Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About muthumohan
Stats
Member since
08-19-2007
62
Posts
4
Helpful
0
Solutions
Created by
muthumohan
in Network Access Control
in Network Access Control
08-27-2018
09:55 PM
08-27-2018
09:55 PM
Adding the Cisco document (see attachment) that talks about support chart and compliance module. Can't see any diff between the two. Can anyone see the diff?
Thank you,
Mohan
... View more
Created by
muthumohan
in Network Access Control
in Network Access Control
08-27-2018
09:53 PM
08-27-2018
09:53 PM
Hello All,
Can someone tell me the diff between ISE (NAC Agent or AnyConnect) compliance module and support?
By reading Cisco documents, it is not very clear what are these and why we need them? Both looks similar in some documents.
Any help to clarify the confusion is much appreciated.
Thank you,
Mohan M
... View more
Labels:
01-07-2017
09:10 PM
Hello all,
Just 2 quick questions;
1. Can ISE be configured to push "VPN Group Policy" to a user as part of its authorization profile? If Yes, what attirbute is used for this?
2. Can ISE override the local group policy parameters via its authorization profile?
Thank you,
Mohan
... View more
Labels:
06-20-2016
08:53 PM
Thank you all and Thanks Philip for the details.
So, just to be sure, there will not be any impact to the user traffic during the sfr failover, right?
I write an access control policy rule to permit traffic from one subnet (10.1.1.0/24) to another subnet (172.16.1.0/24) on the sfr module. There is no explicit rule in access control rule to permit the return traffic. So, I believe, the SFR module keeps a connection table to allow (subject to IPS, file policy etc.) the return traffic. Is this correct?
If so, when the failover happens, this connection information is not available on the new sfr module. Now, if the return packet is coming through the new sfr module, will it allow this traffic to pass or drop it? This is my question.
Would appreciate any help here...
thank you,
Mohan
... View more
Created by
muthumohan
in Network Security
in Network Security
06-02-2016
09:19 PM
06-02-2016
09:19 PM
Hi,
I am trying to understand how the state information is kept in firepower module running on ASA. I know ASA is stateful and keeps track of connections and automatically allow return traffic to pass.
What about the firepower module? Does it maintain state information to allow the return traffic?
Also, in active/standby mode, I know the ASA fails over statefully, but firepower does not failover. the new firepower will start inspecting the traffic from that point onwards. If this is the case, what happens to the connections maintained in the firepower before failover? As they are not transferred to the new firepower, will the connections going via firepower will disconnect?
I could not find any Cisco document on how firepower maintains state information to process the corresponding return traffic.
Would appreciate any help. And I need some help as soon as possible.
thanks in advance,
Mohan
... View more
Labels:
Created by
muthumohan
in Network Security
in Network Security
02-24-2015
08:38 AM
02-24-2015
08:38 AM
Hi, I am performing malware clould lookup using FirePOWER on ASA. I see the file event when I transfer the file, but the FireSIGHT is unable to submit the file SHA-256 for cloud lookup. It times out. The FireSIGHT management IP is able to access the Internet. Does the malware cloud lookup need some subscription for it to work? I am running this in a lab setup with malware license. What could be the reasons for this lookup failure. Due to this, the file disposition is 'unavailable' Another related question. If my file policy action is to BlockMalware, and if the file disposition comes as unknown or unavailable, will the file be transferred or blocked? Appreciate any help. regds, Mohan Muthu
... View more
Labels:
Created by
muthumohan
in Network Security
in Network Security
07-20-2014
11:32 PM
07-20-2014
11:32 PM
Hi, On ASA CX (Next Generation Firewall), how the web categorization and reputation database is accessed? 1. Does the entire database is loaded (and periodically updated from SIO) in the local ASA CX, so that the CX can quickly verify the web category and reputation score of a requested website before allow/deny the packets through ASA CX? Or 2. Does ASA CX queries these databases on an external server (on Internet) for web category and reputation scores as and when new connection requests come from the users? Would appreciate your help. Regards, Mohan
... View more
Labels:
03-27-2014
08:09 AM
Hi, Just a question on ISE license consumption. If a user logs in and gets authenticated (user authentication) via ISE on a device that is already authenticated (device authentication), does it consume 2 licenses, one for the device and one for the user? This is nowhere clearly told in any cisco documentation. Can anybody help me clarify this? Thank you, Mohan
... View more
Labels:
03-25-2014
07:54 AM
Hi, Just a question on ISE license consumption. If a user logs in and gets authenticated via ISE on a device that is already authenticated (device authentication), does it consume 2 licenses, one for the device and one for the user? This is nowhere clearly told in any cisco documentation. Can anybody help me clarify this? Thank you, Mohan
... View more
Labels:
03-25-2014
03:51 AM
Hi, Just a question on ISE license consumption. If a user logs in and gets authenticated via ISE on a device that is already authenticated (device authentication), does it consume 2 licenses, one for the device and one for the user? This is nowhere clearly told in any cisco documentation. Can anybody help me clarify this? Thank you, Mohan
... View more
Created by
muthumohan
in Network Access Control
in Network Access Control
02-09-2014
05:09 AM
02-09-2014
05:09 AM
Hi All, In ISE, the Certificate Authentication Profile (CAP) tells what field from the certificate to be used as username. I got this. But after getting the username from the cert, how does ISE authenticate the user? How do I specify, which identity source to use to verify this username? Also, where is the password for the user to authenticate? I know binary comparision is one way to verify the user, but what if I have not selected this option? Can't ISE verify the ceritificate by using traditional methods (using the CA's cert to verify the user cert)? Why is ISE not doing this? Or does ISE do this? Even if ISE verifies the cert, the cert might be a valid cert, but the user may not be a valid used to access the network. How does ISE identify this? Can anyone help me understand how the CAP is used to authenticate the user in EAP-TLS? Appreciate any help. Regards, Mohan
... View more
Labels:
01-28-2014
03:57 AM
Hi All, All of the recommended design (single SSID, Dual SSID) for BYOD requires PKI infrastructure for providing the certificate for the employee's personal devices. I understand how this works. But my question is, can't we have a BYOD solution without PKI? What if my current organization is not using PKI and wanted to have BYOD solution? Why all the BYOD design documents talk about EAP-TLS as the authentication method for BYOD devices? Can't we have any other (non certificate based) authentication for BYOD? I would appreciate if anyone can throw some light around this. Thanks in advance. Mohan
... View more
Labels:
Re: WLC - Does it perform client to cli...
in Wireless and Mobility
11-05-2013
09:49 PM
11-05-2013
09:49 PM
Hi, I got this from Cisco website: Q. How does a WLC switch packets? A. All the client (802.11) packets are encapsulated in a LWAPP packet by the LAP and sent to the WLC. WLC descapsulates the LWAPP packet and acts based on the destination IP address in the 802.11 packet. If the destination is one of the wireless clients associated to the WLC, it encapsulates the packet again with the LWAPP and sends it to the LAP of the client, where it is decapsulated and sent to the wireless client. If the destination is on the wired side of the network, it removes the 802.11 header, adds the Ethernet header, and forwards the packet to the connected switch, from where it is sent to the wired client. When a packet comes from the wired side, WLC removes the Ethernet header, adds the 802.11 header, encapsulates it with LWAPP, and sends it to the LAP, where it is decapsulated, and the 802.11 packet is delivered to the wireless client. For more information about this, refer to theLWAPP Fundamentals section of the document Deploying Cisco 440X Series Wireless LAN Controllers. From the above, it is clear that the wireless-client to wireless-client switching (same VLAN) is done by the WLC. But my question here is, does WLC swtich packets based on destination IP as mentioned above? My guess would be the destination MAC address, because WLC is primarily a L2 device and does not perform routing. Can anybody from Wireless TAC clarify how the actual switching works inside WLC. By the way, what is MSCB (Mobile Station Control Block)? Does this have anything to do with WLC switching? Appreciare any help. Regards, Mohan
... View more
Re: WLC - Does it perform client to cli...
in Wireless and Mobility
11-05-2013
08:21 PM
11-05-2013
08:21 PM
Thanks for the reply Scott. So you are saying the WLC does the switching, because the AP tunnels all the client traffic to the WLC. Right? Regards, Mohan
... View more
09-01-2013
10:07 PM
Hi All, I understand FCoE. With Multi-hop FCoE, FC-MAP is used to create FPMA address for the CNA, so that CNA can use this address as source to encapsulate all FCOE frames, with FCF-MAC as destination address. I get this part. But, how FC-MAP must be configured? Should it be different on differnt FCFs? Or it must be different on different SAN Fabrics? I am just confused on how this FC-MAP must be configued? I also read that if the FCF receives a frame with a mac address different from its FC-MAP, it will discard the frames etc. Is this something to keep the SAN-A, SAN-B traffic isolated at all times. I am from LAN background, trying to catch up with SAN Just wanted clarification this...also can you point me to any good document on this and Storage VDC on N7K? Thank you and Regards, Mohan
... View more
Labels:
12-11-2019
Hello, I am just wondering what happens if vSmart controllers are in
split brain condition. That is,...
12-10-2019
Hello, SDWAN documentation is driving me crazy. Can't believe that there
are so many mistakes and co...
Created by
muthumohan
in SD-WAN
12-08-2019
12-08-2019
Hello All, In SDWAN, what exactly does color mean? Does it simply
indicate the type of transport suc...
12-08-2019
Hello,If there is a MPLS only site with private IP addresses connected
over MPLS/L3VPN to other site...
06-26-2019
Hello, I am a Cisco instructor and trying to understand the Viptela
SDWAN Architecture. After going ...
Created by
muthumohan
in Network Access Control
08-27-2018
08-27-2018
Adding the Cisco document (see attachment) that talks about support
chart and compliance module. Can...
Created by
muthumohan
in Network Access Control
08-27-2018
08-27-2018
Hello All, Can someone tell me the diff between ISE (NAC Agent or
AnyConnect) compliance module and ...
01-07-2017
Hello all, Just 2 quick questions; 1. Can ISE be configured to push "VPN
Group Policy" to a user as ...
06-20-2016
Thank you all and Thanks Philip for the details. So, just to be sure,
there will not be any impact t...
06-02-2016
Hi, I am trying to understand how the state information is kept in
firepower module running on ASA. ...
Created by
muthumohan
in Network Security
02-24-2015
02-24-2015
Hi,I am performing malware clould lookup using FirePOWER on ASA. I see
the file event when I transfe...
Created by
muthumohan
in Network Security
07-20-2014
07-20-2014
Hi, On ASA CX (Next Generation Firewall), how the web categorization and
reputation database is acce...
03-27-2014
Hi,Just a question on ISE license consumption.If a user logs in and gets
authenticated (user authent...
03-25-2014
Hi,Just a question on ISE license consumption.If a user logs in and gets
authenticated via ISE on a ...
Public Statistics
| Date Registered | 08-19-2007 05:45 AM |
| Date Last Visited | 12-18-2019 12:07 AM |
| Total Messages Posted | 62 |
| Total Helpful Votes Received | 4 |
