Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About muthumohan
06-28-2019
Stats
Member since
08-19-2007
58
Posts
4
Helpful
0
Solutions
01-07-2017
09:10 PM
Hello all,
Just 2 quick questions;
1. Can ISE be configured to push "VPN Group Policy" to a user as part of its authorization profile? If Yes, what attirbute is used for this?
2. Can ISE override the local group policy parameters via its authorization profile?
Thank you,
Mohan
... View more
Labels:
06-20-2016
08:53 PM
Thank you all and Thanks Philip for the details.
So, just to be sure, there will not be any impact to the user traffic during the sfr failover, right?
I write an access control policy rule to permit traffic from one subnet (10.1.1.0/24) to another subnet (172.16.1.0/24) on the sfr module. There is no explicit rule in access control rule to permit the return traffic. So, I believe, the SFR module keeps a connection table to allow (subject to IPS, file policy etc.) the return traffic. Is this correct?
If so, when the failover happens, this connection information is not available on the new sfr module. Now, if the return packet is coming through the new sfr module, will it allow this traffic to pass or drop it? This is my question.
Would appreciate any help here...
thank you,
Mohan
... View more
06-02-2016
09:19 PM
Hi,
I am trying to understand how the state information is kept in firepower module running on ASA. I know ASA is stateful and keeps track of connections and automatically allow return traffic to pass.
What about the firepower module? Does it maintain state information to allow the return traffic?
Also, in active/standby mode, I know the ASA fails over statefully, but firepower does not failover. the new firepower will start inspecting the traffic from that point onwards. If this is the case, what happens to the connections maintained in the firepower before failover? As they are not transferred to the new firepower, will the connections going via firepower will disconnect?
I could not find any Cisco document on how firepower maintains state information to process the corresponding return traffic.
Would appreciate any help. And I need some help as soon as possible.
thanks in advance,
Mohan
... View more
Labels:
Created by
muthumohan
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
02-24-2015
08:38 AM
02-24-2015
08:38 AM
Hi, I am performing malware clould lookup using FirePOWER on ASA. I see the file event when I transfer the file, but the FireSIGHT is unable to submit the file SHA-256 for cloud lookup. It times out. The FireSIGHT management IP is able to access the Internet. Does the malware cloud lookup need some subscription for it to work? I am running this in a lab setup with malware license. What could be the reasons for this lookup failure. Due to this, the file disposition is 'unavailable' Another related question. If my file policy action is to BlockMalware, and if the file disposition comes as unknown or unavailable, will the file be transferred or blocked? Appreciate any help. regds, Mohan Muthu
... View more
Labels:
07-20-2014
11:32 PM
Hi, On ASA CX (Next Generation Firewall), how the web categorization and reputation database is accessed? 1. Does the entire database is loaded (and periodically updated from SIO) in the local ASA CX, so that the CX can quickly verify the web category and reputation score of a requested website before allow/deny the packets through ASA CX? Or 2. Does ASA CX queries these databases on an external server (on Internet) for web category and reputation scores as and when new connection requests come from the users? Would appreciate your help. Regards, Mohan
... View more
Labels:
03-27-2014
08:09 AM
Hi, Just a question on ISE license consumption. If a user logs in and gets authenticated (user authentication) via ISE on a device that is already authenticated (device authentication), does it consume 2 licenses, one for the device and one for the user? This is nowhere clearly told in any cisco documentation. Can anybody help me clarify this? Thank you, Mohan
... View more
Labels:
03-25-2014
07:54 AM
Hi, Just a question on ISE license consumption. If a user logs in and gets authenticated via ISE on a device that is already authenticated (device authentication), does it consume 2 licenses, one for the device and one for the user? This is nowhere clearly told in any cisco documentation. Can anybody help me clarify this? Thank you, Mohan
... View more
Labels:
03-25-2014
03:51 AM
Hi, Just a question on ISE license consumption. If a user logs in and gets authenticated via ISE on a device that is already authenticated (device authentication), does it consume 2 licenses, one for the device and one for the user? This is nowhere clearly told in any cisco documentation. Can anybody help me clarify this? Thank you, Mohan
... View more
Created by
muthumohan
in Policy and Access
in Policy and Access
02-09-2014
05:09 AM
02-09-2014
05:09 AM
Hi All, In ISE, the Certificate Authentication Profile (CAP) tells what field from the certificate to be used as username. I got this. But after getting the username from the cert, how does ISE authenticate the user? How do I specify, which identity source to use to verify this username? Also, where is the password for the user to authenticate? I know binary comparision is one way to verify the user, but what if I have not selected this option? Can't ISE verify the ceritificate by using traditional methods (using the CA's cert to verify the user cert)? Why is ISE not doing this? Or does ISE do this? Even if ISE verifies the cert, the cert might be a valid cert, but the user may not be a valid used to access the network. How does ISE identify this? Can anyone help me understand how the CAP is used to authenticate the user in EAP-TLS? Appreciate any help. Regards, Mohan
... View more
Labels:
01-28-2014
03:57 AM
Hi All, All of the recommended design (single SSID, Dual SSID) for BYOD requires PKI infrastructure for providing the certificate for the employee's personal devices. I understand how this works. But my question is, can't we have a BYOD solution without PKI? What if my current organization is not using PKI and wanted to have BYOD solution? Why all the BYOD design documents talk about EAP-TLS as the authentication method for BYOD devices? Can't we have any other (non certificate based) authentication for BYOD? I would appreciate if anyone can throw some light around this. Thanks in advance. Mohan
... View more
Labels:
Re: WLC - Does it perform client to cli...
in Wireless and Mobility
11-05-2013
09:49 PM
11-05-2013
09:49 PM
Hi, I got this from Cisco website: Q. How does a WLC switch packets? A. All the client (802.11) packets are encapsulated in a LWAPP packet by the LAP and sent to the WLC. WLC descapsulates the LWAPP packet and acts based on the destination IP address in the 802.11 packet. If the destination is one of the wireless clients associated to the WLC, it encapsulates the packet again with the LWAPP and sends it to the LAP of the client, where it is decapsulated and sent to the wireless client. If the destination is on the wired side of the network, it removes the 802.11 header, adds the Ethernet header, and forwards the packet to the connected switch, from where it is sent to the wired client. When a packet comes from the wired side, WLC removes the Ethernet header, adds the 802.11 header, encapsulates it with LWAPP, and sends it to the LAP, where it is decapsulated, and the 802.11 packet is delivered to the wireless client. For more information about this, refer to theLWAPP Fundamentals section of the document Deploying Cisco 440X Series Wireless LAN Controllers. From the above, it is clear that the wireless-client to wireless-client switching (same VLAN) is done by the WLC. But my question here is, does WLC swtich packets based on destination IP as mentioned above? My guess would be the destination MAC address, because WLC is primarily a L2 device and does not perform routing. Can anybody from Wireless TAC clarify how the actual switching works inside WLC. By the way, what is MSCB (Mobile Station Control Block)? Does this have anything to do with WLC switching? Appreciare any help. Regards, Mohan
... View more
Re: WLC - Does it perform client to cli...
in Wireless and Mobility
11-05-2013
08:21 PM
11-05-2013
08:21 PM
Thanks for the reply Scott. So you are saying the WLC does the switching, because the AP tunnels all the client traffic to the WLC. Right? Regards, Mohan
... View more
09-01-2013
10:07 PM
Hi All, I understand FCoE. With Multi-hop FCoE, FC-MAP is used to create FPMA address for the CNA, so that CNA can use this address as source to encapsulate all FCOE frames, with FCF-MAC as destination address. I get this part. But, how FC-MAP must be configured? Should it be different on differnt FCFs? Or it must be different on different SAN Fabrics? I am just confused on how this FC-MAP must be configued? I also read that if the FCF receives a frame with a mac address different from its FC-MAP, it will discard the frames etc. Is this something to keep the SAN-A, SAN-B traffic isolated at all times. I am from LAN background, trying to catch up with SAN Just wanted clarification this...also can you point me to any good document on this and Storage VDC on N7K? Thank you and Regards, Mohan
... View more
Labels:
Created by
muthumohan
in Other Data Center Subjects
in Other Data Center Subjects
09-01-2013
06:48 PM
09-01-2013
06:48 PM
Thank you Richard. I appreciate your quick response. What you said is what I was thinking, no document clearly said that. Thank you again. Yes, DCB is correct term and yes, DCB capable does not mean FCoE capable. Just one more thing about this Nexus 7000 Storage VDC. The documentation says that N7K has FCoE capable ports, but it is not a 'Fibre Channel' switch. If you have virtual Fibre Channel (vFC) ports in a switch, does it not become a FC switch? I know it does not have native Fibre Channel Ports on it, but having a vFC should make it as a FC switch as well, right? Regards, Mohan
... View more
Created by
muthumohan
in Other Data Center Subjects
in Other Data Center Subjects
09-01-2013
06:18 AM
09-01-2013
06:18 AM
Hi All, I know what FCoE is and all that stuff. My only confusion is when we say that Nexus 5K ports can be configured either as 10G Ethernet or FCoE ports, what that actually means? All Cisco video data sheets say this. I know Nexus 5K supports FCoE as a switch. But, why would they say the ports can be configured as FCoE? If a physical port supports Ethernet, then it must also support FCoE frames, right? After all, FCoE frames are Ethernet frames carring is just another payload type (FC, EthType = 8906). So, for Ethernet, FCOE frames are just like any other traffic. What is special about a port being said as FCOE enabled port? My own answer to is this. If the port is FCOE capable, it will look into the incoming frames and if Ethtype is 8906, it will forward to the FC part of the N5K. If any other EthType, forward it the LAN side of the N5K. Is this corret? Also, if an Ethernet Switch is DCB capable, that is, CEE, do we call this as FCoE Switch? This switch is not going to open the Ethernet frames. Looks like these definitions are not clear... Would appreciate any help in clarifying this. Thanks and Regards, Mohan
... View more
Labels:
06-26-2019
Hello, I am a Cisco instructor and trying to understand the Viptela
SDWAN Architecture. After going ...
Created by
muthumohan
in Identity Services Engine (ISE)
08-27-2018
08-27-2018
Adding the Cisco document (see attachment) that talks about support
chart and compliance module. Can...
Created by
muthumohan
in Identity Services Engine (ISE)
08-27-2018
08-27-2018
Hello All, Can someone tell me the diff between ISE (NAC Agent or
AnyConnect) compliance module and ...
01-07-2017
Hello all, Just 2 quick questions; 1. Can ISE be configured to push "VPN
Group Policy" to a user as ...
06-20-2016
Thank you all and Thanks Philip for the details. So, just to be sure,
there will not be any impact t...
06-02-2016
Hi, I am trying to understand how the state information is kept in
firepower module running on ASA. ...
02-24-2015
Hi,I am performing malware clould lookup using FirePOWER on ASA. I see
the file event when I transfe...
Created by
muthumohan
in Firewalls
07-20-2014
07-20-2014
Hi, On ASA CX (Next Generation Firewall), how the web categorization and
reputation database is acce...
03-27-2014
Hi,Just a question on ISE license consumption.If a user logs in and gets
authenticated (user authent...
03-25-2014
Hi,Just a question on ISE license consumption.If a user logs in and gets
authenticated via ISE on a ...
03-25-2014
Hi, Just a question on ISE license consumption.If a user logs in and
gets authenticated via ISE on a...
Created by
muthumohan
in Policy and Access
02-09-2014
02-09-2014
Hi All,In ISE, the Certificate Authentication Profile (CAP) tells what
field from the certificate to...
01-28-2014
Hi All,All of the recommended design (single SSID, Dual SSID) for BYOD
requires PKI infrastructure f...
Created by
muthumohan
in Wireless and Mobility
11-05-2013
11-05-2013
Hi, I got this from Cisco website:Q. How does a WLC switch packets?A.
All the client (802.11) packet...
Created by
muthumohan
in Wireless and Mobility
11-05-2013
11-05-2013
Thanks for the reply Scott.So you are saying the WLC does the switching,
because the AP tunnels all ...
Public Statistics
| Date Registered | 08-19-2007 05:45 AM |
| Date Last Visited | 06-28-2019 12:02 AM |
| Total Messages Posted | 58 |
| Total Helpful Votes Received | 4 |
