Advanced Search
Search Results
535 total results found
Can't Run ASDM On New ASA
(2013-07-05) Problem Brand-new out-of-box ASA (5512 in my case) won't permit the ASDM to run. Error is: Unable to load resource: https://192.168.1.1/admin/public/startup.jnlp Solution What is probably happening is the SSL Cipher settings on your browser are n...
ASDM on Windows 10
(2015-10-01) Problem ASDM 7.1(3) on Windows 10. Solution Install 32-bit and 64-bit Java-JRE. I installed jre-8u60-windows-i586 and jre-8u60-windows-x64. Go to the ASDM web page and click the Install ASDM Launcher and let it install. In C: Program Files (x86)C...
DHCP Reservations
(2021-02-25) DHCP Reservations This feature is now supported on ASA in version 9.13(1) and later Example: Magnus-5506-Desk# sh run dhcpd dhcpd dns 192.168.1.22 dhcpd domain cisco.com dhcpd option 4 ip 172.18.124.1 ! dhcpd address 192.168.100.100-192.168.100.20...
Port Forward
(2017-02-28) Problem I have firewall with public IP 1.2.3.4. I need to expose ssh the private server 192.168.1.1 on IP 1.2.3.5 to the internet peer at 1.9.1.1/ Solution conf t object SERVER-NAT host 192.168.1.1 object INTERNETPEER host 1.9.1.1 access-list in...
Same-interface Hairpin
(2017-05-31) Problem I have a server on my dmz at 192.168.1.10, with a public IP of 1.1.1.1. I need another server on the 192.168.1.0/24 network to be able to access .10 through its public IP. Solution object network LAN subnet 192.168.1.0 255.255.255.0 objec...
Show Dropped Packets
(2019-09-20) Show Dropped Packets ALBERT# capture TEST type asp-drop all real-time […] ^C ALBERT# show capture TEST trace | in 10.7.3.1 9: 10:36:38.550340 10.7.3.1 > 10.1.1.11: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured ru...
Self-Signed Certificates
(2018-01-10) Problem I have a new ASA and I need some self-signed certificates. Solution (this is all conf t ) Setup stuff: hostname myasa domain-name cisco.com clock set 00:00:00 1 Jan 2010 clock set timezone EST -5 Generate the default rsa keypair: crypto...
Disable TCP Timestamps
(2022-01-08) Problem Some security scanner is complaining that TCP Timestamps are enabled on my ASA. Solution access-list ACL_TCP extended permit tcp any any ! class-map timestamp_class_map match access-list ACL_TCP ! tcp-map timestamp_tcp_map tcp-options t...
Force TLSv1.2 or higher
(2020-01-20) Problem ASA still responding to, and using, protocols less than TLS1.2. AKA: SSLv2 and SSLv3 are still being used, which is bad. Solution # config (config)# ssl server-version tlsv1.2 (config)# ssl client-version tlsv1.2 (config)# exit Commentary...
Missing HTTPOnly Cookie Attribute
(2022-01-08) Problem Some security scanner is complaining that there's no 'httpOnly' cookie attribute. Solution None, cisco won't fix because they don't consider it a serious issue. Reference (requires login)
PPPoE Session Status
(2021-12-03) Problem What is happening with my PPPoE session? Solution Nothing, probably, but here are some commands that will show you things: # show vpdn session pppoe state # show vpdn session pppoe packets # show vpdn tunnel pppoe summary # show vpdn pppin...
Security Commands
(2019-01-20) Problem Collection of the SSL mitigations I've been collecting. Solution No commentary. See individual pages in the Cisco/ASA hierarchy for details and sources. conf t ssl cipher tlsv1 fips ssl cipher tlsv1.1 fips ssl cipher tlsv1.2 fips ssl dh-gr...
SSH pubkey authentication
(2020-09-25) Problem How to set up an ASA to accept an ssh pubkey? Solution Create a ssh key as normal. Create the Base64 Encoded Public Key that the ASA wants: $ ssh-keygen -e -f id_rsa.pub ---- BEGIN SSH2 PUBLIC KEY ---- Comment: "4096-bit RSA, converted by ...
Test Authentication Server
(2020-03-18) Problem Is my Radius (or LDAP) server working? Solution # show run | begin aaa-server aaa-server MS-IAS protocol radius aaa-server MS-IAS (inside) host 192.168.8.7 key ***** radius-common-pw ***** [...] MNI-India-FW# test aaa-server authenticati...
TLS DH Group Key Length
(2020-01-20) Problem Something like SSL/TLS: Diffie-Hellman Key Exchange Insufficient DH Group Strength Vulnerability Solution # conf (config)# ssl dh-group group14 (config)# end
Use User's Password As Enable Password
(2020-12-17) Problem I want to use my username password as the enable password in ssh sessions Solution The ASDM will use the password from your Username, while when logging in to the console it will use the enable password when you enter exec mode (when you t...
Faking a secondary IP
(2013-04-30) Problem ASA won't let you define a secondary IP on an interface. Solution Fake it with arp-proxying. Find the mac address of the interface you will be using: sh interface Ethernet0/1 Define a static arp for the new IP with the existing mac addres...
Mailguard
Problem Can't send or receive some messages through a Cisco ASA firewall. Solution Turn off Mailguard on the ASA: ASA# conf t ASA(config)# no fixup protocol smtp 25 ASA(config)# exit ASA# write me Building configuration... It may be necessary to reset/reload ...