VPN - Ping Labz

ASA vpn-tunnel-protocol with no ssl-clientless option, WebVPN removed

ASA

Clientless SSL VPN Is Gone: What Replaced WebVPN on Modern ASA

Cisco removed Clientless SSL VPN (WebVPN) from the ASA in 9.17. Real 9.24 CLI proof, and the Secure Client remote-access VPN that replaced it.

J

Jul 13, 2026 7 min read

IPsec through an ASA: inspect ipsec-pass-thru and the UDP 4500 NAT-T rule

ASA

IPsec Through an ASA: NAT-T, ESP Pass-Through, and Why the Tunnel Won't Come Up

Endpoint versus pass-through on the Cisco ASA: inspect ipsec-pass-thru, NAT-T on UDP 4500, and the classic Phase 1 up, Phase 2 down failure.

J

Jul 13, 2026 8 min read

ASA IKEv1 versus IKEv2 config mapping for a site-to-site migration

ASA

IKEv1 vs IKEv2 on the ASA: Migrating a Site-to-Site Tunnel

Map IKEv1 to IKEv2 on the Cisco ASA command by command, then cut a live site-to-site tunnel over without an outage.

J

Jul 13, 2026 7 min read

ASA IKEv2 site-to-site tunnel in show vpn-sessiondb with AES256 and DH14

ASA

LAN-to-LAN IPsec VPN on the ASA with IKEv2

A real LAN-to-LAN IKEv2 tunnel from a Cisco ASA to an IOS XE peer, verified with show vpn-sessiondb from a live CML capture.

J

Jul 13, 2026 9 min read

GETVPN COOP failover: real syslog showing the secondary key server promoting to primary

IPsec

GETVPN Redundancy: COOP Key Servers and Rekey Survival

COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.

J

Jul 13, 2026 10 min read

IPsec

VRF-Aware IPsec: Keeping VPNs in Their Lane

VRF-aware IPsec has a reputation for being fiddly, and it mostly is not. What it has is two things

J

Jul 13, 2026 10 min read