I think it is the default QoS setting on your 3560 switch. Have your 3560 configured with "mls qos trust cos" or "mls qos trust dscp" on any interface? If no, the COS/DSCP value of every packet go into 3560 would be rewrote to 0. When all packets are treating as the same priority, the QoS become meaningless. So, have a check on current 3560 setting first. If the above command is not found, I think you don't need to enable QoS on your new C2960X. ... View more

interface XX/XX nameif inside interface YY/YY nameif outside access-list inside_inbound extended permit tcp host 10.10.10.10 host 5.5.5.5 eq 1234 access-list outside_inbound extended permit tcp host 5.5.5.5 host 10.10.10.10 eq 123 access-group inside_inbound inside in access-group outside_inbound outside in object network 10.10.10.10_Static_NAT  nat (inside,outside) static (public address for 10.10.10.10) ... View more

First, I am not sure why you are not doing what you want by either AAA server / Role Based Access Control (RBAC). But that's fine, if you insist to doing that with EEM, I could give you some information. But I did not try it, not 100% sure if it work. event manager applet model event cli pattern "clear archive log.*" sync yes occurs 1 action 010 cli command "show users | in ^\*" // * 2 vty 0 network_admin idle 00:00:00 10.1.1.1 // you simply grep the username from the above output by regex. I did NOT test the below regexp, you may need to fix it. action 020 regexp "^\*[ \t]+[0-9]+ (vty|con) [0-9]+[ \t]+([^\s]+)[ \t]+idle.*" "$_cli_result" match line username action 030 if $username eq "networkadmin" action 040 set_exit_status "1" action 050 else action 060 syslog facility "SUPERUSER" msg "Unauthorized, event will be reported" action 070 set _exit_status "0" ... View more

You would also want to check memory usage at the peak hour. For an extreme case, if your ASA has used 99% memory during peak hour, then you should not increase the TCP timeout value because it increased the chance of memory used up. I think you should focus more customer's requirement: Do they really require an idle TCP session over an hour? Have they encountered any issue during file transmission? ... View more

Hello, You cannot block other SSID, but you could jam the rogue AP by wireless controller. However, it may bring some LEGAL ISSUE that you should really think before act. If I were you, I would check the RSSI of the rogue AP to estimate whether it is installed within your facility or not. And try to locate it, and remove it. If it is not within your facility, you better ignore it if there is no impact to your users. Please refer to the previous community post: https://community.cisco.com/t5/other-wireless-mobility-subjects/rogue-ap-question/td-p/1379392 ... View more

Hello, Not sure UDLD aggressive mode could help in your case. If the link state of the port is determined to be bi-directional and the UDLD information times out while the link on the port is still up, UDLD tries to re-establish the state of the port. If not successful, the port is put into the errdisable state. ... View more

Hi, You may refer to the configuration guide: >>> set connection timeout https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/conns_connlimits.html But please make sure if your customers really need the timeout setting to be set to higher. Because the TCP session timeout timer will keep resetting if there is any communicate on that TCP session. Unless your customer will open a TCP session, and leave it idle over an hour, otherwise, you don't have to set the timeout value. Technically speaking, it is expected that more TCP session data will be kept on ASA, and causing higher memory usage. However, if you have enough memory for your ASA, I think you don't need to worry about it. ... View more

If you have configured your workstation to update DNS server as mentioned previously, it should works and no configuration is needed on ASA. An other option is to configure Dynamic DNS setting on ASA to update your Active Directory DNS. But you will have to allow "nonsecure dynamic updates" on your AD server. Either one should work, and I would prefer the first option because it's all related to Microsoft product only, no any integration between Cisco ASA and MS AD servers is needed. Also, if you use option 1, you don't have to allow "nonsecure dynamic updates" on your AD server which might reduce the security level. ... View more