Hi Manel, There are definitely related material to design a Multi-Tenant Data Center (And provide IaaS etc) in addition to Data Center Interconnect (DCI), which covers your requirement of connecting Data Centers. 1. Multi-Tenancy (Using Cisco Validated Design) http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns743/ns1050/white_paper_c11-714729.html 2. Data Center Interconnect http://www.cisco.com/en/US/netsol/ns975/index.html Thanks, Naman ... View more

Hi Steve, This is more of a VMWare\vCenter operation question and I would recommend confirming this in the appropriate forums. However as per my understanding that during vMotion the MAC address will "not" change and that is not a problem since this is being handled by vCenter and there uniqueness is preserved. However if you are importing a VM from a different vCenter environment then this is more of a Copy operation and in that case vCenter will assign a new MAC address. See below, if this explains it better http://communities.vmware.com/thread/303497 Thanks, Naman ... View more

Hi Steve, Typically when using more than one ESXi host, you would use vCenter to manage all the hosts, create new VMs etc. In this case vCenter itself makes sure that no duplicate MAC addresses are being assigned to different VMs. If you are using different ESXi hosts and still not using vCenter due to some reason then you would have to treat each environment uniquely. In this case there will not be a common vSwitch among the ESXi hosts, however you might need to modify the MAC pool on each ESXi hosts to make it unique across your environment. Thanks, Naman ... View more

Hi Sebastian, Various products in Cisco portfolio provide security for Virtual machines from where the traffic enters the Data Center and then all the way up to the Virtual machine. The solution can be pure virtual,physical or a combination of both. E.g. 1. Cisco ASA Firewall and ASA Service Module provide typical Layer-3,4 filtering with limiated Layer 7 inspection. ASA appliance can be installed with an IPS module to have deeper inspection and Application layer security. 2. Virtual Security Gateway (VSG) - Is a virtual appliance, which is Virtual Machine attributes aware and can implement policies based on Layer3\4 attributes but also on VM specific attributes like Name, OS Name etc. This works in conjunction with Nexus 1000v. 3. Virtual ASA (vASA) - Is a virtual appliance which provides a complete virtual solution, when used with VSG and N1K. See below URLs for more information. http://www.cisco.com/en/US/products/ps11208/index.html http://www.cisco.com/en/US/netsol/ns340/ns394/ns224/ns376/index.html In addition to above appliances, many software features on Nexus hardware (when used as DC switch) can provide more security through the use of TrustSec. http://www.cisco.com/en/US/netsol/ns1051/index.html Thanks, Naman ... View more

Hi Irina, Multi-tenancy can be provided through the use of VLANs, VRF-Lite, ASA firewall contexts and so on. Cisco has validated design for "Virtual Multi-Service Data Center" (VMDC) , which covers various options in more detail. You can fnd this information at http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns743/ns1050/landing_vmdc.html HTH Naman ... View more

Hi Sarah, Yes. Trustsec can definitely be used in a Data Center environment. For devices, which natively support Security Tags (SGTs) like Nexus, it can make it easier to deploy firewall policy enforcement rules. Other devices like 6500 can still work with Trustsec using SXP. Below URL provides more info http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html HTH Thanks, Naman ... View more

Hi Dimitri, 1. You can use "Network Access Manager" for preferring a Wired connection over Wireless. AnyConnect itself doesn't have any control over selecting the adapater and will just use the Windows routing table for sending traffic. Usually the Metric for WLAN adapter's default router is higher than Wired, so a Wired connection is preferred in any case.  See below for more information on NAM http://www.cisco.com/en/US/partner/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/ac04namconfig.html 2. For Symantec Endpoint Protection, you will still select Symantec. I have seen this working , so there might be a mis-configuration OR Maybe "Cisco Secure Desktop" is unable to detect the presence of Symantec product. This can be confirmed by running "debug dap trace" on the ASA. Please Note that Cisco Secure Desktop need to be enabled for this to work. 3. With AnyConnect 3.0 the licensing information is as below http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/data_sheet_c78-527494.html (See section 'Cisco AnyConnect Secure Mobility Client Licensing Options' ) The license is based on Simultaneous AnyConnect Client (And doesn't rely on SSL or IKEv2 as the underlying transport mechanism). Also note that HTTPS need to be enabled on the Headend (Even when using IKEv2) for pushing Profiles, Host Scan Checks etc. Thanks, Naman ... View more

Hi Juarez, This forum is for AnyConnect issue but your question is more related to configuring the Access Point. As per my knowledge, this can be done by "Not Broadcasting the SSID", which is a feature\configurable option in the Wireless Access Point GUI. However if you still have any questions then I will suggest to post your question in the "Wireless - Mobility" forum. Hope this helps. Thanks, Naman ... View more

Hi Tony, Thanks for participating in the discussion. 1. AnyConnect connection reporting\accounting is done at the ASA. You can configure RADIUS accounting on the ASA and you will be able to tell when\how long the AnyConnect client stayed connected etc. More information on configuring RADIUS accounting is at http://www.cisco.com/en/US/partner/docs/security/asa/asa84/configuration/guide/access_aaa.html#wp1047241 Please note that you will also need to use RADIUS Authentication for VPN Users in order to user Accounting. As for keeping track of the Users on what Servers they access etc, this cannot be done on the ASA. However you can use VPN-Filters to restrict Users to only specific servers etc. 2. You can definitely configure idle time-out for Users. This can be configured on a Per-Group Policy basis. More information below http://www.cisco.com/en/US/partner/docs/security/asa/asa84/configuration/guide/vpn_groups.html#wp1140327 (See Section 'Configuring the Idle Timeout' ) Hope this helps. Thanks, Naman ... View more

Hi, The connection attempt from NAM is not user initiated. After you have configured the profiles for NAM the connection is attempted when network is available (E.g. LAN cable plugged-in Or Wireless Network available etc) If you have a valid connection before logon (E.g. When user is at a corporate location) then User logs-on to the domain and all scripts\GPO should work as in a normal logon. If you are at a remote location then you can either logon using "Cached" domain credentials , since the domain is not going to be available OR You can also use the AnyConnect SBL (Start before Log-On) feature alongwith NAM so you are connected to the ASA and have VPN connectivity to the domain before log-on to the PC. More information on NAM it at http://www.cisco.com/en/US/partner/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/ac04namconfig.html AnyConnect SBL at http://www.cisco.com/en/US/partner/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/ac03vpn.html#wp1134595 Thanks, Naman ... View more

Hi, The bug\enhancement for this issue is shown to be fixed. It should be available in the next release of AnyConnect (Release after the current 3.0.1047 version). The current schedule shows this to be released end of this month. You can also contact your Cisco Account and they might be able to provide more detailed information. Thanks, Naman ... View more

Hi, Thanks for participating in this session. Can you describe in a little more detail on what will be the purpose\objective for this ? AnyConnect already supports TND (Trusted Network Detection), which when used with Always-On enables a Client to automatically connect to the Headend ASA when the PC is not on the trusted network. The trusted network detection is based on assigned DNS suffix (e.g. domain.com etc) Or DNS Server's IP address. Are you looking something further than this ? Where anyconnect decides on the trusted network by not looking at DNS information but instead getting that information from Windows 7 Location services ? Thanks, Naman ... View more

Hi, Can you access the below link ? http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_cfg_ldap.pdf You might need to login using your CCO credentials to access the documents. Thanks, Naman ... View more

Hi Miro, AnyConnect itself without the NAM module cannot control the LAN\Wireless adapters. If you want to control the Wireless connection then I guess the best way will be to use NAM then you can control the SSID to which Users are allowed to connect by pushing specfic NAM profiles through ASA etc. Hope this helps. Thanks, Naman ... View more

Hi Joceyln, Did you change the "DfltAccessPolicy" action in DAP to 'terminate' ?  If the User doesn't match the Custom DAP , which you created then it will go to the Default Policy and its action should be set to terminate. I would also need to see the output from "debug dap trace" from the ASA, when you connect. This will give us some useful information on what is being detected by CSD. Please note that you might want to open a TAC case to troubleshoot this , if you are un-comfortable in posting your network configuration\debugging on the Public forum. Thanks, Naman ... View more