About tvotna

tvotna · 03-06-2026

Hi experts,Does anybody know precisely under what circumstances ASA/FTD IKEv2 server sends complete certificate chain to 3rd-party IKEv2 clients?The scenario is: hierarchical PKI, sub-CA certificate was renewed, new ASA identity certificate was issue...

tvotna · 03-06-2026

Can anybody provide steps to configure private proxy (residing in corporate network reachable via AnyConnect tunnel) on iOS and Android devices? What options are available here?Thx.

tvotna · 12-24-2025

firepower4145 /eth-uplink/fabric # enter port-channel 48firepower4145 /eth-uplink/fabric/port-channel # set port-channel-modeactive Activeon Onfirepower4145 /eth-uplink/fabric/port-channel # set port-channel-mode onfirepower4145 /eth-uplink/fabric/po...

tvotna · 12-06-2025

Is it really expected that innocent cluster members are kicked out of the cluster after split-brain is resolved and one of cluster control units leave the cluster, or it's a joke of Cisco developers?In the below example unit-2-1 became control unit d...

tvotna · 07-24-2024

Remind me please which IOS debug prints peer's IKEv2 IDi. I got tired troubleshooting "IKEv2-ERROR:% IKEv2 profile not found".

tvotna · 03-06-2026

Private-side proxy in this context is just a proxy inside the corporate network reachable over VPN. This terminology is used by Cisco to distinguish it from the public proxy which resides in the client's LAN or ISP network and which needs to be used ...

tvotna · 03-06-2026

Hi @balaji.bandi . Thanks for the response. How can I configure proxy manually? Does iOS and Android AnyConnect have an option to configure private-side proxy? If it doesn't, do we have step-by-step document for the PAC file feature? In case of a PAC...

tvotna · 12-26-2025

Hi @balaji.bandi . I tested on FXOS 2.10 and 2.12. Logical device runs ASA code.

tvotna · 12-07-2025

@Mark Elsen, Yeah, I saw this article, but it doesn't match what I see. From this article it appears that the new control unit may send CCP_MSG_QUIT/CLUSTER_QUIT_REASON_PRIMARY_UNIT_HC message to member units when it loses communication with the curr...

tvotna · 07-29-2024

I believe that in the routed firewall mode ASA drops all IPv6 if IPv6 addresses are not configured on ASA interfaces, simply because its IPv6 routing table is empty in this case. Transparent firewall mode also requires IPv6 address to be configured.N...

Member Since	‎04-15-2022 09:01 AM
Date Last Visited	‎03-06-2026 02:37 AM
Posts	641
Total Helpful Votes Received	307

User Statistics

User Activity

ASA/FTD hierarchical PKI and sending complete certificate chain

AnyConnect for iOS and Android and private proxy

Port channel mode cannot be changed to ON for CCL links. Why?

Innocent cluster members are kicked out when split-brain is resolved

How to see peer IDi in IKEv2 debugs on IOS?

Re: AnyConnect for iOS and Android and private proxy

Re: AnyConnect for iOS and Android and private proxy

Re: Port channel mode cannot be changed to ON for CCL links. Why?

Re: Innocent cluster members are kicked out when split-brain is resolv

Re: Blocking IPv6 on ASA