network_stuff:cisco:asa
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| network_stuff:cisco:asa [2020/07/29 12:54] – jotasandoku | network_stuff:cisco:asa [2023/11/02 14:38] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 31: | Line 31: | ||
| \\ | \\ | ||
| Concept of **service policy** : | Concept of **service policy** : | ||
| - | show service policy set connection detail | + | show service policy set connection detail |
| This is to see all the class-map with the number of packets and rate they are hit | This is to see all the class-map with the number of packets and rate they are hit | ||
| \\ | \\ | ||
| Line 86: | Line 86: | ||
| show conn all | show conn all | ||
| show access-list | show access-list | ||
| + | |||
| + | |||
| + | ---- | ||
| + | |||
| \\ | \\ | ||
| - | \\ | + | __**NAT**__\\ |
| - | __**NAT**__ | + | |
| - | Essential resource: NAT cheat sheet: See: [[http://packetpushers.net/cisco-nat-cheat-sheet]]/ | + | [[http://blog.packetsar.com/wp-content/ |
| + | |||
| + | {{ : | ||
| \\ | \\ | ||
| {{ : | {{ : | ||
| Line 168: | Line 174: | ||
| **Unified NAT** is used instead of NAT order meaning to down and more specific first order. | **Unified NAT** is used instead of NAT order meaning to down and more specific first order. | ||
| \\ | \\ | ||
| + | |||
| ---- | ---- | ||
| + | |||
| + | __INSERT ACCESS LIST IN POSITIONS__: | ||
| + | |||
| + | access-list outside-in line 1 extended permit tcp object-group mycompany1-networks object tanium-internal eq 17472 # Ao line x is what you’re looking for on where to put the new rule | ||
| + | show access list # blah it’ll show you the rule number order | ||
| + | | ||
| + | |||
| + | ---- | ||
| + | |||
| + | |||
| **Troubleshooting** | **Troubleshooting** | ||
| Line 181: | Line 198: | ||
| show conn count | show conn count | ||
| show processes cpu-usage sorted non-zero | show processes cpu-usage sorted non-zero | ||
| - | fw01/dc.grapeshot.co.uk/ | + | fw01/dc.mycompany1.co.uk/ |
| | | ||
| PERFMON STATS: | PERFMON STATS: | ||
| Line 279: | Line 296: | ||
| \\ | \\ | ||
| - | | + | |
| - | | + | |
| - | | + | |
| + | show vpn-sessiondb anyconnect # (SSL VPN / Anyconnect Clients) | ||
| + | | ||
| \\ | \\ | ||
| To clear down a tunnel: | To clear down a tunnel: | ||
| Line 337: | Line 356: | ||
| \\ | \\ | ||
| **NAT** | **NAT** | ||
| - | | + | |
| Several exempts: | Several exempts: | ||
| from inside to inside | from inside to inside | ||
| Line 491: | Line 510: | ||
| \\ | \\ | ||
| - | ldngs28vpnfw01# | + | ldngs28vpnfw01# |
| Active SA: 11 | Active SA: 11 | ||
| Line 502: | Line 521: | ||
| \\ | \\ | ||
| | | ||
| - | ldngs28vpnfw01# | + | ldngs28vpnfw01# |
| peer address: 213.61.9.96 | peer address: 213.61.9.96 | ||
| Crypto map tag: outside_map, | Crypto map tag: outside_map, | ||
| Line 824: | Line 843: | ||
| Network Operations profile: | Network Operations profile: | ||
| - | ukvpn.marketaxess.com/ | + | ukvpn.mycompany4.com/ |
| Line 949: | Line 968: | ||
| - | vpn.marketaxess.com | + | vpn.mycompany4.com |
| - | usvpn.marketaxess.com (legacy?) | + | usvpn.mycompany4.com (legacy?) |
| - | ukvpn.marketaxess.com | + | ukvpn.mycompany4.com |
| Anyconnect. To check who is currently connected: | Anyconnect. To check who is currently connected: | ||
| Line 976: | Line 995: | ||
| - | Essential resource: NAT cheat sheet: See: http:packetpushers.net/cisco-nat-cheat-sheet | + | Essential resource: NAT cheat sheet: See: [[http://blog.packetsar.com/wp-content/ |
| + | \\ | ||
| + | {{: | ||
| - | + | {{: | |
| Packet flow: | Packet flow: | ||
| Line 1114: | Line 1135: | ||
| Unified NAT is used instead of NAT order meaning to down and more specific first order. | Unified NAT is used instead of NAT order meaning to down and more specific first order. | ||
| + | |||
| Review " | Review " | ||
| Line 1298: | Line 1320: | ||
| + | ---- | ||
| + | |||
| + | conf t | ||
| + | pager 0 # to stop scroll pauses | ||
| + | | ||
| ---- | ---- | ||
| - | **NEW ' | + | |
| - | * Firepower is services on top of the ASA platform | + | **FIREPOWER** |
| * Sourcefire was acquired by Cisco several years ago and now going to change name to NGIPS Firepower center | * Sourcefire was acquired by Cisco several years ago and now going to change name to NGIPS Firepower center | ||
| + | * This is what is added to the asa access ctrl and vpn [[https:// | ||
| + | * The 4100 Series platforms can run either the Cisco ASA Firewall or Cisco Firepower Threat Defense (FTD) | ||
| + | |||
| + | * NGIPS : Intrusion prention, is not even degraded wheb we turn it on! | ||
| + | * Threat intelligence, | ||
| + | * Cisco NGFW shares policy information with the **Cisco Identity Services Engine (ISE)** so that ISE can automatically enforce policy on devices. | ||
| + | |||
| + | MANAGEMENT: | ||
| + | * Firepower Device Manager (FDM) | ||
| + | * Cisco Firepower Management Center (FMC) | ||
| + | * Cisco Defense Orchestrator (CDO) | ||
| + | |||
| + | ---- | ||
| + | FURTHER:\\ | ||
| + | * Cisco Tetration, Umbrella | ||
| + | * DNA: Cisco DNA Center the focal point for insights and actions. Now we are adding new capabilities with Cisco AI Network Analytics in the Cloud. AI Network Analytics collects massive amounts of network data from Cisco DNA Centers at participating customer sites, encrypts and anonymizes the data to ensure privacy, and collates all of it into the Cisco Worldwide Data Platform. | ||
network_stuff/cisco/asa.1596027298.txt.gz · Last modified: (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
