Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Jason Gervia
Jason Gervia
Member since
08-27-2007
Cisco Employee
Former Cisco VPN TAC engineer
Biography from communities:
CCIE 26894
Created by
Jason Gervia
in Firewalls
in Firewalls
08-06-2018
01:04 PM
08-06-2018
01:04 PM
You're in the wrong community - I'd try posting this in Network Architecture.
However, you could use Cisco Management solutions like Cisco Prime, Cisco Security Manager, to accomplish this. Also possibly using something like EEM.
... View more
Created by
Jason Gervia
in Firewalls
in Firewalls
08-06-2018
12:59 PM
08-06-2018
12:59 PM
The logs you've posted indicate that he connectivity is there and the file is downloading correctly and attempting to install - there is some other issue at this point.
My recommendation would to open a TAC case as there may be a hardware issue. The only hits/times I've seen this before we've had to RMA the ASA-SM1. That may not be necessary in this case, but TAC should be able to verify.
... View more
Created by
Jason Gervia
in Firewalls
in Firewalls
07-13-2017
10:59 AM
07-13-2017
10:59 AM
You can't send any traffic out a span port on firepower. Passive ports don't send traffic. If you do decrypt on Firepower, the 80% hit on throughput because everything is running on Software needs to be factored in. As long as you do that, you should be OK. At some point the encryption chips to enable SSL decryption in the FTD platforms will be enabled, and then the throughput should go up for SSL.
... View more
Created by
Jason Gervia
in Firewalls
in Firewalls
07-05-2017
05:26 PM
07-05-2017
05:26 PM
This should be do-able - just set up a normal site to site VPN tunnel for the one that is reachable via a static IP address, and for the internet one use a dynamic crypto map entry as the last entry if the public IP address is going to change, like the configuration below: ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example - Cisco I'm assuming that you're doing this on the same interface, not 2 different ones. If it's 2 different interfaces then you'll have 2 different crypto maps (1 assigned to each interface), and if the public IP address for the peer changes, then use the dynamic crypto map option on the interface facing the internet.
... View more
06-29-2017
07:00 AM
I'd probably just use load sharing using zones and ignore the vlans unless there is a business reason to do so: CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.3 - Traffic Zones [Cisco ASA 5500-X Series Fi… But what you want to do is possible. Check the 'verify availability' portion of this link: http://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/route-policy-bas… From the doc: Verify if the next IPv4 hops of a route map are available: set ip next-hop verify-availability next-hop-address sequence_number track object You can configure an SLA monitor tracking object to verify the reachability of the next-hop. To verify the availability of multiple next-hops, multiple set ip next-hop verify-availability commands can be configured with different sequence numbers and different tracking objects.
... View more
06-23-2017
06:39 PM
Looks like the AMP process was timing out in windows. Maybe high CPU or something going wrong on the machine. I'd probably reboot the machine and see if it resolves the issue. Otherwise, open a case with TAC to get a professional triage of the issue
... View more
Created by
Jason Gervia
in Policy and Access
in Policy and Access
06-23-2017
09:33 AM
06-23-2017
09:33 AM
Typically, you could open a TAC case and TAC could do it, or go through your account team. However, given the fact that EOS is already announced for ACS 5.8, I'm not sure how good the odds are of it getting fixed/modified. Cisco Secure Access Control System 5.8 - Cisco
... View more
Created by
Jason Gervia
in Firewalls
in Firewalls
06-23-2017
09:22 AM
06-23-2017
09:22 AM
There's a good diagram in this thread on the learning network: ASA order of operations (pre-8.3 and post 8.3) - 46543 - The Cisco Learning Network
... View more
Created by
Jason Gervia
in Firewalls
in Firewalls
06-22-2017
08:50 AM
06-22-2017
08:50 AM
Not sure if that is supported yet. Not mentioned in the quick-start guide for FTDv. Cisco Firepower Threat Defense Virtual Quick Start Guide for the AWS Cloud - Cisco
... View more
Created by
Jason Gervia
in Firewalls
in Firewalls
06-22-2017
08:24 AM
06-22-2017
08:24 AM
Just to be clear, FDM is an on-box manager that allows you to manage the firewall without a centralized manager like the FMC. It's available on all the ASAs (with the exception of the 5585) running FTD and the Firepower 2100 platform Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.1 - Getting Started [Cisco …
... View more
Created by
Jason Gervia
in Security Blogs
in Security Blogs
06-22-2017
07:34 AM
06-22-2017
07:34 AM
Cisco LIVE Please note that the 2017 Las Vegas sessions may not have video posted yet, so I've posted some sessions from Berlin. A Deep Dive into using the Firepower Manager (2017 Las Vegas) Dissecting Firepower-NGFW(FTD) - Installation & Troubleshooting (2017 Las Vegas) Firepower NGFW Deployment in the Data Center and Enterprise Network Edge using FTD (2017 Las Vegas) Firepower Platform Deep Dive (2017 Las Vegas) Firepower NGFW Internet Edge Deployment Scenarios (2017 Las Vegas) Dissecting Firepower-NGFW(FTD) & Firepower-Services: Design & Troubleshooting (2017 Berlin) ASA Firepower NGFW typical deployment scenarios (2017 Berlin) A Deep Dive into using the Firepower Manager (2017 Berlin) Videos On Firepower Videos by Jason Maynard, CISCO CSE Channel - https://www.youtube.com/channel/UCwnm1oSSz8pPwDyfzFS5k3w Playlist FMC 6.1 - https://www.youtube.com/playlist?list=PLyf18hdY22ETbPh-0RtjESZvrrlprOy6M FMC 6.2 - https://www.youtube.com/playlist?list=PLyf18hdY22EQzOIa0h5k5CFGykoNLBhTm FMC for Network Administrators: FMC 101: A Network Administrators Perspective - YouTube Cisco TME Channel: Securing Networks with Cisco Firepower Threat Defense - YouTube Firepower Training: Cisco: Security Training - Cisco You should look at the following classes to see which ones fit your needs in the link above: SECUR201 2 day - ISE/Firepower/Stealthwatch/AMP https://learninglocator.cloudapps.cisco.com/courseDetails.do?actionType=executeCourseDetail&courseID=8504 FirePower 200 5 days on Firepower Threat Defense (FTD) NGFW https://learninglocator.cloudapps.cisco.com/courseDetails.do?actionType=executeCourseDetail&courseID=8448 SSFIPS - 5 days on Firepower NGIPS https://learninglocator.cloudapps.cisco.com/courseDetails.do?actionType=executeCourseDetail&courseID=8000 Some 3rd party training links found online: https://www.lammle.com/firepower/ Learn Cisco Sourcefire Firepower Intrusion Prevention System | Udemy Firepower Books: Amazon.com: Cisco Firepower 6.x with Firepower Threat Defense eBook: Todd Lammle, Alex Tatistcheff: Kindle Store Amazon.com: SSFIPS Securing Cisco Networks with Sourcefire Intrusion Prevention System Study Guide: Exam 500-285 eBook: … Firepower Documentation: Configuration Documentation: Cisco Firepower Management Center - Configuration Guides - Cisco Navigating the Cisco FXOS Documentation - Cisco Quick Start Guides: Cisco Firepower Threat Defense for Firepower 9300 Quick Start Guide Cisco ASA for Firepower 4100 Quick Start Guide Hardware Installation Guides: Cisco Firepower 4100 Series Hardware Installation Guide Cisco Firepower 9300 Hardware Installation Guide - Cisco
... View more
Labels:
03-05-2012
06:14 AM
The only command line that I know of is to use the vpncli.exe - but that is only to connect. As Marvin said, you can configure the XML files (either on the ASA, or manually edit them on your machine) but there is no 'command line' on the anyconnect client.
... View more
03-02-2012
12:37 PM
I guess what I'm really interested in is managing a large amount of gateways using either protocol - if there are any differences that would lead me one way vs another if you had a large amount of gateways and a small amount of people to manage them. --Jason
... View more
03-02-2012
11:26 AM
Hello Everyone! We are currently upgrading from CUCM 6.x to 8.6. One of the discussion points has been upgrading our voice gateways (about 200+ of them) from mgcp to h323. I'm a little leery of this given having to manually configure router patterns on each h323 gateway vs doing them on call manager. Are large voice deployments using mgcp vs h323 for the gateways? If so, can you give good reasons why? Thanks in advance, --Jason
... View more
Labels:
Created by
Jason Gervia
in Firewalls
08-06-2018 01:07 PM
08-06-2018 01:07 PM
Do you have the output from a 'show run failover' command?
Created by
Jason Gervia
in Firewalls
08-06-2018 01:04 PM
08-06-2018 01:04 PM
You're in the wrong community - I'd try posting this in Network
Architecture. However, you could use...
08-06-2018 12:59 PM
The logs you've posted indicate that he connectivity is there and the
file is downloading correctly ...
07-13-2017 10:59 AM
You can't send any traffic out a span port on firepower. Passive ports
don't send traffic.If you do ...
Created by
Jason Gervia
in Firewalls
07-05-2017 05:26 PM
07-05-2017 05:26 PM
This should be do-able - just set up a normal site to site VPN tunnel
for the one that is reachable ...
06-29-2017 07:00 AM
I'd probably just use load sharing using zones and ignore the vlans
unless there is a business reaso...
06-23-2017 06:39 PM
Looks like the AMP process was timing out in windows. Maybe high CPU or
something going wrong on the...
Created by
Jason Gervia
in Policy and Access
06-23-2017 09:33 AM
06-23-2017 09:33 AM
Typically, you could open a TAC case and TAC could do it, or go through
your account team. However, ...
Created by
Jason Gervia
in Firewalls
06-23-2017 09:22 AM
06-23-2017 09:22 AM
There's a good diagram in this thread on the learning network:ASA order
of operations (pre-8.3 and p...
Created by
Jason Gervia
in Firewalls
06-22-2017 08:50 AM
06-22-2017 08:50 AM
Not sure if that is supported yet. Not mentioned in the quick-start
guide for FTDv.Cisco Firepower T...
Created by
Jason Gervia
in Firewalls
06-22-2017 08:24 AM
06-22-2017 08:24 AM
Just to be clear, FDM is an on-box manager that allows you to manage the
firewall without a centrali...
Created by
Jason Gervia
in Security Blogs
06-22-2017 07:34 AM
06-22-2017 07:34 AM
Cisco LIVEPlease note that the 2017 Las Vegas sessions may not have
video posted yet, so I've posted...
03-05-2012 06:14 AM
The only command line that I know of is to use the vpncli.exe - but that
is only to connect. As Marv...
03-02-2012 12:37 PM
I guess what I'm really interested in is managing a large amount of
gateways using either protocol -...
Public Statistics
| Date Registered | 08-27-2007 05:27 PM |
| Date Last Visited | 10-04-2018 07:55 AM |
| Total Messages Posted | 240 |
| Total Helpful Votes Received | 151 |
Helpful Votes Given To
Helpful Votes From
