ITAdminGuide.com

Configuration guides for IT Administrators

Cisco ASA

Unable to SSH to ASA

September 30, 2016

⏱︎

Read time:

Cisco, Cisco ASA

We had an issue in SSH to Cisco ASA firewall that was recently purchased and setup in network. While troubleshooting further, we could see some error logs in ASDM as SSH session from 192.168.109.77 on interface inside for user “Unknown” disconnected by SSH server, reason: “Internal error” (0x00) This was caused by lack of local AAA authentication…
Read More →: Unable to SSH to ASA
Traffic between ASA interfaces of same security level

September 30, 2016

⏱︎

Read time:

Cisco, Cisco ASA

Error: Deny inbound UDP from 192.168.109.77 to 8.8.8.8/53 due to DNS query This problem occurs when you have configured 2 or more interfaces of Cisco ASA with same security-level. In such case, you need to configure and allow traffic between them. (config)# same-security-traffic permit inter-interface You can also perform the same section via ASDM. Go to Configuration > Device…
Read More →: Traffic between ASA interfaces of same security level
Cisco ASA cannot ping any hosts on outside

September 30, 2016

⏱︎

Read time:

Cisco, Cisco ASA

Out of the box Cisco ASA firewall doesn’t permit ICMP traffic, that means the firewall permits ping traffic out but it won’t let the reply traffic to come inside. The solution is to add “inspection icmp” to global policy map ASA(config)# policy-map global_policy ASA(config-pmap)# class inspection_default ASA(config)# inspect icmp ASA(config)# exit ASA# write memory After adding the above command, you…
Read More →: Cisco ASA cannot ping any hosts on outside
Cisco ASA ASDM in Windows 10

September 25, 2016

⏱︎

Read time:

Cisco, Cisco ASA

This error occurred in Windows 10 computer while trying to connect Cisco ASA 5506-x via ASDM. Error: ASDM did not get a response from the ASA in the last 60 seconds. Please check the configuration and your connection and then try again by clicking Refresh. Here are couple of workable solutions in Windows 10 The easiest way…
Read More →: Cisco ASA ASDM in Windows 10
Cisco ASA as DHCP Server for Guest Network

September 16, 2016

⏱︎

Read time:

Cisco, Cisco ASA

This is one of the most common deployment where you want Cisco ASA to lease IP address for your wireless Guests. We have a Windows Server in internal network, however for security reason, we want to completely isolate Guest network and do not want an internal server to lease IP address for Guests.Gigabit Interface 1/3 in…
Read More →: Cisco ASA as DHCP Server for Guest Network
Create CSR and Install certificate in Cisco ASA Firewall

August 15, 2016

⏱︎

Read time:

Cisco, Cisco ASA

Generate CSR via Cisco ASA CLI Commands 1. Before generating a CSR request, you must create a private key (config)# crypto key generate rsa label itadminguide.key modulus 2048 INFO: The name for the keys will be:itadminguide.key Keypair generation process begin. Please wait… 2. Once the private key is created, you will then need to create a…
Read More →: Create CSR and Install certificate in Cisco ASA Firewall
Cisco ASA AnyConnect Configuration and Troubleshooting

August 13, 2016

⏱︎

Read time:

Cisco, Cisco ASA

1.Create Network Objects (config)# object network office-subnet subnet 172.20.100.0 255.255.255.0 (config)# object network anyconnect-subnet subnet 192.168.210.0 255.255.255.0 2.Create DHCP Pool for Anyconnect client (config)# ip local pool anyconnect-pool 192.168.210.50-192.168.210.200 mask 255.255.255.0 3.Create ACL and NAT (config)# access-list InternalHosts-SplitTunnelAcl standard permit 172.20.100.0 255.255.255.0 (config)# nat (inside,outside) source static office-subnet office-subnet destination static anyconnect-subnet anyconnect-subnet 4.Enable AnyConnect.…
Read More →: Cisco ASA AnyConnect Configuration and Troubleshooting
Static bidirectional NAT on Cisco ASA firewall

August 11, 2016

⏱︎

Read time:

Cisco, Cisco ASA

In this configuration, 192.168.100.255 is an SMTP Server that we would like to publish on internet with public IP address 221.200.200.51 and open port tcp/25. STATIC NAT: (config)# access-list outside_access_in extended permit tcp any host 192.168.100.235 eq smtp (config)# access-group outside_access_in interface outside (config)# object network srv_192.168.100.235 (config)# host 192.168.100.235 (config)# nat (inside,outside) static 221.200.200.51 service tcp…
Read More →: Static bidirectional NAT on Cisco ASA firewall
Configure IKEv1 Site to Site VPN between Cisco ASAs

July 25, 2016

⏱︎

Read time:

Cisco, Cisco ASA

Step 1: Configure Phase 1 and Phase 2 In ASA of both sides Phase 1: IKE policy In Phase 1, single bi-directional SA (Security Association) is created between VPN peers and is a control channel for Phase-1 keepalives, DH-Key Calculation and Phase-2 SA creation and rekey. ciscoasa(config)# crypto ikev1 policy 10 ciscoasa(config-ikev1-policy)# authentication pre-share…
Read More →: Configure IKEv1 Site to Site VPN between Cisco ASAs
Configure IKEv2 Site to Site VPN between Cisco ASAs

May 6, 2016

⏱︎

Read time:

Cisco, Cisco ASA

We are using the following topology, the most popular one. 2 sites in different geographical location and both have static IP address configured in their ASA firewall. Before we begin, you should also know the advantages of using IKEv2 IKEv2 uses fewer messsages to establish tunnel thus saves bandwidth IKEv2 has built-in mechanism against DoS attacks. ASA uses minimum…
Read More →: Configure IKEv2 Site to Site VPN between Cisco ASAs

Lucas Brey

I’m Lucas Brey, a travel blogger sharing practical guides, hidden gems, and honest tips from the road. Follow along for smart itineraries, great food finds, and stories worth bookmarking.

Tags