SCP to my firewalls in Japan and USA from the UK is painfully slow.  I suspect this is because the firewall does not do any window scaling. If I copy from a local machine, I get a transfer time of about 1m30s for a firmware image.  Transcontinental it is about 6h.  If I copy it to a linux box transcontinental it is only a couple of minutes. So obviously something the firewall is doing badly with the High latency link.   Is there any way I can improve this, other than by using a local jump host? ... View more

  I am about to build an OOB Management network, for about 10 sites, and am trying to identify the most cost effective hardware. I intend to provide OOB Ethernet and Serial connectivity to each network device on my main network which is around 100 devices. The kit is spread out in some DCs and no copper between some racks. My basic plan so far is:   Cisco ASA5508 firewalls at each site, with an internet connection. Two sites designated as Hubs, connecting with IPSec to all others in a double hub & Spoke. Small Sites (x6) Less than 6 Switches to manage can connect direct to the firewall If more than 6 ports are requires then a 24 port switch. 6 port Serial Console server Larger sites (x4) Racks are spread out across DC in about 8 groups Each group will need a Serial console server with an appropriate number of ports Each rack group will need a switch, that switch will need to uplink back towards the firewall with Fibre. The ASA 5508 firewall does not have fibre ports (the 5525 with expansion does, but that is too expensive and only 6 SFP ports). So I need a Distribution switch with > 8 x 1G SFP interfaces. This is the main device I am having difficulty identifying. Each rack group will have a small switch with 1/10/12/24 1G copper interfaces (depending on group size) and an 1G SFP uplink. Some basic requirements are: I don't want to buy EOL kit, it all has to be supportable. All of the kit I need to manage has either 100Mb or 1Gb copper interfaces. Bandwidth throughput does not need to be high. This is not a fully resilient network, it is just a simple double hub and spoke. The Two Hub sites are the biggest DCs. Most of the others are small 1 or two racks. The hardware doesn't have to be Cisco, although I am most familiar with it, but it does need to be one of our existing three that we already use, as I don't want to add a fourth vendor. They are Cisco, Arista and Juniper. I really don't like media converters, as I have found them to be unreliable in the past. All kit must be rack mountable. Hub sites will have some services running to support management, like touchdown server, TACACS, syslog, DNS, DHCP, snmp, NTP. If anyone can share their experience setting up something like this and recommend any hardware it would be greatly appreciated. Alternate suggestions to the above are welcome, if you think there is a better method to achieve the same goal. ... View more

The workaround shows clearing the IKEv1 SA. Does this bug also affect IKEv2 connections, or is it limited to IKEv1? ... View more

Is it possible on the ASA CLI to do a multi line config change in a transactional way.  i.e. All lines are applied or none. Alternatively can I do a rollback if the config is not confirmed within a time period?  There are two things I am trying to achieve: 1. The ability to make multi line config changes, which have inter-dependencies. eg. If I have line 1 without line 2, I loose connectivity, and can never type line 2. 2. I am trying to avoid a situation where I apply an unsuccessful configuration change to a remote device, which blocks connection to the device.  If my config is not successful or unconfirmed, I want to automatically revert to the previous state.    There is the `reload in 10` option, but this is very disruptive and a poor workaround. It also needs to be carefully timed on failover pairs, or the config will persist on the backup even if it wasn't saved. IOS has a config revert option if archiving is configured and the config is not confirmed within a time period. Alas, I can not see this in ASA.       ... View more

Can anyone please confirm my thinking for the CVE-2018-15454 SIP DOS Attack mitigation.  If we only initiate SIP connections outbound and we do not have any rules allowing inbound connections, this attack is not possible from outside.  I just want to check this isn't one of those things that ASA does stuff in the background without explicit rules needing to be present.     ... View more

I have recently installed a couple of Smart Software Manager Satellite VM's.   The offline licence server is a very good idea, but it is severely limited in functionality and monitoring.  As far as I can see it has the following limitations, which I would classify as essential in any enterprise environment.   1. No Multi site or Multi Server resilience or failover. 2. No ability to log to central syslog . 3. No SNMP Monitoring capability (or any other remote monitoring) 4. No centralised AAA capability. 5. No API for programmatic interaction.   Am I correct in the above list of limitations, or are any of these things possible? Has anyone managed to get a solution to monitor the system? ... View more

What is the CellNM5 interface that is listed on the Cisco 819 router?  I have tried searching for it but google turns up nothing that I can see. It appears to be related to Line 6 and is some sort of Async Serial interface. ... View more