Hello (and almost Merry Christmas!),   Does anyone know exactly how AnyConnect decides if it's on a trusted network? I had a strange fault recently on a customer site where the VPN kept coming up even when the user was on-net. The DART bundle logged the following message:-   Untrusted Network detected: Policy is to Connect (The interface <x.x.x.x> is untrusted, because DNS Domain is not among the configured TND DNS Domain *.my_company.com)   Now my first thought was that AnyConnect examines the DNS domain pushed down via DHCP (or statically configured) as reported in an ipconfig /all against the active network adapter for the "Connection-specific DNS Suffix". I came to this conclusion because it was blank for the affected users. However, users at other sites also had a blank entry here but AnyConnect knew it was on the trusted network so did not bring up the VPN.   So my question is: how does AnyConnect decide if it's connected to a trusted network or not? Is there some funky AD shizzle that goes on in the background that AnyConnect can somehow tap into and query? Or a registry entry? Or.....?   Any help/advice here is very much appreciated!   By the way, the underlying problem turned out to be that something went wrong with that site's primary router. It failed over to a 4G backup router that didn't have access to the DCs so that makes sense as the client couldn't talk to the domain. But I still want to know exactly how AnyConnect knows?   Many thanks, Matt.     ... View more

Hi, I have a pair of ASA5525-X firewalls configured as an active/standby cluster. Single context routed mode. I recently did an zero downtime IOS upgrade [ from Version 9.5(2) to 9.5(2)5 ] where I reloaded them one at a time to maintain traffic flow through the cluster. Output of show ver is now:- ########### MyFirewall up 15 days 21 hours failover cluster up 217 days 15 hours ########### So obviously the uptime of each individual FW is only the time since it was last rebooted - 15 days. The cluster uptime is much longer - 217 days. So my question is about the ACL hitcnt statistics when you run the show access-list command.... ########### access-list INSIDE-IN line 123 extended permit tcp host x.x.x.x host y.y.y.y eq 80 ( hitcnt=456 ) 0x0ab1c23d ########### Are these stats since the individual FW was rebooted? Or are they valid for as long as the cluster has been up? As the stats differ greatly between the active FW and the standby FW (and the fact that they do not match) I think I've answered my own question and the stats only persist on a per individual FW basis since the last reboot (so the stats are only 15 days old), but I just wanted to run the question past you guys in case there is a way to get longer term stats. Is there another way to get longer term stats? Thanks in advance! Matt. ... View more

Hi, We're looking to roll out Avaya 9608 handsets to a site that currently do not use IPT. Another team look after the Avaya side of things. I'm on the LAN/WAN side. Site have one large data VLAN but we need several smaller voice VLANs for each building so rather than using DHCP option 242 in the data VLAN to inform the handsets of the voice VLAN, we are using LLDP.  The switches are mostly 3560s and 3750s running 12.2(44)SE6 IPBASE. We are currently testing using a single port/cable. The issue we have is that some phones (brand new out of the box) pick up the voice VLAN, get an IP, register to the call manager and work perfectly while others don't. I'm completely stumped as to why they don't work??? There are plenty of spare IPs in the DHCP pools for the data and voice VLANs. There is no port security so we not hitting an MAC limit. The bad phones correctly pick up the voice VLAN and DHCP discover out but don't appear to get a response. You'd think this was a fault with the DHCP server but why do some phones work and others not?? Helper addresses on the SVI are good. The DHCP servers are offsite but work fine for all other VLANs. Remember - some phones work in this very same port, whilst other do not. We've not implemented IPT using LLDP before (usually just use DHCP option 242 in data VLAN) so folks are starting to point their fingers at this but I'm not convinced - especially as the phone appears to pick up the correct voice vlan. Any help is very much appreciated! Thanks in advance, Matt. ... View more

Hi we have a 2921-VSEC/K9 running c2900-universalk9-mz.SPA.151-4.M4.bin I can't configure any crypto settings. "show licence feature" reveals:- Feature name             Enforcement  Evaluation  Subscription   Enabled  RightToUse ipbasek9                 no           no          no             yes      no securityk9               yes          yes         no             no       yes uck9                     yes          yes         no             yes      yes datak9                   yes          yes         no             no       yes gatekeeper               yes          yes         no             no       yes SSL_VPN                  yes          yes         no             no       yes ios-ips-update           yes          yes         yes            no       yes SNASw                    yes          yes         no             no       yes hseck9                   yes          no          no             no       no cme-srst                 yes          yes         no             no       yes WAAS_Express             yes          yes         no             no       yes UCVideo                  yes          yes         no             no       yes Do I need to 'activate' the securityk9 feature? If so, how please? Many thanks in advance, Matt. ... View more