Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About rosarra
Stats
Member since
06-13-2004
18
Posts
0
Helpful
0
Solutions
Created by
rosarra
in Policy and Access
in Policy and Access
08-18-2016
08:04 AM
08-18-2016
08:04 AM
I'm trying to configure in my lab a simple AAA rule to allow internet web server access via TACACS+ authentication (see attached the configuration).
This configuration seems to work fine when the authentication prompt is displayed using http while the https login page seems to have some problems related to a certificate error recognized from the browser with the message: SSL_ERROR_BAD_MAC_READ
It looks like the https login page redirect is not allowed due to a mismatch server address certificate.
Any advice and suggestions will be greatly appreciated.
... View more
Labels:
01-18-2016
07:24 AM
Hi Rishabh,
thank you for your answer
After your replay I checked the ACS configuration looking at the privilege cmd list in Shell Command Authorization Set.
In effect I forgot to include "more" command in the shell list and after the correction the read-only access is working fine.
Thank you for you help,
Roberto
... View more
01-18-2016
05:57 AM
Hello
I tried to configure the ASDM access using the ACS Tacacs+ (v4.2) for a monitoring-only access (level 3) and read-only access (level 5). Everything works fine for monitoring access (the ASDM management interface correctly display only Home and Monitoring tab) while the read only access seems to hang during the configuration parsing phase.
In read only access when the ASDM tool start, the information banner is correctly displayed confirming that the user is not allowed to modify the ASA configuration.
Later an "Enter Network Password" window is displayed and also inserting the correct read only account information this windows is proposed continuously for about 15 time.
When the network password banner disappear, clicking the Configuration button the parsing running configuration progress bar appears but the process hangs after 77%.
Here follows the sw specification:
ASA 5516X
ASA vers. 9.4(1)
ASDM vers, 7.5(2)
Java vers. 8.66
... View more
Labels:
02-21-2014
05:33 AM
Hi Jouni, please find attached a network schema that can help to better understand my problem. From the inside network a client with the ip 10.12.1.5 is trying to reach an http server using the url solved by an external (out of the ASA) DNS. The ip destination is 4.4.5.2 (external Http server) translated to the internal Http host ip 10.112.1.20. My problem is that if I apply the ASA (8.3) static NAT I cannot use the real ip 10.112.1.20 from the other firewall interfaces because this is already used for the NAT. This is my ASA configuration: nat (INTERNAL-LAN,DMZ-PRODUCTION) source static g-INTERNAL g-INTERNAL destination static h-ext—4.4.5.2 h-int-10.112.1.20 no-proxy-arp For example from the DB server (ip 10.112.2.2) I cannot reach the real ip 10.112.1.20. Consider that on the Checkpoint firewall the NAT rule is already implemented and is working correctly only when an internal host ip try to reach the external server ip address while the real http server (10.112.1.20) ip can be used for all the other interfaces (and also from the internal lan). I hope to was clear … thx - Roberto
... View more
02-17-2014
08:44 AM
Hi Jouni, this is a good question: the EXT-DMZ Interface is also connected to internet public networks (this is an architecture limit). For this reason in some cases I need to reach the original Ip because connection is starting from the Ext Dmz hosts, in other cases I don't need to reach the orignal Ip but I need to translate the Dmz-production Ip with the external Dmz Interface Ip to reach the Internet public network. -Roberto
... View more
02-17-2014
08:15 AM
I'm trying to move my configuration from a Chekcpoint firewall to an ASA 5520 firewall. My problem is related to the rel 8.4(6) NAT features that seems quite different from the Checkpoint format. For example i n the Checkpoint firewall I've the following NAT rule: Source Destination Translated Source Translated Destination INTERNAL DMZ NETW -----> EXTERNAL DMZ NETW EXTERNAL-DMZ-IF-IP ----> Original this means that when an host (in this case included in a DMZ network) try to connect to an External DMZ network Ip the ip address is translated with the External DMZ Interface Ip This is working only when the packet is flowing from the Interna DMZ to the External DMZ and not viceversa . In my new configuration to the ASA I translated this rule using Dynamic PAT: nat (DMZ-PRODUCTION,EXT-DMZ) source dynamic g-PROD-NETWORK interface destination static g-DMZ-EXT-NET g-DMZ-EXT-NET where: DMZ-PRODUCTION is the INTERNAL DMZ NETWORK interface EXT-DMZ is the EXTERNAL DMZ NETWORK interface g-PROD-NETWORK is a group containing all the involved networks backward the DMZ-PRODUCTION g-DMZ-EXT-NET is a group containing all the involved networks backward the EXT-DMZ All is working fine when I try to reach the external DMZ from the specific production host but if I try to connect from the external DMZ to the production DMZ host (in reverse mode) I receive a Drop message: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse
flows; Connection protocol src interface_name:source_address/source_port [(idfw_user)] dst interface_name:dst_address/dst_port [(idfw_user)] denied due to
NAT reverse path failure. An attempt to connect to a mapped host using its actual address was rejected. Seems that the NAT applied on the interface is enabled also in reverse mode, so c an someone explain how I can create this easy NAT rule under Cisco ASA configuration?
... View more
Labels:
01-26-2013
12:30 AM
Solved upgrading to SPA50G 9.5.4 rel. then resetting to factory default.
... View more
01-24-2013
04:30 AM
Hello, recently I tried to configure a Cisco UC540 using two FXO interfaces and 4 Ip Phone Cisco SPA504G. The configuration was performed using the tool wizard (also if I don't much trust with this tool) and, from my point of view is a very simple and basic configuration. All the phones are correctly registered both FXO interfaces are up and I'm able to send an external call from the phone, the problem arise when I receive a call from the external path, in this case the destination phone hang and only a reboot can restart the frozen phone. Here below the UC and Phone version: Software Version UC 540 with FXO SoftwarePack: 8.6.1 IOS Image: uc500-advipservicesk9-mz.151-4.M5 CME Version: 8.6 Voicemail Version: 8.6.5 Active Locale Settings Phone Region: Italian Phone Language: Italian Voicemail Language: Italian Alternate Locale Settings Phone Region: US English Phone Language: US English Voicemail Language: None Telefoni: Cisco SPA 504G Firmware version: 7.5.2b I also submit the configuration (from the CLI) and some logs. Can anyone help me on this?
... View more
Labels:
11-26-2012
05:24 AM
We recently upgraded a Catalyst 6509 switch with a new Supervisor Module (WS-SUP2T-10G) running IOS vers. 12.2(50) SY3 After the upgrade we noticed an error using the WCCP protocol. The following log occurs everytime we enable the WCCP: Nov 24 15:22:47.306: %TUN-4-MTUCONFIGEXCEEDSTRMTU_IPV4: Tunnel4 IPv4 MTU configured 17760 exceeds tunnel transport MTU 1476 Nov 24 15:22:47.306: %WCCP-5-SERVICEFOUND: Service 10 acquired on WCCP Client 10.176.16.240 This is the show tunnel inteface output: Tunnel4 is up, line protocol is up Hardware is Tunnel Interface is unnumbered. Using address of Tunnel5 (172.16.0.1) MTU 17864 bytes, BW 100 Kbit, DLY 50000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 172.16.32.32 Tunnel protocol/transport multi-GRE/IP Key disabled, sequencing disabled Checksumming of packets disabled Tunnel TTL 255, Fast tunneling enabled Tunnel transport MTU 1472 bytes Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 output buffer failures, 0 output buffers swapped out This error is the cause of a buoncing behaviour on the internet connection using a Proxy configured with the WCCP and GRE protocol. The tunnel interface is obviously not modifiable due to the fact that is created only when the WCCP is started so no modification can be made on the MTU size. Can someone help me on this?
... View more
Labels:
05-23-2012
12:52 AM
Unfortunatly in our case there is no solution for this issue. The problem is due to an asymmetric path between the Core Siwtch and the Bluecoat Appliance. At first the switch sent the WCCP packet using the correct interface then reply to the Bluecoat using another interface blocked from the Firewall. Consider that we are using VRF on the Core Switch and WCCP is not VRF aware.
... View more
04-07-2012
11:39 AM
I would like to configure the redundancy also using port channel features. I've a Catalyst 6509E with a redundant 720 supervisor, and two Catalyst 4506E with a single supervisor card. It's possible to connect both Cat 4509 10GE (total 4 interface) to Cat6509 10GE using redundant supervisor 10GE interface?
... View more
04-06-2012
04:41 PM
On the Catalyst VSSE 720 supervisor data sheet I found that this supervisor: "Allows two 10 Gigabit Ethernet and two Gigabit Ethernet uplinks to be active simultaneously; with redundant supervisors, allows all ten uplinks to be active" Can anyone help me to configure this feature? Thanks a lot. Roberto
... View more
Labels:
03-27-2012
04:06 AM
Here you found see the network diagram. The old working interface was the Vlan100 the same users vlan. A new interface was added (Vlan 99) but the dropped packets are flowing from the interface Vlan300. It's a very strange behaviour with a no-sense explanation. I don't think that the Bluecoat reboot can solve the problem because the issue is related to the switch not to the proxy.
... View more
03-27-2012
03:09 AM
On a Catalyst 6509 switch I have configured wccp protocol in order to redirect the Http traffic to a Bluecoat SG8100. It was working fine until a new L3 interface implementation. Thereafter I was unable to redirect the http traffic due to an error reported from the Cat6509: WCCP-EVNT:D10: Built new router view: 0 routers, 0 usable web caches, change # 00000001 WCCP-PKT:D10: Sending I_See_You packet to 10.64.28.240 w/ rcv_id 00000001 WCCP-PKT:D10: Sending I_See_You packet to 10.64.28.240 w/ rcv_id 00000002 WCCP-PKT:D10: Sending I_See_You packet to 10.64.28.240 w/ rcv_id 00000003 WCCP-EVNT:D10: Here_I_Am packet from 10.64.28.240 w/bad rcv_id 00000000 WCCP-EVNT:D10: Here_I_Am packet from 10.64.28.240 w/bad rcv_id 00000000 WCCP-EVNT:D10: Here_I_Am packet from 10.64.28.240 w/bad rcv_id 00000000 WCCP-PKT:D10: Sending Removal_Query packet to 10.64.28.240w/ rcv_id 00000004 WCCP-EVNT:wccp_free_wc_assignment_memory: enter WCCP-EVNT:wccp_free_wc_assignment_memory: deallocate orig info (40 bytes) WCCP-EVNT:wccp_free_wc_assignment_memory: exit WCCP-EVNT:wccp_change_router_view: D10 WCCP-EVNT:wccp_change_router_view: deallocate rtr_view (24 bytes) WCCP-EVNT:wccp_change_router_view: allocate hash rtr_view (1560 bytes) WCCP-EVNT:wccp_change_router_view: rtr_view_size set to 24 bytes WCCP-EVNT:D10: Assignment wait timer started the final status is: SWA1-1#sh ip wccp 10 deta WCCP Cache-Engine information: Web Cache ID: 10.64.28.240 Protocol Version: 2.0 State: NOT Usable Redirection: L2 Packet Return: L2 Packets Redirected: 0 Connect Time: 00:00:19 Assignment: MASK After some checks I supposed that the problem should be the UDP 2048 port connection between the Switch and the Bluecoat while the switch L3 port and the bluecoat are on the same Lan. A deep analysis found that the WCCP protocol seems to be as follow: Proxy address 10.64.28.240 to Switch Port 10.64.28.250 Here I Am Switch Port 10.64.28.250 to Proxy address 10.64.28.240 I See You Switch Port 10.66.0.251 to Proxy address 10.64.28.240 UDP 2048 packet (dropped by firewall) It's strange to me that the first dialog is correctly handled by the correct Cat6509 interface while the UDP packets are flowing from another Vlan interface not configured with the WCCP and apparently not involved on the protocol. Last of all the WCCP is now disabled and unusable, any idea?
... View more
Labels:
11-18-2010
03:21 PM
Hello! after a power off my IronPort system is unable to accept/deliver emails and on the web interface the System Status tell me that "Queue is not mounted"!!! Also the reboot procedure doesn’t really change anything, my last chance was the resetqueue command but after 2h and a lot of point ( .... ) also the reboot command is unable to stop this process. Can anyone help me? Thank you, Roberto
... View more
Labels:
Public Statistics
| Date Registered | 06-13-2004 07:30 PM |
| Date Last Visited | 06-28-2018 02:16 AM |
| Total Messages Posted | 18 |
