This discussion is locked

ASK THE EXPERTS - TROUBLESHOOTING ASA, PIX, and FWSM

Unanswered Question
Jul 20th, 2010

Welcome to the Cisco Networking Professionals Ask the Expert conversation. This is an opportunity to learn how to address and troubleshoot common problems with Adaptive Security Appliances, Private Internet Exchange and Firewall Service Modules with Kureli Sankar.  Kureli is an engineer supporting Cisco's firewall team in Research Triangle Park, North Carolina. Her team supports the Cisco Adaptive Security Appliance, Firewall Services Module, Cisco Security Manager, the Content Security and Control module, and the Zone Based Firewall module in Cisco IOS Software.

Remember to use the rating system to let Kureli know if you have received an adequate response.

Kureli might not be able to answer each question due to the volume expected during this event. Our moderators will post many of the unanswered questions in other discussion forums shortly after the event. This event lasts through July 30, 2010. Visit this forum often to view responses to your questions and the questions of other community members.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 4.8 (10 ratings)
philtukey Tue, 07/20/2010 - 11:07

Hello

I am the network administrator for a county wide public library system. Some of our branches are on a VPN (either DSL or Charter) connected via a cisco 5505 (branch side) and a cisco 5510 (main).

How do I seperate my staff (giving them priority over the bandwidth) from the public PC's?

Thanks,

Phil

philtukey Tue, 07/20/2010 - 13:10

I am not used to the command line and is there way to do this using the GUI interface?

I have already set up 2 groups 1 for staff (and added thier IP's to that list) and then added a group for the rest of the PC's (and added those IP's to that list). I then went into the the Service Policy Rules, and said

Source - Staff to any destination on any IP has QoS enabled priority for this flow

Followed by

Souce - Public to any destination on any IP has Policy Direct input Commited rate 8000

I am really new to this and I will look at the link you sent me but in the mean time can you see if there is something I am doing wrong?

*All of the PC's (Staff and Public) are on the same subnet.

Thanks,

Phil

Poonguzhali Sankar Wed, 07/21/2010 - 20:17

Phil,

Once done pls. post the output of

sh run class-map

sh run policy-map

along with the access-list that you match in the class-map.

-Kureli

philtukey Thu, 07/22/2010 - 08:31

For the sh run class-map:

!

class-map inspection_default

     match default-inspection-traffic

class-map access-list outside_mpc

!

For sh run policy-map

!

policy-map type inspect dns present_dns_map

     parameters

          message-length maximum 512

policy-map global_policy

     class inspection_default

          inspect dns present_dns_map

          inspect ftp

          inspect h323 h226

          inspect h323 ras

          inspect rsh

          inspect rtsp

          inspect esmtp

          inspect sqlnet

          inspect skinny

          inspect sunrpc

          inspect xdmcp

          inspect sip

          inspect netbios

          inspect tftp

policy-map outside-policy

     class ouside-class

          priority

!

What do you mean by the access-list that I matchin the class-map?

Phil

philtukey Fri, 07/23/2010 - 10:41

Any more thoughts?

Thanks!

Poonguzhali Sankar Fri, 07/23/2010 - 13:01

Phil,

Sorry about the delay.  Pls. replace the public pc ip and staff pc ip with proper translated IP address. I hope you are translating staff PC to a certain IP address when it goes out to the internet and the public PCs to another IP address when they go out to the internet.  Pls. send me "sh run" from the firewall so, I can take a look at it.

You should configure something like this. You can copy and paste these lines onto the ASA once you verify the interface names and replace the IP addresses.

conf t

access-list public-pc permit ip host x.x.x.x any eq 80  ----------> where x.x.x.x is the IP address of the public PCs when they go out to the internet

access-list staff-pc permit ip host y.y.y.y any eq 80 ---------------> where y.y.y.y is the IP address of the staff PCs when they go out to the internet.

class-map police-traffic

match access-list public-pc

class-map pirority-traffic

match access-list staff-pc

!

priority-queue outside

policy-map police-priority-policy

class police-traffic

police output 500000  ---------------> You are providing 500Kbps for the public PCs out of the available BW to you. You may choose another value.

class priority-traffic

priority

service-policy police-priority-policy interface outside

-Kureli

philtukey Fri, 07/23/2010 - 13:07

From the ASDM launcher how to copy the results of a sh run?

Thanks!

philtukey Fri, 07/23/2010 - 13:11

Nevermind I got it to copy and paste

Here is the sh run:

Result of the command: "sh run"

: Saved
:
ASA Version 7.2(4)
!
hostname SVCisco5505
domain-name Poldom
enable password ER.y749.lMleEpRJ encrypted
passwd ER.y749.lMleEpRJ encrypted
names
name 192.168.11.23 SVBack
name 192.168.11.20 SVLeft
name 192.168.11.22 SVMid
name 192.168.11.21 SVRight
name 192.168.11.24 SVoffice
name 192.168.11.202 SVOpac01
name 192.168.11.204 SVOpac02
name 192.168.11.201 SVOpac03
name 192.168.11.200 SVOpac04
name 192.168.11.210 SVPublic01
name 192.168.11.203 SVPublic02
name 192.168.11.209 SVPublic03
name 192.168.11.212 SVPublic04
name 192.168.11.211 SVPublic05
name 192.168.11.205 SVPublic06
name 192.168.11.206 SVXC1
name 192.168.11.208 SVXC2
name 192.168.11.207 SVXC3
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.11.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group SU
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name Poldom
object-group network SVStaff
description SVStaff
network-object host SVLeft
network-object host SVRight
network-object host SVMid
network-object host SVBack
network-object host SVoffice
object-group network SVPublic
description SVPublic
network-object host SVOpac04
network-object host SVOpac03
network-object host SVOpac01
network-object host SVPublic02
network-object host SVOpac02
network-object host SVPublic06
network-object host SVXC1
network-object host SVXC3
network-object host SVXC2
network-object host SVPublic03
network-object host SVPublic01
network-object host SVPublic05
network-object host SVPublic04
access-list outside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any
access-list outside_1_cryptomap extended permit ip 192.168.11.0 255.255.255.0 any
access-list outside_mpc extended permit ip object-group SVStaff any
pager lines 24
logging enable
logging list Config-Saved level notifications class sys
logging list Config-Saved message 111008
logging history informational
logging asdm informational
logging mail Config-Saved
logging from-address Summitviewvpn@yvl.org
logging recipient-address ptukey@yvl.org level notifications
logging recipient-address twalker@yvl.org level notifications
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authorization command LOCAL
http server enable
http 68.185.48.254 255.255.255.255 outside
http 192.168.11.0 255.255.255.0 inside
snmp-server host outside 68.185.48.254 community ciscoyvl5505
snmp-server location Summitview
snmp-server contact ptukey@yvl.org
snmp-server community ciscoyvl5505
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change fru-insert fru-remove
snmp-server enable traps remote-access session-threshold-exceeded
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 68.185.48.225
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal  20
crypto isakmp ipsec-over-tcp port 10000
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group SU request dialout pppoe
vpdn group SU localname sulibrary@qwest.net
vpdn group SU ppp authentication pap
vpdn username sulibrary@qwest.net password ********* store-local
dhcpd auto_config outside
!

priority-queue outside
username infotech password tzgCRDEHUdVE5LVu encrypted privilege 3
username config password 6j16spycqHHv8ERa encrypted privilege 15
tunnel-group 68.185.48.225 type ipsec-l2l
tunnel-group 68.185.48.225 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
class-map outside-class
match access-list outside_mpc
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
policy-map outside-policy
class outside-class
  priority
!
service-policy global_policy global
service-policy outside-policy interface outside
smtp-server 68.185.48.200
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
Cryptochecksum:8ab83d0e54174e23156c747a98db5171
: end

philtukey Tue, 07/27/2010 - 12:14

Have you had a chance to look over the log I posted?

Poonguzhali Sankar Tue, 07/27/2010 - 13:02

Phil,

Apologies.  I was hoping you were going to implement the config that I suggested earlier.  Either use the ASDM link that I provided or use CLI and replace the IP addresses in the sample that I provided and add those config lines in place.  If you are skeptical, then we would have to get on the firewall and assist you with the configuration.  Feel free to open a TAC case. Let me know the case once number if you do open one.

-Kureli

philtukey Fri, 07/30/2010 - 13:27

I created a TAC case and updated to a newer version of firmware on our Cisco 5505 and with the help of the Cisco TAC guy we are getting the issue resolved thank you for your help!

mohamed_makled Tue, 07/20/2010 - 11:52

Hi

i have an ASA firewall as the internet gateway for our network. if i need to add another internet line for our network, the ASA firewall can load balance the network traffic on the two internet lines or not??? and how??

Mohamed

Poonguzhali Sankar Tue, 07/20/2010 - 12:47

Mohamed,

Unfortunately we cannot load balance or do PBR (policy based routing) on the ASA.

Read this thread that I have answered in the past: https://supportforums.cisco.com/message/894920

We can only do SLA route tracking meaning if the primary internet cirucuit goes down, traffic will automatically use the backup internet circuit.

You can view this link: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

-Kureli

m.reay Fri, 07/23/2010 - 04:08

Hi Kureli.

The ASA 8.2 documentation suggests you can load balance between 2 ISPs.

Please see the following:

 

 

Configuring a Default Static Route

A default route identifies the gateway IP address to which the adaptive security appliance sends all IP packets for which it does not have a learned or static route. A default static route is simply a static route with 0.0.0.0/0 as the destination IP address. Routes that identify a specific destination take precedence over the default route.

Note In ASA software Versions 7.0 and later, if you have two default routes configured on different interfaces that have different metrics, the connection to the ASA firewall that is made from the higher metric interface fails, but connections to the ASA firewall from the lower metric interface succeed as expected. You can define up to three equal cost default route entries per device. Defining more than one equal cost default route entry causes the traffic sent to the default route to be distributed among the specified gateways. When defining more than one default route, you must specify the same interface for each entry. If you attempt to define more than three equal cost default routes, or if you attempt to define a default route with a different interface than a previously defined default route, you receive the following message: "ERROR: Cannot add route entry, possible conflict with existing routes."

Can you confirm this is correct.

Regards

Mick.

Poonguzhali Sankar Fri, 07/23/2010 - 10:43

m.raey,

That documentation is correct.

1. You CAN have upto 3 default routes pointing the SAME interface. Meaning 3 routers on the primary interface.

2. You CANNOT have two default routes pointing TWO diff. interfaces in case you have two diff. ISPs and load balance (use both at the same time).

3. The only thing you can have is two ISPs for redundancy. When one fails you can have the other link kick in by SLA route tracking as you can see here:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

You cannot load balance betwee two ISPs. You can only have one as a backup to the other.

I hope it is clear. If not pls. post your question.

-Kureli

m.reay Tue, 07/27/2010 - 01:12

Hi Kureli - I am a bit confused when you say you cannot load balance.

The document says "Defining more than one equal cost default route entry causes the traffic sent to the default route to be distributed among the specified gateways."

Surely if I am distributing the traffic among more than 1 specified gateway I am doing load balancing (or more strictly speaking Load Sharing)?

Regards

Mick.

Poonguzhali Sankar Tue, 07/27/2010 - 12:00

m.reay,

My apologies for not being clear in my response.  When the document says you can load balance - you can only load balance upto 3 routers off the same interface.  Like the following:

possible:

route outside 0.0.0.0 0.0.0.0 192.168.1.1

route outside 0.0.0.0 0.0.0.0 192.168.1.2

route outside 0.0.0.0 0.0.0.0 192.168.1.3

When you have two ISPs both of them would be different interfaces. It is not possible to load balance. In this case your default route will be

not possible:

route Primary 0.0.0.0 0.0.0.0 192.168.1.1

route Secondary 0.0.0.0 0.0.0.0 10.10.1.1

Isn't it your intention to utilize both the ISPs at the same time (load balance)? In which case you would have to configure two default routes which is not supported. When you have two ISPs and two default routes out two different interfaces, we can only do SLA route tracking meaning when the primary route goes down, the secondary route will kick in (we would add the secondary default route with a higher metric).

possible with SLA route tracking:

route Primary 0.0.0.0 0.0.0.0 192.168.1.1 1 track 1 ----------->metric 1

route Secondary 0.0.0.0 0.0.0.0 10.10.1.1 254 ---------> higher metric

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

-Kureli


m.reay

Mohamed Sobair Tue, 07/20/2010 - 13:24

Hi Kureli,

I would like to know the major different in the Architecture between ASA and pix? I know there is bugs fixed on the new IOS released in the ASA and some fetures license has been added also. Is this Only the major difference or there is some thing else? could you please rename it?

Thanks!

Mohamed

Poonguzhali Sankar Tue, 07/20/2010 - 21:39

Mohamed,

Cisco has announced EOL and EOS for PIX. The last code that is available for the PIX platform is 8.0.4(32).

http://www.cisco.com/cgi-bin/tablebuild.pl/pix-interim

We are not doing any development work on the PIX code. No more bug fixes or anything. If the customer's encounter a new defect on the PIX code, they would have to upgrade the hardware to an ASA in order to get the fix for the defect.

Here is the PIX EOL-EOS link:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_eol_notices_list.html


Here is the 6.3.x code.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5709/ps2030/end_of_life_notice_for_cisco_pix_sec_app_v63.html

PIX and ASA are completely different hardware. The ASA's can take either a CSC or an AIP module but the PIX cannot.

Data sheet for PIX: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_data_sheets_list.html

Data sheet for ASA: http://www.cisco.com/en/US/partner/products/ps6120/products_data_sheets_list.html

Now, prior to 8.x code you can simply load pix724-25.bin on an ASA and vice versa but, since 8.x the file size differs and you cannot load one code on the other platform.

For example - see the file size exactly same in 7.x code

asa724-k8.bin
Release Date: 07/Apr/2008
Cisco Adaptive Security Appliance Software version 7.2(4) software. Read Release Note prior to downloading this release.
Size: 8316.00 KB  (8515584 bytes)


pix724.bin
PIX OS version 7.2(4) software.
7.2.4     07-APR-2008     8515584

For example - see the file size difference in the 8.x code.

7538688 pix 8.0.4
14137344 asa 8.0.4

-Kureli

scootertgm Tue, 07/20/2010 - 15:59

I am setting up a ASA 5510 that will have users connection via IPSec client  to access a restricted area.  I need to allow then to split tunnel to a few  local resources.

I have tried to use group policy, but the ACL's for the option of exclude the  following networks is a standard ACL.  My challenge is I need to block access to  specific ports on servers to prevent internet access while allowing the PC to  communicate on other ports.

For example, client A coneects to the VPN.  It needs to be able to connect to  a server with ip 10.10.10.15 for printing and updates.  However, that server  also hosts a proxy server that uses port 8080.  I need to prevent the PC from  hitting 8080 on that server.

I have tried a filter on the VPN group but it does not work.

Any ideas?

mbroberson1 Tue, 07/20/2010 - 16:34

Hi Kureli,

First off thank you for having this "ask the experts" discussion. I always enjoy reading through the many questions.

Regarding the ASA 5520/5510 what are some possible reasons while all of a sudden RA VPN IPSec or AnyConnect users cannot establish a VPN connection? Assuming things (memory/CPU/licensing, etc...) on the ASA seem normal.

For example, at any given time you have on average 30 combined (IPSec/AnyConnect) RA VPN clients and all of a sudden no one can connect. Users that are established seem to maintain their connection, but new sessions cannot be established. The health (memory/CPU/licensing, etc...) all seem perfectly normal on the ASA. To fix/work around the issue you typically have to clear all vpn IPSec/AnyConnect sessions.

Any suggestions on where to start the troubleshooting?

Thanks,

Brandon

Poonguzhali Sankar Tue, 07/20/2010 - 22:00

Brandon,

Glad to hear that you enjoyed the session. There are sooo many topics that we could cover in the future. Due to limited time, I picked a few most common ones that we see in the forum on a daily basis for my session.

What you see is very interesting.  When no more users can connect, what syslogs do you see on the ASA and what does the vpn client logs say?

-Kureli

mbroberson1 Fri, 07/30/2010 - 09:35

Hi Kureli,

I think I may be hittng a bug with when somtimes vpn clients cannot connect. We are going to upgrade next week to see if it resolves the issues.

Heres the bug:

CSCtb01577

ASA unable to assign IP address for VPN client from DHCP intermittently


The bug is fixed in 8.3.1, we are on a 8.0(4)k8.

Thanks,

Brandon

Poonguzhali Sankar Fri, 07/30/2010 - 10:53

Nice bug CSCtb01577. Glad you found it.


Good luck with the upgrade. Bug is resolved in 008.002(002.001)          008.001(002.039)          008.000(005.006) .

You can upgrade to 8.2.2.x --> latest to get the fix.

8.3 has nat completely re-designed (simplified!). You would be up for a surprise and it is a slight learning curve to get used to the new syntax.  Unless you are looking for new features, I'd just stick to 8.2.2.18 (I believe) if you are just looking for the fix for the above bug.

-Kureli

mbroberson1 Fri, 07/30/2010 - 12:35

Hi Kureli,

Thanks for the info about the nat changes in 8.3. It's just the bug I would like to fix for now. Do you know where documentation about the nat changes/differences in 8.3 can be located?

Regards,

Brandon

mbroberson1 Fri, 07/30/2010 - 13:05

Hi Kureli,

Never mind, I found the 8.3 doc and the changes regarding nat.

Thanks,

Brandon

m.volodko Wed, 07/21/2010 - 02:04

Hello Kureli

We have some FWSMs implemented in DCs and sometime troubleshoot connectivity through them.
Imagine a typical engeneer task: we have soure IP, destination IP and port. We want to know: is traffic allowed by firewall.
On ASA, it's pretty easy to find out - packet tracer tells this.
As I understand, on FWSM all packets are processed by hardware not by CPU, thats why this command isn't implemented there, but fact I understand why doesn't make my life easier when some troubleshooting needs to be done.
So, assuming I cannot generate traffic but have full access to FWSM, how can I tell if this is traffic allowed?

Misha

Poonguzhali Sankar Wed, 07/21/2010 - 05:31

Misha,

Very good question. You are correct. There is no packet tracker command in the FWSM.  Only way is to look in the access-list to make sure the permission is already there. If the access-list is huge it may be hard but, if you use the following command you may be able to get what you are looking for.

sh access-list blah | i x.x.x.x  -----> for the IP address in question

or

sh access-list blah | i 5060 --------> for the specific port number in question.

Once you have traffic flowing then, you can enable logging and look through the logs for denies due to access-list.

-Kureli

m.volodko Wed, 07/21/2010 - 06:02


Kureli,

According to cisco recommendation we build object oriented policy and configuration looks like this:

object-group network Hosts_in_DMZ
network-object host 10.10.10.10
network-object host 10.10.20.10
network-object host 10.10.30.10

Assuming we looking for acl which allows traffic to 10.10.10.10, your method return just "network-object host 10.10.10.10", or possible few of them.

Misha

Poonguzhali Sankar Wed, 07/21/2010 - 19:34

Misha,

Unfortunately, we are out of luck. I shall bring it up to our BU (Business Unit).  There isn't an easy way to get what we need until we see some traffic and then use the logs to make sure the conn is not getting denied.

-Kureli

gdspa Wed, 07/21/2010 - 02:51

Dear Kureli,

I have a question about external flash.

I need to add an external compact flash to 2 ASA5510 in failover configuration(active-passive).

IOS version is 8.0(4).

Do I need to power them off , insert the compact flash and power on?

Could I utilize failover in any way? I thought, for example, to add memory to the standby unit, switch the role and add memory to the "new" standby unit, without any power off. What do you think?

Poonguzhali Sankar Wed, 07/21/2010 - 06:24

gdspa,

Failover will not disable for memory discrepancy reason.  Only if other hardware is different failover will disable itself.  So you can add the external flash to the primary/active ASA first and then add it on the Sec/Standby.  That should not cause any harm. There is no need to power them off and on.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_overview.html#wp1077536

-Kureli

Paul Cummings Wed, 07/21/2010 - 04:18

Hi Kureli,

I'm importing some legacy firewall policies (from a linux firewall) into multiple contexts on an ASA 5550 running ASA 8.3 and using global access lists..

I have some concerns over the number of object/object-groups being used in the ACLS and the impact on performance.

I've stumbled across the "object-group search access-control" command in the 8.3 command line configuration guide which seems to make processing ACLs with many object-groups more efficient.

Is there a threshold on the size and quantity of object-groups used in ACLs upon which cisco recommend activating this functionality?


Would there be any drawbacks to activating this in my contexts? for example, we will be using CSM 4.0 to manage the policies - will this be possible with the object-group search access-control feature enabled?

Thanks

Paul

Poonguzhali Sankar Wed, 07/21/2010 - 21:30

Paul,

At this point I'd suggest not to implement this command.  From what I see there is an internal defect

CSCtb54865 - ENH Support "object-group-search access-control" command in CSM

This is an enhancement.  I need to get more details as to whether this defect is resolved and make sure CSM 4.0 will support this command.

I will get back to you once I find out.

-Kureli

Poonguzhali Sankar Fri, 07/23/2010 - 12:41

Paul,

I reached out to our development team and they confirmed that this command is supported in CSM 4.0.

-Kureli

venkat.247cs Wed, 07/21/2010 - 08:39

Hi,

I am need to configure QOS on certain IP in the Cisco ASA 5510. Assume the IP's are 10.0.1.5 , 10.0.1.6 , 10.0.1.7. Here i have to configure 512 KBPS for 10.0.1.5 and 2 MBPS for 10.0.1.6 and 10.0.1.7

Can this done on a ASA 5510 series? if yes can you help me how ?

Regards,
Venkat

joe-vieira Wed, 07/21/2010 - 08:41

I have set up 2 ASAs for SSL VPN using both Please point me to some links or documents to configure load-balancing for 2 or more ASAs in the future. Can all boxes be active and do load balancing? Can more than 2 boxes be added to the balancing even if they're in different locations? Will each box need a separate certificate?

Thanks

jgunawardhana Wed, 07/21/2010 - 18:59

Hi ,

I have a ASA5550 Failover pair on one of the sites. it failsover regularly and the error message it gives is that it fails the communication to standby on a interface. for the moment I diabled monitoring on that interface so that it will not failover. is there any way I can check whether it fails the communication on that interface  to the standby unit please? I checked all the interfaces on the switches in related to this problem and I couldn't find any port error on any of them. But I saw some spanning tree topology chages. Can there be any connection between spanning tree convegence and this firewall failover issue please?

Thanks,

Janaki 

Poonguzhali Sankar Wed, 07/21/2010 - 20:15

Janaki,

How long does it say that it failed communication to the standby? Just a few seconds and recovers on its own? May be this interface is just seeing too much traffic that some times it misses the failover hellos sent over this particular interface. Layer 2 issues can certainly cause this.

Is this is busiest interface in the firewall? If so, you can try to increase the poll time and the hold time.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_standby.html#wp1097223

Command reference: http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/ef.html#wp1931144

-Kureli

jgunawardhana Wed, 07/21/2010 - 20:26

Hi Kureli,

yes the communication failure is only few seconds  and it recovers by it self. there is no much traffic on this interface and it is not the busiest interface.

Thanks Janaki

Poonguzhali Sankar Thu, 07/22/2010 - 05:57

Janaki,

Pls. make sure this port is configured for specific speed and duplex that matches on the switch end. Make sure there are no errors. Besides that spanning tree toplology change that you mentioned may be causing this.  Verify if the time that a topolgy change occured matches with the time of the logs. Enable "logging timestamp" on the ASA.

-Kureli

Poonguzhali Sankar Wed, 07/21/2010 - 20:04

Yes, load balancing can be done between two or more ASAs. They can share the load at the same time. Cisco has tested up to ten nodes in a load-balancing cluster.

To implement load balancing, you group together logically two or more devices on the same private LAN-to-LAN network, private subnet, and public subnet into a virtual cluster.

Here is the configuration example: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805fda25.shtml

Refer this link as well: https://supportforums.cisco.com/docs/DOC-5964;jsessionid=300A4842A77445415BE985BD497CFBB2.node0

-Kureli

joe-vieira Thu, 07/22/2010 - 09:14

Please let me know about public certificates and load balancing.

Also, another question. We use RDP plug-in for clientless ssl vpn to access terminal servers after authentication but sometimes it doesn't connect and stays in a loading state for active x, or we get Java errors. Is there a list of minimum requirements for this feature to work seamlessly? What would be troubleshooting procedures for this?

Thanks

Poonguzhali Sankar Thu, 07/22/2010 - 11:15

Joe,

I checked with our VPN engineer.  The units can share the same cert. Here is the procedure:

Best Practice Requirement with UCC:

One Unified Client Certificate (UCC) with multiple CNs/SANs (Subject Alternative Name extensions) for each ASA FQDN/IP .

So you need a UCC certificate with the CN for master FQDN or IP, and SANs for each ASA: for ASA-1 FQDN or IP, ASA-2 FQDN FQDN or IP, and so on.

Several vendors support UCC:godaddy.com, entrust.com, verisign,etc.

Note: the ASA cannot generate a CSR with multiple SANS (CSCso70867 ), so you have to have the PKI vendor submit the enrollment for you.


Procedure for deploying UCC:
General Steps:

1. On ASA master configure one trustpoint '' pointing to the virtual/cluster. All ssl outside and ssl outside vpnloadbalanced pointing to that trustpoint
2.Then export that trustpoint as pkcs12
3.Then import the pkcs12 to each ASA member of the cluster
4. configure all ssl outside and ssl outside vpnloadbalanced pointing to the imported trustpoint ''.

Regarding troubleshooting the RDP plugin, our VPN engineer recommend that you open a case with the VPN team as it is pretty involved. It appears the following data may have to be collected.

1) Is the issue seen with an ASA upgrade or is this a new deployment?
2) Is the ASA added as one of the trusted sites in the client's browser?
3) What is the version of the current installed plugin?
4) What type of certs are installed on the ASA: self-signed or third party?
5) Is this an issue with XP SP3 and VISTA SP1?
6) Is the customer trying to RDP into a Vista?
7) Please capture the configuration including SSL versions/settings
8) Enable the event logs for RDP ActiveX?
9) Are there any proxy servers between the client and or ASA?
10) Java debug info:
11) ActiveX debug info

-Kureli

jgunawardhana Wed, 07/21/2010 - 19:01

Hi ,

I have a ASA5550 Failover pair on one of the sites. it failsover regularly and the error message it gives is that it fails the communication to standby on a interface. for the moment I diabled monitoring on that interface so that it will not failover. is there any way I can check whether it fails the communication on that interface  to the standby unit please? I checked all the interfaces on the switches in related to this problem and I couldn't find any port error on any of them. But I saw some spanning tree topology chages. Can there be any connection between spanning tree convegence and this firewall failover issue please?

Thanks,

Janaki

Actions

Login or Register to take actions

This Discussion

Posted July 20, 2010 at 10:58 AM
Stats:
Replies:112 Avg. Rating:4.8
Views:13640 Votes:0
Shares:0

Related Content

Discussions Leaderboard