Cisco Context Directory Agent Identity Firewall configuration example. Lab using CDA 1.0.0.011 – patch 1 -> 6     Guillermo González GVE VSE Security gugonza2@cisco.com     NOTE: This document explain with some notes and screenshot sequences the configuration of “Identity Firewall” features using Cisco Firewall based on ASA Software and the Cisco Context Directory Agent.     Goal Install and Configure a Laboratory for testing “Identity Firewall” using Context Directory Agent (CDA) with Active Directory and ASAv.   With Identity Firewall, we can configure access-list and allow/restrict permission based on users and/or groups that exist in the Active Directory Domain.   Documentation   This example was implemented with the aid of the following documents:   Installation and Configuration Guide for CDA, release 1.0: https://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/Install_Config_guide/cda10/cda_install.html   CLI Book 2:  Cisco ASA Series Firewall CLI Configuration Guide 9.10: https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/configuration/firewall/asa-910-firewall-config.html   ASDM Book 2:  Cisco ASA Series Firewall ASDM Configuration Guide, 7.10: https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/asdm710/firewall/asdm-710-firewall-config.html     Lab Environment   CDA version 1.0.0.011 with all patches installed (1 -> 6). ASAv version 9.10 Windows Server 2016 with DNS, DHCP and Active Directory Roles installed and configured. Windows 10 as client stations.   This Lab was installed and configured using VMware Fusion 10.1.5 as Virtual Platform.   Lab Schema CDA Lab – Network Schema.           ... View more

Hi,     Please your help in the following quesitons related to AnyConnect NAM: - Is it possible to disable the "Connections Notifications" in AnyConnect NAM ?   is it possible to configure e profile or modify the Windows Registry to avoid the notification any time the module connects or disconnect to the network ?      - Any time the AnyConnect endpoint connect to the network and try to connect a RDP session the Microsoft RDP request the Credential (twice credentials requirement).  As I understand is a RDP design issue but I just want to verify any workarround today.  Any suggestion ?   Thanks in advance. ... View more

Hi Team, AMP for Endpoint in Windows Connector has the Scanning Settings - Scan Email.  With these feature the Connector can scan the email attachment.  But this feature is not on Mac Connectors.   Is it possible to configure these feature using Policies in Management Console (Protect, Audit, etc.) ? Is Scan Email a feature for all Connectors or specific for Windows Connector ? Thanks in Advance. ... View more

Hi Team, I have a customer asking about maximum limits of Active Directory domains using User Agent or ISE integrations with Firepower. - What is the maximum number of AD using User Agent ? - What is the maximum number of AD using ISE integration ? - Is it possible to have User Agent installed on station or server with more than one AD domain ? Thank for your help. ... View more

Hi Team, I have a partner who is asking me about the number of Active Directory domains supported on Firepower integration using User Agent and ISE. - Is there any limit of Active Directory domains using ISE integration with Firepower ? - What is the limit of Active Directory domains using User Agent with Firepower ? - What is the limit of Active Directory domains using ISE with Firepower ? - Is it possible to combine multiple domains using User Agent or ISE with Firepower ? - With User Agent, is it possible to install the Agent in the same machine with multiple domains ? Thanks in advance. Guillermo. ... View more

Hi Team, I´m working with some RFP questions.  The customer has implemented Firepower 4140 and they was waiting hardware acceleration support to implement SSL policies. Now the customer launched a RFP to check if they configure SSL policies or work with another solution. Please your help with the following questions: - High Certificate Warnings:    For certificate reassign, how are warnings communicated to endpoints when an invalid certificate is detected? - High Certificate Errors:     Should the SSL system connect to an SSL server with an invalid certificate, are there options to ignore and pass through the message to the endpoint or drop the connection based upon predefined configuration (e.g. ignore expired certificate warnings and pass warning to endpoint, block connections using self-signed certificates)? - High Device Chaining:   Can the system send unencrypted traffic to multiple devices, both inline and passive, in a defined chain (e.g. inline NGIPS e inline advanced malware detection e passive DLP)? - High Traffic Management:         Can the system send defined traffic (OSI layer 2/3/4/7) to different attached devices? Thank in advance, ... View more

Hi Team, I have a customer who is requiring an Anti-Malware solution for their Servers and Workstations which are not connected to Internet. The customer has an isolated environment and they are looking for an Anti-Malware solution without Internet access. As I understand Cisco AMP requires connection to AMP Cloud or AMP Threat Grid Cloud to provide high level of protection. I was thinking in a possible On-Premise solution using AMP Private Cloud and Private Threat Grid combination but this solutions still requires Internet connection for security updates of on-premise devices.  The customer is checking Stormshield, Palo Alto and Carbon Black solutions. Any suggestion of solution for this case ? Thanks in advance. ... View more

Hi, A customer has a security endpoint who can perform CIFS scanning on Files. They want to know if AMP can do that. AMP for Endpoint can scan CIFS ? Thx. ... View more