Troubleshoot High CPU and Dispatch Unit in a Cisco ASA Firewall

You can issue the following commands in order to troubleshoot a high CPU problem and Dispatch Unit Error in a Cisco ASA firewall:

show cpu usage   // "NORMAL" CPU SHOULD BE UNDER 50%
show proc cpu-usage sorted non-zero   // LOOK FOR DISPATCH UNIT
show perfmon
show xlate count
show service-policy
show interface     // LOOK FOR OVERRUNS
show traffic 


The high CPU and Dispatch Unit is due to a bandwidth oversubscription or excessive load traversing the ASA. You can check the ASA Firewall performance matrix on this link. I had this problem on an ASA 5510. I've issued the crypto engine large-mod-accel global config command. The long term solution would be to upgrade and "size" the correct the hardware platform that will support its current and future bandwidth capacity.

ASA# show cpu usage
CPU utilization for 5 seconds = 85%; 1 minute: 89%; 5 minutes: 91%

ASA# configure terminal
ASA(config)# crypto engine ?             

configure mode commands/options:
  large-mod-accel  Perform Large modulus operations in hardware

ASA(config)# crypto engine large-mod-accel


You'll observe the high CPU and Dispatch Unit dramatically drop after a few minutes. The first-gen ASA was replaced with a next-gen firewall to handle the high bandwidth throughput.

ASA(config)# show cpu usage                   
CPU utilization for 5 seconds = 61%; 1 minute: 63%; 5 minutes: 65%

ASA(config)# show proc cpu-usage sorted non-zero
PC         Thread       5Sec     1Min     5Min   Process
081abd84   a79aff7c    58.9%    60.2%    62.5%   Dispatch Unit
08c2cc96   a79a984c     1.8%     1.8%     1.8%   Logger
08bf3ffc   a79aa03c     0.1%     0.0%     0.0%   ssh
08ae9f08   a799efa0     0.1%     0.0%     0.0%   tacplus_snd
0854100e   a79a0770     0.1%     0.1%     0.1%   ARP Thread
 

Cisco VRF Aware IPSec crypto keyring command

Here's a good Cisco link for the VRF Aware IPSec configuration. You can configure multiple pre-shared key (PSK) and peer address under the crypto keyring vrf command.

R1(config)#crypto keyring MYKEYRING vrf CUST-1
R1(conf-keyring)#pre-shared-key address 20.7.16.4 key key123
R1(conf-keyring)#pre-shared-key address 202.8.26.1 key key456
R1(conf-keyring)#
R1(conf-keyring)#do show run | section crypto
crypto keyring MYKEYRING vrf CUST-1
  pre-shared-key address 20.7.16.4 key key123
  pre-shared-key address 202.8.26.1 key key456

 

I just used tunnel vrf CUST-1 under the GRE tunnel used by CUST-2 VRF.

R1#show run interface Tunnel1

Building configuration...

 

Current configuration : 288 bytes

!

interface Tunnel1

 ip vrf forwarding CUST-2

 ip address 172.20.1.1 255.255.255.252

 tunnel source 172.20.10.6

 tunnel destination 172.20.10.7

 tunnel vrf CUST-1

 !

end

 

I initially configured a separate crypto keyring using a different VRF (CUST-2) but was getting this log error:

.Feb  9 10:29:08.488 UTC: %CRYPTO-6-IKMP_NO_PRESHARED_KEY: Pre-shared key for remote peer at 202.8.26.1 is missing

The debug also showed it's due to a missing PSK. I didn't notice it's using CUST-1 VRF.

R1#debug crypto isakmp

Crypto ISAKMP debugging is on

 

.Feb  9 10:32:12.466 UTC: ISAKMP (0): received packet from 202.8.26.1 dport 500 sport 500 CUST-1 (N) NEW SA

.Feb  9 10:32:12.466 UTC: ISAKMP: Created a peer struct for 202.8.26.1, peer port 500

.Feb  9 10:32:12.466 UTC: ISAKMP: New peer created peer = 0x2A60D02C peer_handle = 0x8000004E

.Feb  9 10:32:12.466 UTC: ISAKMP: Locking peer struct 0x2A60D02C, refcount 1 for crypto_isakmp_process_block

.Feb  9 10:32:12.466 UTC: ISAKMP: local port 500, remote port 500

.Feb  9 10:32:12.466 UTC: ISAKMP:(0):insert sa successfully sa = 2A4C0234

.Feb  9 10:32:12.466 UTC: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

.Feb  9 10:32:12.466 UTC: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): processing SA payload. message ID = 0

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): vendor ID is NAT-T v2

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): vendor ID is NAT-T v3

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch

.Feb  9 10:32:12.466 UTC: ISAKMP (0): vendor ID is NAT-T RFC 3947

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload

.Feb  9 10:32:12.466 UTC: ISAKMP:(0): processing IKE frag vendor id payload

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):Support for IKE Fragmentation not enabled

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):No pre-shared key with 202.8.26.1!

.Feb  9 10:32:12.470 UTC: %CRYPTO-6-IKMP_NO_PRESHARED_KEY: Pre-shared key for remote peer at 202.8.26.1 is missing

.Feb  9 10:32:12.470 UTC: ISAKMP : Scanning profiles for xauth ...

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy

.Feb  9 10:32:12.470 UTC: ISAKMP:      default group 2

.Feb  9 10:32:12.470 UTC: ISAKMP:      encryption AES-CBC

.Feb  9 10:32:12.470 UTC: ISAKMP:      keylength of 128

.Feb  9 10:32:12.470 UTC: ISAKMP:      hash SHA

.Feb  9 10:32:12.470 UTC: ISAKMP:      auth pre-share

.Feb  9 10:32:12.470 UTC: ISAKMP:      life type in seconds

.Feb  9 10:32:12.470 UTC: ISAKMP:      life duration (VPI) of  0x0 0x0 0xA8 0xC0

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):Preshared authentication offered but does not match policy!

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):atts are not acceptable. Next payload is 0

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):no offers accepted!

.Feb  9 10:32:12.470 UTC: ISAKMP:(0): phase 1 SA policy not acceptable! (local 61.4.11.2 remote 202.8.26.1)

.Feb  9 10:32:12.470 UTC: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: construct_fail_ag_init

.Feb  9 10:32:12.470 UTC: ISAKMP:(0): Failed to construct AG informational message.

.Feb  9 10:32:12.470 UTC: ISAKMP:(0): sending packet to 202.8.26.1 my_port 500 peer_port 500 (R) MM_NO_STATE

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):Sending an IKE IPv4 Packet.

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):peer does not do paranoid keepalives.

.Feb  9 10:32:12.470 UTC: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 202.8.26.1)

Cisco ASA failover key Command

I needed to add the failover key <KEY> command in a Cisco ASA firewall pair. The failover pair is working but the previous admin forgot to add this command. I used two Cisco ASAv firewalls in my GNS3 lab to simulate if it's relatively safe to add the said command and wouldn't break the failover pair. It's still advisable to do this in an approved maintenance window.

ASAv-1# show version

 

Cisco Adaptive Security Appliance Software Version 9.8(1)

Firepower Extensible Operating System Version 2.2(1.47)

Device Manager Version 7.8(1)

 

Compiled on Wed 10-May-17 15:38 PDT by builders

System image file is "boot:/asa981-smp-k8.bin"

Config file at boot was "startup-config"

 

ASAv-1 up 16 mins 35 secs

 

Hardware:   ASAv, 2048 MB RAM, CPU Pentium II 1900 MHz,

Model Id:   ASAv10

Internal ATA Compact Flash, 8192MB

Slot 1: ATA Compact Flash, 8192MB

BIOS Flash Firmware Hub @ 0x0, 0KB

 

 

 0: Ext: Management0/0       : address is 0ce5.a655.f500, irq 11

 1: Ext: GigabitEthernet0/0  : address is 0ce5.a655.f501, irq 11

 2: Ext: GigabitEthernet0/1  : address is 0ce5.a655.f502, irq 10

 3: Ext: GigabitEthernet0/2  : address is 0ce5.a655.f503, irq 10

 4: Ext: GigabitEthernet0/3  : address is 0ce5.a655.f504, irq 11

 5: Ext: GigabitEthernet0/4  : address is 0ce5.a655.f505, irq 11

 6: Ext: GigabitEthernet0/5  : address is 0ce5.a655.f506, irq 10

 7: Ext: GigabitEthernet0/6  : address is 0ce5.a655.f507, irq 10

 

License mode: Smart Licensing

ASAv Platform License State: Unlicensed

No active entitlement: no feature tier and no throughput level configured

*Memory resource allocation is more than the permitted limit.

 

Licensed features for this platform:

Maximum VLANs                     : 50            

Inside Hosts                      : Unlimited     

Failover                          : Active/Standby   // ASAv SUPPORTS ACTIVE/STANDBY BY DEFAULT

Encryption-DES                    : Enabled       

Encryption-3DES-AES               : Enabled       

Security Contexts                 : 0             

Carrier                           : Disabled      

AnyConnect Premium Peers          : 2             

AnyConnect Essentials             : Disabled      

Other VPN Peers                   : 250           

Total VPN Peers                   : 250           

AnyConnect for Mobile             : Disabled      

AnyConnect for Cisco VPN Phone    : Disabled      

Advanced Endpoint Assessment      : Disabled      

Shared License                    : Disabled      

Total TLS Proxy Sessions          : 2             

Botnet Traffic Filter             : Enabled       

Cluster                           : Disabled      

 

Serial Number: 9A81V5LKN5F

 

Image type          : Release

Key version         : A

 

Configuration last modified by enable_15 at 03:03:53.969 UTC Tue Jan 25 2022

 

 

-----

 

 

ASAv-2# show version

 

Cisco Adaptive Security Appliance Software Version 9.8(1)

Firepower Extensible Operating System Version 2.2(1.47)

Device Manager Version 7.8(1)

 

Compiled on Wed 10-May-17 15:38 PDT by builders

System image file is "boot:/asa981-smp-k8.bin"

Config file at boot was "startup-config"

 

ASAv-2 up 1 min 53 secs

 

Hardware:   ASAv, 2048 MB RAM, CPU Pentium II 1900 MHz,

Model Id:   ASAv10

Internal ATA Compact Flash, 8192MB

Slot 1: ATA Compact Flash, 8192MB

BIOS Flash Firmware Hub @ 0x0, 0KB

 

 

 0: Ext: Management0/0       : address is 0ce5.a6d4.2800, irq 11

 1: Ext: GigabitEthernet0/0  : address is 0ce5.a6d4.2801, irq 11

 2: Ext: GigabitEthernet0/1  : address is 0ce5.a6d4.2802, irq 10

 3: Ext: GigabitEthernet0/2  : address is 0ce5.a6d4.2803, irq 10

 4: Ext: GigabitEthernet0/3  : address is 0ce5.a6d4.2804, irq 11

 5: Ext: GigabitEthernet0/4  : address is 0ce5.a6d4.2805, irq 11

 6: Ext: GigabitEthernet0/5  : address is 0ce5.a6d4.2806, irq 10

 7: Ext: GigabitEthernet0/6  : address is 0ce5.a6d4.2807, irq 10

 

License mode: Smart Licensing

ASAv Platform License State: Unlicensed

No active entitlement: no feature tier and no throughput level configured

*Memory resource allocation is more than the permitted limit.

 

Licensed features for this platform:

Maximum VLANs                     : 50            

Inside Hosts                      : Unlimited     

Failover                          : Active/Standby

Encryption-DES                    : Enabled       

Encryption-3DES-AES               : Enabled       

Security Contexts                 : 0             

Carrier                           : Disabled      

AnyConnect Premium Peers          : 2             

AnyConnect Essentials             : Disabled      

Other VPN Peers                   : 250           

Total VPN Peers                   : 250           

AnyConnect for Mobile             : Disabled      

AnyConnect for Cisco VPN Phone    : Disabled      

Advanced Endpoint Assessment      : Disabled      

Shared License                    : Disabled      

Total TLS Proxy Sessions          : 2             

Botnet Traffic Filter             : Enabled       

Cluster                           : Disabled      

 

Serial Number: 9AK137KWDWB

 

Image type          : Release

Key version         : A

 

Configuration last modified by enable_15 at 03:17:50.569 UTC Tue Jan 25 2022

 

 

Configure failover on ASAv-1 and ASAv-2 without the failover key command.

 

ASAv-1# configure terminal

ASAv-1(config)# interface GigabitEthernet0/6   // DIRECT CABLE TO ASAv-2 G0/6

ASAv-1(config-if)#  no shutdown

ASAv-1(config-if)# failover lan unit primary

ASAv-1(config)# failover lan interface FAILOVER GigabitEthernet0/6

INFO: Non-failover interface config is cleared on GigabitEthernet0/6 and its sub-interfaces

ASAv-1(config)# failover link FAILOVER GigabitEthernet0/6

ASAv-1(config)# failover interface ip failover 10.0.0.1 255.255.255.252 standby 10.0.0.2

ASAv-1(config)# failover

ASAv-1(config)# .

 

        No Active mate detected

Beginning configuration replication: Sending to mate.

End Configuration Replication to mate

 

The ASAv pair started to sync and form the failover pair (or cluster) even without the failover key command.

 

ASAv-2# configure terminal

ASAv-2(config)# interface GigabitEthernet0/6

ASAv-2(config-if)#  no shutdown

ASAv-2(config-if)# failover lan unit secondary

ASAv-2(config)# failover lan interface FAILOVER GigabitEthernet0/6

INFO: Non-failover interface config is cleared on GigabitEthernet0/6 and its sub-interfaces

ASAv-2(config)# failover interface ip failover 10.0.0.1 255.255.255.252 standby 10.0.0.2

ASAv-2(config)# failover

ASAv-2(config)# ..

 

        Detected an Active mate

Beginning configuration replication from mate.

WARNING: Disabling auto import may affect Smart Licensing

WARNING: Local user database is empty and there are still 'aaa' commands for 'LOCAL'.

Creating trustpoint "_SmartCallHome_ServerCA" and installing certificate...

 

Trustpoint CA certificate accepted.

WARNING: Failover is enabled but standby IP address is not configured for this interface.

WARNING: Failover is enabled but standby IP address is not configured for this interface.

WARNING: Failover is enabled but standby IP address is not configured for this interface.

 

WARNING: Trustpoint _SmartCallHome_ServerCA is already authenticated.

WARNING: This command will not take effect until interface 'inside' has been assigned an IPv4 address

End configuration replication from mate.

 

 

The failover failed due to the monitored interfaces on ASAv-2. The only interface connected in ASAv-2 is a direct cable to ASAv-1 used for the failover interface (G0/6).

 

ASAv-1# ping 10.0.0.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.0.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/8/20 ms

 

 

ASAv-1# show failover

Failover On

Failover unit Primary

Failover LAN Interface: FAILOVER GigabitEthernet0/6 (up)

Reconnect timeout 0:00:00

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 3 of 61 maximum

MAC Address Move Notification Interval not set

Version: Ours 9.8(1), Mate 9.8(1)

Serial Number: Ours 9A81V5LKN5F, Mate 9AK137KWDWB

Last Failover at: 03:20:54 UTC Jan 25 2022

        This host: Primary - Active

                Active time: 52 (sec)

                slot 0: empty

                  Interface outside (200.1.1.1): Normal (Waiting)

                  Interface inside (172.16.1.1): Normal (Waiting)

                  Interface dmz (10.1.1.1): Normal (Waiting)

        Other host: Secondary - Failed

                Active time: 0 (sec)

                  Interface outside (0.0.0.0): No Link (Waiting)

                  Interface inside (0.0.0.0): No Link (Waiting)

                  Interface dmz (0.0.0.0): No Link (Waiting)

 

<OUTPUT TRUNCATED>

 

 

ASAv-1# show failover state

 

               State          Last Failure Reason      Date/Time

This host  -   Primary

               Active         None

Other host -   Secondary

               Failed         Ifc Failure              03:21:27 UTC Jan 25 2022

                              outside: No Link

                              inside: No Link

                              dmz: No Link

 

====Configuration State===

        Sync Done

====Communication State===

        Mac set

 

 

ASAv-1# show failover history

==========================================================================

From State                 To State                   Reason

==========================================================================

03:02:35 UTC Jan 25 2022

Not Detected               Disabled                   No Error

 

03:20:19 UTC Jan 25 2022

Disabled                   Negotiation                Set by the config command

 

03:20:54 UTC Jan 25 2022

Negotiation                Just Active                No Active unit found

 

03:20:54 UTC Jan 25 2022

Just Active                Active Drain               No Active unit found

 

03:20:54 UTC Jan 25 2022

Active Drain               Active Applying Config     No Active unit found

 

03:20:54 UTC Jan 25 2022

Active Applying Config     Active Config Applied      No Active unit found

 

03:20:54 UTC Jan 25 2022

Active Config Applied      Active                     No Active unit found

 

==========================================================================

 

 

I've temporarily removed monitoring on all interfaces using the no monitor-interface <INTERFACE> and added the prompt hostname priority command to distinguish between Primary and Secondary ASAv. The failover worked afterwards and Secondary ASAv status changed to Standby Ready.

 

ASAv-1(config)# no monitor-interface outside

ASAv-1(config)# no monitor-interface inside

ASAv-1(config)# no monitor-interface dmz

ASAv-1(config)# prompt hostname priority

ASAv-1/pri(config)#

 

 

ASAv-1/sec#      

Switching to Ok for reason Interface check.

 

 

ASAv-1/pri# show failover

Failover On

Failover unit Primary

Failover LAN Interface: FAILOVER GigabitEthernet0/6 (up)

Reconnect timeout 0:00:00

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 0 of 61 maximum

MAC Address Move Notification Interval not set

Version: Ours 9.8(1), Mate 9.8(1)

Serial Number: Ours 9A81V5LKN5F, Mate 9AK137KWDWB

Last Failover at: 03:20:54 UTC Jan 25 2022

        This host: Primary - Active

                Active time: 277 (sec)

                slot 0: empty

                  Interface outside (200.1.1.1): Normal (Not-Monitored)

                  Interface inside (172.16.1.1): Normal (Not-Monitored)

                  Interface dmz (10.1.1.1): Normal (Not-Monitored)

        Other host: Secondary - Standby Ready

                Active time: 0 (sec)

                  Interface outside (0.0.0.0): No Link (Not-Monitored)

                  Interface inside (0.0.0.0): No Link (Not-Monitored)

                  Interface dmz (0.0.0.0): No Link (Not-Monitored)

 

<OUTPUT TRUNCATED>

 

 

ASAv-1/pri# show failover state

 

               State          Last Failure Reason      Date/Time

This host  -   Primary

               Active         None

Other host -   Secondary

               Standby Ready  Ifc Failure              03:21:27 UTC Jan 25 2022

                              outside: No Link

                              inside: No Link

                              dmz: No Link

 

====Configuration State===

        Sync Done

====Communication State===

        Mac set

 

 

ASAv-1/pri# failover exec mate show run   // VERIFY CONFIG IN ASAv-2

: Saved

 

:

: Serial Number: 9AK137KWDWB

: Hardware:   ASAv, 2048 MB RAM, CPU Pentium II 1900 MHz

:

ASA Version 9.8(1)

!

hostname ASAv-1

enable password $sha512$5000$5bps8k/6inHnfDTz/HO44A==$PjXAl3nW8pK5BfcT6tJYwA== pbkdf2

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

passwd 2KFQnbNIdI.2KYOU encrypted

names

 

!

interface GigabitEthernet0/0

 description ### TO R1 F1/0: INTERNET ###

 nameif outside

 security-level 0

 ip address 200.1.1.1 255.255.255.0

!

interface GigabitEthernet0/1

 description ### TO IOU_SW01 E0/0: INSIDE ###

 nameif inside

 security-level 100

 ip address 172.16.1.1 255.255.255.0

!

interface GigabitEthernet0/2

 description ### TO R2 DMZ SERVER ###

 nameif dmz

 security-level 50

 

<OUTPUT TRUNCATED>

 

 

ASAv-1/pri# failover exec mate show run failover

failover

failover lan unit secondary

failover lan interface FAILOVER GigabitEthernet0/6

failover link FAILOVER GigabitEthernet0/6

failover interface ip FAILOVER 10.0.0.1 255.255.255.252 standby 10.0.0.2

 

 

So I added the failover key command and confirmed it didn't "break" the ASA failover pair. The command was also immediately sync'd to ASAv-2.

ASAv-1/pri# configure terminal

ASAv-1/pri(config)# failover key cisco

ASAv-1/pri(config)# end

 

ASAv-1/pri# show run failover

failover

failover lan unit primary

failover lan interface FAILOVER GigabitEthernet0/6

failover key *****

failover link FAILOVER GigabitEthernet0/6

failover interface ip FAILOVER 10.0.0.1 255.255.255.252 standby 10.0.0.2

 

ASAv-1/pri# failover exec mate show run failover

failover

failover lan unit secondary

failover lan interface FAILOVER GigabitEthernet0/6

failover key *****

failover link FAILOVER GigabitEthernet0/6

failover interface ip FAILOVER 10.0.0.1 255.255.255.252 standby 10.0.0.2

 

 

ASAv-1/pri# sh failover

Failover On

Failover unit Primary

Failover LAN Interface: FAILOVER GigabitEthernet0/6 (up)

Reconnect timeout 0:00:00

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 0 of 61 maximum

MAC Address Move Notification Interval not set

Version: Ours 9.8(1), Mate 9.8(1)

Serial Number: Ours 9A81V5LKN5F, Mate 9AK137KWDWB

Last Failover at: 03:20:54 UTC Jan 25 2022

        This host: Primary - Active

                Active time: 416 (sec)

                slot 0: empty

                  Interface outside (200.1.1.1): Normal (Not-Monitored)

                  Interface inside (172.16.1.1): Normal (Not-Monitored)

                  Interface dmz (10.1.1.1): Normal (Not-Monitored)

        Other host: Secondary - Standby Ready

                Active time: 0 (sec)

                  Interface outside (0.0.0.0): No Link (Not-Monitored)

                  Interface inside (0.0.0.0): No Link (Not-Monitored)

                  Interface dmz (0.0.0.0): No Link (Not-Monitored)

 

<OUTPUT TRUNCATED>

 

Cisco ASA Mutiple Context-Based ASA Firewall login Command

Here's a link about AAA and local username database in a Cisco ASA Multiple mode/Context-based Firewall. You should use the login command instead of enable in order to use the local username account (with privilege 15) for AAA fallback wherein the remote authentication server such TACACS+ or RADIUS is not reachable. This would allow you to jump to a context and issue any show and global config commands.

ciscoasa/pri/act> enable

Username: cisco-admin

Password: ***********

ciscoasa/pri/act# changeto context admin

ciscoasa/pri/act/admin# show run interface Manamgement0/0

Fallback authorization. Username 'enable_15' not in LOCAL database

Command authorization failed

 

ciscoasa/pri/act/admin# configure terminal

Command authorization failed

 

 

ciscoasa/pri/act> login

Username: cisco-admin

Password: ***********

ciscoasa/pri/act# changeto context admin

ciscoasa/pri/act/admin# show run interface Manamgement0/0

!

interface Management0/0

 management-only

 nameif management

 security-level 100

 ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2

 

Configuring Objects in a Cisco ASA Firewall

Here's a link about Cisco ASA Objects. I needed to "harden" our SIP connection to an external SIP gateway in the Internet. So instead of configuring multiple ACL entries, I configured Network and Service Objects on the Cisco ASA Firewall.

ciscoassa# configure terminal
ciscoassa(config)# object-group network SIP-EXTERNAL
ciscoassa(config-network-object-group)# network-object ?

network-object-group mode commands/options:
  Hostname or A.B.C.D                     Enter an IPv4 network address
  Hostname/<0-128> or X:X:X:X::X/<0-128>  Enter an IPv6 prefix
  host                                    Enter this keyword to specify a
                                          single host object
  object                                  Enter this keyword to specify a
                                          network object
ciscoassa(config-network-object-group)# network-object host 208.7.8.1
ciscoassa(config-network-object-group)# network-object host 208.7.8.2

ciscoassa(config)# object-group network SIP-INTERNAL
ciscoassa(config-network-object-group)# network-object host 192.168.1.6
ciscoassa(config-network-object-group)# network-object host 192.168.1.7

ciscoassa(config)# object-group service SIP-PROTOCOLS
ciscoassa(config-service-object-group)# service-object ?

dual-service-object-group mode commands/options:
  <0-255>  Enter protocol number (0 - 255)
  ah      
  eigrp   
  esp     
  gre     
  icmp    
  icmp6   
  igmp    
  igrp    
  ip      
  ipinip  
  ipsec   
  nos     
  object   Enter this keyword to specify a service object
  ospf    
  pcp     
  pim     
  pptp    
  sctp    
  snp     
  tcp     
  tcp-udp  Both TCP & UDP
  udp     
ciscoassa(config-service-object-group)# service-object udp ? 

dual-service-object-group mode commands/options:
  destination  Keyword to specify destination
  source       Keyword to specify source
  <cr>
dual-service-object-group mode commands/options:
  <0-65535>          Enter port number (0 - 65535)
  biff              
  bootpc            
  bootps            
  cifs              
  discard           
  dnsix             
  domain            
  echo              
  http              
  isakmp            
  kerberos          
  mobile-ip         
  nameserver        
  netbios-dgm       
  netbios-ns        
  nfs               
  ntp               
  pcanywhere-status 
  pim-auto-rp       
  radius            
  radius-acct       
  rip               
  secureid-udp      
  sip               
  snmp              
  snmptrap          
  sunrpc            
  syslog            
  tacacs            
  talk              
  tftp              
  time              
  vxlan             
  who               
  www               
  xdmcp                    
ciscoassa(config-service-object-group)# service-object udp destination ?

dual-service-object-group mode commands/options:
  eq     Port equal to operator
  gt     Port greater than  operator
  lt     Port less than operator
  neq    Port not equal to operator
  range  Port range operator
ciscoassa(config-service-object-group)# service-object udp destination eq 5060
ciscoassa(config-service-object-group)# service-object tcp destination eq 5060
ciscoassa(config-service-object-group)# service-object udp destination range 5000 60000

ciscoassa(config)# show object
object-group network SIP-EXTERNAL
 network-object host 208.7.8.1
 network-object host 208.7.8.2
object-group service SIP-PROTOCOLS
 service-object udp destination eq sip
 service-object tcp destination eq sip
 service-object udp destination range 5000 60000
object-group network SIP-INTERNAL
 network-object host 192.168.1.6
 network-object host 192.168.1.7

ciscoassa(config)# access-list SIP-OUTSIDE-IN extended permit ?

configure mode commands/options:
  <0-255>       Enter protocol number (0 - 255)
  ah           
  eigrp        
  esp          
  gre          
  icmp         
  icmp6        
  igmp         
  igrp         
  ip           
  ipinip       
  ipsec        
  nos          
  object        Specify a service object after this keyword
  object-group  Specify a service or protocol object-group after this keyword
  ospf         
  pcp          
  pim          
  pptp         
  sctp         
  snp          
  tcp          
  udp          
ciscoassa(config)# access-list SIP-OUTSIDE-IN extended permit object-group ?

configure mode commands/options:
  WORD  Service or protocol object-group name
ciscoassa(config)# access-list SIP-OUTSIDE-IN extended permit object-group SIP-PROTOCOLS ?                 

configure mode commands/options:
  A.B.C.D                Source IP address
  X:X:X:X::X/<0-128>     Source IPv6 address/prefix
  any                    Abbreviation for source address/mask of
                         0.0.0.0/0.0.0.0 OR source prefix ::/0
  any4                   Abbreviation of source address and mask of 0.0.0.0
                         0.0.0.0
  any6                   Abbreviation for source prefix ::/0
  host                   Use this keyword to configure source host
  interface              Use interface address as source address
  object                 Keyword to enter source object name
  object-group           Network object-group for source address
  object-group-security  Keyword to specify security object-group for source
  object-group-user      Keyword to specify user object-group for source
  security-group         Keyword to specify inline security-group
  user                   Keyword to specify user for source
  user-group             Keyword to specify user-group for source
ciscoassa(config)# access-list SIP-OUTSIDE-IN extended permit object-group SIP-PROTOCOLS object-group SIP-EXTERNAL ?                 

configure mode commands/options:
  A.B.C.D                Destination IP address
  X:X:X:X::X/<0-128>     Destination IPv6 address/prefix
  any                    Abbreviation for destination address/mask of
                         0.0.0.0/0.0.0.0 OR destination prefix ::/0
  any4                   Abbreviation for destination address and mask of
                         0.0.0.0 0.0.0.0
  any6                   Abbreviation for destination prefix ::/0
  host                   Use this keyword to configure destination host
  interface              Use interface address as destination address
  object                 Keyword to enter destination object name
  object-group           Network object-group for destination address
  object-group-security  Keyword to specify security object-group for
                         destination
  security-group         Keyword to specify inline security-group
ciscoassa(config)# access-list SIP-OUTSIDE-IN extended permit object-group SIP-PROTOCOLS object-group SIP-EXTERNAL object-group SIP-INTERNAL   // ONLY A SINGLE ACE

ciscoassa(config)# show run access-list
access-list SIP-OUTSIDE-IN extended permit object-group SIP-PROTOCOLS object-group SIP-EXTERNAL object-group SIP-INTERNAL

ciscoassa(config)# show access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list SIP-OUTSIDE-IN line 1 extended permit object-group SIP-PROTOCOLS object-group SIP-EXTERNAL object-group SIP-INTERNAL (hitcnt=0) 0xc506ba7b
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.1 host 192.168.1.6 eq sip (hitcnt=0) 0xa581f8ec
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.1 host 192.168.1.7 eq sip (hitcnt=0) 0xe8109d83
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.2 host 192.168.1.6 eq sip (hitcnt=0) 0xcd331db8
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.2 host 192.168.1.7 eq sip (hitcnt=0) 0x401975dd
  access-list OUTSIDE_IN line 1 extended permit tcp host 208.7.8.1 host 192.168.1.6 eq sip (hitcnt=0) 0x22d073e8
  access-list OUTSIDE_IN line 1 extended permit tcp host 208.7.8.1 host 192.168.1.7 eq sip (hitcnt=0) 0x08a4966a
  access-list OUTSIDE_IN line 1 extended permit tcp host 208.7.8.2 host 192.168.1.6 eq sip (hitcnt=0) 0x9747ecca
  access-list OUTSIDE_IN line 1 extended permit tcp host 208.7.8.2 host 192.168.1.7 eq sip (hitcnt=0) 0x41479753
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.1 host 192.168.1.6 range 5000 60000 (hitcnt=0) 0x98df0f49
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.1 host 192.168.1.7 range 5000 60000 (hitcnt=0) 0x3542d660
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.2 host 192.168.1.6 range 5000 60000 (hitcnt=0) 0xcbde7f33
  access-list OUTSIDE_IN line 1 extended permit udp host 208.7.8.2 host 192.168.1.7 range 5000 60000 (hitcnt=0) 0x2b5bdc5b