Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Marvin Rhoads
Marvin Rhoads
.jpg){kind=icon}
Hall of Fame Master
CCNP Security (CCIE Sec. written June 2017, one lab attempt so far!), Fire Jumper, Cisco Support Community Hall of Fame and VIP x6. Passionate about solving problems in network security and helping others learn to do the same.
Recent Badges
Stats
Member since
06-28-2001
16375
Posts
15543
Helpful
3073
Solutions
Created by
Marvin Rhoads
in VPN and AnyConnect
Marvin Rhoads
in VPN and AnyConnect
09-22-2019
04:54 AM
09-22-2019
04:54 AM
The University may have changed their VPN policy to not allow "split tunnel" (i.e. sends only University-bound traffic over the VPN and allows you to continue to use your local Internet otherwise).
You can check this while connected by opening the AnyConnect user interface in your system tray and clicking on the "gear" icon. In the resultant details box, look at the "route details" tab associated with the VPN. If it says 0.0.0.0/0 then they are forcing all traffic to their network. Normally when we do that we allow the remote network to "hairpin" your traffic out to the Internet but it's optional.
... View more
09-21-2019
08:43 PM
If you want to segment the server in a DMZ then all of it's ingress and egress traffic should be controlled by the firewall's security settings.
While you could put secondary interfaces on it or possibly cobble together a solution with switch-based ACLs, either would greatly reduce the effectiveness of (or even negate) the firewall's security controls - especially if you are availing yourself of IPS (Firepower) features
... View more
09-21-2019
03:39 AM
If the server sits in the DMZ then by default you can access if from inside. If you have an ACL already on your inside interface then add an entry for the DMZ server to it explicitly.
Also by default, the DMZ server cannot initiate communications to the inside. So if the server is compromised, that segmentation reduces your attack surface as desired.
... View more
09-21-2019
03:35 AM
It pulls the info from the chassis. Log into the chassis (not the ASA logical device) and change the system settings there.
https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/fxos221/web-guide/b_GUI_FXOS_ConfigGuide_221/system_administration.html
... View more
Created by
Marvin Rhoads
in Intrusion Prevention and Detection Systems (IPS - IDS)
Marvin Rhoads
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-21-2019
03:10 AM
09-21-2019
03:10 AM
I was saying that sometimes the customer insists in IPS only. At the end of the day they may make decisions different from my recommendations. There are few reasons for needing a dedicated IPS such as the classic series. If that's their choice then so be it. I usually advise otherwise though.
Those links you mentioned are marketing documents from 2+ years ago. I try to focus on technical and functional requirements and not debate marketing presentations.
... View more
09-20-2019
06:50 AM
The error in the log indicates the wrong upgrade file is being used.
If you've confirmed the file is the one I linked then I would suggest opening a TAC case for further investigation.
... View more
09-20-2019
06:10 AM
Are you upgrading from cli? If so, why that and not from FMC?
The file for an ASA 5585-X SSP-10/20/40/60 would be "Cisco_Network_Sensor_Patch-6.0.1-29.sh", found here:
https://software.cisco.com/download/home/286271178/type/286277393/release/6.0.1
But from your FMC snippet I think you want to move up to 6.1.
FMC from version 6.1 up to the latest (currently 6.4.0.5) can manage version 6.1+ sensors.
... View more
Created by
Marvin Rhoads
in Firewalls
Marvin Rhoads
in Firewalls
09-20-2019
04:53 AM
09-20-2019
04:53 AM
No it does not.
When you run an ASA logical device on a Firepower appliance it does not support any service module functionality (such as any type of IPS).
If you need IPS then you must run an FTD logical device or else use a separate appliance.
... View more
Created by
Marvin Rhoads
in Firewalls
Marvin Rhoads
in Firewalls
09-20-2019
04:50 AM
09-20-2019
04:50 AM
The license type doesn't change.
You configure an ASA pair with multiple contexts to get Active-Active operation. Without using the multiple context feature you are limited to Active-Standby.
... View more
Created by
Marvin Rhoads
in Intrusion Prevention and Detection Systems (IPS - IDS)
Marvin Rhoads
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-20-2019
04:24 AM
09-20-2019
04:24 AM
Very few new installations will use the classic series.
Most of the larger vendors have differences in their product lines for various reasons - compatibility with older products, some features customers rely on have not been ported to new architecture, operational models that are slow to adopt new products etc.
For a dedicated IPS with absolutely no need for other FTD features some (but fewer than before) might still select a new classic series. They might cost a bit less, all other things being equal. On the other hand, they are limited should the organization decide later they want the non-IPS features.
... View more
Created by
Marvin Rhoads
in Firewalls
Marvin Rhoads
in Firewalls
09-19-2019
09:05 PM
09-19-2019
09:05 PM
In 6.3, Firepower introduced the following feature (but ONLY on Firepower Device Manager):
"The deployment window has changed to provide a clearer view of the pending changes that will be deployed. In addition, you now have the option to discard changes, copy changes to the clipboard, and download changes in a YAML formatted file. You can also name deployment jobs so they are easier to find in the audit log."
https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-get-started.html?#task_BEE4E37389B64E518EE91FF3824476A9
Prior to that you had to manually undo anything you changed click-by-click.
Unfortunately in FMC we still have that limitation (even with 6.4.0.5). Hopefully 6.5 will offer the feature but we'll see...
... View more
Created by
Marvin Rhoads
in Firewalls
Marvin Rhoads
in Firewalls
09-19-2019
08:34 PM
09-19-2019
08:34 PM
Try loading the latest interim build - 9.12(2.4).
There is a bug that you may be hitting:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp78232
... View more
09-19-2019
08:31 PM
You should check your Smart license portal at software.cisco.com to see an accurate and detailed view of allocated smart licenses. Looking on the end devices may not give you a complete picture.
... View more
Created by
Marvin Rhoads
in Firewalls
Marvin Rhoads
in Firewalls
09-19-2019
08:23 PM
09-19-2019
08:23 PM
ASA release 9.8(4)10 is the latest and Cisco-recommended interim build. There were some bugs in the earlier builds that have since been remedied.
Specifically:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp67392/?rfs=iqvred
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp78232
Although Cisco hasn't given it the "gold star" yet, I've had good experience with 9.10(1). Interim build 30 is the latest there and the 9.10(1) train very stable in my experience:
https://software.cisco.com/download/home/284143129/type/280775065/release/9.10.1%20Interim
... View more
Created by
Marvin Rhoads
in VPN and AnyConnect
Marvin Rhoads
in VPN and AnyConnect
09-19-2019
09:15 AM
09-19-2019
09:15 AM
Your syr-asa has :
crypto map CRYPTO-MAP 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
A matching ikev1 transform set definition is missing on nc-asa. You should have the same transform sets on both - so add it on the nc-asa side
... View more
09-22-2019
The University may have changed their VPN policy to not allow "split
tunnel" (i.e. sends only Univer...
09-21-2019
Ah you hadn't mentioned earlier that your ISP device is also the WAP.
Often you cannot put anything ...
09-21-2019
If you want to segment the server in a DMZ then all of it's ingress and
egress traffic should be con...
09-21-2019
It should be between your network and that of your provider. Your
network > Firepower > Provider equ...
09-21-2019
If the server sits in the DMZ then by default you can access if from
inside. If you have an ACL alre...
09-21-2019
It pulls the info from the chassis. Log into the chassis (not the ASA
logical device) and change the...
Created by
Marvin Rhoads
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-21-2019
09-21-2019
I was saying that sometimes the customer insists in IPS only. At the end
of the day they may make de...
Created by
Marvin Rhoads
in FirePOWER
09-20-2019
09-20-2019
When running an ASA image on a Firepower 2100 series, some things - such
as interface types allocate...
09-20-2019
The output indicates the module is up/up and an FMC manager is
configured. Have you registered the d...
09-20-2019
The error in the log indicates the wrong upgrade file is being used. If
you've confirmed the file is...
09-20-2019
AnyConnect is available for Windows, Mac OS and Linux. Features are
similar between the models but n...
Created by
Marvin Rhoads
in FirePOWER
09-20-2019
09-20-2019
Firepower OS is running over a Linux OS. If you switch to "expert" mode
you can use standard Linux c...
09-20-2019
Are you upgrading from cli? If so, why that and not from FMC? The file
for an ASA 5585-X SSP-10/20/4...
Created by
Marvin Rhoads
in Firewalls
09-20-2019
09-20-2019
No it does not. When you run an ASA logical device on a Firepower
appliance it does not support any ...
Public Statistics
| Date Registered | 06-28-2001 03:55 PM |
| Date Last Visited | 09-21-2019 11:22 PM |
| Total Messages Posted | 16,375 |
| Total Helpful Votes Received | 15543 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 25 | |
| 15 | |
| 60 | |
| 25 | |
| 10 |
.jpg "VIP Advocate"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 35 | |
| 10 | |
| 15 | |
| 5 |
Awards
Hall of Fame
Cisco Designated VIPs
2018 FirePOWER Firewalling VPN
Cisco Designated VIPs
2017 Firewalling Network Management VPN
Cisco Designated VIPs
2016 Firewalling Network Management VPN
Cisco Designated VIPs
2015 Security
Cisco Designated VIPs
2014 Network Management Security
Cisco Designated VIPs
2013 Network Management Security
Cisco Designated VIPs
2019 Firewalls, Firepower, Security
