Hi We have a requirement to set up a s2s VPN tunnel with a third-party. Our firewall is ASA 5545 and they use Forcepoint.They have a primary peer and a secondary peer and they want us to use IKEv2 and configure it policy based than route based. Would this be possible to have primary and secondary peer on IKEv2 policy based configuration? TIA ... View more

I inherited the systems and on a single Cisco 1812 router I see this configuration. Could anyone kindly explain what this configuration is supposed to do? There are the only two interfaces which are configured on this router.   interface FastEthernet0 description External ip address 192.168.255.19 255.255.255.248 no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly duplex auto speed auto standby delay reload 60 standby 8 ip 192.168.255.18 standby 8 preempt delay minimum 60 reload 60 sync 60 standby 8 name GL-HSRP-OUT standby 8 track FastEthernet1 ! interface FastEthernet1 description Internal ip address 192.168.98.204 255.255.255.240 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly duplex auto speed auto standby delay reload 60 standby 9 ip 192.168.98.205 standby 9 preempt delay minimum 60 reload 60 sync 60 standby 9 name GL-HSRP-IN standby 9 track FastEthernet0 ! ... View more

I am in the process of configuring TACACS+ on the catalyst 6800 FEX. I have followed the attached guide to configure ISE. Now I need to configure the switch. These are the commands from the guide. Could someone help me understand the commands as I don't want to break anything in this process.   IOS Configuration for TACACS+ TACACS+ AAA on a Cisco IOS device can be configured in the following sequence: 1. Enable TACACS+ Authentication and Fallback 2. Enable TACACS+ Command Authorization 3. Enable TACACS+ Command Accounting TACACS+ Authentication and Fallback Before configuring TACACS+, SSH or a good remote connection protocol needs first configured. The following example configuration shows how to enable SSH. hostname CSRv no ip domain-lookup ip domain-name securitydemo.net crypto key generate rsa modulus 2048 ip ssh version 2 enable secret ISEisC00L (config is enable secret 5) username local-admin privilege 15 secret ISEisC00L aaa new-model aaa authentication login CON none aaa authentication login default local   I have the below config instead    aaa authentication login default local enable aaa authentication enable default enable interface GigabitEthernet1 ip address 10.1.100.160 255.255.255.0 ip access-list extended vtyAccess permit tcp 10.1.100.0 0.0.0.255 any eq 22 The config I have enables access from anywhere, I know its not secure, but I will lock down later. line con 0 exec-timeout 0 0 (I have  exec-timeout 15 0) login authentication CON logging synchronous (I have logging synchronous level 4) !! Below assumes only 5 VTY lines (from 0 to 4) line vty 0 4  ( I have  line vty 0 5 ) access-class vtyAccess in transport input ssh ( I also have transport output telnet ssh) logging synchronous   Since we have a valid IP address for the above sample network device at this stage, we can SSH to this IOS device from a client in 10.1.100.0/24 while the console login remains no authentication. Note that we disable EXEC timeout for CONSOLE so to avoid possible access issue during AAA configuration. TACACS+ authentication can be enabled with a configuration similar to the following: tacacs server ise-1 - I guess this is the ISE server name address ipv4 10.1.100.21 - guess this is the ip of the ISE server key ISEisC00L - what is this key? Shared secret? aaa group server tacacs+ demoTG - demoTG just a name? server name ise-1 - - I guess this is the ISE server name aaa authentication login VTY group demoTG local aaa authentication enable default group demoTG enable line vty 0 4 login authentication VTY We have thus switched to TACACS+ to authenticate the VTY lines. Note that the “enable” authentication has the default list only so both VTY and CONSOLE use TACACS+ to authenticate “enable” access. In the events that the configured TACSACS+ server becomes unavailable, the login authentication falls back to use the “local” user database while the enable authentication to the “enable” secret. TACACS+ Command Authorization EXEC Authorization is a special form of command authorization. It happens right after a user login and can be enabled by adding the following: aaa authorization exec CON none aaa authorization console aaa authorization exec VTY group demoTG local if-authenticated line con 0 authorization exec CON line vty 0 4 authorization exec VTY At this point, the shell profiles with the default privilege attribute apply to new SSH sessions. Further TACACS+ Command Authorization for the configuration mode and for various privilege levels can be enabled by adding the following:   How does the below config work?  aaa authorization config-commands aaa authorization commands 1 VTY group demoTG local if-authenticated aaa authorization commands 15 VTY group demoTG local if-authenticated line vty 0 4 authorization commands 1 VTY authorization commands 15 VTY TACACS+ Command Accounting Command accounting sends info about each command executed, which includes the command, the date, and the username. The following adds to the previous configuration example to enable this accounting feature: aaa accounting exec default start-stop group demoTG aaa accounting commands 1 default start-stop group demoTG aaa accounting commands 15 default start-stop group demoTG Here uses the default method list as we need not distinct accounting based on connection types. We are done with the IOS configuration for TACACS+.   ============================================================   I alredy have SSH enabled and there is a local admin. Should I go ahead with line vty 0 4 or line vty 0 5?       ... View more

hello everyone   I am managing a cisco 6800 FEX switch, there is an admin account which I use to perform admin tasks.    I can see this in the conf  username admin password 0 paswword1   I want to add another admin and used the command    username NetAdmin privilege 15 password 0 password2   I am able to ssh into the switch but when I type enable I am getting the access denied error.   The user admin was set up during the installation I guess. Coould you please help with the following?   1. Why the NetAdmin account I have added is getting access denied for priv exec mode? 2. Whay the original account has no privelege level mentioned in the config? 3. What is the correct way of adding additional users?   Thanks in Advance ... View more