Hi ! I'm trying to authenticate from Solwarwinds application to our Nexus 5596 switch.  I'm always getting the following error message : 2017 Jun  2 14:35:35 SWITCH_HOSTNAME %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed from Solarwinds_IP - sshd[23978] 2017 Jun  2 14:35:37 SWITCH_HOSTNAME %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed from Solarwinds_IP - sshd[23979] To getting and make sure that is no ACL in place to bloc me, I RDP to Solarwind server to initiate SSH connection to the same using same credential...  And I successfully been authenticate and connected. I don't want to delete the switch node in the Solarwind configuration to avoid loosing all history we have on this device in Solarwinds.  But I like to now if any debug command can help me to trouble shoot the SSH process of the connection.  I have the feeling the SSH certificate been cached in the Solarwinds software in past and had been regenerated for some reason. Up to now the "debug aaa all"  didn't help me much.....  the command to not return anything when I'm trying from Solarwind software, or the command do not debug the authentication process but only authorisation and accounting....  When I'm try using putty through SSH I'm getting all debug messages after successful or failed authentication attempt. Anyone has idea ? ... View more

Hi ! we have Cisco USC solution in place and the enterprise choose to use Solarwinds as monitoring tool for the Company.  I need the Solarwinds server to be able to connect to UCS to take copy of the system configuration.   Solarwinds can successfully monitor UCS using SNMP, but I need now to take copy of system configuration in case we need restore, rollback and configuration history and changes. What kind of rights the user needs to have on USC to accomplish expected tasked ? with minimal rights.... Thanks ! ... View more

Hi ! I did worked much up to now with ASA and firewall feature with Cisco product up to now.  I start to read "Cisco Firewalls" By Alexandre M.S.P. Moraes from CiscoPress I had it in my personal library but never takes time to read it... 1- In the book the author speak about different ways to treat NAT, static NAT, Policy NAT, Nat identity....  I would like to know what is the benefit to configure NAT Identity if NAT Exemption can also provide connectivity for a host trying to establish connection for lower security level to a host behind higher security level.  I understand the identity NAT consume memory resource while NAT exemption do not. About Syslog : 2- in the following example taken from the book : ! DMZ sends an ICMP Echo Request to OUT (172.16.4.4) but does not receive a Reply DMZ# ping 172.16.4.4 source 172.16.7.7 repeat 1 Success rate is 0 percent (0/1) ! ! ASA2 builds outbound ICMP connection, allowing the echo request %ASA-6-302020: Built outbound ICMP connection for faddr 172.16.4.4/0 gaddr 172.16.7.7/6 laddr 172.16.7.7/6 ICMP echo request from dmz:172.16.7.7 to out:172.16.4.4 ID=6 seq=0 len=72 What is the /0 and /6 following the IP addresses in the syslog statement ?  if it is port number is always the source or destination port listed there ? the /6 is equal to the ID.. Did I understood right ? 3- I also read that we have hashed value messages which are matching the value on the ACL statement : ! Sample flow denied by explicit rule (hash is now present) %ASA-4-106023: Deny icmp src dmz:172.16.7.7 dst out:172.16.4.4 (type 8, code 0) by access-group “DMZ” [0xedd51436, 0x0] ! ! Viewing the hit counts for an ACE using the hash information ASA2# show access-list DMZ | include 0xedd51436 access-list DMZ line 5 extended deny icmp any any (hitcnt=1) 0xedd51436 OK I understand that the line in the syslog " %ASA-4-106023: Deny icmp src dmz:172.16.7.7 dst out:172.16.4.4 (type 8, code 0) by access-group “DMZ” [0xedd51436, 0x0]" was generated because the ACL statement : "access-list DMZ line 5 extended deny icmp any any (hitcnt=1) 0xedd51436".  yes....  but in case another packet hit the same ACL statement will I getting the same hashed value in the syslog ? 4-  in this section, excuse myself but I didn't catch the  "the logging message containing the aggregated count of hits sent after the 300 seconds interval." and the relation with "%ASA-6-106100: access-list OUT permitted icmp out/172.16.4.41(8) -> dmz/172.16.7.7(0) hit-cnt 5300-second interval [0x61f4cfd9, 0x7463e142]"  and why this case we start to getting 2 hashed values, sometimes we dont have anyone, sometime 1 and in this example 2 ? which one is for ACLs entry and the other one is used for what ?  And why we don't gets anyone ? thanks a lot for your help ! Logging is enabled by default for ACEs configured with the deny action (both implicit and explicit rules). Example 7-31 teaches how to configure logging for an ACE that has permit as its action. The logging level (6 by default) can be changed to any of the possible values (0 to 7). The example also registers the occurrence of the first hit of a permit ACE and the logging message containing the aggregated count of hits sent after the 300 seconds interval. Example 7-31 ACL Maintenance Tasks (2) ! Enabling logging for a given ‘permit’ ACE access-list OUT line 1 extended permit icmp 172.16.0.0 255.255.0.0 172.16.0.0 255.255.0.0 object-group PING log 5 access-list OUT line 2 extended permit udp object-group OUT1 object-group LOGHOSTS object-group LOGGING log 6 ! ! Logs generated by the first occurrence of a ‘permit’ statement %ASA-6-302020: Built inbound ICMP connection for faddr 172.16.4.41/0 gaddr 172.16.7.7/0 laddr 172.16.7.7/0 %ASA-6-106100: access-list OUT permitted icmp out/172.16.4.41(8) -> dmz/172.16.7.7(0) hit-cnt 1 first hit [0x61f4cfd9, 0x7463e142] ! ! Log generated by a ‘permit’ statement after the default 300 seconds interval %ASA-6-106100: access-list OUT permitted icmp out/172.16.4.41(8) -> dmz/172.16.7.7(0) hit-cnt 5300-second interval [0x61f4cfd9, 0x7463e142] ... View more

Hi ! I have build myself a ISE 1.2.1 server in a isolated environment to propare ma next CCNP certification. This installation is only for lab purpose....  My guest has 510G hard drive 1 cpu 9Go of RAM. The host it self is a HP DL380 Gen 7 with 3 SAS drives of 300G each 12 Gig of memory and 1 cpu 2.83 GHz On a regular basic I have at the console "INIT : Id "S0" respawnin too fast: disabled for 5 minutes" what is it meaning, what kind of problem this may introduce to me during my labs, and what I should do to address it ? Thanks ! ... View more

Hi ! We are using our ACS server 5.6 running patch Level 4 to authenticate users on different telecom equipment  with in the Compagny. I'm actually trying to configure "read only access" for some users to our BlueCoat Packet Shapper device.  The full access works properly actually. I had add a new statement in the Policy before the Full access statement.  Statements are pretty simple the restricted statement said : if Identity group is "limited" and "Device Type" is "BlueCoat" Shell Profile is "Permit access" Rule number 8 the next statement do not take care of user member group membership  but "Device Type" is "BlueCoat" Shell Profile is "Permit Touch" Rule number 9 When I look at the AAA report I know some of my attemp aren't log (and I'd liked to know why...) I don't know what I can do more to make my first statement match instead of the second Anyone may help ? ... View more

Hi ! I have to return back to local authentication process without AAA process, on one switch running CatOS 8.4.6 I have those command configured : #authorization set authorization exec enable tacacs+ none console set authorization exec enable tacacs+ none telnet set authorization commands enable all tacacs+ none telnet #accounting set accounting exec enable start-stop tacacs+ set accounting connect enable start-stop tacacs+ set accounting commands enable all stop-only tacacs+ #tacacs+ set tacacs server server_IP set tacacs key key ! #authentication set authentication login tacacs enable telnet primary I need also to configure username/password for telnet access instead is someone can help me with this ? ... View more

Hi !   I need some help to find a way to configure my ASA appliance in this configuration.   I have 2 connections from only one ISP to Internet for which, both are receiving IP configuration through DHCP.  I know over the time the netmask and next value change without any notice.  But IP address of each interface will never change. Also, it may happen to get the same MAC address for both next hop IP, which would be different for each ISP connections.   I need to have one interface usually used for Internet traffic and the other one for VPN traffic.  In case of one of those link failed the traffic need to be direct to the remainning connection.   someone can help me with this ?   Thanks ! ... View more