EIGRP on the Cisco ASA is one of the most straightforward things you will configure on the platform, right up until a neighbour refuses to form. And the number-one reason an EIGRP neighbour will not come up on the
OSPF is the dynamic routing protocol you are most likely to meet on a Cisco ASA. When a firewall needs to learn more than a handful of internal prefixes and the core already speaks OSPF, running it on the ASA
The Cisco ASA is a firewall that happens to route. That framing matters, because when you sit down at an ASA after years on IOS routers, the routing looks familiar right up until it doesn't. The commands are
COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.
VRF-aware IPsec has a reputation for being fiddly, and it mostly is not. What it has is two things called almost the same thing, doing completely different jobs, and until you separate them in your head nothing about the
The hands-on GETVPN build on Cisco IOS XE. Key server first, then group members (nine lines, no peer, no ACL), then verification. Every command verified on cat8000v 17.18.02.
Pre-shared keys are a fine way to learn IPsec and a poor way to run it. A PSK is a shared secret sitting in a config file, in plain sight of anyone with read access to the device, in
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
PKI is one of those topics that everyone nods along to and almost nobody has actually built. You read about certificate authorities, trustpoints, enrollment, and revocation, and it all stays abstract because the tooling feels heavy: a Windows domain, AD
Every Cisco engineer eventually inherits a router with four different VPN styles bolted onto it: a crypto map for the legacy branch, a static VTI for the partner link, DMVPN for the regional spokes, and EzVPN for the handful of
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
FlexVPN is what happens when Cisco stops bolting features onto crypto maps and rebuilds the whole thing on top of IKEv2. There is no crypto ACL, no static tunnel per peer, and no routing protocol running over the overlay just