Cisco NetPro -

asdm unable to open

Fri, 6 Nov 2009 22:10:56 PST

one of our clients are having problems with using asdm for firewall with version 4.0 and asdm 6.1. Am using java jre 1.4.2_6 version. It used to open earlier but now it hangs at login. Please suggest. Thanks!

ASK THE EXPERT - CISCO SECURITY MANAGEMENT JUMPSTART

Fri, 6 Nov 2009 15:54:26 PST

Welcome to the Cisco Networking Professionals Ask the Expert conversation. This is an opportunity to get more information on CSM, MARS, ASDM, IME, CCP, and IronPort SMA with Cisco experts Raghu Kasavaraju and Ziad Sarieddine. Raghu, Product Manager for Cisco Security Manager, has 15 years of extensive experience in IT and he has spent the last 10 years in Information Security Operations, Consulting & Engineering roles. Currently, Raghu is the PM Lead for Cisco Security Manager 4.0 release. Ziad (CCIE Security # 23379) is a security management technologist with expertise in security solutions covering Firewall, IPS, and VPN. Prior to joining Cisco in 2006, Ziad spent 10+ years as a Lead Analyst / Senior Network Engineer designing and installing large networks at different companies. Remember to use the rating system to let Ziad know if you have received an adequate response. Ziad might not be able to answer each question due to the volume expected during this event. Our moderators will post many of the unanswered questions in other discussion forums shortly after the event. This event lasts through November 6, 2009. Visit this forum often to view responses to your questions and the questions of other community members.

internal hosts cannot access internet w/ L2L tunnel configured

Fri, 6 Nov 2009 10:58:22 PST

Internal hosts behind the ASA cannot access the internet with a L2L tunnel configured. The L2L tunnel is up and passing traffic properly. However, the internal hosts cannot access the internet through the ASA. I think I've got my NAT hosed up somewhere. I can't even get a statically mapped host to the internet. It might be because I am used to having a WAN IP for the outside interface that is different from the CIDR block assigned by the ISP. In this case, it is all together, with the ASA's outside interface occupying the first available address. We were assigned CIDR range x.x.x.64/28. x.x.x.65 is my gateway and my first usable is .68, per the ISP (I guess they use .66 and .67 for internal use.) The ASA's outside interface is .68 and I'm trying to have it NAT the others. I'm PATing all internal DHCP clients, and have some static entries as well. The relevant NAT config is below. Again, all traffic is passing over the tunnel correctly, just not from inside to outside. If more info is needed, please advise. interface outside ip address x.x.x.68 255.255.255.240 nat-control global (outside) 2 x.x.x.69-x.x.x.77 global (outside) 1 x.x.x.78 nat (inside) 0 access-list nonat nat (inside) 1 10.10.10.0 255.255.255.0 static (inside,outside) x.x.x.69 STATIC_NAT_EXAMPLE netmask 255.255.255.255 access-group internal in interface inside route outside 0.0.0.0 0.0.0.0 x.x.x.65 1 access-list internal permit ip 10.10.10.0 255.255.255.0 any !Remote LAN is 192.168.10.0/24 access-list nonat extended permit ip 10.10.10.0 255.255.255.0 192.168.10.0 255.255.255.0

PIX MTU / MSS / DF Bit Questions

Fri, 6 Nov 2009 10:55:19 PST

Hello All- I am tying to find out if I am running my PIX VPN's as efficiently as possible. Here is the setup: Our PIX 525 pair terminates about 150 VPNs from customers and sites. Some connections we control both ends (usually an 1811 on the other side). Others are customer controlled. The PIX devices have 2811s before the PE device. Our primary ISP is qwest serving 30Mbps via an MPLS fiber connection. On the inside interfaces of the PIX is our datacenter switch stack of 3750s. Our servers connect to this switch stack directrly with the routing being handled by the 3750. On the PIX we have an MTU on the outside and inside interface at 1500. The MSS is set to 1368. On the inside and outside intercace of the pix pre-fragmentation is enabled and DF bit policy is set to copy. On the edge routers we have an MTU of 1500 on the inside and outside interface. This is the same for the 3750 stack. The ports have an MTU of 1500 and the vlan has an mtu of 1500. I am not seeing any fragmentation on the vpn connections, but I am trying to figure out what the optimal setting should be to maximize throughput. Any thoughts / comments / advise is greatly appreciated. Thanks

Configure SSLVPN on ASA5520

Fri, 6 Nov 2009 10:06:03 PST

I have a 5520 Version 6, need to configure sslvpn on it, but I cannot find any instructions for version 6. Everything is version 5 or older. Is there anything out there for this version?

Port-security tripped by invalid MAC

Fri, 6 Nov 2009 05:57:49 PST

I enable port-security on all of my switches and it has worked flawlessly, but I'm starting to wonder if I got a false positive or a glitch. Last night around 11:17pm the switch port connecting to my Inter-tel phone processor got put in err-disable state because there were now two MAC addresses found on the port (I have 99% of the ports set with the default maximum of 1). I received an alert from our NMS that port-security had been tripped and shut down this port; attached is the exact syslog message. The MAC address in the trap is the actual MAC, it was not changed by me for posting it on this forum. At this time of night nobody is in the building where this closet is located and it is physically locked so the chances of someone plugging a switch or hub into the port is between slim and none. Attachment Keywords : 1) port-security.txt

ASDM Startup Window Stalling

Thu, 5 Nov 2009 22:30:52 PST

Hi I'd like to configure my security appliance using ASDM. Below are the versions. Cisco Adaptive Security Appliance Software Version 7.0(6), Device Manager Version 5.0(6) I use IE and Java Plug-in is installed. But it is stalling on the part where it displays information about, ASDM software version, browser type, browser version, etc. Is there something wrong?

CSA Events and Zulu Time

Thu, 5 Nov 2009 16:49:41 PST

Is their a way to have the events that show up in CSA come in as Zulu time? The event time seem to be controlled by the agents that sent them but is their some way to make them zulu time without changing the time of the systems the agent run on?

copy ftp start -- can we use a nondefault port?

Thu, 5 Nov 2009 14:40:00 PST

I have a limited availability of server assets and IP addresses and would like to separate the folders for anonymous general ftp connections and those used for router maintenance. Can I use port 2121 for example: copy ftp://anonymous@192.168.1.5:2121/startup.txt start I tried it and it always goes to the IIS FTP site that is running port 21. IOS version is c2800nm-adventerprisek9-mz.124-19.bin

NAC guest server <-> AD : TLS/SSL?

Thu, 5 Nov 2009 07:40:03 PST

For sponsor authentication, Active directory is used without SSO. How is the connection between the server and active directory? Is it via AD TLS or AD SSL? Does somebody has more information about this? Best regards

NAT VPN no traffic, 106014 deny inbound

Wed, 4 Nov 2009 19:07:21 PST

I'm not sure if this should go in the Security section or here, but perhaps someone can help with this configuration? Trying to NAT the internal IP to another subnet so the destination end doesn't clash. The tunnel comes up fine, but traffic does not pass over it. If I send a ping to the destination, it gives "106014 deny inbound icmp src inside:192.168.7.20 dst outside:192.168.27.40 (type 8, code 0)". I know there's something fundamental wrong, but can't spot it. Local site 192.168.7.0, local NAT to 192.168.17.0, remote site 192.168.27.0. TIA! access-list outside_access_in extended permit ip 192.168.27.0 255.255.255.0 192.168.17.0 255.255.255.0 access-list SiteName_access extended permit ip 192.168.27.0 255.255.255.0 192.168.7.0 255.255.255.0 access-list SiteName_NAT extended permit ip 192.168.7.0 255.255.255.0 192.168.27.0 255.255.255.0 access-list SiteName_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.27.0 255.255.255.0 ! nat (inside) 0 access-list inside_nat0_outbound nat (outside) 0 access-list outside_nat0_outbound static (inside,outside) 192.168.17.0 access-list SiteName_NAT access-group outside_access_in in interface outside route outside a.b.c.d 255.255.255.255 outside_router 1 ! crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto map outside_map 3 match address SiteName_cryptomap crypto map outside_map 3 set pfs crypto map outside_map 3 set peer a.b.c.d crypto map outside_map 3 set transform-set ESP-AES-256-MD5 crypto map outside_map 3 set security-association lifetime seconds 3600 crypto map outside_map 3 set reverse-route crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 20 authentication pre-share encryption aes-256 hash md5 group 2 lifetime 28800 no crypto isakmp nat-traversal ! group-policy SiteName internal group-policy SiteName attributes vpn-filter value SiteName_access vpn-tunnel-protocol IPSec ! tunnel-group a.b.c.d type ipsec-l2l tunnel-group a.b.c.d general-attributes default-group-policy SiteName tunnel-group a.b.c.d ipsec-attributes pre-shared-key Mykey

NAS redirect page

Wed, 4 Nov 2009 10:44:07 PST

Hi All, there is NAS, OOB, L3, RGW implementation. I've remove NAS from NAM, then readded it. after that, when I type NAS untruted interface in broswer, it prompts to redirect and after a while it shows "web page can't be displated". In address bar in IE, it only shows domain name without the NAS host name. like: https://companyabc.com/...... I've checked DNS and it looks ok. any suggestion would be very appreciated. thanks Alex

CAS SSO Failing

Wed, 4 Nov 2009 10:32:16 PST

We have a CAS appliance configured for Windows SSO. This worked in the past, but I notice today that the Windows SSo service showed stopped on the CAS(this is at our DR site and is not used often so I do not know how long it has been in this state). When I tried to start the service I see the following log entries in the nac_manager log: setAttribute failed: com.perfigo.wlan.jmx.admin.ServerInfo.SSOState @10.7.255.100:duration=0:ConnectorClient not connected to RMI Connector Server invoke failed:: com.perfigo.wlan.jmx.admin.ServerInfo.startSSOServer @10.7.255.100:duration=59992:Error unmarshaling return header; nested exception is: java.net.SocketTimeoutException: Read timed out Any ideas? TAC case will be next in the morning if I cannot figure this out. I am flat out of ideas. I am having the Admins check the account that we use to ensure it has not changed, but short of that I do not now where to turn. Those log messages do not mean much to me.

Hairpinning Fails

Wed, 4 Nov 2009 10:07:11 PST

Hi I have two local subnets 192.168.1.0 and 192.168.2.0 behind another router. I hairpinning on the ASA (IP 192.168.1.252) to route traffic to the subnet 192.168.2.0. I applied the next commands (I received help from pkampana to do this): same-security-traffic permit intra-interface access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 route inside 192.168.2.0 255.255.255.0 192.168.1.254 1 If I ICMP echo using ASDM Packet Tracer works in both directions. If I ping using a computer from subnet 192.168.1.0 to subnet 192.168.2.0 works. If I ping using a computer from subnet 192.168.2.0 to subnet 192.168.1.0 fails. If I remote desktop from any subnet fails and ASDM is logging the error that say: severity: 6 Syslog ID: 106015 Source IP: 192.168.1.153 Destination IP: 192.168.2.4 Description: Deny TCP (no connection) from 192.168.1.153/1168 to 192.168.2.4/3389 flags RST on interface inside. Thank you in advance. RC

SNAA 642-515 exam

Wed, 4 Nov 2009 07:41:51 PST

Hello, This is my last test in order to get my CCSP certification. I don't seem to find much of study materials for it. Lookint at the topics of the exam most of it is based on the ASDM. Would you recommend studying from the ASDM 6.0 User Guide.pdf file available on cisco.com? Thanks

Block traffic sourced from ASA 5540

Wed, 4 Nov 2009 07:13:08 PST

Hi Champs, I would like to know if there is any way to block traffic sourced from an ASA 5540. Basically i am seeing some snnmp authentication failures and the ip address in the message is sourced from ASA. The irony is that i do not have any snmp configured on the firewall as such. Thanks! Best Regards, Manoj

How to match tftp traffic in CoPP

Wed, 4 Nov 2009 07:10:59 PST

I am trying to configure CoPP on my 7200 router. Everything works fine, but when I try to download IOS via TFTP, the TFTP keeps dropping off. I tried to use the below access-list to match TFTP traffic but it does not work. Is TFTP using different port for DATA and control traffic like FTP? Anyone could help? 60 permit udp 210.18.250.0 0.0.1.255 any eq tftp 70 permit udp 210.18.250.0 0.0.1.255 eq tftp any Thanks

ASA - Webvpn - portal customization

Tue, 3 Nov 2009 15:16:08 PST

Hi.. On my webvpn Homepage (front) I only see my bookmarks.. I would like to have the Start Anyconnect option there too - so the users do not need to access the Anyconnect tab in the navigation bar.. Is that possible ? Furthermore I would like to customize the text that explains the anyconnect feature - and all the info regarding seciruty settings.. Is that possible ? I can´t see that in the portal editor.. Best regards Tue F. Noergaard

NAC and changing IP address

Tue, 3 Nov 2009 13:12:51 PST

Hi All, we are using NAC OOB, L3, Real IP gateway with AD-SSO. when users log in to the PC, PC is supposed to change the IP address after authentication with windows user account. But based on security policy, users don't allow to change IP address, so changing IP address will be failed. is there any workaround for this matter? should we change our security policy and let users to have right to change IP address? in this case, what security in GPO we have to modify to give them permission to do "ipconfig /renew" command right? any suggestion would be very appreciated. thanks Alex

Adding AV/AS Rule for AVG 9

Tue, 3 Nov 2009 12:56:16 PST

A while back I had TAC send me instructions for adding custom AV rule for AVG 8. I seem to have misplaced those (they're not lost - I just can't find em). Can someone post the steps that I will need to add AVG 9 as a custom rule for NAC? Thanks in advance.

Cisco Biomed NAC

Tue, 3 Nov 2009 12:35:56 PST

Has anyone had any experience with the Cisco Biomed NAC? What benefits would their be over having two seperate infrastructures both biomed devices and the regular hospital network? Are there any different config changes that we would need on our switches and routers?

SNMP community string - encryption

Tue, 3 Nov 2009 11:31:40 PST

Hi All, how can I encrypt SNMP community string? with RW and clear text, it is big security breach. any suggestion would be very appreciated. Alex

Can a virus get propagated over a L2L?

Tue, 3 Nov 2009 09:29:32 PST

Hello all, I have a question. I work at a hospital with about 500 PC’s. A much larger hospital (40,000 PC’s) wants me to setup a site-to-site VPN. My concern is this hospital got hit hard with the Confiker virus earlier in the year that took them a couple of weeks to get rid of, what is the chance that a virus will propagate over the site-to-site VPN and infect my PC’s? I'm sure they would want to do subnets instead of host ACLs. I have an ASA with the SSM module installed; will this inspect encrypted VPN traffic?

NAC disconnecting users after successfully login

Tue, 3 Nov 2009 08:20:47 PST

Hi all, I'm implementing the NAC solution. Curently i'm on the testing phase. My problem is that whether i'm using CCA or web client it takes less than a minute for the user to be on the network. I'm using ver 4.5.1 of the software. Is there a timer set somewhere by default? I havent set any session timer. regards, Stanslaus.

PMTUD is broken

Mon, 2 Nov 2009 13:23:38 PST

Hi all, I tried to solve problem with fragmentation and configured parameters as below. The same is on the router on the other side. interface Tunnel0 ip mtu 1438 tunnel path-mtu-discovery ... I configured GRE over IPSEC (transport mode), and problem is PMTUD. It seem to be broken. I don't have firewall between router. Ping to other side with large packet and set DF bit is unsuccesful. With sniffer I saw one ICMP request sent and received ICMP unreachable packet but subsequent ping packets is again unsuccesful and ping packets was not seeing with sniffer. Any suggestions is helpfull!

NAC and IP phone

Mon, 2 Nov 2009 12:30:26 PST

Hi All, I was configuring NAC. I've noticed when I plug IP phone to the switch managed by NAC, IP phone register to the callmanager without to creating filter on NAC. On switch port, voice vlan has been assigned and IP phone has been registered without any problem. Do I still need to setup filter for IP phones or leave it as is? why Cisco mentions in documents to create filter for IP phones even though it's registered to Callmanager without filter? any suggestion would be very appreciated. Alex

NAC in non dhcp environment

Mon, 2 Nov 2009 11:44:17 PST

how can implement nac in non dhcp environment (all users have static ip) ? i need to use virtual GW mode? all the useres must be in the same access vlan ?

Cisco 525 6.3

Mon, 2 Nov 2009 09:05:49 PST

I have a vpn pool which is set for 50 addresses but I need to rest the pool to start at the beginning address. I have tried using the clear isakmp cryto sa command. Is this correct or should I also try clear ipsec cryto sa?

one application problem with site2site vpn

Sun, 1 Nov 2009 22:48:49 PST

hello we have hub and spoke MPLS network connecting HO to remote sites. in each site one cisco router (3800 in HO and 1800 in remote) connects the LAN to the MPLS network. we activated IPsec between these routers. it was working fine for some period, then one day, one oracle appliation began to hang. all other applications are working fine. we can also ping this server from everywhere. if we remove crypto map, the oracle application works correctly. using sniffer we can see that the connection is established correctly, then in data transfer, the client said it is waiting for sequence nbr 1234 (for example) in the server side we can see that the server has sent this seq. but the client did not receive it. so why HO router fails to send these TCP sequence correctly? any idea. thx

WCCP support on ASA 5580

Sat, 31 Oct 2009 05:08:43 PST

Hi, For a campus network with almost 7000 users we are planning to run WCCP with ASA 5580 appliance. IS the ASA appliance has any hardware limitations? Any help would be appreciated.