Dont they just mean the snmp v1/2 community string? Thats how it sounds to me.   The guide (from memory) states that it needs SNMP and Telnet/SSH, however ideally should be SNMPv3 and SSH and locked down to permitted management hosts plus the CSP-C. You also need to ensure this communication is permitted through any firewalls.   I dont knwo where it is specifically on the UCS sorry but a bit of digging around you should find SNMP. ... View more

Thanks Rafal, Are there any compatibility guides/notes? We may build a machine here to ship out to customers but don't have any hardware in mind just yet. ... View more

The plot thickens! So, forgotting the idea of disabling it from the console completely, i dont think i can do this. The 2 servers in the group should be marked as "down" and then the LOCAL method is used. This works but.. they immediately come back up after the command has finished. so i have tried to add the following command under the server group: "reactivation-mode depletion deadtime 50" the way i understand this is that it will work through the servers in the group, if they are all down then it reactivates them. This is what im seeing, but, the "deadtime 50" should keep them down for 50 minutes. BUT IT DOESNT WORK!!! ... View more

I have already created a method list as per below: "aaa authorization command ACS LOCAL" Unless i misunderstand what a method list is. The above "list" performs command authorization as per policies on our ACS, if the ACS is not responding then it uses the local authorization sets. This already works just fine, however the delay that is caused when every command needs to look at both our ACS servers prior to looking at the local authorization sets is a bit annoying, especially if you were trying to troubleshoot an issue and under a great deal of pressure. In our lab, we adjusted the timers down to 1 second, it takes between 3 and 4 seconds if the primary ACS is not responding for the command to be authorised. So i assume in our real network, which has 2 ACS servers its going to take at least 7 seconds to respond and that doesnt take into account the secondary ACS is over a WAN link. Im thinking that if we have a problem with our network, waiting 7 seconds after every command will be unbearable. ***UPDATE*** By setting the "max-failed-attempts" to 1 on the server group it marks the server as "down" a lot quicker, however this could introduce issues. Is there a way to leave it at the default (3 attempts) and ensure the server is kept as "marked down" untill it actually comes back up, bit of debug below: ASA1(config)# sh run aaa-server Marking server 192.168.2.106 down in servertag ACS aaa-server ACS protocol tacacs+ max-failed-attempts 1 aaa-server ACS (inside) host 192.168.2.106 timeout 1 key ***** aaa-server ACS (inside) host 192.168.2.107 timeout 1 key ***** ASA1(config)# Marking server 192.168.2.107 down in servertag ACS Marking server 192.168.2.106 in server tag ACS Up Marking server 192.168.2.107 in server tag ACS Up AAA_BindServer: No server found ERROR: No error As you can see, it marks the servers back up immediately and 192.168.2.107 doesnt exist! ... View more

CBAC is configured so the external ACL is pretty locked down. Only the static nat traffic is permitted through, as well as ESP and ISAKMP. So the "deny" will be catching anything else. Although i usually configure some BOGON filters, just not in this case. No source verify. For an outbound session, How will the router decide which MAC address to forward traffic to? The first one it sees in the table? Im not exactly sure how this sharedband works but i believe its aggregated somewhere in the shareband network, or so their documentation states. ... View more