Cisco ASA Redundant or Backup ISP Links with VPNs
KB ID 0000544 Problem This method provides failover to a redundant ISP link should your primary network connection go down. IT IS NOT going to load balance the traffic across both interfaces. In this example I’ve also got a VPN to a remote site and some port forwarding to contend with as well. Where we are at the start. Where we want to be Solution Before you go any further the ASA that will have the backup ISP line,...
Allow access to VMware View through Cisco ASA 5500
KB ID 0000545 Problem To access VMware View though a firewall you need the following ports to be open; TCP Port 80 (http/www) TCP Port 443 (https/ssl) TCP Port 4172 (PCoIP) UDP Port 4172 (PCoIP) In the following example I’m using 192.168.1.100 as the internal IP address of the View Server and the public IP address of the firewall is 123.123.123.123. Which solution you use, depends on weather you are allowing access via a...
Cisco ASA 5500 Active/Standby – Zero Downtime Upgrade
KB ID 0000733 Problem You have two ASA firewalls deployed in Active/Standby failover configuration, and need to upgrade either the operating system or the ASDM. As you already have a high availability solution you do not want any downtime. Before we start, we need to make sure we know the difference between primary, secondary, active and standby. From the rear (Active=Green, Standby=Amber) The Primary and Secondary firewalls are...
Cisco ASA 5500 – VPN Works in One Direction
KB ID 0000759 Problem The title of this article can cover a multitude of possible causes, however I recently had a strange problem where a client with a remote site protected by an ASA5505 had a VPN tunnel connected to their main site which had an ASA5510. The tunnel established at phase 1, and phase 2, the main site could talk to the remote site, but the remote site refused to talk back to the main site. Update 23/04/19: Seen again...
Cisco ASA 5505 Routing Between Two (Internal) VLANS
KB ID 0000869 Problem I had to set this up for a client this week, I’ve setup a DMZ on a 5505 before and I’ve setup other VLANs to do other jobs, e.g. visitor Internet access. But this client needed a secondary VLAN setting up for IP Phones. In addition I needed to route traffic between both the internal VLANs. I did an internet search and tried to find some configs I could reverse engineer, the few I found were old (Pre version 8.3)...