Newbie practicing ASA VPN on PT

Hello, /networking

newbie here practicing on PT.

so here's the scenario, I've got a remote network that i want to connect to the HQ via VPN. on my Remote network I'm using a router as the edge and HQ is an ASA 5505. so I've tried checking the connection from my HQ (VLAN 10 192.168.1.10) to the Remote network(192.168.8.0) without the VPN and it works. but when I'm testing icmp from a VLAN that is map to the VPN ACL. my packets get stuck at the ASA. Below is my code for my ASA and Remote Router. I have not setup any NAT for this as per my understanding I should only do NAT if my networks overlap. Correct me if I'm wrong

REMOTE#sh run Building configuration... Current configuration : 1549 bytes ! version 15.3 no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption ! hostname REMOTE ! ! boot system flash c1900-universalk9-mz.SPA.155-3.M4a.bin ! ! ! ! ! ! ip cef no ipv6 cef ! ! ! ! license udi pid CISCO1941/K9 sn FTX15241TIS license boot module c1900 technology-package FoundationSuiteK9 ! ! ! crypto isakmp policy 10 encr aes authentication pre-share group 2 ! crypto isakmp key cisco12345 address 209.165.200.230 ! ! ! crypto ipsec transform-set VPN_SET esp-aes esp-sha-hmac ! crypto map VPN_MAP 10 ipsec-isakmp set peer 209.165.200.230 set transform-set VPN_SET match address VPN_ACL ! ! ! ! ! ! spanning-tree mode pvst ! ! ! ! ! ! interface GigabitEthernet0/0 ip address 1.1.1.1 255.0.0.0 duplex auto speed auto shutdown ! interface GigabitEthernet0/1 ip address 192.168.8.1 255.255.255.0 duplex auto speed auto ! interface Serial0/0/0 ip address 209.165.200.226 255.255.255.252 crypto map VPN_MAP ! interface Serial0/0/1 no ip address clock rate 2000000 ! interface Vlan1 no ip address shutdown ! ip classless ip route 0.0.0.0 0.0.0.0 209.165.200.225 ! ip flow-export version 9 ! ! ip access-list extended VPN_ACL permit ip 0.0.0.0 255.255.255.0 192.168.1.0 0.0.0.255 permit ip 0.0.0.0 255.255.255.0 192.168.2.0 0.0.0.255 permit ip 0.0.0.0 255.255.255.0 192.168.3.0 0.0.0.255 permit ip 0.0.0.0 255.255.255.0 192.168.4.0 0.0.0.255 permit ip 0.0.0.0 255.255.255.0 192.168.5.0 0.0.0.255 ! ! ! ! ! line con 0 ! line aux 0 ! line vty 0 4 login ! ! ! end 

..

ciscoasa#sh run : Saved : ASA Version 8.4(2) ! hostname ciscoasa names ! interface Ethernet0/0 switchport access vlan 3 ! interface Ethernet0/1 switchport access vlan 2 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 no nameif no security-level no ip address ! interface Vlan2 nameif inside security-level 0 ip address 192.168.5.1 255.255.255.0 ! interface Vlan3 nameif outside security-level 0 ip address 209.165.200.230 255.255.255.252 ! object network NET_REMOTE subnet 192.168.8.0 255.255.255.0 object network NET_VLAN10 subnet 192.168.1.0 255.255.255.0 object network NET_VLAN20 subnet 192.168.2.0 255.255.255.0 object network NET_VLAN30 subnet 192.168.3.0 255.255.255.0 object network NET_VLAN40 subnet 192.168.4.0 255.255.255.0 object network NET_VLAN50 subnet 192.168.5.0 255.255.255.0 ! route outside 0.0.0.0 0.0.0.0 209.165.200.229 1 route inside 192.168.1.0 255.255.255.0 192.168.5.2 1 route inside 192.168.2.0 255.255.255.0 192.168.5.2 1 route inside 192.168.3.0 255.255.255.0 192.168.5.2 1 route inside 192.168.4.0 255.255.255.0 192.168.5.2 1 ! access-list VPN_ACL extended permit ip object NET_VLAN20 object NET_REMOTE access-list VPN_ACL extended permit ip object NET_VLAN30 object NET_REMOTE access-list VPN_ACL extended permit ip object NET_VLAN40 object NET_REMOTE access-list VPN_ACL extended permit ip object NET_VLAN50 object NET_REMOTE ! ! ! ! ! ! ! ! ! telnet timeout 5 ssh timeout 5 ! dhcpd auto_config outside ! dhcpd enable ! ! ! ! crypto ipsec ikev1 transform-set VPN_SET esp-aes esp-sha-hmac ! crypto map VPN_MAP 10 match address VPN_ACL crypto map VPN_MAP 10 set peer 209.165.200.226 crypto map VPN_MAP 10 set ikev1 transform-set VPN_SET crypto map VPN_MAP interface outside crypto ikev1 enable outside crypto ikev1 policy 10 encr aes authentication pre-share group 2 ! tunnel-group 209.165.200.226 type ipsec-l2l tunnel-group 209.165.200.226 ipsec-attributes ikev1 pre-shared-key cisco12345 ! ciscoasa#sh cry ciscoasa#sh crypto ipsec sa There are no ipsec sas ciscoasa#sh cry ciscoasa#sh crypto isa ciscoasa#sh crypto isakmp sa There are no IKEv1 SAs There are no IKEv2 SAs ciscoasa# 

did I mess up the configuration? or is it just a newbie mistake of forgetting some configuration?

PS. I've set the sec level of the inside and outside Interface of the ASA so i can test the vpn connections first.

​

​

Why do IOT devices use Telnet? is it CPUs?

The Mirrai attacks in 2016/17 were largely successful because of the over-reliance of IOT devices using Telnet for remote-admin. I'm writing an essay for uni which touches on this topic, and I'm wondering if it would be accurate for me to say that the IOT devices use of Telnet, is because of the CPU load which would be required to use an encrypted protocol such as SSH.

If not; what is the reason for using such an outdated protocol? sheer incompetence?

Calculating uptime

We are trying to set goals and standards for next year. One of the goals I would like to set is at least 3 9 uptime for network availability.

We have a single data center with 13 remote locations that connect back to the data center.

What is the best way to calculate network uptime across these locations as it is often only 1 site that goes down?

True or false: an Ethernet interface with no learned MAC addresses will egress zero unicast traffic.

I want to say that's always true, or are there exceptions?

Cisco SMB Hardware Recommendations

Hi all,

​

EDIT: Not necessarily from their SMB line, for a company of let's say 100 users.

Currently operate 2 locations, each with 1x SG350X-48MP doing DHCP. One location is an office which has an RV345 above the switch, the other location has an 892FSP above the switch. I really like the SG350x and haven't had any issues, other than one dying the other day...not sure what happened but that's for another post. Anyhow, soon the second (hq) building will be completed and the locations will be combining into a 2 building campus with fiber between. I will move the 892fsp to the main building as well as installing about 160-170 ports, was planning on doing this with 4 stacked SG350X-48MP switches. However, I believe I would need all the SFP+ ports to stack them. Once the two buildings are connected there will be around 50 computing users between the two. 80 or so employees total with associated personal wireless devices.

​

We are also using WAP581 access points. Also super happy with them, blazing fast. However, the Single Point Setup functionality only supports I believe up to 16 WAPs in a cluster. We will have a third building up in a year or so and will definitely be above 16 so I don't want to switch then, I'd rather switch now, since we may end up going above 16 anyways with just this second building.

1. What would be the best way to connect fiber between the two buildings - switch to 4 switch stack?
2. Would you recommend a different Cisco switch that is 48 Ports of at least PoE+ in the same price range (~$1700)?
3. What Cisco WAP would you recommend? The WAP581 is only about $320, don't want to go too far above that.

TIA.

Certificate management?

Hello, /networking.

How do you all manage your SSL certificates so that you have them all in one place, know when they expire, protect the keys, etc.?

I really don’t want to mess with Excel spreadsheets. Surely there’s some great app/service that handles all that.

Any good recs?

Faxing problems. SIP trunks, shoretel, and a Multitech faxfinder

We currently cannot send or receive faxes. We have a Multitech FaxFinder-240IP-2 fax server appliance paired with a ShoreTel phone system (v. 14.2). Here is what we know: • When an incoming fax arrives, our provider sends it to our SIParator device which routes it to our ShoreTel PBX. • Once it’s handed to ShoreTel, its routed over a vtrunk via “off system extension” to the FaxFinder appliance. • It reaches the FaxFinder appliance correctly, but gets hung up at “negotiating” and the call/fax fails to complete. The error descriptions in the logs are generic and provide little to no detail on a possible solution. I’m happy to provide Wireshark packet captures that we’ve gathered while troubleshooting. Any help would be greatly appreciated.

Cisco Nexus 9000 QSFP to SFP+ 1470nm

We are buying a 10Gbit wavelength from our ISP and want connect that to our existing Nexus 9000-series switch. We have some QSFP ports on the Nexus switch that we wanna use. Is there any adapter sfp module that enables us to running 10G?

The ISP is are giving us 1470nm 40km on one side and 1310nm 20km on the other side. The speed is 10G.

Small Office Network. Netgear VLAN, HPE 1950-12XGT-4SFP+

I've recently joined small-ish company and now have the pleasure to also be partly responsible for our network, which is a pure Layer 2 network. We have a few Servers running with the usual services (smb, email, voip) but also provide 2 even smaller subcompanies with network intrastructure too (some shared services). The current network consists of mostly Netgear switches, which work reasonably well in this simple configuration, besides the occasional needed resets every few weeks/months.

I've been toying with the idea of improving our infrastructure to improve network availability and add some much needed separation. Am i correct in the assumption, that it would be best to add separate vlans for the services and look for a layer 2+/3 switch as our main switch for intra-vlan routing?

If we have a shared voice vlan, does this mean i have to hand over vlan trunk to their switch. We're also responsible for those, but it has happened in the past that people fiddled with them, so i'd like to make sure our internal network can no longer be easily influenced by any changes in the network topology at their end. Thinking about rogue dhcp servers, loop detection, etc. Any recommendations?

We have a Netgear GS724Tv4 which appears to support vlan routing as a L3 Feature. I know we should probably be looking for a more enterprise grade solution, but does anyone have experience with netgear VLAN routing, any known problems with those (i vagely remember reading about performance issues)?

As an alternative, i'm also considering the HPE 1950-12XGT-4SFP+ as a main switch , which peaked my interest because of it's 10G RJ45 capabilities for future upgrades (bandwidth increase to file server and access switches), does anyone have one of those running in a similar configuration?

I also remember reading that 10Gbit can be run over Cat 5e/6 for shorter runs, any oppinions or experiences in that department?

CiscoASA5505 - New WAN IP - Windows SBS DNS not working

Hello:

Today I had to install a new ISP into a Cisco 5505 for a remote office of ours...

Tunnel is up passing Phase1 and Phase2. I can SSH into the new external IP all looks good from a networking standpoint *I believe.

However DNS from a Windows SBS server is not working. It was not touched before this cutover so the only change was to the WAN IP on the 5505. We can ping 8.8.8.8 from the users PCs but unable to hit google.com etc.. We cannot ping 8.8.8.8 from the SBS server.

The SBS was setup with the DNS to point to itself inside its NIC then the forwarders were blank in the admin controls. Again nothing was changed other then the WAN IP on the firewall.

Any help guidance would be greatly appreciated.