Hi   We're going to perform a change on our ESA, but we need to fully understand some mail flows first. I want to find out if some mails are matching a SMTP route and therefore are sent to an internal Exchange Server. I'm not sure whether they're sent there by an Outgoing Content Filter or by the SMTP route. How can I trace that? We can check "message tracking" on SMA, but it only shows that the message matches an Outgoing Mail Policy and then it's sent to Exchange Server successfully. Is there a log that we can use to find the content filters matched by a message? We would like to see something like: matched XXX Outgoing Mail Policy, and X,Y,Z content filters. Or is there a log that shows me that we're using the configured SMTP route to deliver the message?       Appreciate help.   Thanks.     ... View more

Hi We use a Firemon management tool that needs to communicate with different ASAs on the company. We have no  problem with most firewalls, but for one of them, Firemon is not able to collect its configuration. Firemon support told us that the tool collects a "show access-list" command from the device, and it's failing because it sees a message on the output that creates a problem. The message is:   WARNING: OOB Access-list config change detected. Possible modification from,  SSH/Telnet sessions or ASDM/CSM. Hence, Access-list XXXXX  may not be displayed.   We have run some tests, exporting a "show access-list" command, and indeed, we can see that message sometimes. But we're sure nobody is modifying the configuration.   This is a ASA 5545-X running Version 9.8(2)38. Don't know whether it is a way to disable that, or why we see those messages. I have found some bugs but they're related to lower versions. What can we do to avoid receiving those messages while exporting that "show access-list" command?   Thanks!   ... View more

Hi.   We're having a discussion since some managers are reluctant to migrate the default gateways from Nexus 7k to ACI, given the business impact on their sensible applications. They were asking about the ability to filter on ACI without migrating the SVIs. It really doesn't make to much sense to me, since I told them that the L3 device will perform the filtering, and we need the gateways on ACI in order to create the contracts between different EPGs. I even perform a quick test on another TENANT, with 2 machines on different EPGs, same bridge-domain, with their default gateways on an external device (SVI on Nexus 7k, static ports association on each EPG), and no matter what contract I created, the machines could always communicate between each other. I could create a contract between a machine and its exernal gateway, and it worked, but I couldn't filter traffic between machines on different EPGs.   They insist there's Cisco documentation that states that it is possible to segment traffic on ACI without having the gateways on the fabric, but I honestly wouldn't think it is possible. Since I'm not 100% sure, I decided to post this discussion here, so anyone could give us their thoughts and ideas. Our aim is to restrict communication between different servers (Application Centric Model), permitting only what each server needs. Is there a way to do it properly on ACI without moving the SVIs? Any concept, option or feature we don't know or we're missing? It just doesn't make sense to me since I would think ACI is forcing an ACL on the underlay, and it would apply it on the gateway; but I wanted to hear oppinions from the community.   Thanks!   Fabio.   ... View more

It seems an easy thing but I haven't been able to accomplish our objective:   We created 2 Guest-Portals and 2 Sponsor-Portals, each one will be managed by 2 different administrators, of course each one is associated to 2 different SSIDs. Everything is fine but: We want specific users (locally configured) to be able to login ONLY to sponsor portal 1. Those same users should NOT be able to login to sponsor portal 2. And vice versa. We need independency between those Sponsors, and they should only manage accounts for their SSID.   We can only see Identity Source Sequence options, but nothing can be customized. It seems that any local user configured on ISE can access all Sponsor Portals. Besides, any GUEST user created by Sponsor 1, can authenticate on Portal2!!   Portals have "authentication method", but as I said, the only options available are InternalUsers, and it refers to ALL of them; we would like to control this.   Thanks!!!   ... View more

Need help with this requirement:   Customer has 2 Sites, and each site has its own WLC, with few SSIDs with respective Vlans (different vlans on both sites). They want to create a new SSID  that broadcasts on both sites, but want the traffic for users that connect to it to go out through WLC1, always; no matter where they connect, they want that traffic to leave through WLC1. How can we do that?   We've read about WLC anchoring, but we're not sure if that could apply here. Because they don't have a dedicated WLC to use in a DMZ, they will have both WLCs working on both sites, with different SSIDs (everything managed locally), and they just need a new SSID with traffic always leaving one controller.   Any ideas would be appreciated.   Thanks! ... View more