Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About plearmouth
Stats
Member since
05-27-2004
42
Posts
0
Helpful
1
Solution
07-14-2010
03:12 AM
Hi JR Apologies I thought I had posted the outcome ! TAC Webex'd onto UCCX and confirmed the problem. Then the following excerpt 'taken from the TAC case' - Created new ldap profile - selected only primary ldap server - bind it to the user (CUPS admin, APplication/CUPC/User Settings) - it worked - changed back to original profile - worked again - included secondary ldap server as well under the profile - worked again - so basically, latest config is the original starting point when it was not working but now it is working without any restarts being performed in the system, but only the changes listed above in that order. Essentially, TAC confirmed the issue, then it went away simply by creating a second Profile then reverting back to mine. Not an ideal answer but its working. Paul
... View more
Created by
plearmouth
in Other Security Subjects
in Other Security Subjects
03-08-2010
03:11 AM
03-08-2010
03:11 AM
Hi We have a L3 OOB routed gateway configuration (with redundant CAS and CAM), We are currently running 4.7.1 on the appliances and the agent is 4.7.10. We have experienced two problems: 1. On several occasions we can abort a valid logon, but can still be allowed access to the network 'silently' ; a - without any indication on the CAM i.e. no online users, no certified devices b - the switch is still in the 'unauthenticated vlan' and the c - ip address of the client is on the 'untrusted' subnet. d - the 'unauthenticated' policy DOES NOT ALLOW web traffic. It would seem that the user is able to trick the system by aborting the logon with the agent i.e. closing the window etc, (the login credentials are correct and posture fails on an optional check and so amber) but the system DOES NOT show the user at all. The Temporary role does allow full access, if I disable the policy rule the traffic is stopped. The problem is there is no indication of this user on the system at all, this happens a couple of times a week. 2. When a user is genuinely placed into a TEMPORARY role (as indicated by the system, note: not the same as above), about 50% of the time communication is blocked even though the policy allows it (repeated challenges by NAC). Close the agent and do it the second time and it will work. I think the symptoms are related as they both seem to be related to the usage of the TEMPORARY ROLE - has anyone else seen this bug ?
... View more
Labels:
11-11-2009
02:59 AM
Chris, Its been a TAC case now for a couple of weeks without resolution. I will post a message once 'resolved' regards Paul
... View more
10-21-2009
08:44 AM
see bug CSCsy82260 fixed in 8.2.1.10 - TAC provided an excellent turn around to the case. Paul
... View more
10-16-2009
07:31 AM
Sorry - I think you mis-understood what I meant to say I had already seen this document and although the validation succeeds the problem still exists. i.e. it still doesn't work
... View more
10-16-2009
01:24 AM
Tom No I think it IS a cisco ASA issue - not IRONPORT or SQUID as the problem you describe is exactly the same for me with different caches. Paul
... View more
10-16-2009
12:18 AM
hi I have an ASA 8.2.1 with WCCP to two Ironports appliances and was just about to ask the exact same question in this forum. The problem existed in 8.1 and I had hoped that 8.2.1 would resolve it. Everything appears to be up and useable (after an outage) but no traffic is redirected. Remove and add again and it magically works again. A bug I think. Paul
... View more
10-15-2009
11:34 PM
Mike A static entry pointing to where ? Remember I can see a correct response from the LDAP server but still the error - so I know it can resolve the LDAP server address from the profile thanks in advance. Paul
... View more
10-15-2009
07:52 AM
Hi I have configured the presence AXL user to that of my cups username and everything validates okay. My CUPC client works fine and can view all contacts so the LDAP profile is correct. However, when I try to search for contacts within CDA I recieve the message CDAUI2067 Search did not complete successfully, and only partial results are displayed. Contact technical support. I have taken a wireshark trace of the LDAP transaction between UCCX and LDAP server and the response is fine with correct response i.e. valid search yet the application errors. Anyone had similar issues Paul
... View more
Labels:
05-20-2009
09:18 AM
Hi We have two VIPS (LIVE and TEST)with SSL-proxys configured. One is fine (LIVE), the other (TEST) WAS misconfigured with the same certificate and keys as the LIVE. This has been subsequently corrected. However, the original LIVE (incorrect) certificate is always offered to the TEST vip. Is it cached somewhere ? Is it a sticky entry needs clearing ? The certificates are definitely different. Any help greatly received Paul
... View more
Labels:
Created by
plearmouth
in Other Security Subjects
in Other Security Subjects
03-10-2009
08:10 AM
03-10-2009
08:10 AM
Dan The popup issue appears to be a client build, tried with a non customer laptop and the window popped up without a hitch. I have a second more pressing issue and probably worth a separate discussion, but the customer has two AD's which I have established a two-way trust between and authentication works. However, we were performing role mapping based on AD groups. I have had the lookup server working on the initial AD but there is no obvious way to specify a second LDAP server. If it is not possible to have two separate LDAP queries, would converting to RADIUS(ACS) as an authentication service be the answer, however, we do want SSO capability so is RADIUS and SSO compatible? I will try it in the mean time. Many thanks in advance Paul
... View more
Created by
plearmouth
in Other Security Subjects
in Other Security Subjects
03-09-2009
07:42 AM
03-09-2009
07:42 AM
Hi Version: 4.5 My question is I have had Real IP/OOB/L3 working successfully. If I now attach a client L2 adjacent to the CAS so Real IP/OOB/L2 the agent does not 'pop up'. The docs say that L3 functions do not work if you have managed subnets configured and yet you need managed subnets for L2 adjacent clients. So the question is : Are L2 and L3 clients supported when 'L3 support' is enabled ? If so why does the CCA not respond, event log is empty. What troubleshooting tools are available. Thanks in advance Paul
... View more
Labels:
11-18-2008
04:15 AM
Ben I think I understand where I was going wrong, to provide access to a route within a VRF you would add a static route within the global table and the next-hop being a PHYSICAL interface (probably to the CE router), and so applied at the CE/PE boundary. I was trying to apply the route at a PE that has learnt the route as a VPNV4 prefix. When you apply the static route there are NO PHYSICAL interfaces for the next hop associated with the VPN. Adding a static route pointing to an SVI or loopback within the same VPN does not provide forwarding of the packet to the remote subnet. Personally, I think it would be nice where incases that provide a central service (i.e. Internet connection) that I could provision statics at the Internet end. clear as mud. Paul
... View more
11-13-2008
05:07 AM
Giuseppe I did have a loopback but it just doesn't work. I guess its just not possible to do it this way. Thanks for all your help Paul
... View more
07-14-2010
Hi JRApologies I thought I had posted the outcome !TAC Webex'd onto UCCX
and confirmed the problem. ...
Created by
plearmouth
in Other Security Subjects
03-08-2010
03-08-2010
HiWe have a L3 OOB routed gateway configuration (with redundant CAS and
CAM), We are currently runni...
11-11-2009
Chris,Its been a TAC case now for a couple of weeks without resolution.
I will post a message once '...
Created by
plearmouth
in Firewalls
10-21-2009
10-21-2009
see bug CSCsy82260 fixed in 8.2.1.10 - TAC provided an excellent turn
around to the case. Paul
10-16-2009
Sorry - I think you mis-understood what I meant to say I had already
seen this document and although...
Created by
plearmouth
in Firewalls
10-16-2009
10-16-2009
TomNo I think it IS a cisco ASA issue - not IRONPORT or SQUID as the
problem you describe is exactly...
Created by
plearmouth
in Firewalls
10-16-2009
10-16-2009
hi I have an ASA 8.2.1 with WCCP to two Ironports appliances and was
just about to ask the exact sam...
10-15-2009
MikeA static entry pointing to where ? Remember I can see a correct
response from the LDAP server bu...
10-15-2009
HiI have configured the presence AXL user to that of my cups username
and everything validates okay....
05-20-2009
HiWe have two VIPS (LIVE and TEST)with SSL-proxys configured.One is fine
(LIVE), the other (TEST) WA...
Created by
plearmouth
in Other Security Subjects
03-10-2009
03-10-2009
DanThe popup issue appears to be a client build, tried with a non
customer laptop and the window pop...
Created by
plearmouth
in Other Security Subjects
03-09-2009
03-09-2009
HiVersion: 4.5 My question is I have had Real IP/OOB/L3 working
successfully. If I now attach a clie...
11-18-2008
BenI think I understand where I was going wrong, to provide access to a
route within a VRF you would...
Public Statistics
| Date Registered | 05-27-2004 07:28 AM |
| Date Last Visited | 08-18-2017 03:54 AM |
| Total Messages Posted | 42 |
