Dear Forum! I would like to ask You for a quick help regarding ASA5585-SSP-IPS60 high availability: Does anybody have experience with IPS60 SSM module in ASA5585 if shutting down the IPS module with the "hw-module module 1 shutdown" command has any impact of the ASA redundancy group? So for example, if I issue the "hw-module module 1 shutdown" for the IPS SSM module on an ASA which has an active redundancy group running on it, can I expect failover to the another ASA node because of the shutdown status of the IPS module? Many thanks in advance! Best Regards, Belabacsi ... View more

Dear Community! I'm new to ACS version 5 family and I would like to ask if anybody has already experienced the following strange issue with ACS version 5.3.0.40 GUI: I have several AAA clients already defined in the " Network Devices and AAA Clients" menu and I need to create a new device filter in the "Policy Elements >  ... >  Session Conditions >  Network Conditions >  Device Filters" menu. But unfortunately after clicking "Create" button, I cannot use any types of device filters :-( After filling in the device IP / name / or group and clicking "Go" button, nothing happens, the I always get no results, so I cannot select any device to be included into the device filter. For example, I have an IPS device named "DC1IPSC010" and I'm trying to add this device to a new device filter with no luck. What I have already tried: Using full text which equals to DC1IPSC010. Using partial text containing IPS. Using Internet Explorer 9-10-11 Using FireFox v4.x and the latest v32 versions Clearing my Java temporary files cache Using different operating systems My installed Java version is Java 1.7 update 51. Has anybody experienced the same issue with this version? Are there any workarounds for this? Many thanks in advance! BR Bela     ... View more

Dear Community! Please help me solving a problem regarding ACE management access. Our ACE web GUI access (not ANM, the own device manager) has become very slow and unresponsive recently (using IE browser). The CLI access and the ACE performance are OK, I think only the HTTP management service is affected. Refer to the exact device parameters below: ACE-4710-0.5F-K9 appliance system:    Version A3(2.6) installed license: ACE-AP-500M-LIC ACE-AP-C-100-LIC ACE-AP-OPT-50-K9 stateful HA using FT group with another identical device at 2 site (#A and #B) 4 user context; each of them active az #A side average CPU usage ~10-12% The "show processes" command output shows several httpd process, I think it is not normal :-( 15362      S  b7e726e1            1     -  httpd 15363      S  b7e726e1            1     -  httpd 15364      S  b7e726e1            1     -  httpd 15365      S  b7e726e1            1     -  httpd 15366      S  b7e726e1            1     -  httpd 15367      S  b7e726e1            1     -  httpd 15368      S  b7e726e1            1     -  httpd 15369      S  b7e726e1            1     -  httpd 15370      S  b7e726e1            1     -  httpd 15371      S  b7e726e1            1     -  httpd 15372      S  b7e726e1            1     -  httpd 15373      S  b7e726e1            1     -  httpd 15374      S  b7e726e1            1     -  httpd 15375      S  b7e726e1            1     -  httpd 15376      S  b7e726e1            1     -  httpd 15377      S  b7e726e1            1     -  httpd 15378      S  b7e726e1            1     -  httpd 15379      S  b7e726e1            1     -  httpd 15380      S  b7e726e1            1     -  httpd 15381      S  b7e726e1            1     -  httpd 15382      S  b7e726e1            1     -  httpd ... Does anybody have any experience about this? Any help would be greatly appreciated :-) Thanks and BR Belabacsi ... View more

Dear Community! I would like to create a "filtered DHCP pool", which can assign an IP address regarding relay agent forwarding IP address. So, two remote router has an ip-helper-address configured pointing to the DHCP server router interface. If a DHCP request arrives from remote router #A, we should accept DHCP request and assign an IP address to the remote host. If a DHCP request arrives from another forwarder IP address, the DHCP should reject the request. Could anyone help me configuring this DHCP server "filtering"? Thanks and Best Regards, Belabacsi ... View more

Dear Community! I would like to configure Cisco ACE 4710 CLI and WebAmin to use ACS v4.2 TACACS+ authentication and accounting feature. After found a Cisco document, which describes ACE AAA features ( http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/security/guide/aaa.html ), I have setup all configuration parameters mentioned in this document, everything seems to be OK. But... I have a TACACS+ group named "Network Administrators", which has privilege level 15 option enabled, so admins do not have to type enable password when authenticating. After setting up ACE AAA, the prvilege level 15 option stops working, while logging in Cisco routers: after authentication, the user remains in privilege level 1. Logging in Cisco switches seems to be OK, stepping immediately to level 15 as usual. I tried upgrading IOS in a router, but no luck... Does anybody have any experiance about this "bug"? Thanks in advance! Regards, Belabacsi @ Budapest, Hungary ... View more

Dear Community! I would like to use a Cisco router as simple web-server hosting an automatic proxy configuration script file. Is is possible to configure HTTP AAA to allow access without username / password authentication? See the test configuration below: ! aaa new-model aaa authentication login CISCO_HTTP_AUTH none aaa authorization exec CISCO_HTTP_AUTH none aaa authorization commands 15 CISCO_HTTP_AUTH none ! access-list 99 permit host [***Host IP***] ! ip http server ip http access-class 99 ip http authentication aaa login-authentication CISCO_HTTP_AUTH ip http authentication aaa exec-authorization CISCO_HTTP_AUTH ip http authentication aaa command-authorization 15 CISCO_HTTP_AUTH no ip http secure-server ip http path flash: ! Router#dir Directory of flash:/     1  -rw-    22855564                    <no date>  [*** IOS Image ***]      2  -rw-        3877   Sep 2 2010 13:15:09 +02:00  ipproxy 33030140 bytes total (10170568 bytes free) Router# Thanks in advance! Regards Belabacsi ... View more