turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Rahul Govindan
Online
Rahul Govindan
Member since
10-28-2015
.jpg){kind=icon}
VIP Advocate
Network Security Engineer/Consultant.
CCIE Security (#29948) and CISSP from ISC2. Cisco Live presenter at CL Melbourne 2015.
1428
Posts
1480
Helpful
315
Solutions
Recent Badges
Awards
2
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
02-14-2019
08:27 AM
02-14-2019
08:27 AM
DNS and Domain is usually a property of the ASA group-policy. So you can set up 2 different group-policies on the ASA so that the DNS and Domain is set specific to that group-policy. You would then tie up Connection profile to group-policy so that the user receives that DNS setting based on the group they chose.
... View more
Created by
Rahul Govindan
in Firewalls
Rahul Govindan
in Firewalls
02-09-2019
12:22 PM
02-09-2019
12:22 PM
To add to what @RJI mentioned, this is almost certainly an issue with the remote end setting. Sometimes, third party devices do route based VPN instead of policy based. This means that they negotiate a local and remote proxy as 0.0.0.0. If this is the case and the ASA is the one initiating the tunnel, the ASA would propose the right proxies, but the remote end still installs 0.0.0.0 in their SA database. ASA obviously creates the SA's with the right proxies. The ASA also has a security check (which many 3rd party devices do not), to check to see if the inner traffic (or actual data through tunnel) matches what we negotiated for in the first place. That is why you are seeing this error message. See if there is a setting to do policy based VPN on the 3rd party VPN device.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
02-05-2019
07:50 AM
02-05-2019
07:50 AM
My guess is that the Windows 10 systems are being defaulted to Windows 8 because of the bug I mentioned earlier (no support for Windows 10 on ASDM below 7.4). Since they match Windows 8 incorrectly, they are getting through.
Another bug was opened for Windows 10 machines incorrectly matching as Windows 8 in an older hostscan version.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuv82622
I do not know if that applies to you based on your version. I would suggest opening a TAC case to have them confirm this.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
02-04-2019
07:14 AM
02-04-2019
07:14 AM
What is your ASA and ASDM version? It could be that the ASDM does not support anything above Windows 8 in endpoint OS, hence defaults everything back to Windows 8. Your AnyConnect hostscan component is correctly detecting Windows 10, so that seems correct.
Looking at this bug, you should be running at least 7.4(1) ASDM version.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCur90915/?rfs=iqvred
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
01-29-2019
06:13 AM
01-29-2019
06:13 AM
There is a 12 second default timeout for the AnyConnect authentication prompt. This is controlled by the AnyConnect profile setting. You might want to change it to 60 seconds or so.
There are also timeouts for the ASA to reach the AAA server like @RJI mentioned. But which timeout plays a role depends on at what point he/she faces the timeout. If the timeout happens when the prompt is up, then it is the Authentication timeout I mentioned above. If it is something after the username/password is sent, then it is most likely a AAA server timeout.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
01-24-2019
06:41 AM
01-24-2019
06:41 AM
Can you share the tunnel-group and group-policy settings that you have configured? IF the user has chosen tunnel-group B from the drop-down, they should always be on that group. Group-policy can change based on AD attributes like AD group membership, but not tunnel-group.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
01-24-2019
06:38 AM
01-24-2019
06:38 AM
Look at "show vpn-sessiondb detail anyconnect". This should show you the current idle timeout set for the user and how much of that remains. Idle timeout is hit when there is no data from the client received on the ASA. But there are always background process sending network data that is transparent to the user. A good way to troubleshoot this is to have the user connect and watch the output multiple times.
... View more
Created by
Rahul Govindan
in VPN and AnyConnect
Rahul Govindan
in VPN and AnyConnect
01-24-2019
06:06 AM
01-24-2019
06:06 AM
If you want to utilize the UPN to login to the AnyConnect client, you can change the LDAP configuration of the ASA to use UPN as the naming attribute instead of sAMAccountName. Usually your ASA ldap configuration looks something like this:
ciscoasa(config-aaa-server-group)#aaa-server LDAP_SRV_GRP (inside)
host 192.168.1.2
ciscoasa(config-aaa-server-host)#ldap-base-dn dc=ftwsecurity, dc=cisco, dc=com
ciscoasa(config-aaa-server-host)#ldap-login-dn cn=admin, cn=users, dc=ftwsecurity, dc=cisco, dc=com
ciscoasa(config-aaa-server-host)#ldap-login-password **********
ciscoasa(config-aaa-server-host)#ldap-naming-attribute sAMAccountName
ciscoasa(config-aaa-server-host)#ldap-scope subtree
ciscoasa(config-aaa-server-host)#server-type microsoft
ciscoasa(config-aaa-server-host)#exit
Change "ldap-naming-attribute sAMAccountName" to "ldap-naming-attribute userPrincipalName" and users should be able to use there UPN instead of firstname.lastname.
GUI based config referenced below:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98625-asa-ldap-authentication.html
... View more
12-20-2018
07:28 AM
There have been issues in the past related to incompatibility between Java and ASDM versions. What are the ASA and ASDM versions on both the Firewalls? Also, what is the error message when you try to login via ASDM?
... View more
12-20-2018
06:40 AM
The Meraki MX64 should have all these features. For the features you need would just need the Meraki Mx64 hardware (MX64-HW) and Enterprise license (LIC-MX64-ENT-1YR). You can refer the datasheet for more details on this:
https://meraki.cisco.com/lib/pdf/meraki_datasheet_mx.pdf
... View more
Created by
Rahul Govindan
in Firewalls
Rahul Govindan
in Firewalls
12-20-2018
06:17 AM
12-20-2018
06:17 AM
Short answer is no. ASA does not have DDOS protection mechanism built-in as a feature. You can do rate based policy based on source/destination networks/protocols etc, but the whole idea of DDOS is that it is distributed to source from different networks. Plus the ASA5508 is one of the lower end models, so it would not be able to take a high volume of traffic that is usually seen in a DOS attack. Arbor and Radware are more suited for DDOS protection.
... View more
12-20-2018
06:12 AM
In most cases, there is just 1 logical device per chassis, so you are not sharing resources among multiple logical devices. You cannot run the ASA software directly on the chassis if that is what you were asking.
Once the Firepower chassis and ASA is setup, it is managed like a traditional ASA - all the features and configurations are exactly the same. I have only used to chassis management post-deployment if I need to upgrade the FXOS. This is usually to maintain compatibility between the chassis and logical device.
... View more
12-20-2018
06:07 AM
To add to what @Marvin Rhoads mentioned, if you just copied your config from your old Firewall to the new one, then your DAP rules might not have copied over. DAP configuration is a combination of dap.xml files and ASA commands. You need to do a backup and restore to get the full copy of all files to the new Firewall.
... View more
12-20-2018
06:00 AM
Setting up a Firepower 4100 or 9300 has 2 major sections to it. One is the FXOS setup. This is sort of like a hypervisor running on the chassis. It has a separate management interface and other settings specific to the chassis. The ASA is installed as a logical device on top of the FXOS. Once the ASA is installed as a logical device (including specifying which chassis interfaces are going to be used for the ASA), the rest of the configuration is just like the ASA code running on the 55xx series. You can ssh or use ASDM as you used to do before. The reason you have to do this is because the Firepower devices have the capability to run ASA or FTD as logical devices on top of it. It just depends on what you install as a logical device.
... View more
Created by
Rahul Govindan
in Other Security Subjects
Rahul Govindan
in Other Security Subjects
12-17-2018
06:13 PM
12-17-2018
06:13 PM
As a part of the Umbrella deployment, you specify your internal domains on the dashboard. Internal domains are resolved by your own DNS server (whether a Roaming Client or Virtual appliance deployment), while external domains are resolved using Umbrella.
https://docs.umbrella.com/deployment-umbrella/docs/appx-d-internal-domains
... View more
Created by
Rahul Govindan
in Identity Services Engine (ISE)
yesterday
yesterday
Ok, makes sense. Can you paste the ASA side config for that
tunnel-group? Also, do you have the ASA ...
yesterday
DNS and Domain is usually a property of the ASA group-policy. So you can
set up 2 different group-po...
Created by
Rahul Govindan
in Identity Services Engine (ISE)
yesterday
yesterday
Does DUO auth proxy also tie to the backend AD? IF yes, I believe you
can set ISE as only your autho...
Created by
Rahul Govindan
in Firewalls
Saturday
Saturday
To add to what @RJI mentioned, this is almost certainly an issue with
the remote end setting. Someti...
Created by
Rahul Govindan
in VPN and AnyConnect
a week ago
a week ago
My guess is that the Windows 10 systems are being defaulted to Windows 8
because of the bug I mentio...
Created by
Rahul Govindan
in VPN and AnyConnect
2 weeks ago
2 weeks ago
What is your ASA and ASDM version? It could be that the ASDM does not
support anything above Windows...
2 weeks ago
How are you selecting the client certificate to be sent to the gateway?
Do you have an AnyConnect cl...
Created by
Rahul Govindan
in VPN and AnyConnect
2 weeks ago
2 weeks ago
There is a 12 second default timeout for the AnyConnect authentication
prompt. This is controlled by...
Created by
Rahul Govindan
in VPN and AnyConnect
3 weeks ago
3 weeks ago
Can you share the tunnel-group and group-policy settings that you have
configured? IF the user has c...
Created by
Rahul Govindan
in VPN and AnyConnect
3 weeks ago
3 weeks ago
Look at "show vpn-sessiondb detail anyconnect". This should show you the
current idle timeout set fo...
3 weeks ago
If you want to utilize the UPN to login to the AnyConnect client, you
can change the LDAP configurat...
12-20-2018 07:28 AM
There have been issues in the past related to incompatibility between
Java and ASDM versions. What a...
12-20-2018 06:40 AM
The Meraki MX64 should have all these features. For the features you
need would just need the Meraki...
Created by
Rahul Govindan
in Firewalls
12-20-2018 06:17 AM
12-20-2018 06:17 AM
Short answer is no. ASA does not have DDOS protection mechanism built-in
as a feature. You can do ra...
Public Statistics
| Date Registered | 10-28-2015 01:28 PM |
| Date Last Visited | 02-15-2019 06:08 AM |
| Total Messages Posted | 1,428 |
| Total Helpful Votes Received | 1480 |
Helpful Votes Given To
Helpful Votes From
Awards
Cisco Designated VIPs
2018 AAA Firewalling VPN
Cisco Designated VIPs
2019 VPN, Firewalls
