Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About arnert
Stats
Member since
07-21-2016
32
Posts
10
Helpful
0
Solutions
11-04-2019
10:37 AM
BTW -> this thread started in 2008! 04-21-2008 05:19 PM exactly, this is pretty pathetic.
... View more
11-04-2019
10:24 AM
Yes, I agree these are just tactics to get you to buy something else. We are a Cisco shop but we have quickly bought a number of PAN devices. It's been like this since the early 90's.
... View more
07-17-2019
02:06 PM
The WSA and ESA are also very expensive. Just wondering if we really need it. If we had an array of them I could see it. Where's the beef?
... View more
07-17-2019
11:55 AM
My company is evaluating the extra cost of purchasing SMA. What will it give us that we don't already have? We have little problems with our ironports. We have 2 ESA's and 2 WSA's? Why can't we just use Splunk app or even a SYSLOG tool? It's just another box to manage with limited staff and critical email and web services. We don't cluster and we use explicit proxy. We are much more interested in Umbrella and improving security with the Cisco cloud at some point. Why spend the $ when we are to the cloud? Licensing the security controls is very expensive. Why? that is the question. thx
... View more
05-09-2019
01:42 PM
On our network we upgraded our 5525-X(s) last year to 9.10(1). This greatly improved the cipher strength and compliance issues and concerns. A major upgrade late in the year 2018. We use the ASA's as VPN concentrator's only, running a current version of AnyConnect, using Machine Certificates RSA SecureID user names and passwords, (SDI) in addition to TLS1.2. I am hesitant from experience to load just released firmware in general for support and uptime reasons. This release seems to fix a number of bugs over a number of few years. What is the chance of this image 9.12 causing stability issues for the ASA(s)? We have little choice but to patch against any and all threats, every month? WIYO? Any input appreciated!
... View more
04-29-2019
10:11 AM
Doesn't appear that there is, the solution the community is hoping for seemingly is different then what Cisco's product path plan is. Apparently. No other way to read this. IMO.
... View more
04-29-2019
07:28 AM
You should probably provide more info about your config. I think the issue is users that have ipam installed and use it to control names and addresses. They need a solution that will management dynamic the ip reservations within that database and network. Setting hundreds of arps on the unit is not going to be a great scale able solution. Please correct me if I am wrong. I think the original problem and it's been awhile, is the headend needs to not replace the mac address with it's own. Other dhcp products won't do that. Again correct me if I am wrong.
... View more
04-03-2019
12:40 PM
My tunnels are negotiating properly also. dtlsv1.2 is up and running.
... View more
Created by
arnert
in Policy and Access
in Policy and Access
04-03-2019
12:14 PM
04-03-2019
12:14 PM
Ok, so I understand that MFA authentication is only provided by 3rd parties vendors. For a RSA and a ISE cisco shop (our enterprise). What are 2fa options available other than these companies? And if not. Is there a known configuration to configure a local certificate map to filter non network admins when using RSA to run ssh or asdm? Our RSA db is not connected to ldap. Additionally: Can ISE proxy the RSA/SDI communication similar to how we have our Anyconnect clients currently configured. MFA is easier using the remote access config because the server instance can do certificate plus username and password. thx marvin. Struggling here with 800-171 issues.
... View more
Created by
arnert
in Cisco Bug Discussions
in Cisco Bug Discussions
01-30-2019
11:33 AM
01-30-2019
11:33 AM
Does this CSC#/issue imply that a blanket no split tunneling policy is not possible with IPV6 at this point in ASA/AnyConnect releases? Any one have any feedback on this?
... View more
Labels:
12-17-2018
10:51 AM
This new thread denotes a possible MTU bug with the new client. Has any one else seen this? https://community.cisco.com/t5/vpn-and-anyconnect/anyconnect-4-7-00136-significant-mtu-bug/m-p/3764323 javentre Beginner Beginner 12-15-2018 06:34 AM AnyConnect 4.7.00136 - Significant MTU bug There is a fairly major bug in AnyConnect 4.7.00136 regarding the tunnel MTU. If DTLS is enabled, it will send packets that are too big and many applications break. Ignoring the df-bit and/or specifying a low MTU doesn't workaround the issue. Disabling DTLS is the only workaround. Syslog may show a flood of errors like this, where the packet is most often 16 bytes larger than the threshold.: 14 Dec 08 2018 20:06:33 722035 Group <ar-6> User <IC005654> IP <198.18.3.45> Received large packet 1276 (threshold 1260).
... View more
12-13-2018
10:30 AM
I am going to load v9.10.1 on one production 5525 this weekend to test out compatibility, I was wondering if any version of Anyconnect 4.x will work with the release? Currently running 4.6.3 and tested AC 4.7 on one machine. We don't have a lab. This ASA is not a busy as others. We are using Machine Certs and RSA SDI prox-ied thru ISE. In essence just username and password (RSA) with Machine Certificate Authentication. Our AC client is v4.4.03034. This should work just fine? Is this also the case? (I am little hesitant about it) If v4.6.02074 works I don't see why not? ? -> 'With the release of v9.10.1, has anyone been able to get DTLSv1.2 working with AnyConnect sessions? (Our clients are v4.6.02074)' Thanks for the Help to all!
... View more
12-13-2018
08:43 AM
I have scanned the requirements. Anyconnect 4.7 is required to enable TLS1.2. Do you also have to have a ECDHE Public Certificate? I am a little confused. There is a requirement for cipher strength in the documentation that I saw. Is this the case? 'ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384'
... View more
12-12-2018
07:44 AM
We have recently had issues with the VPN Downloader and are going use the Bypass downloader attribute on our SSL/TLS/DTLS ASA headends with client services disabled for our network. One ASA is using IKEv2 as the tunneling protocol, the question is. Can we disable the client services listener in this situation? I saw some where that Client Services is a requirement for IKEV2 Anyconnect client tunnels! Is this true?
... View more
12-06-2018
07:35 AM
Marvin, the config print out from your lab lists the the DTLS tunnel as using TLS 1.1 and SHA1. Was this an oversite in the thread?
Solved: Re: AnyConnect new feature - DTLSv1.2 - Cisco Community
DTLS-Tunnel:
Tunnel ID : 5.3
Assigned IP : 172.31.1.211 Public IP : 192.168.0.107
Encryption : AES256 Hashing : SHA1
Ciphersuite : DHE-RSA-AES256-SHA
Encapsulation: DTLSv1.0 UDP Src Port : 51520
UDP Dst Port : 443 Auth Mode : userPassword
Idle Time Out: 30 Minutes Idle TO Left : 29 Minutes
Client OS : Windows
Client Type : DTLS VPN Client
Client Ver : Cisco AnyConnect VPN Agent for Windows 4.7.00136
Bytes Tx : 15114 Bytes Rx : 34217
Pkts Tx : 117 Pkts Rx : 273
Pkts Tx Drop : 0 Pkts Rx Drop : 0
... View more
11-04-2019
BTW -> this thread started in 2008! 04-21-2008 05:19 PM exactly, this is
pretty pathetic.
11-04-2019
Yes, I agree these are just tactics to get you to buy something else. We
are a Cisco shop but we hav...
07-17-2019
The WSA and ESA are also very expensive. Just wondering if we really
need it. If we had an array of ...
07-17-2019
My company is evaluating the extra cost of purchasing SMA. What will it
give us that we don't alread...
05-09-2019
On our network we upgraded our 5525-X(s) last year to 9.10(1). This
greatly improved the cipher stre...
04-29-2019
Doesn't appear that there is, the solution the community is hoping for
seemingly is different then w...
04-29-2019
You should probably provide more info about your config. I think the
issue is users that have ipam i...
04-03-2019
Ok, so I understand that MFA authentication is only provided by 3rd
parties vendors. For a RSA and a...
Created by
arnert
in Cisco Bug Discussions
01-30-2019
01-30-2019
Does this CSC#/issue imply that a blanket no split tunneling policy is
not possible with IPV6 at thi...
12-17-2018
This new thread denotes a possible MTU bug with the new client. Has any
one else seen
this?https://c...
12-13-2018
I am going to load v9.10.1 on one production 5525 this weekend to test
out compatibility, I was wond...
12-13-2018
I have scanned the requirements. Anyconnect 4.7 is required to enable
TLS1.2. Do you also have to ha...
12-12-2018
We have recently had issues with the VPN Downloader and are going use
the Bypass downloader attribut...
Public Statistics
| Date Registered | 07-21-2016 02:19 PM |
| Date Last Visited | 11-05-2019 11:15 PM |
| Total Messages Posted | 32 |
| Total Helpful Votes Received | 10 |
Helpful Votes Given To
.jpg "VIP Advocate"){kind=icon}
