I'm rolling out dot1x in our environment and during the roll-out, there are certain interfaces that are skipped for various reasons. Is there a way to tell which interfaces don't have dot1x enabled? Lets say I have a fully populated 4510 with 48 port cards. There are about 10 ports that don't have dot1x applied to them. What's the easiest way to find out what these 10 ports are?  ... View more

I have two ISP's and am having an issue when I setup the routing to send all the internet traffic out the second ISP and site-to-site traffic out the first ISP. I'm setup exactly like this guide. http://oasysadmin.com/2013/06/14/cisco-asa-with-dual-isps-one-for-internet-and-one-for-vpn-example/ My DHCP is assinging me the DNS server in my remote office, like it should. So, to get to the internet, I query a DNS server at 10.2.2.0/24, then I should be going out 192.168.1.1 to get the website. But, for some reason it's not doing that. I can see my machine querying the DNS server and see the response, but then I can't see anything about it not pulling up the page. To make matters worse, I'm in a different office and can't see the actual IE screen the user is getting.     Here's the NAT and routes   global (ISP1) 1 interface global (ISP2) 2 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 nat (ISP2) 0 access-list ISP2_nat0_outbound nat (ISP2) 2 0.0.0.0 0.0.0.0 route ISP1 0.0.0.0 0.0.0.0 192.168.1.254 1 route ISP2 10.2.2.0 255.255.255.0 172.16.1.254 1 route ISP2 172.16.2.0 255.255.255.0 172.16.1.254 1 interface Vlan1  nameif inside  security-level 100  ip address 10.1.1.254 255.255.255.0 ! interface Vlan2  nameif ISP1  security-level 0  ip address 192.168.1.1 255.255.255.0 ! interface Vlan12  nameif ISP2  security-level 0  ip address 172.16.1.1 255.255.255.0     access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 access-list ISP1_2_cryptomap extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 access-list ISP2_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 ... View more

I have a WLC 2112 and currently if you plug in a Cisco access point, it will connect to the controller and download the config. I don't like this and want to allow only the AP's that I specify. Anyone could just walk into one of our buildings and plug in an AP and get our entire wireless config. Is there a way in the WLC 2112 to only allow the AP's that I specify to be connected to the controller?             ... View more

I'm trying to block access to dropbox.com on our ASA5510. I have it setup and it blocks dropbox.com just fine. But it is also blocking google.com. I can't figure out why. Here's my config. When it blocks google, it blocks it with the terminated by inspection engine, reason - disconnected, dropped packet.             regex Block_Dropbox "\.dropbox\.com" access-list URL_Filtering extended permit tcp any any eq www access-list URL_Filtering extended permit tcp any any eq https class-map type regex match-any Block_Domains match regex Block_Dropbox class-map type inspect http match-all Block_These_Domains match request header host regex class Block_Domains class-map inspection_default match default-inspection-traffic class-map httptraffic match access-list URL_Filtering policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map type inspect http http_inspection_policy parameters protocol-violation action drop-connection class Block_These_Domains drop-connection policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp policy-map inside-policy class httptraffic inspect http http_inspection_policy service-policy global_policy global service-policy inside-policy interface inside ... View more