Hi I am looking at disabling TLS V1.0 on our ASAs. I am running ASA Version 9.8 and ASDM Version 7.9. Currently I have 2 IPSEC VPNs and 0 RA VPNs. I can see in ASDM how to change the minimum SSL level to use. So i can change it from here to use atleast TLS 1.1.    What effect will this have on my IPSEC tunnels and my access to the ASA using ASDM. I would make the changes out of hours.    TIA ... View more

Hi I have a simple setup for testing purposes. PC > Switch > Router   VLAN 1 network is 192.168.1.0/24   So by default VLAN 1 is the native VLAN. The PC is configured statically with 192.168.1.50/24 with a gateway of 192.168.1.1 The switchport for the PC is configured as an access port in VLAN 1 The uplink to the router is configured as a trunk port allowing all VLANs The switch itself is configured with a mgmt SVI in VLAN 1 of 192.168.1.10/24 The router interface is configured as a trunk allowing all VLANS with a VLAN 1 SVI (192.168.1.1/24) The router is the root bridge and all ports on the switch are in spanning tree forwarding.   So why can the PC ping the switch, but not the router? The switch can ping both the PC and the router.   The router is managed by the ISP but I have the configs and its just a trunk port with the SVI, however HSRP is configured, probably as their template config as there is not a secondary router. So it gateway IP is virtual, but I cannot ping the physical IP either.   My feeling is this is something to do with the native VLAN 1, as I also alongside this setup configured the same using VLAN 10, as the ISP router already has a VLAN 10 SVI and that works fine. It just does not work on VLAN 1.   I have done the basics, ie sh int status and all ok, sh ip int br, all are up up, spanning tree is forwarding for all interfaces and vlans and no blocked ports, sh int gig xxx, sh int gig xxx switchport etc    I can get the ISP to change the VLAN but just curious why it does not work on VLAN 1.   TIA     ... View more

Hi I have switchport security on all our switches in the DC as requested by our auditors. The issue we however have is the VM Hosts are connected to multiple switchports and so a mac addresses of a vm can move between ports.   This causes mac violations when a mac address moves and the vm does not have connectivity for 5 mins until the mac ages out on the previous port, the aging timer is set to 5 mins for inactivity   I can decrease the timer to 1 min but does port security have any command to allow mac moves like dot1x does?   Im guessing there is no such solution for port security as it may defeat its whole purpose but just trying to get some confirmation if this is the case ... View more

Hi I am using 2 routers in the DC as NTP servers which will be getting their time from the domain controllers. Then all our network devices will be using the 2 routers as a primary and secondary NTP server. I am also looking to configure NTP authentication.   I have the following configuration, is there anything I could add or remove?   NTP SERVERS ntp server x.x.x.x (Internal DC - No Authentication) ntp authentication-key 1 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2 ntp peer y.y.y.y   ntp server y.y.y.y (Internal DC - No Authentication) ntp authentication-key 2 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2 ntp peer x.x.x.x   CLIENT ntp authentication-key 1 md5 xxx ntp authentication-key 2 md5 xxx ntp authenticate ntp server x.x.x.x key 1 prefer ntp server y.y.y.y key 2 ntp trusted-key 1 ntp trusted-key 2 ... View more

Hi I just want to confirm my NTP configuration. I have 2 routers acting as the NTP servers. They are receiving their time from the domain controllers ( ntp server x.x.x.x) . Then all the network devices (Clients) in the business will be configured to use the 2 routers as NTP servers as primary and secondary.   Does the following configuration look correct. Is there anything I can add or remove for best practice?   SERVERS ntp server x.x.x.x ntp authentication-key 1 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2   ntp server y.y.y.y ntp authentication-key 2 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2   CLIENT ntp authentication-key 1 md5 xxx ntp authentication-key 2 md5 xxx ntp authenticate ntp server x.x.x.x key 1 prefer ntp server y.y.y.y key 2 ntp trusted-key 1 ntp trusted-key 2 ... View more