You should be able to just use the 'prompt' command in config mode. A limitation is that it doesn't show the modified prompt at config mode. You could use something like this: 3560cx(config)#prompt %h.Hamburg%p This will take the existing hostname, append it with .Hamburg then add the prompt character based on your current level, > or #. So when you exit out of config mode, it should show: 3560cx.Hamburg# But if you go back to config mode, it will switch away from the custom prompt: 3560cx(config)# ... View more

When you say client, are you talking about a specific endpoint, like a computer? It probably will not trigger a new request. When layer 1 drops, like a shut/no shut on an interface, most endpoints will go through the DHCP process again. Shutting an SVI wouldn't cause L1 to reset on an interface. ... View more

I've followed the instructions in this guide but it's not quite working. I do see my client attempt to connect prior to Windows login but the SSL sessions terminates immediately. We use machine certs for VPN so the cert is present on the endpoint. Is there something not included in this document that needs to be completed before the management tunnel works? ... View more

Why did you decide not to use BGP? iBGP between your routers and eBGP to each provider, you could accept provider routes plus the default from both ISPs, which would give you some amount of load sharing based on the destination. Full tables would provide even better load sharing but that takes more resources on the router. Then configure HSRP or VRRP on your edge routers and point the firewall at that address for it's next hop. ... View more

There's a keyring set up with different peers. I've included the hub and spoke below. But my configuration won't work the way you want since I define the peer specifically by hostname. If the spokes ever change names, I would need to update my hub keyring.  You could just set it for the domain.com only instead of the hostname.domain.com HUB: crypto ikev2 keyring HUB-KEYRING peer SPOKE-1 identity fqdn SPOKE-1. xxxxx.com  pre-shared-key <key> (or you could try) peer ALL-SPOKES identity fqdn domain  xxxxx .com    pre-shared-key < key>   SPOKE: crypto ikev2 keyring SPOKE -KEYRING peer HUB address <HUB address> identity HUB.xxxxx.com pre-shared-key <key> ... View more

Is there a reason you're using the @ symbol in the fqdn? If you use something like the below config using a dot and and specify remote fqdn, it should work by just matching the domain.  I'm using this for ikev2 with DMVPN and it works fine.   HUB crypto ikev2 profile IKEV2_PROFILE  match identity remote fqdn domain cisco.com  identity local fqdn HUB.cisco.com   SPOKE1 crypto ikev2 profile IKEV2_PROFILE  match identity remote fqdn cisco.com  identity local fqdn Client1+AB233422.cisco.com ... View more

Always On requires a Windows login before it launches. It's a listed limitation and I observed it during testing.  Again, I'm looking for VPN to launch automatically, pre Windows login, with no user interaction. Neither SBL nor Always On can provide this. ... View more

@Shakti Kumar   Thanks for the reply. SBL does not do what I want. It requires the user to take action for the tunnel to engage. I don't want the user to click another button to log in to Anyconnect, followed by having to actually log in to Windows. Asking users to double login won't work for us. At least one other vendor has an automated VPN connection before login with no user action necessary. ... View more