Hi all Who knows where the ceritifcate on the ASA can be edited/deleted/renewed which is responsible for the access via ASDM? With the "show crypto key mypubkey rsa" I get all certificates, but none matches with the modulus I can see when I access the ASA with a webbroser to https://asa-name Thank you Markus ... View more

Hi all not a long time ago, Cisco introduced the secret 4 (for enable secret and username), now this secret 4 no longer seems to be an option (within the 3650 switch with the IOS-XE 03.03.01SE. There are the hashes 8 (PBKDF2) and 9 (SCRYPT) instead. For me this is new, is there a documentation which describes the function of these two options 8 and 9? Why is the option 4 no longer availalbe, is there any security concerns? Should be AES-256 as as far as I know, this option is really secure. Thank you Markus ... View more

Hi all We setup two switches WS-C3750X-48T-S, each has a 350W power supply. I connected the power stack cable in the default mode, means I have a total of 700W power available. When I check the datasheet I can see that one switch uses 120W (weighted average). Therefore I would say it would be sufficient if one power supply fails, the two switches still should be online. I am wondering when I run the command "show stack-power" that I have a power budget of 223. Now, when I test it and I power off one device, I still have both switches running but the log messages appears that the stack run under the budget. Does anybody knows why there is a value of 223W (and not 120W) and if this is ok from a redundancy point of view to have only one 350W power supply per switch, so that it is no problem to run both switches even if one power supply fails? Thank you Markus ... View more

Hi all I need to connect from an inside host to a host located in the DMZ zone for DNS queries. The host in the DMZ zone has a static NAT to the outside. The point now is that I would like to connect from inside to the NATed outside address, means to the public Internet address. Inside host: 10.0.0.1 -> PAT for 10.0.0.0/8 to 20.0.0.254 (Outside Interface) DMZ host: 192.168.1.1 -> NAT to outside to 20.0.0.1 The traffic should be 10.0.0.1 udp>1024 to 20.0.0.1 udp=53. The source IP address on the outside interface now is 20.0.0.254 (according to the PAT), the destination IP address 20.0.0.1. The DNS reply from 20.0.0.1 should go back now to 20.0.0.254 and then to the inside host 10.0.0.1. I know that on the PIX it was not possible, to have outgoing traffic on the outside interface which immediately enters again the same interface. Can I realize this scenario with the ASA 8.4(3) release now? Thank you Markus ... View more

Hi all when I migrated the ASA config from 8.2 to 8.3, in all groups the group members has been replaced by the IP address object. However, the "name" for this object has been migrated, but there is the "object network name" configuration missing. What I can do now is that I can open the new created object in the ASDM, search for the object with this IP address and then enter the object name I had before. When I apply the config, ASDM then creates the object and replaces all affected objects in all groups, by replacing the object group memeber "network-object host hostname" with "network-object object hostname". Do you know if there exists an automated way, which checks all the groups for members "network-object host", creates the "object network" and replaces the "network-object hosts" with "network-object object" within the group? As long we have a lot of groups which contains partially > 50 members, this really would be helpful. Thanks for your inputs Markus ... View more