0.x network from the VPN session. I did remove that route inside as all of the other config examples did not have a specific route statement for the local pool even though it is not on the inside network. I have limited knowledge of their network as we just were told to manage it. Thanks again.

  • Remote Access VPN, how to specify on which interface clients will be placed on?

    Hi,
    I have a general understanding problem with remote access VPN and Cisco ASA.
    If I have an ASA with multiple interfaces and I want to make sure that a Remote Access VPN Client is placed onto a specific interface, how do I do this?
    example:
    ASA has 4 interfaces: outside, inside-clients, inside-workers, inside-lab.
    I want to allow multiple Remote Access VPN configurations that put clients coming from "outside" to "inside-lab" and "inside-clients", with two different profiles and two different IP pools, as the IP addresses for each of the interfaces is different.
    How do I do that?
    If possible be as explanatory as possible for me to really grasp the concept.
    Many thanks
    Pat

    Hi,
    The ASA will view the hosts in its routing table behind the ASA interface which forms the VPN connection with the VPN Client. This is most of the time the interface called "outside".
    By default the ASA allows all traffic coming from a VPN connection to bypass the interface ACL of the ASA. The thought process behind this is I guess the fact that the VPN devices/clients have already proven they have right to connect to the network to all traffic is allowed.
    The configuration that controls this setting globally on the ASA is
    sysopt connection permit-vpn
    The above is the default setting of the command and it WONT show up in the CLI format configurations because its a default setting.
    If you were to issue the following command
    no sysopt connection permit-vpn
    Then this would mean that the ASA would require an ACL statement on its VPN terminating interface (outside) to permit the traffic from the VPN Pool to the LAN networks.
    Naturally you would have to take into consideration also that if you have existing VPNs and insert the above global command they would also need ACL statements on the "outside" interface ACL or the inbound traffic from the VPN will start to get blocked.
    Other option (wihtout touching the above setting) would be to configure VPN Filter ACL that is a separate ACL that is only attached to a certain user or group of users.
    I personally prefer the method of using the above global setting and using the "outside" interface ACL to control traffic.
    Naturally it still leaves the question of how you are going to configure the Tunnel Groups, Group Policys and Usernames. To be honest, I have gotten a bit distracted from VPN client setups and have forgotten a lot of stuff since I dont work with them on a day to day basis. I mostly handle L2L VPN nowadays among normal firewall configurations.
    If I had to suggest something simple at this point it would be this
    Configure separate Tunnel Groups
    Configure separate VPN Pools for the above Tunnel Groups
    Configure separate Group Policys for the above Tunnel Groups
    Configure the above mentioned Global setting to limit inbound traffic from VPN
    Configure the "outside" interface ACL so that you only permit traffic from a certain VPN Tunnel Group users only to certain LAN networks
    Configure the required NAT0 configurations for traffic between these networks
    As Marcin said, there are multiple different ways to achieve the same thing as above.
    And as I said I have gotten a bit rusty with the VPN Client side on the ASA so I am not sure if at the moment I can even consider all the possible options but surely the simple ones.
    PS. The link that Marcin posted seems to point to a Group Policy setting that would let you lock the that VPN connection to use only a certain local Vlan (subinterface) on the ASA and therefore limit traffic from going to networks behind other interfacec
    Hope this helps
    - Jouni

  • Unable to access certain ports over Site to Site VPN

    We have a client that has a Cisco 1801W Firewall that is setup as a site to site VPN terminating to a Cisco ASA 5505. The tunnel is up and established, I can ping from both sides of the tunnel.
    The problem is the clients behind the Cisco ASA (192.168.2.x) cannot reach certain ports behind the Router (192.168.1.x). The main thing we're trying to do is browse via UNC path (ex: \\192.168.1.120 from a 192.168.2.x machine).
    I got 3389 working after I changed the -
    ip nat inside source static tcp 192.168.1.120 3389 y.y.x.x 3389 route-map SDM_RMAP_1 extendable
    Modified the command to include the public IP instead of interface FastEthernet0
    I believe it has something to do with the way NAT and route-maps are setup currently but I'm not familar enough with them to make the changes. I worked with Cisco to ensure the VPN tunnel was fine and it's something security related on the Router.
    Here is the configuration (removed a few lines not necessary. y.y.x.x = WAN IP of Router x.x.y.y = WAN IP of ASA).
    Building configuration...
    Current configuration : 23648 bytes
    version 12.4
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname PrarieTow
    boot-start-marker
    boot-end-marker
    logging buffered 52000
    enable secret 5 $1$7Ab8$oFQY76OPhJm/UUkXfqCbl/
    aaa new-model
    aaa group server radius rad_eap
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login default local
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authorization ipmobile default group rad_pmip
    aaa accounting network acct_methods start-stop group rad_acct
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key Ch4C5eSP address x.x.y.y
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel tox.x.y.y
    set peer x.x.y.y
    set transform-set ESP-3DES-SHA
    match address 118
    no ip source-route
    ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 192.168.1.1 192.168.1.19
    ip dhcp excluded-address 192.168.1.101 192.168.1.254
    ip dhcp excluded-address 192.168.1.60
    ip dhcp excluded-address 192.168.1.120
    ip dhcp excluded-address 192.168.1.125
    ip dhcp excluded-address 192.168.1.126
    ip dhcp pool sdm-pool1
       network 192.168.1.0 255.255.255.0
       domain-name pltowing.local
       default-router 192.168.1.1
       dns-server 192.168.1.120 68.238.0.12
    no ip bootp server
    ip domain name pltowing
    ip name-server 184.16.4.22
    ip name-server 184.16.33.54
    ip port-map user-protocol--8 port udp 3389
    ip port-map user-protocol--9 port udp 14147
    ip port-map user-protocol--2 port tcp 3489
    ip port-map user-protocol--3 port udp 3489
    ip port-map user-protocol--1 port udp 3390
    ip port-map user-protocol--6 port udp 4431
    ip port-map user-protocol--7 port tcp 3389
    ip port-map user-protocol--4 port tcp 3390
    ip port-map user-protocol--5 port tcp 4431
    ip port-map user-protocol--13 port tcp 3487
    ip port-map user-protocol--12 port udp 3488
    ip port-map user-protocol--11 port tcp 3488
    ip port-map user-protocol--10 port tcp 14147
    ip port-map user-protocol--16 port tcp 8099
    ip port-map user-protocol--15 port udp 1194
    ip port-map user-protocol--14 port udp 3487
    ip inspect log drop-pkt
    multilink bundle-name authenticated
    parameter-map type protocol-info msn-servers
    server name messenger.hotmail.com
    server name gateway.messenger.hotmail.com
    server name webmessenger.msn.com
    parameter-map type protocol-info aol-servers
    server name login.oscar.aol.com
    server name toc.oscar.aol.com
    server name oam-d09a.blue.aol.com
    parameter-map type protocol-info yahoo-servers
    server name scs.msg.yahoo.com
    server name scsa.msg.yahoo.com
    server name scsb.msg.yahoo.com
    server name scsc.msg.yahoo.com
    server name scsd.msg.yahoo.com
    server name cs16.msg.dcn.yahoo.com
    server name cs19.msg.dcn.yahoo.com
    server name cs42.msg.dcn.yahoo.com
    server name cs53.msg.dcn.yahoo.com
    server name cs54.msg.dcn.yahoo.com
    server name ads1.vip.scd.yahoo.com
    server name radio1.launch.vip.dal.yahoo.com
    server name in1.msg.vip.re2.yahoo.com
    server name data1.my.vip.sc5.yahoo.com
    server name address1.pim.vip.mud.yahoo.com
    server name edit.messenger.yahoo.com
    server name messenger.yahoo.com
    server name http.pager.yahoo.com
    server name privacy.yahoo.com
    server name csa.yahoo.com
    server name csb.yahoo.com
    server name csc.yahoo.com
    username prairie privilege 15 password 0 towing
    archive
    log config
      hidekeys
    ip ssh version 2
    class-map type inspect match-all sdm-nat-user-protocol--7-1
    match access-group 108
    match protocol user-protocol--7
    class-map type inspect match-all sdm-cls-VPNOutsideToInside-1
    match access-group 120
    class-map type inspect match-all sdm-nat-user-protocol--6-1
    match access-group 107
    match protocol user-protocol--6
    class-map type inspect match-any SDM_HTTPS
    match access-group name SDM_HTTPS
    class-map type inspect match-any SDM_SSH
    match access-group name SDM_SSH
    class-map type inspect match-any SDM_SHELL
    match access-group name SDM_SHELL
    class-map type inspect match-any sdm-cls-access
    match class-map SDM_HTTPS
    match class-map SDM_SSH
    match class-map SDM_SHELL
    class-map type inspect match-all sdm-nat-user-protocol--5-1
    match access-group 106
    match protocol user-protocol--5
    class-map type inspect match-all sdm-nat-user-protocol--4-1
    match access-group 105
    match protocol user-protocol--4
    class-map type inspect match-all sdm-nat-user-protocol--3-1
    match access-group 104
    match protocol user-protocol--3
    class-map type inspect match-all sdm-nat-user-protocol--2-1
    match access-group 103
    match protocol user-protocol--2
    class-map type inspect match-all sdm-nat-user-protocol--1-1
    match access-group 102
    match protocol user-protocol--1
    class-map type inspect match-any SDM_AH
    match access-group name SDM_AH
    class-map type inspect imap match-any sdm-app-imap
    match  invalid-command
    class-map type inspect match-all sdm-nat-user-protocol--9-1
    match access-group 110
    match protocol user-protocol--9
    class-map type inspect match-all sdm-nat-user-protocol--8-1
    match access-group 109
    match protocol user-protocol--8
    class-map type inspect match-any sdm-cls-protocol-p2p
    match protocol edonkey signature
    match protocol gnutella signature
    match protocol kazaa2 signature
    match protocol fasttrack signature
    match protocol bittorrent signature
    class-map type inspect match-any sdm-cls-insp-traffic
    match protocol cuseeme
    match protocol dns
    match protocol ftp
    match protocol h323
    match protocol https
    match protocol icmp
    match protocol imap
    match protocol pop3
    match protocol netshow
    match protocol shell
    match protocol realmedia
    match protocol rtsp
    match protocol smtp extended
    match protocol sql-net
    match protocol streamworks
    match protocol tftp
    match protocol vdolive
    match protocol tcp
    match protocol udp
    class-map type inspect match-all sdm-insp-traffic
    match class-map sdm-cls-insp-traffic
    class-map type inspect match-any SDM_ESP
    match access-group name SDM_ESP
    class-map type inspect match-any SDM_VPN_TRAFFIC
    match protocol isakmp
    match protocol ipsec-msft
    match class-map SDM_AH
    match class-map SDM_ESP
    class-map type inspect match-all SDM_VPN_PT
    match access-group 119
    match class-map SDM_VPN_TRAFFIC
    class-map type inspect gnutella match-any sdm-app-gnutella
    match  file-transfer
    class-map type inspect match-any SDM-Voice-permit
    match protocol h323
    match protocol skinny
    match protocol sip
    class-map type inspect ymsgr match-any sdm-app-yahoo-otherservices
    match  service any
    class-map type inspect msnmsgr match-any sdm-app-msn-otherservices
    match  service any
    class-map type inspect match-all sdm-protocol-pop3
    match protocol pop3
    class-map type inspect match-all sdm-nat-user-protocol--16-1
    match access-group 117
    match protocol user-protocol--16
    class-map type inspect match-all sdm-nat-user-protocol--14-1
    match access-group 115
    match protocol user-protocol--14
    class-map type inspect match-all sdm-nat-user-protocol--15-1
    match access-group 116
    match protocol user-protocol--15
    class-map type inspect match-all sdm-nat-user-protocol--12-1
    match access-group 113
    match protocol user-protocol--12
    class-map type inspect match-all sdm-nat-user-protocol--13-1
    match access-group 114
    match protocol user-protocol--13
    class-map type inspect match-all sdm-nat-user-protocol--10-1
    match access-group 111
    match protocol user-protocol--10
    class-map type inspect match-all sdm-nat-user-protocol--11-1
    match access-group 112
    match protocol user-protocol--11
    class-map type inspect match-any sdm-cls-icmp-access
    match protocol icmp
    match protocol tcp
    match protocol udp
    class-map type inspect match-any sdm-cls-protocol-im
    match protocol ymsgr yahoo-servers
    match protocol msnmsgr msn-servers
    match protocol aol aol-servers
    class-map type inspect aol match-any sdm-app-aol-otherservices
    match  service any
    class-map type inspect pop3 match-any sdm-app-pop3
    match  invalid-command
    class-map type inspect match-all sdm-access
    match class-map sdm-cls-access
    match access-group 101
    class-map type inspect kazaa2 match-any sdm-app-kazaa2
    match  file-transfer
    class-map type inspect match-all sdm-protocol-p2p
    match class-map sdm-cls-protocol-p2p
    class-map type inspect http match-any sdm-http-blockparam
    match  request port-misuse im
    match  request port-misuse p2p
    match  req-resp protocol-violation
    class-map type inspect match-all sdm-protocol-im
    match class-map sdm-cls-protocol-im
    class-map type inspect match-all sdm-invalid-src
    match access-group 100
    class-map type inspect match-all sdm-icmp-access
    match class-map sdm-cls-icmp-access
    class-map type inspect ymsgr match-any sdm-app-yahoo
    match  service text-chat
    class-map type inspect msnmsgr match-any sdm-app-msn
    match  service text-chat
    class-map type inspect edonkey match-any sdm-app-edonkey
    match  file-transfer
    match  text-chat
    match  search-file-name
    class-map type inspect http match-any sdm-app-httpmethods
    match  request method bcopy
    match  request method bdelete
    match  request method bmove
    match  request method bpropfind
    match  request method bproppatch
    match  request method connect
    match  request method copy
    match  request method delete
    match  request method edit
    match  request method getattribute
    match  request method getattributenames
    match  request method getproperties
    match  request method index
    match  request method lock
    match  request method mkcol
    match  request method mkdir
    match  request method move
    match  request method notify
    match  request method options
    match  request method poll
    match  request method propfind
    match  request method proppatch
    match  request method put
    match  request method revadd
    match  request method revlabel
    match  request method revlog
    match  request method revnum
    match  request method save
    match  request method search
    match  request method setattribute
    match  request method startrev
    match  request method stoprev
    match  request method subscribe
    match  request method trace
    match  request method unedit
    match  request method unlock
    match  request method unsubscribe
    class-map type inspect edonkey match-any sdm-app-edonkeychat
    match  search-file-name
    match  text-chat
    class-map type inspect http match-any sdm-http-allowparam
    match  request port-misuse tunneling
    class-map type inspect fasttrack match-any sdm-app-fasttrack
    match  file-transfer
    class-map type inspect match-all sdm-protocol-http
    match protocol http
    class-map type inspect edonkey match-any sdm-app-edonkeydownload
    match  file-transfer
    class-map type inspect match-all sdm-protocol-imap
    match protocol imap
    class-map type inspect aol match-any sdm-app-aol
    match  service text-chat
    policy-map type inspect sdm-permit-icmpreply
    class type inspect sdm-icmp-access
      inspect
    class class-default
      pass
    policy-map type inspect p2p sdm-action-app-p2p
    class type inspect edonkey sdm-app-edonkeychat
      log
      allow
    class type inspect edonkey sdm-app-edonkeydownload
      log
      allow
    class type inspect fasttrack sdm-app-fasttrack
      log
      allow
    class type inspect gnutella sdm-app-gnutella
      log
      allow
    class type inspect kazaa2 sdm-app-kazaa2
      log
      allow
    class class-default
    policy-map type inspect sdm-pol-NATOutsideToInside-1
    class type inspect sdm-nat-user-protocol--1-1
      inspect
    class type inspect sdm-nat-user-protocol--2-1
    inspect
    class type inspect sdm-nat-user-protocol--3-1
      inspect
    class type inspect sdm-nat-user-protocol--4-1
      inspect
    class type inspect sdm-nat-user-protocol--5-1
      inspect
    class type inspect sdm-nat-user-protocol--6-1
      inspect
    class type inspect sdm-nat-user-protocol--7-1
      inspect
    class type inspect sdm-nat-user-protocol--8-1
      inspect
    class type inspect sdm-nat-user-protocol--9-1
      inspect
    class type inspect sdm-nat-user-protocol--10-1
      inspect
    class type inspect sdm-nat-user-protocol--11-1
      inspect
    class type inspect sdm-nat-user-protocol--12-1
      inspect
    class type inspect sdm-nat-user-protocol--13-1
      inspect
    class type inspect sdm-nat-user-protocol--14-1
      inspect
    class type inspect sdm-nat-user-protocol--15-1
      inspect
    class type inspect sdm-nat-user-protocol--16-1
      inspect
    class type inspect sdm-cls-VPNOutsideToInside-1
      inspect
    class class-default
    policy-map type inspect imap sdm-action-imap
    class type inspect imap sdm-app-imap
      log
    class class-default
    policy-map type inspect pop3 sdm-action-pop3
    class type inspect pop3 sdm-app-pop3
      log
    class class-default
    policy-map type inspect im sdm-action-app-im
    class type inspect aol sdm-app-aol
      log
      allow
    class type inspect msnmsgr sdm-app-msn
      log
    allow
    class type inspect ymsgr sdm-app-yahoo
      log
      allow
    class type inspect aol sdm-app-aol-otherservices
      log
      reset
    class type inspect msnmsgr sdm-app-msn-otherservices
      log
      reset
    class type inspect ymsgr sdm-app-yahoo-otherservices
      log
      reset
    class class-default
    policy-map type inspect sdm-inspect
    class type inspect sdm-invalid-src
      inspect
    class type inspect sdm-protocol-http
      inspect
    class type inspect sdm-protocol-imap
      inspect
      service-policy imap sdm-action-imap
    class type inspect sdm-protocol-pop3
    inspect
      service-policy pop3 sdm-action-pop3
    class type inspect sdm-protocol-p2p
      inspect
      service-policy p2p sdm-action-app-p2p
    class type inspect sdm-protocol-im
      inspect
      service-policy im sdm-action-app-im
    class type inspect sdm-insp-traffic
      inspect
    class type inspect SDM-Voice-permit
      inspect
    class class-default
      pass
    policy-map type inspect http sdm-action-app-http
    class type inspect http sdm-http-blockparam
      log
      reset
    class type inspect http sdm-app-httpmethods
      log
      reset
    class type inspect http sdm-http-allowparam
      log
    allow
    class class-default
    policy-map type inspect sdm-permit
    class type inspect SDM_VPN_PT
      pass
    class type inspect sdm-access
      inspect
    class class-default
    zone security out-zone
    zone security in-zone
    zone-pair security sdm-zp-self-out source self destination out-zone
    service-policy type inspect sdm-permit-icmpreply
    zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zone
    service-policy type inspect sdm-pol-NATOutsideToInside-1
    zone-pair security sdm-zp-out-self source out-zone destination self
    service-policy type inspect sdm-permit
    zone-pair security sdm-zp-in-out source in-zone destination out-zone
    service-policy type inspect sdm-inspect
    bridge irb
    interface FastEthernet0
    description $ETH-LAN$$FW_OUTSIDE$
    ip address y.y.x.x 255.255.255.252
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat outside
    ip virtual-reassembly
    zone-member security out-zone
    duplex auto
    speed auto
    crypto map SDM_CMAP_1
    interface BRI0
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    encapsulation hdlc
    shutdown
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    interface FastEthernet4
    interface FastEthernet5
    interface FastEthernet6
    interface FastEthernet7
    interface FastEthernet8
    interface Vlan1
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    bridge-group 1
    interface BVI1
    description $FW_INSIDE$
    ip address 192.168.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    zone-member security in-zone
    ip default-gateway 50.50.20.105
    ip route 0.0.0.0 0.0.0.0 50.50.20.105
    ip route 10.8.0.0 255.255.255.0 192.168.1.251
    ip http server
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 600 life 86400 requests 10000
    ip nat inside source static tcp 192.168.1.120 8099 interface FastEthernet0 8099
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0 overload
    ip nat inside source static udp 192.168.1.251 1194 y.y.x.x 1194 route-map SDM_RMAP_1 extendable
    ip nat inside source static tcp 192.168.1.120 3389 y.y.x.x 3389 route-map SDM_RMAP_1 extendable
    ip nat inside source static udp 192.168.1.120 3389 y.y.x.x 3389 route-map SDM_RMAP_1 extendable
    ip nat inside source static tcp 192.168.1.125 3489 y.y.x.x 3390 route-map SDM_RMAP_1 extendable
    ip nat inside source static udp 192.168.1.120 3390 y.y.x.x 3390 route-map SDM_RMAP_1 extendable
    ip nat inside source static tcp 192.168.1.126 3487 y.y.x.x 3487 route-map SDM_RMAP_1 extendable
    ip nat inside source static udp 192.168.1.126 3487 y.y.x.x 3487 route-map SDM_RMAP_1 extendable
    ip nat inside source static tcp 192.168.1.126 3488 y.y.x.x 3488 route-map SDM_RMAP_1  extendable
    ip nat inside source static udp 192.168.1.126 3488 y.y.x.x 3488 route-map SDM_RMAP_1 extendable
    ip nat inside source static udp 192.168.1.125 3489 y.y.x.x 3489 route-map SDM_RMAP_1 extendable
    ip nat inside source static tcp 192.168.1.120 4431 y.y.x.x 4431 route-map SDM_RMAP_1 extendable
    ip nat inside source static udp 192.168.1.120 4431 y.y.x.x 4431 route-map SDM_RMAP_1 extendable
    ip nat inside source static tcp 192.168.1.120 14147 y.y.x.x 14147 route-map SDM_RMAP_1 extendable
    ip nat inside source static udp 192.168.1.120 14147 y.y.x.x 14147 route-map SDM_RMAP_1 extendable
    ip access-list extended SDM_AH
    remark SDM_ACL Category=1
    permit ahp any any
    ip access-list extended SDM_ESP
    remark SDM_ACL Category=1
    permit esp any any
    ip access-list extended SDM_HTTPS
    remark SDM_ACL Category=1
    permit tcp any any eq 443
    ip access-list extended SDM_SHELL
    remark SDM_ACL Category=1
    permit tcp any any eq cmd
    ip access-list extended SDM_SSH
    remark SDM_ACL Category=1
    permit tcp any any eq 22
    access-list 1 permit 192.168.1.0 0.0.0.255
    access-list 2 remark SDM_ACL Category=2
    access-list 2 permit 192.168.1.0 0.0.0.255
    access-list 100 remark SDM_ACL Category=128
    access-list 100 permit ip host 255.255.255.255 any
    access-list 100 permit ip 127.0.0.0 0.255.255.255 any
    access-list 100 permit ip 50.50.20.104 0.0.0.3 any
    access-list 101 remark SDM_ACL Category=128
    access-list 101 permit ip any any
    access-list 102 remark SDM_ACL Category=0
    access-list 102 permit ip any host 192.168.1.120
    access-list 103 remark SDM_ACL Category=0
    access-list 103 permit ip any host 192.168.1.125
    access-list 104 remark SDM_ACL Category=0
    access-list 104 permit ip any host 192.168.1.125
    access-list 105 remark SDM_ACL Category=0
    access-list 105 permit ip any host 192.168.1.120
    access-list 106 remark SDM_ACL Category=0
    access-list 106 permit ip any host 192.168.1.120
    access-list 107 remark SDM_ACL Category=0
    access-list 107 permit ip any host 192.168.1.120
    access-list 108 remark SDM_ACL Category=0
    access-list 108 permit ip any host 192.168.1.120
    access-list 109 remark SDM_ACL Category=0
    access-list 109 permit ip any host 192.168.1.120
    access-list 110 remark SDM_ACL Category=0
    access-list 110 permit ip any host 192.168.1.120
    access-list 111 remark SDM_ACL Category=0
    access-list 111 permit ip any host 192.168.1.120
    access-list 112 remark SDM_ACL Category=0
    access-list 112 permit ip any host 192.168.1.126
    access-list 113 remark SDM_ACL Category=0
    access-list 113 permit ip any host 192.168.1.126
    access-list 114 remark SDM_ACL Category=0
    access-list 114 permit ip any host 192.168.1.126
    access-list 115 remark SDM_ACL Category=0
    access-list 115 permit ip any host 192.168.1.126
    access-list 116 remark SDM_ACL Category=0
    access-list 116 permit ip any host 192.168.1.251
    access-list 117 remark SDM_ACL Category=0
    access-list 117 permit ip any host 192.168.1.120
    access-list 118 remark SDM_ACL Category=4
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 119 remark SDM_ACL Category=128
    access-list 119 permit ip host x.x.y.y any
    access-list 120 remark SDM_ACL Category=0
    access-list 120 remark IPSec Rule
    access-list 120 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 121 remark SDM_ACL Category=2
    access-list 121 remark IPSec Rule
    access-list 121 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 121 permit ip 192.168.1.0 0.0.0.255 any
    no cdp run
    route-map SDM_RMAP_1 permit 1
    match ip address 121
    radius-server attribute 32 include-in-access-req format %h
    radius-server vsa send accounting
    control-plane
    bridge 1 protocol ieee
    bridge 1 route ip
    bridge 2 route ip
    line con 0
    line aux 0
    line vty 0 4
    privilege level 15
    transport input ssh
    webvpn cef
    end

    Hello Frank,
    Just to clarify, you have changed the rule so y.y.x.x is router WAN link:
    ip nat inside source static tcp 192.168.1.120 3389 y.y.x.x 3389 route-map SDM_RMAP_1 extendable
    and after that you could access 192.168.1.120:3389 from 192.168.2.0 networks ?
    Above rule do a static translation of 192.168.1.120 3389 to your WAN link for all traffic EXCEPT VPN.
    So maybe you were trying to access y.y.x.x (not 192.168.1.120) port 3389 from 192.168.2.0 networks ?
    (and that traffic is not being sent via VPN but just normally routed through internet)
    Michal

  • IPSec VPN b/w ISA500 and RV042

    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=Could not change to directory '/etc/ipsec.d/crls';
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=Could not change to directory '/etc/ipsec.d/ocspcerts': /;
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=Could not change to directory '/etc/ipsec.d/aacerts': /;
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  error in X.509 certificate default.pem;
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  loaded CA cert file 'default.pem' (2745 bytes);
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  loaded CA cert file 'default_crt.pem' (1070 bytes);
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  error in X.509 certificate default_key.pem;
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  loaded CA cert file 'default_key.pem' (1675 bytes);
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=Changed path to directory '/mnt/shiner/certificate';
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=loading secrets from "/tmp/etc/ipsec.d/S2S.secrets";
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  loaded CA cert file 'default.pem' (2745 bytes);
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  loaded CA cert file 'default_crt.pem' (1070 bytes);
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  error in X.509 certificate default_key.pem;
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=  loaded CA cert file 'default_key.pem' (1675 bytes);
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=Changed path to directory '/mnt/shiner/certificate';
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=loading secrets from "/tmp/etc/ipsec.d/S2S.secrets";
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=loading secrets from "/etc/ipsec.secrets";
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=forgetting secrets;
    2013-07-30 11:37:04
    Information
    IPsec VPN
    msg=added connection description "Tunnel0";
    2013-07-30 11:37:02
    Information
    IPsec VPN
    msg="Alabang" #117: deleting state (STATE_MAIN_R1);
    2013-07-30 11:37:02
    Information
    IPsec VPN
    msg="Alabang": deleting connection;
    2013-07-30 11:36:55
    Warning
    IPsec VPN
    msg="Alabang" #117: STATE_MAIN_R1: sent MR1, expecting MI2;
    2013-07-30 11:36:55
    Error
    IPsec VPN
    msg=ERROR: "Alabang" #117: sendto on ppp0 to 112.209.172.XXX:500 failed in STATE_MAIN_R0. Errno 101: Network is unreachable;
    2013-07-30 11:36:55
    Information
    IPsec VPN
    msg="Alabang" #117: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1;
    2013-07-30 11:36:55
    Information
    IPsec VPN
    msg="Alabang" #117: responding to Main Mode;
    2013-07-30 11:36:55
    Warning
    IPsec VPN
    msg=packet from 112.209.172.XXX:500: received Vendor ID payload [Dead Peer Detection];
    2013-07-30 11:36:46
    Information
    IPsec VPN
    msg=Could not change to directory '/etc/ipsec.d/crls';
    2013-07-30 11:36:46
    Information
    IPsec VPN
    msg=Could not change to directory '/etc/ipsec.d/ocspcerts': /;
    ==============================================================
    Site 1 = Cisco ISA 500. Named as CHI
    Site 2 = Cisco RV042. Named as Alabang
    Shown above is the logs from my ISA 570 IPSec VPN. I have set the same settings for my IKE Policies and my Transform Sets. Attached are the screenshots of my the VPN Settings of my 2 systems. It does show in the table above that the 112.209.172.XXX is unreachable, but please look at screen6.bmp and see that I can very well ping the RV042 system. Please feel free to ask me for more info about my setup.
    On a side note, take a look at Screen5.bmp. This screenie shows that I have an existing WORKING VPN connection to another site with a Linksys RV042, named as Villa. So as you can also see in the screenshot, it has a VPN setup for CHI but it can not connect. Hence my problem above. The VPN setting for Villa is the same as CHI (PFS, IKE, Transforms, PFS).

    Dan,
    Since I'm not a Cisco employee, don't have access to spare ISAs and RVs to setup a lab and test, don't have a setup similar enough to yours to test with, don't have access to your devices, and wouldn't have other than UI access if I did, doing a little trial and error is all I have to work with to assist you.
    That said, it's not random trial and error. From what I'm able to see via your screenshots and explanations, all of your config looks correct. So if everything for Phase 1 & 2 are accurate, then it should work unless there is an interesting traffic mismatch.
    Usually this is pretty straightforward and simple to troubleshoot and confirm. However when you add in additional challenges that come with Multi-WAN support, terminating the VPN on the secondary WAN interface, and PBR, there is a lot of room for possible mistakes as the config is becoming fairly complex.
    So my thought was to remove what I perceived to be the least impacting piece of complexity, which is the custom PBR that is sending those 2 laptops out WAN 2 instead of WAN 1, so that the only non-typical configuration was the VPN terminating on WAN 2.
    Right now I'm assuming the issue isn't the the possibility of the ISA and RV042 being incapable of establishing a VPN. I'm assuming it is either an issue with VPN termination on WAN 2 (which I don't believe is an issue) or something not quite right with PBR and VPN interesting traffic.
    Sent from Cisco Technical Support iPhone App

  • How to verify encryption (isakmp and ipsec) on VPN

    Our customer believes the only way to verify data is being encrypted properly is to tap the fiber connections between our routers (encryptors). They are afraid that data might traverse the network that hasnt been encrypted.
    I contend that using cisco show commands such as crypto session, crypto isakmp sa, and crypto ipsec sa validate VPN is setup correctly and providing data encryption.
    Does anyone else have this scenario and any suggestions would be greatly appreciated on validating encryption.
    Thank you.
    Antonio

    Hi Antonio,
    you can use the following sh commands on asa to check the isakmp and ipsec details and encrypted networks
    sh cry isa sa det
    sh cry ipsec sa det
    sh vpn-sessiondb det l2l
    sh cry ipsec sa det peer
    please refer the following link for router and asa commands
    http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml
    once you know the packets are getting encrypted on the device you can run a capture on the outside interface of the VPN  terminating decice and use wire shark to open the capture to do further analysis for encryption on the captured paccket.
    refer the following doc to capture the packcet on FW
    https://supportforums.cisco.com/docs/DOC-17345
    Thanks and Regards,
            ROHAN 

  • WRVS4400N VPN out of the box?

    Hi
    I'm looking at purchasing a WRVS4400N and I just wondered if it comes with everything needed to setup VPN (terminated on the router) 'out of the box'? Or do you need to purchase extra software or certificates?
    Many thanks
    Dan

    Correct, there isn't any addition software to purchase or certificate to buy.
    Jason Bryant
    Cisco Support Engineer

  • Vpn tunnel behavior

    Hello,
    I have a HA pair of Cisco ASA 5510's and the configurations are identical. The customer has about 100 vpn tunnels on the ASA. There was a link failure on the primary firewall and had to failover to the secondary but when it failed over, only about 17 of the tunnels came up. Does anyone know why all the tunnels would come up? As soon as the link failure was fixed and I failed it back over to the primary firewall all the tunnels came right back up. I noticed that if I run a "sh crypto isakmp sa" on the standby firewall, all the tunnels are in "MM_STANDBY". Since they are in standby shouldn't the tunnels become active once the firewall becomes active?  Any info would be appreciated. Both ASA's are on code version 7.2(4) and have 256 MB RAM. 
    Thanks!

    Peter
    I do not have much experience with the 3002 but do have experience with other 3000 series concentrators and with PIX. The behavior that you describe of clients not being able to communicate with other clients was typical when VPN was terminated on PIX (up to the 7.0 release) because the PIX would not forward a packet back out the same interface that it arrived on. (and the ability to do this was introduced in 7.0) That behavior has not been typical on VPN terminated on the 3000 series concentrators. I have done several implementations where VPNs are terminated on 3000 series concentrators and the clients are able to surf the Internet. It sounds to me like there are PIX firewall policies that are not allowing the VPN traffic to get from the DMZ to the Internet.
    HTH
    Rick

  • "Unable to establish VPN" message

    Hello, I have a windows vista 32 system laptop and I can't establish a VPN. I use it without a problem on my XP desktop. Could anyone guide me in solving this problem? I'm not very familiar with how it works.

    What VPN software are you using?
    What kind of VPN are you trying to create?
    What type of equipment is the remote end VPN terminating on?

  • Pix 515e vpn setup

    I currently have a pix 515e setup as a firewall and vpn terminator. We will be moving our network to a new isp that will provide the firewall service, but i need to keep the pix for the vpn functionality. The pix currently has a public IP for the vpn but the new ISP want to do nat for the pix, so I have to give it a private ip. here is what the ISP sent me.
    >Essentially - Customer needs
    >1. Internal Server IP address that >will arrive from customer to the f/w.
    >
    >2. The public address NAT that will >represent the customer internal server.
    >
    >3. The proper ports open to support >this request. UDP ? 10000 or 4500 ? >and 500.
    I'm new to VPN I would like some direction on where to find some documents on how to setup the cisco behind another router and without a public ip. Also can the pix have both interfaces on the same subnet?
    Thank you
    rene

    Rene -
    You can't have both the interfaces on the same subnet.
    3. Ports needed for VPN to work.
    UDP - 500 ==> which is ISAKMP
    UDP - 4500 ==> NAT-T
    UDP - 10000 ===> IPSec over UDP
    ESP protocol ==> which is protocol number 50.
    1 & 2. Your external (outside) IP address of the PIX.
    Does this answer your question.

  • Duplicate remote networks and PAT - IOS VPN

    This question pertains to an IOS router running c3900e-universalk9-mz.SPA.152-4.M5.
    We are deploying a new VPN termination router that will support multiple IPSec tunnels to multiple unrelated external organizations. We have many of these VPN routers in other regions hosting dozens of IPsec tunnels to dozens of unrelated external organizations. In the past, to allow for IPv4 uniqueness, we have suggested (required) these external organizations to PAT their source addresses to unique public addresses owned by the external organization. In some cases, my company has provided a public range of addresses to the external organization which the external organization uses to PAT their sources before presenting the traffic to our side of the VPN tunnel.
    This has served us well and scales quite well.
    However, we are now faced with an external organization (the very first organization on this new VPN termination router) that wants to present my company with non-unique addresses in the 10.0.0.0/8 range. This external organization has requested that we PAT their sources for them, which I understand that technically we can do.
    My first question is, if my company decides to go into the business of PATing the 10/8 sources of other external organizations, how will this impact the IP network used at the remote end of the tunnel and could these remote networks be overlapping between two or more external organizations without using some flavor of VRF? I developed a scenario below that I'd like help in understanding:
    interface Port-channel20.2900
    description Internet Bound (Outside)
    crypto map JIM                                               
    ip address 130.96.10.243 255.255.255.248
    ip nat inside 
    interface Port-channel20.2901
    *** Transit DMZ or LAN Bound (Inside)
    ip nat outside
    ip address 130.96.10.251 255.255.255.248 
    If we had two crypto external organizations:
    External Organization #1
    crypto map JIM 100 ipsec-isakmp
    description ***
    set peer 1.1.1.1
    set transform-set esp-3des-sha
    set security-association lifetime seconds 28800
    match address SCA
    crypto isakmp key blah address 1.1.1.1
    ip access-list extended SCA
    permit ip host 130.96.10.92 host 130.96.10.223
    access-list 7 remark *** SCA NAT List - SCA *** JMM
    access-list 7 permit 10.254.0.0 0.0.255.255
    ip nat pool SCA 130.96.10.223 130.96.10.223 prefix 30
    ip nat inside source list 7 pool SCA overload
    ip route 1.1.1.1 255.255.2552.255 130.96.10.241
    ip route 10.254.0.0 255.255.0.0 130.96.10.241
    External Organization #2
    crypto map JIM 200 ipsec-isakmp
    description ***
    set peer 2.2.2.2
    set transform-set esp-3des-sha
    set security-association lifetime seconds 28800
    match address SCB
    crypto isakmp key blah address 2.2.2.2
    ip access-list extended SCB
    permit ip host 130.96.11.14 host 130.96.11.223
    access-list 8 remark *** SCB NAT List - SCB *** JMM
    access-list 8 permit 10.254.0.0 0.0.255.255
    ip nat pool SCB 130.96.11.223 130.96.11.223 prefix 30
    ip nat inside source list 8 pool SCB overload
    ip route 2.2.2.2 255.255.2552.255 130.96.10.241
    Imagine these flows are present:
    Flow #
    External Organization
    Source
    NAT Destination
    Real Destination
    1
    1
    130.96.10.92
    130.96.10.223
    10.254.10.10
    2
    2
    130.96.11.14
    130.96.11.223
    10.254.10.10
    Since our interesting traffic access-lists are based on PAT addresses, theoretically the flow could be positively associated with the crypto-map clause before PAT. Is it true that in the forward direction we have PAT, followed by routing, followed by encryption? If so, this would mean that after PAT and routing the egress interface would be the same for both flows (Port-channel20.2900) and the IP destination address would also be the same (10.254.10.10). However, the source IP address would be distinct for each flow. Since routing has already happened, isn’t the router smart enough to associate the post-PAT packet(s) with the correct crypto-map clause on the crypto-enabled interface which would be based on the access-list in the “match address” clause within the crypto-map:
    ip access-list extended SCA
    permit ip host 130.96.10.92 host 130.96.10.223
    ip access-list extended SCB
    permit ip host 130.96.11.14 host 130.96.11.223
    In theory it seems this would allow duplicate IP networks at remote sites. Am I correct? If I'm wrong, where and how exactly does this fail?
    Thanks,
    Jim

    Hey Nathan...
    My VPN is down at the moment, but I think your going to have to manually configure all of the "clients" who are sharing the VPN to an IP range that your office uses. When you connect to your VPN, check your network prefs, and you'll see the IP addresses assigned to your VPN are similar to your network at the office. So, in a way, your sharing computer has 2 IP addresses... one from your modem or router at home, and one from the VPN server at the office. It's this 2nd IP address that allows you to appear to be on the network at the office.
    So, if you can find a way to set up your shared clients the same way.... it might work. It will also be VERY helpful if your IP range at home is different from the IP range at the office....192.168... for one...and 10.0.0 for the other. (Whether traffic will pass thru your "sharing server" is a different matter altogether.)
    Now, and I'm really guessing here.. if this works at all... you may be only able to access stuff from the office on your "shared clients" (ie no internet).... the way around that is to set up your VPN to allow VPN clients to pull stuff from the internet from the office thu the VPN... and for the life of me don't remember how that is done. But it will most likely be a bit slow.
    I'd start with the basics... setup one client with a manual IP address/router/dns servers, and try to ping a computer at the office. If this works... at least part of your problem is solved.
    With all that said... it may not work at all. Good Luck!

  • ASA 5505 - 2 Internet Connections, Problems with the Default Route

    Hey there,
    i have a Problem at a Customer Site at the moment. The customer uses an ASA 5505 with two internet connections attached to it. On the first connection (which is the only one in use at the moment) he has some Static-PAT's from Outside to Inside where he translates different services to the internal servers. He also has a site-2-site VPN terminating there and AnyConnect.
    He now wants to switch the Internet Traffic from Inside to the new Internet Connection. Therefore changing the default route to that new ISPs Gateway. The problem now is, that no traffic recieved on the old "outside" Interface is transmitted back out of that old "outside" Interface. And this happens although the "same-security permit intra-interface" command is set.
    Can you tell me what's wrong here? For every Static-PAT from outside to inside there is also a dynamic PAT from inside to outside. But the ASA seems to ignore this. I have not looked into the Logs yet, was too busy finding the problem because i had no real time window to test on the productive ASA.
    Can it be achieved in any way? Having a default route on the ASA which leads any traffic to the second internet connection while still having connections on the first internet connection where no explicit route can be set? Because connections arrive from random IPs?
    Many thanks for your help in advance!
    Steffen

    Phillip, indeed , I have as well read may comments,it all depends on your environment as they all differ from one another, you best bet is to have a good solid plan for upgrade and fall back. You do have a justification to upgrade for features needed, so I would suggest the following:
    1- Do a search again in forum for ASA code upgrades and look at comments from users that have gone through this process and note their impact in fuctionality if any. I believe this is good resource to collect information .
    2- Very important , look into release notes for a particular version. For example version 8.0, look into open CAVEATS usually at the end of the link page, reading the open bugs gives you clues what has not yet been resolved for that particular code and if in fact could impact you in your environment, it is possible that a particular bug does not realy apply to your environment becuase you have yet not implemented that particualr configuration. Usually we all try to aim towards a GD (General Deployment) code which is what we all understand is most stable but not necesarily means you have to be stack in that code waiting for another GD release, in my personal experience I have upgraded our firewall from 7.2 to 8.0(3) long ago and had no issues, and recently upgraded to 8.0(4)when it was first release in August this year.
    Release notes
    http://www.cisco.com/en/US/products/ps6120/prod_release_notes_list.html
    3- AS a good practice precaution -
    a-Backup firewall configs in clear text as well as via tftp code.
    b-Backup running code and ASDM version code currently running in firewall.
    c- Save the output of " show version " to have as reference for all the feature licenses you currently have running as asll as activation keys - good info to have to compare with after upgrade.
    d- Ensure that the code you will be using to upgrade also uses correct ASDM version code.
    I think with thorough assesment and preparation you can indeed minimize impact.
    Rgds
    Jorge

Maybe you are looking for