I need to install our local certificates on our WLC. Failed. >> https://www.sslsupportdesk.com/cisco-wireless-lan-controller-ssl-installation/# >>https://pvoord.wordpress.com/2012/06/20/importing-3rd-party-certificate-on-cisco-wlc/ >>https://support.quovadisglobal.com/kb/a476/how-do-i-install-a-certificate-onto-cisco-wlan-controller-wlc.aspx I tried everything from advices above: installed openssl 0.9.8 and did all steps on it (of course, medial certificates are from 1.1). == wifi.conf == [ req ] default_bits = 2048 default_md = sha512 default_keyfile = wifi.key prompt = no encrypt_key = no distinguished_name = DN req_extensions = v3_req [ DN ] countryName = "BY" stateOrProvinceName = "xxxx" localityName = "xxxx" postalCode = "nnnn" streetAddress = "aaaa" organizationName = "aaaa" organizationalUnitName = "aaaaaaaaaaaaa" commonName = "*.wifi.xxx" emailAddress = "email@xxx.by" [ v3_req ] subjectAltName = DNS:wifi-a.wifi.xxx,DNS:wifi-b.wifi.xxx,DNS:wifi-c.wifi.xxx,IP:10.0.0.9,IP:10.0.0.10,IP:10.0.0.11 == Command: #openssl req -new -config wifi.conf -out wifi.csr send csr for subscrition >>wifi.cer #cat wifi.cer ../subca.cer ../rootcert.cer >all.cer #openssl pkcs12 -export -inkey wifi.key -in all.cer -out wifi.pfx -clcerts -passout "pass:---" #openssl pkcs12 -in wifi.pfx -out wifi.pem -passin "pass:---" -passout "pass:---" # telnet wism wism>transfer wism transfer> download mode tftp wism transfer> download datatype webauthcert wism transfer> download serverip 10.0.0.66 wism transfer> download path / wism transfer> download filename wifi.pem wism transfer> download certpassword --- wism transfer> download start But I still got an error. What and where to check? ... View more

I want a 2G fiber downlink on my ASA 5520. It has a 4GE-SSM module installed. The problem is: it works OK on 8.47 IOS, but on 9.03 all interfaces of 4GE refused to become a channel-gropu members. Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x0) Boot microcode        : CN1000-MC-BOOT-2.00 SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03 IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.08 Cisco Adaptive Security Appliance Software Version 9.0(3) ..... Reading from flash... !!!!!! channel-group 1 mode on ^ ERROR: % Invalid input detected at '^' marker. *** Output from config line 50, " channel-group 1 mode on" channel-group 1 mode on ^ ERROR: % Invalid input detected at '^' marker. *** Output from config line 57, " channel-group 1 mode on" asa# show run int po1 ! interface Port-channel1 description Intranet nameif INSIDE security-level 100 ip address 10.149.8.252 255.255.255.0 asa# show run int g1/2 ! interface GigabitEthernet1/2 media-type sfp no nameif no security-level no ip address asa# conf t asa(config)# int g1/2 asa(config-if)# chan? ERROR: % Unrecognized command asa(config)# int g0/0 asa(config-if)# c? interface mode commands/options: channel-group In documentation, I found: http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/interface_start.html ...You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA 5550, as part of an EtherChannel... WTF?? ... View more

I want to use C3900 (Ios 15.3(1)T) as DNS server. I found it can serve SOA, NS, A, MX records. It generetes PTR records automatically too. But we have some CNAME records and TXT ones. I can't find any way to emulate it. Maybe, somebody knows? 1. general config ip dns server ip domain-lookup ip name-server 8.8.8.8 2. SOA ip dns primary bsu.by soa ns.bsu.by dvorc@bsu.by 86400 3600 1209600 86400 3. NS ip host bsu.by ns ns.bsu.by 4. A ip host ns.bsu.by 217.21.43.2 5. CNAME ? #have to be: xxx.bsu.by CNAME xxx.gov.by 6. MX ip host bsu.by mx 10 xwall.bsu.by 7. TXT ? # have to be TXT "spf -v bsu.by" -- ... View more

Hello! I am the administrator of an University network. We have (among other resuorces) two DNS servers, mail server and a spam-filtering server. they are: ------------------------------------------------------------IP server     IP_address     external IP dns     10.149.254.39     217.21.43.3 www     10.149.254.35     217.21.43.2 smtp     10.149.254.2     217.21.43.223 mail     10.0.0.5          217.21.43.224 ------------------------------------------------------------DNS In DNS server, we have: zone [bsu.by] dns     A     10.149.254.39 www     A     10.149.254.35 smtp     A     10.149.254.2 mail     A     10.0.0.5 --- While on version 8.24, this works: ------------------------------------------------------------asa-824.cfg names name 10.149.254.2 xwall.bsu name 10.149.254.35 www.bsu name 10.149.254.39 dns1.bsu name 10.0.0.5 mail.bsu ! interface GigabitEthernet0/1 nameif INSIDE security-level 100 ip address 10.149.8.252 255.255.255.0 ! interface GigabitEthernet0/2 nameif DMZ-WEB security-level 50 ip address 10.149.254.33 255.255.255.224 ! interface GigabitEthernet0/3 nameif OUTSIDE security-level 0 ip address 217.21.43.130 255.255.255.128 ! interface Management0/0 nameif DMZ-MAIL security-level 50 ip address 10.149.254.1 255.255.255.224 ! static (DMZ-WEB,OUTSIDE) 217.21.43.2 dns1.bsu netmask 255.255.255.255 dns static (DMZ-MAIL,OUTSIDE) 217.21.43.224 xwall.bsu netmask 255.255.255.255 dns static (INSIDE,OUTSIDE) 217.21.43.223 mail.bsu netmask 255.255.255.255 dns static (DMZ-WEB,OUTSIDE) 217.21.43.3 www.bsu netmask 255.255.255.255 dns ------------------------------------------------------------LOG >SSH far.aray.external.linux.server login: ******* >nslookup >>server 217.21.43.3 >>set type=A >>www.bsu.by 217.21.43.2 ------------------------------------------------------------ASA-847.cfg But, on 8.47 this configuration FAILS: object network mail.bsu host 10.0.0.5 object network xwall host 10.149.254.2 object network www.bsu host 10.149.254.35 object network www.dns1 host 10.149.254.39 object network net.bsu-intranet subnet 10.0.0.0 255.0.0.0 object network DMZ-net subnet 10.149.254.0 255.255.255.0 object network net.bsu-intranet-1 subnet 10.0.0.0 255.0.0.0 object network net.bsu-intranet-2 subnet 10.0.0.0 255.0.0.0 object network mail.bsu.by host 217.21.43.223 object network xwall.by host 217.21.43.224 object network www.dns1.by host 217.21.43.2 object network www.bsu.by desc ***** corrupted for the test, have to be "3" host 217.21.43.3 object network www.euniver.by host 217.21.43.18 ! object network mail.bsu nat (INSIDE,OUTSIDE) static mail.bsu.by dns object network xwall nat (DMZ-MAIL,OUTSIDE) static xwall.by dns object network www.bsu nat (DMZ-WEB,OUTSIDE) static www.bsu.by dns object network www.euniver nat (DMZ-WEB,OUTSIDE) static www.euniver.by dns object network www.dns1 nat (DMZ-WEB,OUTSIDE) static www.dns1.by dns ! object network net.bsu-intranet nat (INSIDE,DMZ-WEB) static net.bsu-intranet object network net.bsu-intranet-1 nat (INSIDE,DMZ-MAIL) static net.bsu-intranet object network net.bsu-intranet-2 nat (INSIDE,OUTSIDE) dynamic 217.21.43.64 ! access-list ALLOW extended permit ip any any access-group ALLOW in interface DMZ-WEB access-group ALLOW in interface INSIDE access-group ALLOW in interface OUTSIDE access-group ALLOW in interface DMZ-MAIL ------------------------------------------------------------LOG >SSH far.aray.external.linux.server login: ******* >nslookup >>server 217.21.43.3 >>set type=A >>www.bsu.by 10.149.254.39 ------------------------------------------------------------end What to do?? How to debug DNS doctoring events (to see, for example: A record for www.xxx.com is  translated from x.x.x.x to 10.y.y.y)? ... View more