Hello, We are experiencing an issue with latest Cisco AnyConnect VPN Agent for Android 4.7.03061; user is not able to sync emails via IMAP and SMTP when connected via Cisc AnyConnect Client and ASA Firewall. Captures on ASA Firewall to inside interface were email server is hosted did not indicate any email related traffic.   I was wondering, if other people do experience similar issues with that Cisco AnyConnect VPN Agent version  4.7.03061.   Thanks,      sh vpn-sessiondb detail anyconnect   Username     : ***********                Index        : 28476 Assigned IP  : ********       Public IP    : ******* Protocol     : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel License      : AnyConnect Essentials, AnyConnect for Mobile Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)3DES  DTLS-Tunnel: (1)3DES Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA1  DTLS-Tunnel: (1)SHA1 Bytes Tx     : 21570                  Bytes Rx     : 7515 Pkts Tx      : 66                     Pkts Rx      : 61 Pkts Tx Drop : 0                      Pkts Rx Drop : 0 Group Policy : *****                Tunnel Group : ***** Login Time   : 16:22:36 EST Wed Jul 17 2019 Duration     : 0h:08m:46s Inactivity   : 0h:00m:00s NAC Result   : Unknown VLAN Mapping : N/A                    VLAN         : none   AnyConnect-Parent Tunnels: 1 SSL-Tunnel Tunnels: 1 DTLS-Tunnel Tunnels: 1   AnyConnect-Parent:   Tunnel ID    : 28476.1   Public IP    : ******   Encryption   : none                   Hashing      : none   TCP Src Port : 37425                  TCP Dst Port : 443   Auth Mode    : userPassword   Idle Time Out: 120 Minutes            Idle TO Left : 111 Minutes   Client OS    : Android   Client Type  : AnyConnect   Client Ver   : Cisco AnyConnect VPN Agent for Android 4.7.03061   Bytes Tx     : 7056                   Bytes Rx     : 3937   Pkts Tx      : 6                      Pkts Rx      : 5   Pkts Tx Drop : 0                      Pkts Rx Drop : 0   SSL-Tunnel:   Tunnel ID    : 28476.2   Assigned IP  : ********     Public IP    : ******   Encryption   : 3DES                   Hashing      : SHA1   Encapsulation: TLSv1.0                TCP Src Port : 45605   TCP Dst Port : 443                    Auth Mode    : userPassword   Idle Time Out: 120 Minutes            Idle TO Left : 111 Minutes   Client OS    : Android   Client Type  : SSL VPN Client   Client Ver   : Cisco AnyConnect VPN Agent for Android 4.7.03061   Bytes Tx     : 3528                   Bytes Rx     : 0   Pkts Tx      : 3                      Pkts Rx      : 0   Pkts Tx Drop : 0                      Pkts Rx Drop : 0   DTLS-Tunnel:   Tunnel ID    : 28476.3   Assigned IP  : ******      Public IP    : *****   Encryption   : 3DES                   Hashing      : SHA1   Encapsulation: DTLSv1.0               UDP Src Port : 38478   UDP Dst Port : 443                    Auth Mode    : userPassword   Idle Time Out: 120 Minutes            Idle TO Left : 118 Minutes   Client OS    : Android   Client Type  : DTLS VPN Client   Client Ver   : Cisco AnyConnect VPN Agent for Android 4.7.03061   Bytes Tx     : 7208                   Bytes Rx     : 3454   Pkts Tx      : 52                     Pkts Rx      : 54   Pkts Tx Drop : 0                      Pkts Rx Drop : 0   NAC:   Reval Int (T): 0 Seconds              Reval Left(T): 0 Seconds   SQ Int (T)   : 0 Seconds              EoU Age(T)   : 539 Seconds   Hold Left (T): 0 Seconds              Posture Token:   ... View more

Hello, Since OTV feature is missing in virtual NX-OS, I was wondering, if it is possible to obtain a evaluation license for lab purposes:   Thanks,   Netmart   sh version Cisco Nexus Operating System (NX-OS) Software TAC support: http://www.cisco.com/tac Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_serie s_home.html Copyright (c) 2002-2016, Cisco Systems, Inc. All rights reserved. The copyrights to certain works contained herein are owned by other third parties and are used and distributed under license. Some parts of this software are covered under the GNU Public License. A copy of the license is available at http://www.gnu.org/licenses/gpl.html. NX-OSv9K is a demo version of the Nexus Operating System Software BIOS: version NXOS: version 7.0(3)I5(1) BIOS compile time: NXOS image file is: bootflash:///nxos.7.0.3.I5.1.bin NXOS compile time: 10/29/2016 6:00:00 [10/29/2016 13:46:41] Hardware cisco NX-OSv Chassis Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz with 8165264 kB of memory. Processor Board ID 9B8N333MW4G Device name: switch bootflash: 3509454 kB Kernel uptime is 0 day(s), 2 hour(s), 23 minute(s), 14 second(s) Last reset Reason: Unknown System version: Service: plugin Core Plugin, Ethernet Plugin Active Package(s):         switch(config)# feature o? openflow Enable/Disable OpenFlow agent ospf Enable/Disable Open Shortest Path First Protocol (OSPF) ospfv3 Enable/Disable Open Shortest Path First Version 3 Protocol (OSPFv3) ... View more

Hello, I was wondering, if there is a way to apply Local Preference [BGP] to a prefix which is not part of received BGP update.   Example: Prefix received by BGP peer: 1.0.160.0/19   Instead of applying local preference to the whole subnet 1.0.160.0/19, I would like to apply local preference only to one host covered by this subnet. For example: 1.0.191.250/32   Since this host is not part of the prefixes provided via BGP updates by eBGP peer, local preference will never be applied for this IP 1.0.191.250/32.   Extract of BGP table:  *>  1.0.160.0/19                    59.0.0.1      70080               0    1700  38000 777   Extract of BGP config:   access-list 1 permit host 1.0.191.250   route-map LocPref permit 10 match ip address 1 set local-preference 500 ! route-map LocPref  permit 20   router bgp 36000 bgp log-neighbor-changes : neighbor 59.0.0.1 route-map LocPref in :   Please advise.   Thanks.   ... View more

According to Cisco AnyConnect login failed. Based on debugs ASA server is sending correct tunnel group RAD attribute string: it-vpn1 AAA server does respond with wrong tunnel group string/Radius Type25: it-vpn2.   Note: User is assigned multiple tunnel-groups AAA server (Win AD Server) always respond with it-vpn2 tunnel group, although VPN User selects 'it-vpn1' in Cisco AnyConnect Login Menu - see trace   How does  the Windows NPS have to be set up when AD user is required to access multiple tunnel groups?   ==>ASA  Upstream RADIUS  Attributes [to AAA Server] Radius: Type = 146 (0x92) Tunnel-Group-Name Radius: Length = 10 (0x0A) Radius: Value (String) = 68 61 63 73 2d 76 70 6e                            |  test-vpn1 Radius: Type = 26 (0x1A) Vendor-Specific Radius: Length = 12 (0x0C) Radius: Vendor ID = 3076 (0x00000C04) Radius: Type = 150 (0x96) Client-Type Radius: Length = 6 (0x06) Radius: Value (Integer) = 2 (0x0002) send pkt 192.168.1.1/1645       ==> RADIUS Downstream Authorization Attributes [from AAA Server] Parsed packet data..... Radius: Code = 2 (0x02) Radius: Identifier = 204 (0xCC) Radius: Length = 262 (0x0106) Radius: Vector: 290B4D24880917E0C20FBEBD60C56DC7 Radius: Type = 25 (0x19) Class Radius: Length = 8 (0x08) Radius: Value (String) = 69 74 2d 76 70 6e                                  |  test-vpn2 ... View more

Hello, I was wondering, how to create, save, and run a TCL script on Cisco c4500 [Cisco IOS XE] performing a traceroute and saving the output to txt file.   Thanks, ... View more

Hello, I set up the following event script; its purpose is to run a ping and traceroute and save its output on text file, if a specific syslog message is triggered:  "%TRACK-6-STATE: 16 ip sla 16 reachability Up -> Down"    event manager applet Test   event syslog pattern "%TRACK-6-STATE: 16 ip sla 16 reachability Up -> Down"   action 1.0 cli command "enable"   action 2.0 cli command "ping 8.8.8.8   source vlan 10 | append bootflash:/Test.txt"   action 2.1 cli command "traceroute 8.8.8.8    | append bootflash:/test"   action 2.2 cli command "exit"   Based on the syslog messages and event manager history, the event is triggered, but no textfile is stored on bootflash.   Model is WS-C4500X-3, Version 03.06.07.E     I would appreciate any advise on this issue.   Thanks,       Event Manager History   No.  Job Id Proc Status   Time of Event            Event Type        Name   : 10   423    Actv success  Tue Dec25 09:17:34 2018  syslog            applet: Test   Syslog:   12/25/2018 9:17:40 AM      ----    7259562: Dec 25 14:17:39.340: %TRACK-6-STATE: 16 ip sla 16 reachability Down -> Up                        6                23                                 12/25/2018 9:17:35 AM        ----   7259561: Dec 25 14:17:34.339: %TRACK-6-STATE: 16 ip sla 16 reachability Up -> Down                        6                23           ... View more

Hello, The goal is to route all traffic coming from VLAN200 via ASA VTI tunnel. In this case, I wanted to apply PBR at ASA Group-Channel Interface and to use  VTI Peer IP as next hop. Please see information below. Any help is much appreciated.   10.20.200.0/24 [HQ, rtr-core]----[HQ-ASA, VTI IP 10.70.0.1]===VTI===[VTI IP10.70.0.3,DC-ASA [DC] inside 10.28.121.218---[DC,rtr-core]....   I assigned PBR to Po48 which is the inside interface adjacent to njo1p-rtr-core. I tried to use both, Tunnel Peer's inside IP [10.28.121.218] and Tunnel Peer's IP 10.70.0.3] But I am not able to see any traffic related to VLAN200 passing the tunnel.  To my knowledge, I am able to use a next-hop IP as long as this IP is present in Local RIB see output below. However, I don't know whether the same is true, when using VTI  Tunnel Peer IP as next hop.   At ASA, HQ: interface Port-channel48 lacp max-bundle 8 nameif inside security-level 100 ip address 10.50.0.6 255.255.255.252 policy-route route-map VLAN200     route-map VLAN200 permit 10 match ip address VLAN200Route set ip next-hop  10.70.0.3   or: set ip next-hop 10.28.121.218 |   access-list VLAN200Route extended permit 10.20.200.0 255.0.0.0 any       ASA-HQ# sh route 10.70.0.3   Routing entry for 10.70.0.0 255.255.255.248   Known via "connected", distance 0, metric 0 (connected, via interface)   Routing Descriptor Blocks:   * directly connected, via NWK-ndj1p-fw-vpn2       Route metric is 0, traffic share count is 1     ASA-HQ# sh route 10.28.121.218   Routing entry for 10.28.121.0 255.255.255.0   Known via "bgp 64514", distance 20, metric 100   Tag 64512, type external   Last update from 10.70.0.3 3:02:50 ago   Routing Descriptor Blocks:   * 10.70.0.3, from 10.70.0.3, 3:02:50 ago       Route metric is 100, traffic share count is 1       AS Hops 1       Route tag 64512       MPLS label: no label string provided   The PBR ACL got hit, but I am not able to see any traffic traversing the VTI tunnel:   access-list VLAN200Route; 2 elements; name hash: 0xb6c462d5 access-list VLAN200Route line 1 extended permit ip 10.20.200.0 255.255.255.0 any (hitcnt=7) 0x56cfe80a access-list VLAN200Route line 2 extended deny ip any any (hitcnt=2439) 0xccb0ae2f   Please advise.   Thanks ... View more