Virtual office solutions from Cisco boost flexibility  and productivity and extend the enterprise by delivering secure, rich, and  manageable network services to teleworkers and employees working outside the  traditional office environment. By providing full IP phone, wireless, data, and  video services, Cisco Virtual Office provides a smooth, office-caliber  experience to staff, wherever they may be located. Virtual Office Deployment Options Cisco Virtual Office includes provisioning and  management through a number of management tools that provide the ability to  define networkwide policy, use identity for authorization, and actively update  configurations at remote sites. Cisco Virtual Office Express refers to a simplified  architecture to address initial installation steps. It extends the same network  services available through the Cisco Virtual Office solution but is distinct in  its ability to quickly set up the secured connections between sites. Cisco  Virtual Office Express has a reduced number of management and head-end  components to provide rich functionality while keeping operational costs low. To generate useful information for your current network  or obtain configuration suggestions: http://www.cisco.com/cdc_content_elements/calc/cvo/cvoExpress.html For more information, refer to the following URL: http://www.cisco.com/en/US/netsol/ns855/index.html ... View more

VPN Client 5.0.06 features support on Microsoft Windows 7  (32-bit only). This release does not support Microsoft Windows 2000 and  Tablet PC 2004/2005, although it may work with these OSs. VPN Client 5.0.06 supports the following Microsoft OSs: •      Windows 7 (32-bit only) •      Windows Vista  (all released 32-bit versions) •      Windows XP  (32-bit) The VPN Client supports the following Cisco VPN devices: •      Cisco Series  5500 Adaptive Security Appliance, Version 7.0 and later. •      Cisco VPN  3000 Series Concentrator, Version 3.0 and later. •      Cisco PIX  Firewall, Version 6.2.2(122) or Version 6.3(1). •      Cisco IOS  Routers, Version 12.2(8)T and later. Upgrading the VPN Client Software on Windows 7 and Vista For Windows 7 and Vista, please use add/remove programs to  uninstall the VPN Client before upgrading to a new Client release. ... View more

Problem : Can map multiple DNS names to different connection  profiles? Service1.cisco.com map to one profile Service2.cisco.com map to another profile Service3.cisco.com map to another…. ... View more

The AIP SSM running IPS software Version 6.0 and above can  run multiple virtual sensors, which means you can configure multiple security  policies on the AIP SSM. You can assign each context or single mode adaptive  security appliance to one or more virtual sensors, or you can assign multiple  security contexts to the same virtual sensor. See the IPS documentation for more  information about virtual sensors, including the maximum number of sensors  supported. ... View more

A smart tunnel is a connection between a TCP-based application and a private site, using a clientless (browser-based) SSL VPN session with the security appliance as the pathway, and the adaptive security appliance as a proxy server. You can identify applications to which you want to grant smart tunnel access, and specify the local path to each application. For applications running on Microsoft Windows, you can also require a match of the SHA-1 hash of the checksum as a condition for granting smart tunnel access. Lotus SameTime and Microsoft Outlook Express are examples of applications to which you might want to grant smart tunnel access. Configuring smart tunnels requires one of the following procedures, depending on whether the application is a client or is a web-enabled application: • Create one or more smart tunnel lists of the client applications, then assign the list to the group policies or local user policies for whom you want to provide smart tunnel access. • Create one or more bookmark list entries that specify the URLs of the web-enabled applications eligible for smart tunnel access, then assign the list to the Dynamic Access Policies (DAPS)or group policies, or local user policies for whom you want to provide smart tunnel access. You can also list web-enabled applications for which to automate the submission of login credentials in smart tunnel connections over clientless SSL VPN sessions. The remote host originating the smart tunnel connection must  be running Microsoft Windows Vista, Windows XP, or Windows 2000, and the browser  must be enabled with Java, Microsoft ActiveX, or both. Support for Windows 7 and IE 8.0 and MAC OSX 10.6.x with Safari 4.x will be added in in Release  version 8.3 (to Beta in late fall 2009).a Please refer to the Smart Tunnel Configuraiton Guide for details on setup and applicability. I. Smart Tunnel capabilities as of  ASA version 8.2.x : Smart tunnel is an all or nothing operation. Meaning once you turn it on for a specific process or for a specific bookmark, all your traffic for that process (and the browser you used to initiate the Clientless SSL session ) will go through the ASA. Example: Enable ST option for a process or within bookmark#1 (which hooks IE used to initiate the session). Opening a separate IE browser instance will tunnel all traffic through the ASA, if the new browser window belongs to the same process. All browser tabs traffic of this browser will be smart tunneled, even for those bookmarks( ie. bookmark#2) not specifically smart tunneled. You must use a different browser (ie. FireFox) in this case if you want some of your traffic (ie. bookmark#2) not to be smart tunneled. Note:Smart-tunnel split-tunnelling capability will be available in the next major ASA rellease 8.3.1 release (to go t oBeta in late fall 2009). Smart Tunnel doesn't require administrative user privileges to be run. Smart tunnel is turned off only when you logout out the Clientless SSL VPN portal page.This is the behavior as of ASA 8.2.1. From 8.3.1 onwards, on Windows, Smart Tunnel will be turned off once all browser windows (note: not tabs, but all browser windows) have been closed. Alternatively, in 8.3.1 the admin can choose to provide a log out icon so that the session can survive closing all browsers while the user can still log out from the icon. The browser must have either MS ActiveX (IE environments) or Java (FireFox,IE environments or other Java supported browsers), or both enabled. It tries installing using ActiveX first, and then falls back to Java. Think of Smart-Tunnels as a specialized "port-forwarder", a thin-client. Smart Tunnel uses applications or web bookmarks for the configuration. Port Forwarding uses ports for the configuration. When either the core Clientless SSL VPN (CTE) or the AnyConnect full-tunnel client are not deployment options, Smart-Tunnels should be considered. As of ASA versions 8.1.2 and 8.0.4 and 8.2.x, only supported on Windows 32-bit Win2000/XP/Vista and MAC OS 10.4 and 10.5 . Smart Tunnel will be supported on 64 bit Windows (including Windows 7) and MacOS X 10.6 in ASA 8.3.1 http://www/en/US/docs/security/asa/asa80/configuration/guide/webvpn.html#wp1096902 Smart Tunnels do not currently support .NET applications (CSCsv29942) By .NET application, we really mean a exe binary that is developed using .NET, we don't mean anything else, especially not a web service developed with .NET Native Microsoft Outlook can connect via Smart Tunnels as of ASA version 8.4 Beginning with JRE6 Update 10, Java starts differently from standard practice. Consequently, the user's smart-tunnel enabled browser freezes if they open a website containing a Java applet, and JRE6 Update 10 or later is installed on the user's computer. If you are using JRE update 10 or later, you need ASA image version 8.0.4 22 or later. For to ASA version earlier than 8.3, to make Java applets functional on a smart-tunnel enabled browser, go to Configuration > Remote Access VPN > Clientless SSL VPN Access > Portal > Smart Tunnels > Smart Tunnels, and add the following processes to the smart tunnel lists: program, java.exe, jp2launcher.exe II.  Smart Tunnel capabilities being introduced in ASA version 8.3.x (to Beta in late fall 2009) Add support for  64-bit Windows (including Windows 7) and 32-bit and 64-bit MacOS X 10.6 Logout SSL VPN session (when closing all browser types that initiated the session) or via Logout-icon in task bar/message area Split-tunneling Statistics for the smart-tunnel in the Clientless SSL VPN portal ... View more

Problem : "An internal error has occurred. Please close all the browser windows and ensure that the specific device is added and submitted in Cisco Security Manager (CSM)" Solution : The problem is due to CSM-MARS-Integration does not handle Firewall alerts with names. Alerts being queried are generated from firewalls, and the alerts are in names, not an ip addresses, as the firewall is configured for names. The solution is to enable the cross launch feature for all firewall alerts, and do not use "names" in the firewall configuration. Issue the command "no names" on the firewall. ... View more

Security Appliance QoS Features Created by Bob Eckhoff Have you ever participated in a long-distance phone call that involved a satellite connection? The conversation might be interrupted with brief but perceptible voice gaps at odd intervals. The gaps between arriving voice packets is called jitter, and it is caused by latency in the network. Some network traffic, such as voice and video, cannot tolerate long latency times. Quality of service (QoS) is a feature that enables you to prioritize critical traffic, prevent bandwidth hogging, and manage network bottlenecks to prevent packet drops. Supported QoS Features The security appliance supports the following QoS features: Priority queuing: For critical traffic that cannot tolerate latency, priority queuing enables you to prioritize certain traffic flows (such as latency-sensitive traffic like voice and video) ahead of othertraffic. Policing: To prevent individual flows from consuming all network bandwidth, you can limit themaximum bandwidth used per flow by dropping the out-of-limit traffic. Traffic shaping: If you have a device that transmits packets at a high speed, such as a securityappliance with Fast Ethernet, and it is connected to a low-speed device such as a cable modem,then the cable modem is a bottleneck at which packets are frequently dropped. To manage networks with differing line speeds, you can configure the security appliance to transmit packets at a fixed slower rate by queuing or delaying the out-of-limit traffic. In comparing traffic policing versus traffic shaping, traffic policing typically drops the traffic that exceeds a configured rate, whereas traffic shaping typically delays excess traffic to prevent unnecessary drops. Priority Queuing (QoS) Priority queuing is typically used to provide low-latency voice and video service. If you want to enable priority queuing for traffic, you need to create the priority queue on each interface where the voice traffic will be prioritized. Each physical interface with priority queuing uses two queues: one for priority traffic and the other for all other traffic. The interface services all packets in the priority queue before servicing any packets in the general queue. To create a standard priority queue on an interface for use with priority queuing, use the priority-queue command in global configuration mode: priority-queue interface-name Optionally, to change the size of the priority queues, enter the following command: hostname(config-priority-queue)# queue-limit number_of_packets Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped (called tail drop). To avoid having the queue fill up, you can use the queue-limit command to increase the queue buffer size. The number_of_packets is the number of average, 256-byte packets that the specified interface can transmit in a 500-ms interval. A packet that stays more than 500 ms in a network node might trigger a timeout in the end-to-end application. Such a packet can be discarded in each network node. The upper limit of the range of values for the queue-limit command is determined dynamically at run time. To view this limit, enter queue-limit ? on the command line. The key determinants are the memory needed to support the queues and the memory available on the device. The queue-limit that you specify affects both the higher priority low-latency queue and the besteffort queue. This tx-ring-limit command sets the maximum number of low-latency or normal-priority packets allowed into the Ethernet transmit driver before the driver pushes back to the queues on the interface to let them buffer packets until the congestion clears. The number_of_packets is the number of maximum 1550-byte packets that the specified interface can transmit in a 10-ms interval. This guarantees that the hardwarebased transmit ring imposes no more than 10 ms of extra latency for a high-priority packet. The upper limit of the range of values for the tx-ring-limit command is determined dynamically at run time. To view this limit, enter tx-ring-limit ? on the command line. The key determinants are the memory needed to support the queues and the memory available on the device. The tx-ring-limit that you specify affects both the higher priority low-latency queue and the best-effort queue. To enable QoS priority queuing, use the priority command in class configuration mode. For critical traffic that cannot tolerate latency, such as VoIP, you can identify traffic for low-latency queuing (LLQ) so that it is always transmitted at a minimum rate. ... View more