Hi folks,    I have version 4.4 of the AnyConnect client installed on an OSX Yosemite Macbook.  It fails to connect to our SSL VPN stating login error (Even  thought the username and password combo used works on a Windows client machine) any ideas why this might be?    ASA reports:   %ASA-6-113004: AAA user authentication Successful : server = 10.34.1.201 : user = ssl-test %ASA-6-113013: AAA unable to complete the request Error : reason = Invalid password : user = ssl-test   We use DUO two factor authentication.  This all works great through the Windows client.  Not sure what the OSX client is doing different here.   Any ideas? ... View more

Hi guys, Looking for a bit of advice.  I have an ASA on which I am trying to NAT through a couple of ports to a server on the LAN which are being accessed by a client machine on the internet.  This bit I can do no problem however once NAT'd and passed through to the server in question the server is seing the return address as being a publicly routable address.  As the server in question has a different route out to the internet via another provider this is obviously causing some issues. As I can't change any routing what I was hoping to do was to change the source address that the server saw to the LAN interface of the ASA which forwarded the traffic.  However for the life of me can't get the syntax quite right. Could someone assist? Details are as follows (Changed for obvious reasons) Internet IP: 4.4.4.4 Actual IP on LAN of Web Server: 192.168.1.1 LAN Interface IP: 192.168.200.1 The source could be any routable address ... Many thanks in advance, J ... View more

Hi all, Not entirely convinced that I've not missed something very simple along the way but am looking for some help. Essentially I can't ping the outside interface of my ASA from another network several hops away.  However I can ping devices on the 'inside' interface.  I am guessing this some sort of ICMP policy stopping this or perhaps just the default behaviour of the ASA but I'm not sure what I've missed.  I am running version 9.4. Topology is as follows: 192.168.1.0 - Inside 192.168.10.0 - Outside | MPLS Network | 192.168.20.0 - Remote site Access lists as follows: outside_out extended permit icmp any any object-group networksvc-ping outside_in extended permit icmp any any object-group networksvc-ping  inside_outextended permit icmp any any object-group networksvc-ping inside_in extended permit icmp any any object-group networksvc-ping  Applied to: access-group outside_in in interface Outside access-group outside_out out interface Outside access-group inside_in in interface inside access-group inside_out out interface inside Also policy-maps: policy-map icmp_policy  class icmp-class   inspect icmp policy-map global_policy  class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny     inspect sunrpc   inspect xdmcp   inspect sip     inspect netbios   inspect tftp   inspect ip-options Single default route via the inside.  Couple of statics pointing to internal networks behind the inside interface.  All inside interface IPs can be pinged.  However from the outside I cannot ping the outside interface.  Any ideas/thoughts? Can see nothing on the logs or via debug ICMP which makes me think its some sort of default behaviour that drops this traffic automatically.  No nat if configured. Thanks in advance, happy to post more config if needed. Many thanks, ... View more

Hi all, Currently experiencing a very weird problem (Which I shall raise a TAC for at some point) but was wondering if anyone could help before I do? We recently upgraded four Nexus 5548UP switches from 6.0.2 N2 to 7.0.1.N1(1a) they are two pairs both in vPC's but connected via fabricpath in a kind of mesh. HSRP was configured on each switch with priority given to switch 1 then 2 and then 3 and then 4.  This worked perfectly until we upgraded to the above version and now when switch 1 is up packets are dropped in every which way as if there is vPC/HSRP issue.  If we shutdown switch 1 and allow switch 2 to take over HSRP all is ok.  Equally if I shutdown the SVI on switch 1 and 2 and let 3 and four take over HSRP duties all is equally well.  Another thing I've noticed is that all switches are set to preempt, so in the event of a failure the topology will hopefully reset with switch 1 being the primary, 2 being the backup etc etc.  Even though switch 1 is set with a higher priority than the other three when it is turned back on it will not take the active role (You can see in the coup info being sent but its like the other switches are ignorning it). I'll post some config tomorrow but annoyingly this hasnt changed for over 2 years and is now no longer working. Anyone shed any light? Cheers, Jamie ... View more

Hi folks, I am hoping this is something trivial but am having some issues routing between two subnets behind a Cisco ASA 5510.  Before I start I am aware this is less than optimal however at present we have no choice regarding this configuration. So E0/1 is configured as the 'inside' interface with an address of 192.168.1.0/24.  We also have another subnet on the inside; 192.168.15.0/24 (Accessible via router 192.168.1.180) which is configured with a static route to provide access.  That router is directly connected to both subnets. The following configuration is on the ASA: no nat-control interface Ethernet0/0 description outside nameif outside security-level 0 ip address 87.224.126.171 255.255.255.248 ! interface Ethernet0/1 description inside nameif inside security-level 100 ip address 192.168.1.254 255.255.255.0 ! same-security-traffic permit inter-interface same-security-traffic permit intra-interface access-list inside_access_in extended permit ip any any access-list inside_access_out extended permit ip any any access-group inside_access_in in interface inside access-group inside_access_out out interface inside route inside 192.168.15.0 255.255.255.0 192.168.1.180 1 The confusing thing here is I can ping all interfaces and all devices local to those subnets (Trace route appears to check out etc) however I can do nothing else.   I have a number of open ports on devices at the other end which are not visible however I can see nothing occurring on the firewall to block access. Does anyone have any thoughts? This one has me bamboozled at the moment ... J ... View more

Good afternoon, I was wondering if someone might be able to help,  I have an interesting setup which I am working with at the moment which consists of 4x Nexus 55xx switches running HSRP for around 4 VLAN's.  What we are looking to do advertise routes from the Nexus 5548's to a SonicWall via OSPF.  Ultimately this is to to reduce the admin overhead of constantly adding static routes as this may be connected to a more complex upstream network where adding hundreds of static routes would be impractical. However instead of distributing these routes via a traditional L3 routed link we have attached the SonicWall via a L2 link (In the form of a switch connected to both Nexus 5548's via a port channel) and are advertising the VLANs (Running HSRP) via OSPF.  There are a number of technical and logistical reasons for this approach however I do have a couple of specific questions regarding this setup:  1) HSRP adjacency using a L2 port channel connected to two Nexus 5548's.  Is this a valid (And safe?) configuration. I read that an adjacency like this over a vPC(or vPC+) link will not work due to the loop prevention technologies used by vPC.  Is this correct? 2) HSRP adjacency over FabricPath, Is this ok and is it supported? 3) Any other safe way of achieving the above requirement? Apologies if the explanation regarding this configuration is not very clear.  I will amend as required and have posted up a very simple diagram to try and explain ... Regards, Jamie ... View more