Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Patrick0711
06-18-2019
Stats
Member since
03-02-2009
173
Posts
63
Helpful
16
Solutions
04-13-2018
10:20 PM
I have a Firepower 2110 that I've registered to a FMC. I configure interfaces, push platform settings, access-control policies, etc, through the FMC.
I then break the SFtunnel communication by installing a new security pack version from the FXOS CLI. Upon re-imaging of the device, I attempt to re-register it with the same FMC using the same Regkey and NAT ID. The FMC will never re-establish communication with the device and the registration status shows up as pending:
> show managers
Host : xxx
Registration Key : ****
Registration : pending
RPC Status :
> sftunnel-status
SFTUNNEL Start Time: Thu Apr 5 19:23:59 2018
Both IPv4 and IPv6 connectivity is supported
Broadcast count = 0
Reserved SSL connections: 0
Management Interfaces: 1
management0 (control events) x.x.x.x,
***********************
**RPC STATUS****889547*************
Caught Simple Exception: RPC Request failedCheck routes:
**Note - I do have NAT between the FTD and FMC and I'm using DONTRESOLVE on the FTD.
The only way I'm able to re-establish communication is by deleting the device from FMC and re-adding it. I've tried restarting the sftunnel on both the FTD and FMC using ‘sudo manage_procs.pl’ with no success.
Unfortunately, deleting and re-adding the device on the FMC also deletes the interface and route configurations.
Is there a way that I can force the FMC to re-establish the SFtunnel and begin communicating with the FTD without deleting and re-adding the device?
Thanks,
Patrick
... View more
Labels:
Created by
Patrick0711
in VPN and AnyConnect
in VPN and AnyConnect
04-24-2015
01:06 PM
04-24-2015
01:06 PM
Hello Everyone, I have the following configuration in place: crypto ipsec ikev2 ipsec-proposal INTERIM protocol esp encryption aes protocol esp integrity sha-1 crypto dynamic-map DYNMAP 65535 set pfs group5 crypto dynamic-map DYNMAP 65535 set ikev2 ipsec-proposal INTERIM crypto dynamic-map DYNMAP 65535 set security-association lifetime seconds 82800 crypto map VPNMAP 65535 ipsec-isakmp dynamic DYNMAP crypto ca trustpoint vpn.domain.org-TP revocation-check crl enrollment terminal keypair vpn.domain.org-TP crl configure cache-time 720 crypto ikev2 policy 11 encryption aes integrity sha group 5 prf sha lifetime seconds 82800 crypto ikev2 enable outside client-services port 443 crypto ikev2 remote-access trustpoint vpn.domain.org-TP webvpn enable outside anyconnect image disk0:/anyconnect-win-3.1.05160-k9.pkg 1 anyconnect profiles IKEv2 disk0:/ikev2.xml anyconnect enable group-policy ANYCONNECT-IKEV2-CESG internal group-policy ANYCONNECT-IKEV2-CESG attributes wins-server none dns-server value 1.1.1.1 2.2.2.2 vpn-session-timeout 1440 vpn-tunnel-protocol ikev2 ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value vpn-split-tunnel default-domain value domain.local webvpn anyconnect modules value vpngina anyconnect profiles value IKEv2 type user tunnel-group ANYCONNECT-IKEV2-CESG type remote-access tunnel-group ANYCONNECT-IKEV2-CESG general-attributes address-pool IPPOOL1 default-group-policy ANYCONNECT-IKEV2-CESG tunnel-group ANYCONNECT-IKEV2-CESG webvpn-attributes authentication certificate Also, the default tunnel-group-map configuration is in place: no tunnel-group-map enable rules tunnel-group-map enable ou tunnel-group-map enable ike-id tunnel-group-map enable peer-ip tunnel-group-map default-group DefaultRAGroup I am connecting with the following client identity certificate: CN= client1.domain.com OU= ANYCONNECT-IKEV2-CESG I figured that the default tunnel-group-map would take the OU of the client cert and map me to the relevant tunnel-group. Unfortunately, it looks like it lands on the DefaultRAGroup and I'm prompted for local authentication credentials. If I configure the following certificate map, the connection lands on the correct tunnel-group: crypto ca certificate map CERT-MAP 1 subject-name attr ou eq anyconnect-ikev2-cesg webvpn certificate-group-map CERT-MAP 1 ANYCONNECT-IKEV2-CESG Any ideas as to why the connection doesn't follow the logic of the tunnel-group-map's OU matching? Thank you, Patrick
... View more
Labels:
02-28-2013
06:17 PM
There is no definitive answer to this. Your explanation of the scenario is so vague that it makes it impossible to determine anything. What is "real life" if we don't know the device's purpose? The ASA (the first generation line) will almost always be more burdened more by the number of connections/second and the rate of incomming packets than the bottom-line throughput numbers. I rarely see cases where the sheer volume of of traffic is the limiting factor. You fail to mention what type of traffic traverses your firewall. HTTP, SMB, and NFS are examples of very chatty application-layer protocols that require the ASA to rapidly perform fastpath functions that maintain the state of a given TCP connection. HTTP intensive environments may also introduce several thousand new tcp connections per second which is computationally expensive since the ASA must perform various checks for each new connection in the session management path. You should have evaluated what your limiting factor was before you upgraded. The "shoot first, ask questions later" mentality is not the correct way to address situations like this IMO.
... View more
Created by
Patrick0711
in VPN and AnyConnect
in VPN and AnyConnect
02-28-2013
06:03 PM
02-28-2013
06:03 PM
You only need 1 debug for this. debug crypto isakmp 254 Post the output from this when you try to connect, along with the sanitized output of: show run crypto sh run tunnel-group sh run group-policy sh run ip local pool and we can get a better idea of where the problem lies.
... View more
Created by
Patrick0711
in VPN and AnyConnect
in VPN and AnyConnect
10-12-2012
07:28 AM
10-12-2012
07:28 AM
It's something local to your workstation. I use Windows 7 as my office workstation and have tested hundreds of client VPN configurations without issue. There are also probably 50+ other technicians in my office who run Windows 7, do the same type of work, and do not experience issues with route injection.
... View more
08-02-2012
09:27 PM
Are you sure you changed the VPN idle timeout under the correct group policy? I've configured tunnels to ISG's running ScreenOS many times without issue. Enable logging or turn on the ISAKMP debugs on the ASA and see if you can see a delete message being sent to the Juniper or a loss of contract betwen the peers debug crypto isakmp 254
... View more
Created by
Patrick0711
in VPN and AnyConnect
in VPN and AnyConnect
08-02-2012
09:25 PM
08-02-2012
09:25 PM
Looks normal to me Where do you see an issue? Why are you using a 3rd party client? Use the Cisco client...
... View more
08-02-2012
09:19 PM
I think Karthik pretty much covered it. There is no way to have two default routes or perform any kind of intelligent load-balancing You can use static routes to direct certain traffic across the two links but you must specify destination networks. As Karthik was suggesting 0.0.0.0 128.0.0.0 **** This will cover 0.0.0.0 to 127.0.0.0 *** 128.0.0.0 128.0.0.0 *** This will cover 128.0.0.0 to 255.0.0.0 *** The ASA supports redundant ISP links in an active/passive scenario but will not load-balance between them.
... View more
08-02-2012
09:10 PM
Yup, you need to upgrade to 8.4 to set up an etherchannel bundle Note You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA 5550, as part of an EtherChannel.
... View more
08-02-2012
09:08 PM
Most of that information is not publicly disclosed. Troubleshoot it with the tools available to you, don't focus so much on individual threads/processes. show processes cpu-usage - a lot of times it will be the dispatch unit which can be caused by a number of things show perfmon - check for a large number of conns/sec sh log (with buffer logging enabled) - check for any unusual messages while the CPU utilization issue is occurring sh asp drop - check for a quickly incrementing "Flow is denied by configured rule (acl-drop)" or other quickly incrementing counters "Our TCP connection rate is not going above 55K" Are you saying you're testing with 55,000 connections/second? Or are you saying you're testing with 55,000 established connections?
... View more
07-27-2012
01:00 PM
Bringing this back from the dead... Interface GigabitEthernet1/0 "inside", is up, line protocol is up Hardware is VCS7380 rev01, BW 1000 Mbps, DLY 10 usec Full-Duplex(Full-duplex), 1000 Mbps(1000 Mbps) Input flow control is unsupported, output flow control is unsupported Media-type configured as RJ45 connector MAC address 1cdf.0f66.35da, MTU 1500 IP address x.x.x.x, subnet mask 255.255.255.0 2136842533 packets input, 2505600752697 bytes, 0 no buffer Received 6118 broadcasts, 0 runts, 0 giants 3519301 input errors, 0 CRC, 0 frame, 3519301 overrun, 0 ignored, 0 abort 0 L2 decode drops 1231746618 packets output, 186031413394 bytes, 0 underruns 0 pause output, 0 resume output 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops 0 rate limit drops input queue (blocks free curr/low): hardware (0/0) output queue (blocks free curr/low): hardware (0/0) Traffic Statistics for "inside": 2132528034 packets input, 2462177894354 bytes 1231761102 packets output, 163876265191 bytes 69112 packets dropped 1 minute input rate 15279 pkts/sec, 17668962 bytes/sec 1 minute output rate 8978 pkts/sec, 1071206 bytes/sec 1 minute drop rate, 0 pkts/sec 5 minute input rate 17170 pkts/sec, 20191846 bytes/sec 5 minute output rate 9932 pkts/sec, 1170989 bytes/sec 5 minute drop rate, 0 pkts/sec This platform has an ASA 5510 Security Plus license. sh blocks SIZE MAX LOW CNT 0 400 383 400 4 100 99 99 80 400 284 399 256 3148 2928 3148 1550 2285 1807 2025 2048 2100 1422 2100 2560 164 164 164 4096 100 98 100 8192 100 99 100 16384 100 99 100 65536 16 16 16 Interface is being overrun, there are sufficient 1550 byte memory blocks, the 'no buffer' count is 0. Still, after several years, trying to find an explanation that explains this type of overrun. If it were 'bursty' traffic, wouldn't the interface buffer fill before being overrun which would show an incrementing 'no buffer' counter?
... View more
Created by
Patrick0711
in VPN and AnyConnect
in VPN and AnyConnect
05-25-2012
10:01 PM
05-25-2012
10:01 PM
Have you tried connecting from multiple workstations? Seems like it may be an issue with that particular workstation
... View more
Created by
Patrick0711
in VPN and AnyConnect
in VPN and AnyConnect
05-25-2012
09:56 PM
05-25-2012
09:56 PM
What code version? What kind of inspection is configured?
... View more
Created by
Patrick0711
in VPN and AnyConnect
in VPN and AnyConnect
05-06-2012
07:18 AM
05-06-2012
07:18 AM
Check for static port redirection or PAT via a global/nat configuration
... View more
04-13-2018
I have a Firepower 2110 that I've registered to a FMC. I configure
interfaces, push platform setting...
04-24-2015
Hello Everyone, I have the following configuration in place: crypto
ipsec ikev2 ipsec-proposal INTER...
02-28-2013
There is no definitive answer to this. Your explanation of the scenario
is so vague that it makes it...
02-28-2013
You only need 1 debug for this.debug crypto isakmp 254Post the output
from this when you try to conn...
Created by
Patrick0711
in VPN and AnyConnect
10-12-2012
10-12-2012
It's something local to your workstation. I use Windows 7 as my office
workstation and have tested h...
08-02-2012
Are you sure you changed the VPN idle timeout under the correct group
policy? I've configured tunnel...
Created by
Patrick0711
in VPN and AnyConnect
08-02-2012
08-02-2012
Looks normal to meWhere do you see an issue?Why are you using a 3rd
party client? Use the Cisco clie...
08-02-2012
I think Karthik pretty much covered it.There is no way to have two
default routes or perform any kin...
08-02-2012
Yup, you need to upgrade to 8.4 to set up an etherchannel bundle Note
You cannot use interfaces on t...
Created by
Patrick0711
in Firewalls
08-02-2012
08-02-2012
Most of that information is not publicly disclosed. Troubleshoot it with
the tools available to you,...
07-27-2012
Bringing this back from the dead...Interface GigabitEthernet1/0
"inside", is up, line protocol is up...
Created by
Patrick0711
in VPN and AnyConnect
05-25-2012
05-25-2012
Have you tried connecting from multiple workstations? Seems like it may
be an issue with that partic...
Created by
Patrick0711
in VPN and AnyConnect
05-25-2012
05-25-2012
What code version?What kind of inspection is configured?
Created by
Patrick0711
in VPN and AnyConnect
05-06-2012
05-06-2012
Check for static port redirection or PAT via a global/nat configuration
Public Statistics
| Date Registered | 03-02-2009 08:47 PM |
| Date Last Visited | 06-18-2019 09:37 AM |
| Total Messages Posted | 173 |
| Total Helpful Votes Received | 63 |
Helpful Votes Given To
Helpful Votes From
