# ASA **URL:** https://forum.networklessons.com/c/security/asa/33.md?page=2 [Latest](https://forum.networklessons.com/latest.md) · [Categories](https://forum.networklessons.com/categories.md) **Page:** 3 --- ## [Can someone explain how unicast RPF or RPF works in ASA?](https://forum.networklessons.com/t/can-someone-explain-how-unicast-rpf-or-rpf-works-in-asa/7087)
**Author:** [@harshitha.gudur89](https://forum.networklessons.com/u/harshitha.gudur89)\ **Replies:** 1\ **Last updated:** [May 13, 2019, 1:06pm UTC](https://forum.networklessons.com/t/can-someone-explain-how-unicast-rpf-or-rpf-works-in-asa/7087 "2019-05-13T13:06:26Z")
I have really hard time understanding RPF in cisco asa packet flow and how it contains spoofing or dos attacks ? --- ## [Site to Site VPN with ASA and Strongswan will not auto connect](https://forum.networklessons.com/t/site-to-site-vpn-with-asa-and-strongswan-will-not-auto-connect/6844)
**Author:** [@doug.reid](https://forum.networklessons.com/u/doug.reid)\ **Replies:** 1\ **Last updated:** [April 16, 2019, 1:10pm UTC](https://forum.networklessons.com/t/site-to-site-vpn-with-asa-and-strongswan-will-not-auto-connect/6844 "2019-04-16T13:10:12Z")
ASA 5506-X Connecting to Ubuntu 14.04 ikev1 (PSK). When I would connect to a webserver on Strongswan side from the ASA side the ASA would establish connection. That is not happening anymore and I am not sure why. I am… --- ## [Double NAT in Cisco ASA](https://forum.networklessons.com/t/double-nat-in-cisco-asa/6593)
**Author:** [@sivak80nayan](https://forum.networklessons.com/u/sivak80nayan)\ **Replies:** 7\ **Last updated:** [April 3, 2019, 7:29am UTC](https://forum.networklessons.com/t/double-nat-in-cisco-asa/6593 "2019-04-03T07:29:40Z")
I am in requirement of double NAT (Primary and Secondary) in Cisco ASA, I need to configure single public IP to 2 different Inside Local IP address, in any case primary IP address fails, ASA should nat public IP to seco… --- ## [Ipsec site to site VPN - NAT required? nat-t information?](https://forum.networklessons.com/t/ipsec-site-to-site-vpn-nat-required-nat-t-information/6427)
**Author:** [@johnnyn](https://forum.networklessons.com/u/johnnyn)\ **Replies:** 0\ **Last updated:** [March 7, 2019, 9:56am UTC](https://forum.networklessons.com/t/ipsec-site-to-site-vpn-nat-required-nat-t-information/6427 "2019-03-07T09:56:58Z")
Hello, In the lesson configuring ipsec between two sites with static ip address it does not mention NAT exemption anywhere, shouldn’t it be included? Also, it would be helpful if you can elaborate a bit on NAT-T. Johnn… --- ## [The access-list is always checked before NAT translation](https://forum.networklessons.com/t/the-access-list-is-always-checked-before-nat-translation/5699)
**Author:** [@sclarke1210](https://forum.networklessons.com/u/sclarke1210)\ **Replies:** 0\ **Last updated:** [December 12, 2018, 2:21pm UTC](https://forum.networklessons.com/t/the-access-list-is-always-checked-before-nat-translation/5699 "2018-12-12T14:21:06Z")
Hi I’m really confused bt this statement “The access-list is always checked before NAT translation” So if I have traffic coming into the asa on the outside interface with a public IP address destined for a server on my … --- ## ['Level' of the ASA course?](https://forum.networklessons.com/t/level-of-the-asa-course/6168)
**Author:** [@jpmcdowell](https://forum.networklessons.com/u/jpmcdowell)\ **Replies:** 1\ **Last updated:** [February 11, 2019, 7:21am UTC](https://forum.networklessons.com/t/level-of-the-asa-course/6168 "2019-02-11T07:21:24Z")
Hello! This site was a great help to me for my CCNP R&S (passed my last exam last month!) and now I’ve moved on to CCNA security. ASA firewalls are on the topic list so I’m using your course here to study for that sect… --- ## [Config remote tunnel with Dynamic IP to Datacenter static IP (ASA 5520)](https://forum.networklessons.com/t/config-remote-tunnel-with-dynamic-ip-to-datacenter-static-ip-asa-5520/5994)
**Author:** [@adrian](https://forum.networklessons.com/u/adrian)\ **Replies:** 0\ **Last updated:** [January 15, 2019, 3:40pm UTC](https://forum.networklessons.com/t/config-remote-tunnel-with-dynamic-ip-to-datacenter-static-ip-asa-5520/5994 "2019-01-15T15:40:06Z")
After adding: crypto map Outside\_map 1 set ikev1 phase1-mode aggressive My tunnel dropped and stopped working. Version: HomeASA(config)# show version Cisco Adaptive Security Appliance Software Version 9.1(7)16 Device … --- ## [Cisco ASA Load balancing](https://forum.networklessons.com/t/cisco-asa-load-balancing/5951)
**Author:** [@sivak80nayan](https://forum.networklessons.com/u/sivak80nayan)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 12:12pm UTC](https://forum.networklessons.com/t/cisco-asa-load-balancing/5951 "2019-01-10T12:12:09Z")
Dear Rane, Please help me on the below queries. Does Cisco ASA supports load balancing? If yes, how do I make reach ability to secondary destination server in case of primary destination server is down. How ASA can be … --- ## [DOWNLOAD PDF FIle](https://forum.networklessons.com/t/download-pdf-file/5919)
**Author:** [@aengrafk](https://forum.networklessons.com/u/aengrafk)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 11:43am UTC](https://forum.networklessons.com/t/download-pdf-file/5919 "2019-01-10T11:43:43Z")
I am unable to download PDF copy ASA course. --- ## [Dont see ASA video lessons](https://forum.networklessons.com/t/dont-see-asa-video-lessons/5783)
**Author:** [@aanisjama](https://forum.networklessons.com/u/aanisjama)\ **Replies:** 1\ **Last updated:** [January 2, 2019, 1:46pm UTC](https://forum.networklessons.com/t/dont-see-asa-video-lessons/5783 "2019-01-02T13:46:34Z")
Hi Greetings ,I am new member recently joined I dont see any ASA video training other then that it is very good learning site and really like the way it is designed. --- ## [Monitor failed Cisco Anyconnect VPN connection attempts](https://forum.networklessons.com/t/monitor-failed-cisco-anyconnect-vpn-connection-attempts/4991)
**Author:** [@charlesbreslin](https://forum.networklessons.com/u/charlesbreslin)\ **Replies:** 3\ **Last updated:** [October 23, 2018, 1:20am UTC](https://forum.networklessons.com/t/monitor-failed-cisco-anyconnect-vpn-connection-attempts/4991 "2018-10-23T01:20:45Z")
Our clients should authenticate via certificate but for our DR datacentre site ASA authentications are failing. All works Ok from the same Anyconnect client to the ASA at our primary datacentre. Can someone point me in … --- ## [IPSEC Tunnel Phase 2 Traffic is not encrypted](https://forum.networklessons.com/t/ipsec-tunnel-phase-2-traffic-is-not-encrypted/5056)
**Author:** [@mskowa](https://forum.networklessons.com/u/mskowa)\ **Replies:** 2\ **Last updated:** [October 10, 2018, 5:25pm UTC](https://forum.networklessons.com/t/ipsec-tunnel-phase-2-traffic-is-not-encrypted/5056 "2018-10-10T17:25:28Z")
Hi Rene, Just configured a site 2 site VPN tunnel and its shows up and active but realized the traffic passing is not encrypted. when you do “show cry ipsec sa” the encrypt and decrypt packets are zero they do not inc… --- ## [Asa logging](https://forum.networklessons.com/t/asa-logging/4934)
**Author:** [@sivak80nayan](https://forum.networklessons.com/u/sivak80nayan)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 5:11am UTC](https://forum.networklessons.com/t/asa-logging/4934 "2018-09-19T05:11:54Z")
what is the best practice for logging in ASA Active/standby fail over while collection logs in Solarwind syslog Server. --- ## [Out going email not working](https://forum.networklessons.com/t/out-going-email-not-working/4718)
**Author:** [@berihun.molla2](https://forum.networklessons.com/u/berihun.molla2)\ **Replies:** 3\ **Last updated:** [August 29, 2018, 4:06pm UTC](https://forum.networklessons.com/t/out-going-email-not-working/4718 "2018-08-29T16:06:04Z")
Hi Rene, i have question on ASA . i have created ACL that permit incoming and outgoing email traffic but the outgoing is sometimes not working ..their is full connectivity between our devices.what will be the problem… --- ## [ASA 5516 IP addressing](https://forum.networklessons.com/t/asa-5516-ip-addressing/4114)
**Author:** [@anandtipanwar](https://forum.networklessons.com/u/anandtipanwar)\ **Replies:** 1\ **Last updated:** [June 19, 2018, 4:55pm UTC](https://forum.networklessons.com/t/asa-5516-ip-addressing/4114 "2018-06-19T16:55:13Z")
Hi, I am trying to assign an IP address to one of the interface of ASA 5516 but for some reason none of the commands are working. nameif, IP add, security-level , none of them are working. I am not able to assign IP t… --- ## [ASA - SSL Remote Access VPN with AAA and Certificates](https://forum.networklessons.com/t/asa-ssl-remote-access-vpn-with-aaa-and-certificates/2491)
**Author:** [@lfrasier](https://forum.networklessons.com/u/lfrasier)\ **Replies:** 1\ **Last updated:** [December 20, 2017, 1:53pm UTC](https://forum.networklessons.com/t/asa-ssl-remote-access-vpn-with-aaa-and-certificates/2491 "2017-12-20T13:53:13Z")
Hello - I need to configure an ASA for remote access for five users. They need access to network shares. I am looking at setting up an SSL VPN as shown in the Cisco ASA AnyConnect Remote Access VPN write-up using self-… --- ## [VPN between public IP & private IP](https://forum.networklessons.com/t/vpn-between-public-ip-private-ip/3183)
**Author:** [@mustafa\_ahmed\_91](https://forum.networklessons.com/u/mustafa_ahmed_91)\ **Replies:** 2\ **Last updated:** [March 16, 2018, 11:26am UTC](https://forum.networklessons.com/t/vpn-between-public-ip-private-ip/3183 "2018-03-16T11:26:08Z")
Hi is there any way to connect two sites together, for ex: Site (a) & Site (b) both of them can reach the internet, but only site (a) have a public IP? --- ## [I need some quick topic Underlay, Overlay and GET VPN](https://forum.networklessons.com/t/i-need-some-quick-topic-underlay-overlay-and-get-vpn/2994)
**Author:** [@ccnp.manami](https://forum.networklessons.com/u/ccnp.manami)\ **Replies:** 4\ **Last updated:** [March 9, 2018, 5:18pm UTC](https://forum.networklessons.com/t/i-need-some-quick-topic-underlay-overlay-and-get-vpn/2994 "2018-03-09T17:18:38Z")
Hi Rene, Can you please help me to understand three topics. I need to implement something related to these three in my company. What is underlay? What is overlay? and GET VPN I need to implement one GET VPN Client in… --- ## [Can SSL VPN users go through site-to-site VPN to access file](https://forum.networklessons.com/t/can-ssl-vpn-users-go-through-site-to-site-vpn-to-access-file/2806)
**Author:** [@yiwei.shih](https://forum.networklessons.com/u/yiwei.shih)\ **Replies:** 1\ **Last updated:** [February 9, 2018, 9:42am UTC](https://forum.networklessons.com/t/can-ssl-vpn-users-go-through-site-to-site-vpn-to-access-file/2806 "2018-02-09T09:42:13Z")
Hello, I have a Cisco ASA-5512 in our HQ and Cisco ASA-5505 in our warehouse. I set up Site to Site VPN between HQ and warehouse to let users access each other’s file. I also set up SSL VPN on Cisco ASA-5512 to let use… --- ## [Netflow Configuration on ASA](https://forum.networklessons.com/t/netflow-configuration-on-asa/2683)
**Author:** [@zballa](https://forum.networklessons.com/u/zballa)\ **Replies:** 1\ **Last updated:** [January 17, 2018, 3:30pm UTC](https://forum.networklessons.com/t/netflow-configuration-on-asa/2683 "2018-01-17T15:30:56Z")
I need to configure netflow on the Cisco ASA firewalls. We have Riverbed Cascade gateways that the routers send flows and the gateways, after de-duplication, send the flows to the Profiler to display. I did not see any c… --- ## [ASA Replacement](https://forum.networklessons.com/t/asa-replacement/2142)
**Author:** [@zballa](https://forum.networklessons.com/u/zballa)\ **Replies:** 2\ **Last updated:** [January 8, 2018, 11:14pm UTC](https://forum.networklessons.com/t/asa-replacement/2142 "2018-01-08T23:14:12Z")
I have to replace four ASA 5550s running version 8.2.5 with four 555Xs running version 9.1.X. I tried to convert the configuration from 8.2.5 to the latest by stepping through the recommended upgrade process. I have a te… --- ## [Using DN/Subject for site-to-site certificate auth](https://forum.networklessons.com/t/using-dn-subject-for-site-to-site-certificate-auth/2268)
**Author:** [@bmathis-networklesso](https://forum.networklessons.com/u/bmathis-networklesso)\ **Replies:** 1\ **Last updated:** [October 27, 2017, 10:57am UTC](https://forum.networklessons.com/t/using-dn-subject-for-site-to-site-certificate-auth/2268 "2017-10-27T10:57:56Z")
Here is my scenario: I have multiple site-to-site VPNs, all of which are fully trusted. So far I have setup an openssl CA, created x509 certs for each device, and have IKE2 VPNs up that are all authenticated by the mere… --- ## [Creating trunk vlan on Cisco ASA to Cisco Router](https://forum.networklessons.com/t/creating-trunk-vlan-on-cisco-asa-to-cisco-router/2430)
**Author:** [@FLOYD.BALL](https://forum.networklessons.com/u/FLOYD.BALL)\ **Replies:** 1\ **Last updated:** [November 27, 2017, 1:53pm UTC](https://forum.networklessons.com/t/creating-trunk-vlan-on-cisco-asa-to-cisco-router/2430 "2017-11-27T13:53:59Z")
Hi, My Cisco ASA terminates at the gateway of my network. Behind the Cisco ASA I have a Cisco Router. I am trying to configure virtual interfaces on the router to my ASA with multiple VLANs. I imagine that I will need… --- ## [Packet flow through ASA](https://forum.networklessons.com/t/packet-flow-through-asa/2148)
**Author:** [@ashwinkrishnamr](https://forum.networklessons.com/u/ashwinkrishnamr)\ **Replies:** 2\ **Last updated:** [September 9, 2017, 2:19pm UTC](https://forum.networklessons.com/t/packet-flow-through-asa/2148 "2017-09-09T14:19:20Z")
Hi Rene, Greetings !! It would be really helpful if you can explain the packet flow through ASA (also when VPN is taken into account) / Order of Operation - version 8.3 and later --- ## [IPsec vs SSL VPN](https://forum.networklessons.com/t/ipsec-vs-ssl-vpn/755)
**Author:** [@jinesh194](https://forum.networklessons.com/u/jinesh194)\ **Replies:** 1\ **Last updated:** [January 8, 2017, 8:39am UTC](https://forum.networklessons.com/t/ipsec-vs-ssl-vpn/755 "2017-01-08T08:39:32Z")
Whats the difference between IPSec VPN and SSL VPN? Is there any difference between UTM and Next Gen. Firewall? Is there any difference between WAF and IPS? Stateless vs. Stateful Servers --- ## [Cisco ASA Remove Access-list entries](https://forum.networklessons.com/t/cisco-asa-remove-access-list-entries/1931)
**Author:** [@popsgills](https://forum.networklessons.com/u/popsgills)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 7:04am UTC](https://forum.networklessons.com/t/cisco-asa-remove-access-list-entries/1931 "2017-07-18T07:04:27Z")
How do you delete an entry from an access-list on a cisco asa --- ## [Anyconnect VPN configuration using 2FA (Radius and LoginTC)](https://forum.networklessons.com/t/anyconnect-vpn-configuration-using-2fa-radius-and-logintc/1769)
**Author:** [@sivak80nayan](https://forum.networklessons.com/u/sivak80nayan)\ **Replies:** 4\ **Last updated:** [June 21, 2017, 1:30pm UTC](https://forum.networklessons.com/t/anyconnect-vpn-configuration-using-2fa-radius-and-logintc/1769 "2017-06-21T13:30:21Z")
Good afternoon, First time I am posting one query about Cisco ASA Anyconnect external Group policy for Radius authentication. I have made one LAB setup for anyconnect 3.1 using internal authentication and it is working,… --- ## [CISCO ASA: How to NAT in both directions?](https://forum.networklessons.com/t/cisco-asa-how-to-nat-in-both-directions/738)
**Author:** [@steven.passenier](https://forum.networklessons.com/u/steven.passenier)\ **Replies:** 3\ **Last updated:** [March 29, 2017, 5:48pm UTC](https://forum.networklessons.com/t/cisco-asa-how-to-nat-in-both-directions/738 "2017-03-29T17:48:07Z")
Hi all, I am not able to figure out the best method to NAT because there are so many options.. In ASDM \> When do I use “add object wth NAT option” and when do I use “add NAT rule” for example: I would like to set up … --- ## [ASA to ASA hairpin](https://forum.networklessons.com/t/asa-to-asa-hairpin/1213)
**Author:** [@stevegalarza](https://forum.networklessons.com/u/stevegalarza)\ **Replies:** 1\ **Last updated:** [January 8, 2017, 9:54am UTC](https://forum.networklessons.com/t/asa-to-asa-hairpin/1213 "2017-01-08T09:54:16Z")
Hello, I’m hoping you can help me with this issue. I’m having some difficulties finding documentation on how to configure ASA to ASA hairpin. The plan is to have clients connect to our ASA but make a U turn to another… --- ## [Inter DMZ configuration](https://forum.networklessons.com/t/inter-dmz-configuration/795)
**Author:** [@bridgetedwards](https://forum.networklessons.com/u/bridgetedwards)\ **Replies:** 1\ **Last updated:** [January 8, 2017, 9:26am UTC](https://forum.networklessons.com/t/inter-dmz-configuration/795 "2017-01-08T09:26:55Z")
I need to create an ASA config to allow traffic between DMZ1 and DMZ2. It would need to transit the core VSS switch. What do I need to be aware of here? Thanks, Bridget [Previous page](https://forum.networklessons.com/c/security/asa/33.md?page=1) [Next page](https://forum.networklessons.com/c/security/asa/33.md?page=3)