I'm not positive about what the chassis backup includes. I don't think it gets logical device platform settings.
Basically, older versions of FTD don't have a sound backup strategy. That's why Cisco is enhancing those features going forward.
... View more
I assume that here is a switch between the ASA and DHCP clients? If so, and it is managed device, check that DHCP snooping is correctly configured. More here, for some Cisco switches. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_2_se/configuration/guide/3750x_cg/swdhcp82.html#24258
... View more
The pxGrid certificate must be both a client and server certificate. Most wildcard certificates don't generally have both of those attributes. If yours does, then you should be able to use it.
... View more
Hi @itsupport , Maybe this links can give you some help: https://community.cisco.com/t5/small-business-switches/sg300-20-with-hardware-version-v03/td-p/2618589 https://community.cisco.com/t5/small-business-switches/latest-firmware-for-sg300-hw-v04/td-p/3325893 Regards
... View more
OK, it seems that filling out the form behind Community Feedback was the way to go, a few hours later, content has been reviewed and is back again!
... View more
Hi. I am in the midst of configuring a VPN setup. Head unit is an ASA-5508x, running FTD 6.2.2.1, administered by a vFMC running 6.2.2.1. I am trying to setup TWO types of client VPN: 1. One for users who wish to manually connect from home, or an other site on a PC and manually authenticate with a username/password combo. 2. One for a heap of tablets we have, for field workers. These are basically armored Windows 8 PCs with no keyboard. These devices have inbuilt 4G cards, which connect out through the cellphone network. I want these to authenticate via machine certificates, and establish a VPN as soon as they are powered up. I have confirmed that the 4G cards connect before user login. So, far, the User VPN is working fine, however I am having problems with the tablet VPN. It connects just fine once a user logs in, but I want it to connect before then. I have installed "Core and VPN" and "Start Before Login" components of Anyconnect 4.6.03049, and I see that the file c:\windows\syswow64\vpnplap64.dll exists after the install. I have tried configuring this both by stipulating "Use start before login" in a group policy, as well as by ticking the "Start VPN before user logon to computer" in the Anyconnect preferences on a client machine. Either way no connection until a user logs on. (works fine then). I have tried on Windows7 and Windows8 machines. I have also disabled fast user switching on both of these machines. Any idea where I should be looking next?
... View more
Having same issues with my cert. I don't know the reason for my errors. Not too much on the fingerprint error, really could use some guides or other document.
... View more
OK for anyone else following, I eventually figured this out: 1. Create a Flexconfig policy, apply the Default_Inspection_Protocol_Disable, System defined object.
2. Go to Objects, Flexconfig, Text Object. Edit the disableInspecProtocolList to include ESMPT. More than a little counterintuitive and convoluted, but works.
... View more
I am working on testing the FTD and decided to create a VPN profile without Split-Tunnel to test URL Filter etc. In order to allow the VPN subnet to send all traffic via the tunnel I had simply added Dynamic NAT. See the attachment with NAT rule created.
... View more
Finally got an answer from TAC on a 2+ month old SR of them, and it works, no fancy settings required:
Add ICMP (either v4 or v6) Destination Unknown and Time Exceeded to the list of allowed ICMP traffic.
And that's it, plain and simple. Not what I was expecting but hey, the theory behind it makes sense if you think about it. If anyone feels brave enough digging into all the small sub-options, feel free to do so and let us know so we can tight even further our controls :)
Cheers.
... View more
For no2 I believe the issue lays on the NPS server config. Did you enable NPS accounting and then read the log file. Here's an overview in the attachments.
What I would do:
read the log file
attempt a VPN certificate connect
re read the file and lookup for connection Connection Request Policy and Network policy being used.
... View more
The problem here is time it takes for the evaluation. The firewall does not want to block all traffic until the evaluation is made. Your case should be easily fixed by re-ordering the rules. Cisco TAC generally recommends the Application and URL rules to be placed after the L3/L4 rules. So If you are really blocking that specific traffic below, that rule should be above this rule to block URL's.
... View more