Odd that everyone is saying that these are false positives.  Our IPS alerted about a number of hosts, an AV scan found crytpowall on all of the hosts that IPS has reported.  Furthur analysis discovered that the  malware was being served from the ads on trusted sites.  The advertisements exploited vulnerability in flash player and injected itself into iexplorer process without any interaction from the user. Our AV did not detect the initial injection as it does not have heuristics. I have not received any alerts since the signature was updated, I hope that it is still doing its job. ... View more

Thanks for the details, so it looks like SVI is supported so the switch port interfaces can simply be put into the appropriate vlans. Does anyone else have experience with the product? I would hate to be an early adopter and find that using the 5500 as a distribution or core device blows up in my face ... View more

Nicolas, thanks for your clarification. Had one more quick one if your willing... I was thinking of doing  MAB for the phone and printers onsite. I will have ports that have viop phones, users will connected to the secondary port on the phone.  will this require me to set this port as a multi-host? as I understand it if I setup the port for multihost anyone connecting to the phone second port will have access without authenticating using machine credentials.  Is there another approach that I should consider for this? I would like to have the phone auth using MAB or other, and the user connected to the phone do the normal machine authentication.  Also I would perfer to have the phone and data networks seperated on different vlans if possible. Much appreciated! Eric ... View more

Just to clarify... -  is the machine profile on the AD server used for 802.1x  verification/authentication? meaning ACS will pass off to AD to verify  the machine is part of the domain? or do you have to create machine  profiles in ACS? yes it's best to use ACS with AD so that it uses the machine profile on AD and machine account password change happens automatically every x days. When you say "machine account password change happens automatically every x days" are you indicating that users will be prompted for a password during boot to complete the machine authentication? if so is the password maintained in AD or ACS? please clarify. I was hoping this authentication would be completely transparent to the end user.. - I have read a few articles out there about  issues with machine auth with clients using XP, perhaps this was related  to previous serivce packs before SP3? there was mention of registery  changes required etc. Indeed. There seems to many forum articles out there regarding this subject, often they are confusing.  Do you have a url you could share that will give me direct answers to what needs to be configured on the clients registry? In addition if you have any other url's that you used or think would help me setup this solution please share thme with me if possible. Thanks for all your help ... View more

Thanks too you both for the responses. I have a few followup questions which I have added inline. Q: - With the setup I described above using MSCHAPv2 when the  user boots  the computer in the morning, hits ctrl+alt+delete and  provides their AD  credentials will this act as a single sign on? first  authenticating them  through 802.1x so the port is authorized and then  authenticating them  to the AD server? or will there be some type of pop  up window that will  appear before the ctrl+alt+delete window? making  the user provide  credentials twice (annoying) A:  If you select "Use windows credentials" it won't prompt you for credentials. so All automatic. However  note that it will only login AFTER you entered the credentials on the  logon page. So you won't have network connectivity for the initial  logon, so no login scripts this way. -- With your comments I am rethinking my approach, I am considering that if the company security policy will allow it I will do machine authentication only instead of user auth.   Obviously this is not as secure since a rogue user could change the local admin password and have access to the network.  But interms of simplicity and ease of use machine authentication provides a transparent authentication mechanism that should suffice.  I would just have to sell the solution to security.  There a few things I need to understand before persuing this. - will the machine be 802.1x authenticated and on the network before the  ctrl+alt+delete? so when user logs in the machine has passed 802.1x  already and has received ip from dhcp? this is my hope. - is peap/mschap still the supported protocol so no physical cert is required per machine? no EAP-TLS - is the machine profile on the AD server used for 802.1x verification/authentication? meaning ACS will pass off to AD to verify the machine is part of the domain? or do you have to create machine profiles in ACS? - I have read a few articles out there about issues with machine auth with clients using XP, perhaps this was related to previous serivce packs before SP3? there was mention of registery changes required etc. - is there a different supplicant offered by cisco that is more robust that would provide more stability or is the cisco supplicant cost money per user license or other etc. Again your feedback is invaluable as I do not have the physical equipment to test with.  Unfortunatly I have to propose a solution before actually testing something which I am not particularly fond of. Regards, Eric ... View more

Not sure if this helps but I use Camtasia's powerpoint plugin to convert presentations that have animation into video files in either swf/flv or wmv format.  For standalone powerpoint presentations that do not include animations I simply use a program called PPTools which allows me to export high quality images from my presentations without losing any quality. ... View more

Nicolas, Thanks for your feedback, I was unware that problem was only happening to clients using firefox.  I will be testing this on IE8 later today to see if it works. Regards, Eric ... View more

For anyone that comes across this thread I was able to solve this issue after an exhausting bout with TAC. To get all of the WCCP services too function with the ASR I needed to issue the following commands.  I have never had to use these before in any implementation so I was very surprised that they resolved my issue. ip wccp check services all no ip wccp variable-timers Now all is well Hope this helps someone ... View more

Can you confirm that Cisco has identified this as a bug? and can you provide the BudID to me for reference if possible. thanks! ... View more

Hi, I think I am experiencing something similar to this bug, I have attached a photo of the error.  Can someone please confirm this is the same error that you are receiving.  The playlist in question has only two jpegs in a loop, I noticed that after two days of playing I would receive this error.  The fix I have put in place is to schedule a reboot of the dmp each day first thing in the morning. Thanks! ... View more