Cisco ASA useful commands
There are thousands of commands available on the Cisco ASA. I found some of the commands very useful when troubleshooting.
1. Removing a tunnel-group
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
ikev1 pre-shared-key lksdjflksd565glmfb
ASA (config)# clear configure tunnel-group 1.1.1.12. Viewing a list of Remote access VPN users
ASA# show vpn-sessiondb anyconnect | incl U
Username : user1 Index : 6787
Username : user2 Index : 87653. Displays information about a particular user
ASA# show vpn-sessiondb anyconnect filter name user1
Session Type: AnyConnect
Username : user1 Index : 6787
Assigned IP : 10.10.1.10 Public IP : 1.1.1.1
Protocol : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License : AnyConnect Essentials
Encryption : AnyConnect-Parent: (1)none SSL-Tunnel: (1)AES256 DTLS-Tunnel: (1)AES256
Hashing : AnyConnect-Parent: (1)none SSL-Tunnel: (1)SHA256 DTLS-Tunnel: (1)SHA1
Bytes Tx : 3894551326 Bytes Rx : 1305056771
Group Policy : GRP-POLICY. Tunnel Group : RA-VPN
Login Time : 16:50:12 BST Tue May 7 2020
Duration : 0d 8h:26m:44s
Inactivity : 0h:00m:00s
VLAN Mapping : N/A VLAN : none
Audt Sess ID : 00000000019e9025eb16f50
Security Grp : 10:Sales 4. View the IPsec SAs built between peers.
The show crypto ipsec sa command shows the IPsec SAs that are built between the peers. The encrypted tunnel is built between IP addresses 2.2.2.2 and 1.1.1.1for the traffic that flows between the networks 10.10.1.0 and 10.20.1.0. You can also see the two ESP SAs built for the inbound and outbound traffic.
ASA/act/sec# show crypto ipsec sa peer 1.1.1.1
peer address: 1.1.1.1
Crypto map tag: map, seq num: 10, local addr: 2.2.2.2
access-list VPN-ACL extended permit ip 10.10.1.0 255.255.255.0 10.20.1.0 255.255.255.0
local ident (addr/mask/prot/port): (10.10.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.20.1.0/255.255.255.0/0/0)
current_peer: 1.1.1.1
#pkts encaps: 16905, #pkts encrypt: 16905, #pkts digest: 16905
#pkts decaps: 16906, #pkts decrypt: 16906, #pkts verify: 16906
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 16905, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 2.2.2.2/4500, remote crypto endpt.: 1.1.1.1/4500
path mtu 1500, ipsec overhead 82(52), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: CEFTYUBA
current inbound spi : CTYCBHYJ5. ping tcp
This command allows the ASA device to send any TCP packet (TCP SYN) from any source IP to any destination IP on any port. This is very handy for troubleshooting. In this example, I'm testing connectivity from 10.10.1.10 to example.net (93.184.216.34) on port 80
ping tcp $source_interface $dest_ip $dest_port source $src_ip $ $src_portASA# ping tcp inside 93.184.216.34 80 source 10.10.1.10 25000
Type escape sequence to abort.
Sending 5 TCP SYN requests to 93.184.216.34 port 80
from 10.10.1.10 starting port 25000, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 69/70/73 ms6. Find the name of an object for 10.1.1.1
ASA# show running-config object network in-line | i 10.10.1.1
object network web-server1 host 10.10.1.1Note - in-line is used to view the output in one line
ASA# show run object network ?
in-line display the output in one line
| Output modifiers
<cr>7. View the contents of an object
ASA# show run object id web-server1
object network web-server1
host 10.10.1.18. View the contents of an object group
ASA# show run object-group id public-servers
object-group network public-servers
network-object host 10.10.1.1
network-object host 10.10.1.29. packet-tracer utility
You can use packet-tracer command to identify whether traffic is able to traverse through the firewall.
ASA# packet-tracer input $source_interface $traffic_type $src_ip $src_port $dest_ip $ dest_port
ASA# packet-tracer input inside tcp 10.10.10.10 25000 8.8.8.8 8010. View active IP-SGT Bindings
You can use show cts sgt-map command to find the sgt-tag assigned to a specific IP via ISE.
ASA# show cts sgt-map
Active IP-SGT Bindings Information
IP Address SGT Source
================================================================
10.10.1.10 11 SXP
10.10.15.11 13 SXP
10.10.50.12 22 SXP
10.10.12.16 17 SXP11. View detail information about Remote access VPN user such as OS and AnyConnect client version
Note - You can remove the filter to view the entire output.
ASA# show vpn-sessiondb detail anyconnect filter name user1 | incl Client
Client OS : mac-intel
Client OS Ver: 10.13.6
Client Type : AnyConnect
Client Ver : Cisco AnyConnect VPN Agent for Mac OS X 4.7.04056
Client OS : Mac OS X
Client Type : SSL VPN Client
Client Ver : Cisco AnyConnect VPN Agent for Mac OS X 4.7.04056
Client OS : Mac OS X
Client Type : DTLS VPN Client
Client Ver : Cisco AnyConnect VPN Agent for Mac OS X 4.7.04056
Thanks for reading
As always, your feedback and comments are more than welcome.