It is seems like MAC address limit setting issues on the switch ports. To resolve the issue try to alter the MAC address limits setting. ... View more

You must configure email alerts on a per-rule basis. Create a custom rule (Rules > Add), and then choose any for all parameters except severity. For the severity parameter, choose RED, and set an action to email to configure email alerts on MARS for all severity level RED rules. To send alert notifications to individual users or groups of users, configure the Action parameters of a rule to create an alert action http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/alerts.html#wp139732 ... View more

CSC Plus license expiration does not disable URL blocking in ASDM ... View more

Here is the action plan to solve this issue. 1. Show platform port-asic stats drop port asic will give the drops, if any on the egress for a specific port. For newer codes, you can try 'show platform port-asic stats drop , instead of giving port and asic numbers. Check in this output if you see the egress drop counters incrementing. If you see drops on egress, it indicates oversubscription. Tuning of buffers is only possible when QoS is enabled 2. To check CPU drops, the command is: Show controller cpu-interface. This will give you the number of packets hitting each of the 16 queues in the CPU and if any packets were dropped from any of the queues and if the drops are increasing. 3. And Also check you are hitting bug CSCsd84624 3750 drop Fragment multicast packet drop when (S,G) entry is expired. 4. To reduce fragment multicast packets from server and try. 5. To change threshold values on qos configuration in 3750 ... View more

Type ipconfig /release, then ipconfig /renew to reset the DHCP lease for the client. ... View more

The router is prevented from downgrading firmware from 2.x.x to 1.x.x on RV082 v2 hardware. Here is the Release Notes for RV082 Firmware Version 2.0.0.19-tm. http://www.cisco.com/en/US/docs/routers/csbr/rv082/release/notes/RV082_RN_v2-0-0-19-tm.pdf ... View more

The fix for this bug is a patch that needs to be installed on Cisco Secure ACS. In order to download the patch, open a service request with the Cisco Technical Assistance Center (TAC). http://supportwiki.cisco.com/ViewWiki/index.php/Wireless_LAN_Services_Module_(WLSM)_access_point_(AP)/Wireless_Domain_Services_(WDS)_fails_to_fully_authenticate_with_Cisco_Secure_ACS_3.3_and_4.0 ... View more

I think it is possible. The link below has an example of using overload commands on IP nat pool in HSRP. http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6969/ps1839/prod_white_paper0900aecd8052870b.html ... View more

Please check and see if there any access list is blocking the traffic in interval time. See the syslog message to verify. Here is the good link. http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/configuration/guide/traffc_f.html ... View more

The Cisco intrusion detection system/intrusion prevention system (CIDS/IPS) instructs controllers to block certain clients from accessing the wireless network when attacks involving these clients are detected at Layer 3 through Layer 7. This system offers significant network protection by helping to detect, classify, and stop threats including worms, spyware/adware, network viruses, and application abuse. Two methods are available to detect IDS attacks: • IDS sensors • IDS signatures You can configure IDS signatures, or bit-pattern matching rules used to identify various types of attacks in incoming 802.11 packets, on the controller. When the signatures are enabled, the access points joined to the controller perform signature analysis on the received 802.11 data or management frames and report any discrepancies to the controller. http://www.cisco.com/en/US/docs/wireless/controller/4.0/configuration/guide/c40sol.htm l ... View more

AP has a neighbor on same channel for 2.4 GHz radio, with power. These reports on possible co-channel interference. This may or may not be relevant depending on power and application used. AP has a neighbor on same channel for 5 GHz radio, with power. These reports on possible co-channel interference. This may or may not be relevant depending on power and application used. AP has a neighbor on an adjacent channel for X GHz radio, with power. This reports possible adjacent channel interference, which may be disruptive depending on how far is the AP on channel distance, and the power received ... View more

The AnyConnect client allows access to IPv6 resources over a public IPv4 connection (only for Windows XP SP2, Windows Vista, Mac OS X, and Linux). You must use the command line interface to configure IPv6 access. ASDM does not support IPv6. You enable IPv6 access using the ipv6 enable command as part of enabling SSL VPN connections. http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect20/release/notes/cvcrn200.html#wp659370 ... View more

After you upgrade MARS from version 6.0.2 to 6.0.3, it appears that drop rules are ignored. Update your MARS with the patch release 6.0.3 (3188) (csmars-6.0.3.3190-customerpatch.zip) in order to correct the potential issues with drop rules. http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/rules.html#wp532001 The specified object in the system log message has exceeded the specified burst threshold rate or average threshold rate. The object can be drop activity of a host, TCP/UDP port, IP protocol, or various drops due to potential attacks. It indicates the system is under potential attack. ... View more

The security appliance obtains endpoint security attributes by using posture assessment methods that you configure. These include Cisco Secure Desktop and NAC. The security appliance uses a DAP policy when the user attributes matches the configured AAA and endpoint attributes. The Prelogin Assessment and Host Scan modules of Cisco Secure Desktop return information to the security appliance about the configured endpoint attributes, and the DAP subsystem uses that information to select a DAP record that matches the values of those attributes. Most, but not all, antivirus, antispyware, and personal firewall programs support active scan, which means that the programs are memory-resident, and therefore always running. Host Scan checks to see if an endpoint has a program installed, and if it is memory-resident as follows: •If the installed program does not support active scan, Host Scan reports the presence of the software. The DAP system selects DAP records that specify the program. •If the installed program does support active scan, and active scan is enabled for the program, Host Scan reports the presence of the software. Again the security appliance selects DAP records that specify the program. •If the installed program does support active scan and active scan is disabled for the program, Host Scan ignores the presence of the software. The security appliance does not select DAP records that specify the program. Further, the output of the debug trace command, which includes a lot of information about DAP, does not indicate the program presence, even though it is installed. ... View more

The problem can be that the xauth times out. Increase the timeout value for AAA server in order to resolve this issue ... View more