Security

XDR: Learn how to activate a product instance

Activating a product instance Once a subscription has been claimed and its start date has been reached, you can activate the products in the subscription. If there is an existing product instance activated in the current enterprise, you can choose t...

OpenDNS is not working

Hello, I was wondering that my OpenDNS is not working starting from 10 October, 2026.I added my office public ip in OpenDNS and redirect dns in my router.Internet is working but any filtering website are not work. All filtering website are open and c...

ISE Secondary node, Unable to login via CLI after upgrade

Hello,We have an ISE two-node deployment.Upgraded from 3.3 patch 12 to 3.4 patch 7.Trying to login to check the running services. I'm unable to login via CLI to the secondary. Access is denied.CLI and GUI access is working on the PAN. GUI is accessib...

Duo Proxy Account Lockouts

HelloI'm running into an issue of random user account lockouts with the only information I can see is via the Single Sign on Report.  The only information I am getting is Denied Invalid Credentials (5 in a row) and the caller lockout computer is the ...

Passwordless Auth - Yubikey

 It has been reported in other posts that the "Windows Hello" (webauth) type authentications are disabled automatically when Cisco Duo for login is installed. I was wondering what the future roadmap looks like for this feature. It has also been said ...

Entra ID Dynamic Group can be used in ISE Teap Authorization Rule ?

If I use Dynamic AD Group to be used as part of ISE TEAP Authorization Rule ( Dynamic AD group is at Microsoft Entra ) should this be a problem ? In other words does ISE support the use of Dynamic AD Entra AD Group ?

Reviewing the final milestones for the SCA Convergence into XDR

Duo for macOS 3.0.1 Released 2026-10-20

Happy Office Chocolate Day! I need to check the kitchen to see if we're celebrating at the Duo office, but first, here are the release notes for Duo downloadable software released today.Duo Authentication for macOS 3.0.1Adds support for macOS 27 (Gol...

ISE VM license for AWS

I have ISE deployment on prem using physical servers.  Would it be possible to add one or a few servers in AWS and join them to the existing deployment?  I understand I need to get a VM license for each instance in AWS, but would I be able to run the...

DUO service requires restart almost every Monday.

I use DUO with radius for my VPN users and the phone prompt has worked for several years. In the last 2 months approximately I have had to restart the DUO service from the Proxy Manager almost every Monday morning to get DUO to prompt for just VPN us...

FTD Remote Access VPN SAML w/ 2nd connection using local certificates

Currently have an FTD setup and managed by an FMC with a publicly signed certificate assigned and in use for remote access users with a SAML integration.  That is working without any issues.  I now wanted to add a 2nd connection method for some mobil...

Secure Client NAM prompt for credentials

Hi, we have implemented EAP-FAST with machine (eap-tls) and user authentication (MSCHAP). Secure client 5.0.05040. Everything works fine but one user is reporting that sometimes when he logs in, the secure client shows him error: An authentication er...

Question about renewing a public RA VPN cert from FMC

Hello,Basic question about renewing a public RA VPN certificate from the FMC. Since the Certificate Authority Root cert is allready installed, do I still need to include the CA part everytime we want to enroll a new identity certificate? The picture ...

FTD Decryption CPU Peformance Estimator

Hello Cisco Community,I want to ask, I plan to use decryption on FTD special for social media applications to block any file that going to be uploaded. So I tried to use firewall performance estimator (https://ngfwpe.cisco.com/) and it's confusing. I...

Stale cached A record for one domain (TTL 0) — can it be purged?

Hi,I own northernriversremovals.com.au and recently moved it to new hosting. Most resolvers picked the change up, but OpenDNS still returns the previous hosting address at TTL 0 across nearly every CacheCheck location, and the CacheCheck refresh does...