Cisco ASA asp-drop Counters Explained
The Cisco ASA's accelerated security path (ASP) is the data-plane fast path that handles every forwarded packet after a flow has been admitted. When the ASP drops a packet, the reason it cites in show asp drop
Jaime
Latest posts — page 35
Cisco ASA Packet Capture from CLI
Packet capture from the Cisco ASA CLI is the highest-resolution diagnostic tool you have. When show conn, show xlate, and packet-tracer all agree the firewall should pass a flow but the application still does not work, capture is
Cisco ASA Stateful Failover and Interface Tracking
Stateful failover is the option that turns a Cisco ASA active/standby pair into something users actually do not notice when one unit fails. Without it, basic failover preserves the IPs and continues to forward new traffic - but every existing
Cisco ASA Active/Standby Failover Configuration
Active/standby failover on the Cisco ASA is the simplest high-availability mode the platform supports: two physically identical firewalls connected by a dedicated failover link, one unit forwarding traffic, the other watching and waiting. When the active unit dies,
Troubleshoot AnyConnect Login and Certificate Problems on ASA
AnyConnect (Cisco Secure Client) login failures fall into a small handful of categories, and each one has its own debug path on the Cisco ASA. The two most common are AAA failures (the user typed a wrong password, or the
Troubleshoot Cisco ASA IPsec VPN Phase 1 and Phase 2
When an IPsec VPN tunnel on a Cisco ASA does not come up, the failure is almost always in one of two phases: Phase 1 (the IKE_SA where the two peers prove who they are and negotiate a control-
Cisco ASA Certificate Management for AnyConnect
Certificates on a Cisco ASA serving AnyConnect (Cisco Secure Client) traffic do two related but distinct jobs. First, the ASA presents an identity certificate to the client during the TLS or IKEv2 handshake; the client validates that cert before sending
Cisco ASA Dynamic Access Policies (DAP)
Dynamic Access Policies (DAP) on the Cisco ASA are the runtime override layer for VPN sessions. They evaluate at login time, can match against AAA attributes plus endpoint posture (HostScan / Cisco Secure Endpoint) plus connection attributes, and they can override
Cisco ASA AAA for VPN: LDAP, RADIUS, and TACACS+
Authentication, Authorization, and Accounting (AAA) on a Cisco ASA decides three things for every VPN session: who is the user, what are they allowed to do, and what activity should be logged. The three protocols you can wire into the
Cisco ASA VPN Group Policies and Tunnel Groups
Two of the most overloaded terms in Cisco ASA VPN configuration are group-policy and tunnel-group. They sound similar, they are configured in the same area, and they both apply attributes to a connecting client. The difference between them
Cisco ASA Split Tunneling Explained
Split tunneling controls which traffic from a connected VPN client traverses the encrypted tunnel and which traffic exits to the internet directly. Get it wrong and you either backhaul Netflix traffic across your WAN (paying for bandwidth and adding latency)
Cisco ASA AnyConnect IKEv2 VPN Configuration
AnyConnect (Cisco Secure Client) supports two transport options when connecting to an ASA: SSL/TLS over TCP/443 and IKEv2/IPsec over UDP/500 + UDP/4500. SSL is the default for most deployments because it traverses captive-portal networks the