Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Pawel Cecot
Stats
Member since
12-18-2012
11
Posts
16
Helpful
2
Solutions
Created by
Pawel Cecot
in VPN and AnyConnect
in VPN and AnyConnect
09-30-2013
10:54 AM
09-30-2013
10:54 AM
Yes, the packet-tracer will bring up an IPSec vpn tunnel. Pawel
... View more
06-04-2013
11:44 AM
Hi Marco, It is an expected bahaviour. Since ACS5.3 patch 7+ and 5.4 patch 1+ if you hit F5 (refresh) the GUI will display “ACS: Resource not found or internal server error”. You need to log out and log in back to fix that. The reason for that is a GUI vulnerability found in ACS 5.3 and the fix for that was to disallow refresh/reload/back on the GUI. It is the same as in online bank account where you are not allowed to do ‘refresh’. Seems like on 5.4 patch 3 they even added the pop-up explaining what you did wrong. Just click on a specific url/menu and avoid using F5 (refresh). Pawel
... View more
05-30-2013
03:45 AM
Hi Jonathan, Please follow the user guide: http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/admin_operations.html#wp1056068 The Log collector will be one for the whole deployment. It is recommended to have the Log collector on the instance which is handling less AAA requests. To define the Log collector: http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/admin_config.html#wpxref50831 Pawel
... View more
04-10-2013
11:03 AM
Patrick, just to be sure, we are talking about ACS 5.x? If yes, you need to go to ACS View, and to go there you need to click on [Monitoring and Reports > Launch Monitoring & Report Viewer], after that you will be redirected to the ACS View (which is the same server or one from the distributed deployment). Next you should go to [Monitoring Configuration > System Operations > Data Management > Removal and Backup]. I hope that helps. Thanks, Pawel
... View more
04-10-2013
09:26 AM
I think that maximum is 365 (exactly what you need) and it is related to database purging which can be set to maximum value of 12 months (Monitoring Configuration > System Operations > Data Management > Removal and Backup). If you would like to keep from a longer period, you should consider logging to an external syslog. Thanks, Pawel
... View more
04-10-2013
06:47 AM
Hi Patrick, In the ACS View Reports (Monitoring & Reports > Reports > Catalog > AAA Protocol) you can select the radio button and by selecting 'Run' on the bottom run a specific query. Without that by default you will see only a report from one day. For the 2nd question, yes the ACS View is designed to store that information, however if needed you can send the logs to an external syslog server or perfrom regular backups of the ACS View database. Kind regards, Pawel
... View more
Created by
Pawel Cecot
in VPN and AnyConnect
in VPN and AnyConnect
01-19-2013
01:43 PM
01-19-2013
01:43 PM
same-security-traffic permit intra-interface has to be enabled on the HQ (ASA1) as this is where you need to do a u-turn with the Internet traffic. NAT should also be performed on the HQ, so that the Internet will know where to send the traffic back - HQ. The crypto ACL should look something like that (assuming that 10.79.1.0/24 is the branch subnet): HQ - access-list NAME permit ip any 10.79.1.0 255.255.255.0 BRANCH - access-list NAME permit ip 10.79.1.0 255.255.255.0 any + PAT (first example: http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/vpn_params.html#wp1047799 ) Pawel
... View more
Created by
Pawel Cecot
in VPN and AnyConnect
in VPN and AnyConnect
01-19-2013
12:40 PM
01-19-2013
12:40 PM
Yes I'm aware the the document is about VPN Client, however the idea is the same. You need to do a u-turn on th ASA. For that you need sames-security... And after that you need to translate the source of the packets so they will be routable on the Internet. Configuration guide which explains all you need: http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/vpn_params.html#wp1042114 Pawel
... View more
Created by
Pawel Cecot
in VPN and AnyConnect
in VPN and AnyConnect
01-19-2013
12:04 PM
01-19-2013
12:04 PM
Hi, you need to configure so called "hairpinning". Check the below document: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml The important steps are: same-security-traffic permit intra-interface + proper NAT pre-8.3 nat (outside) 10 ... global (outside) 10 ... post-8.3 nat (outside,outside) ... Thanks, Pawel
... View more
12-25-2012
03:26 PM
Jiri Zvolanek wrote: Hello. I think you have problem in ASA configuration. Here´s the reason. "access-group outside_access_in in interface outside" You´re applying ACL outside_access_in to your outside interface but there is no such ACL present in your ASA cfg so I think packets are droped. Try to permit you VPN traffic or Public IP of the router at outside ACL in the ASA. (not sure which one will work for u) As long as there is the default 'sysopt connection permit-vpn' the vpn traffic will be allowed regardless of the inbound ACL. Either the ASA is not receiving the MM1 or after the ASA is replying with MM2 it gets dropped somewhere. All in all I suggest to collect captures or debugs. Pawel
... View more
12-25-2012
04:13 AM
Hi, - The configuration looks fine. - We can clearly see from the debug that MM1 message is beeing retransmitted so that packet is somewhere blocked/dropped. Some questions which might help you: - Do you have udp/500 and udp/4500 allowed along the path in both directions? - Is it a static - bi-directional NAT? - Do we receive something on the ASA? I suggest to: - collect debugs on the ASA - collect captures on the ASA to verify if you receive the MM1 packet from the IOS (capture ISAKMP type isakmp interface outside) Pawel
... View more
06-04-2013
Hi Marco,It is an expected bahaviour.Since ACS5.3 patch 7+ and 5.4 patch
1+ if you hit F5 (refresh) ...
05-30-2013
Hi Jonathan,Please follow the user guide:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_acce...
04-10-2013
Patrick,just to be sure, we are talking about ACS 5.x?If yes, you need
to go to ACS View, and to go ...
04-10-2013
I think that maximum is 365 (exactly what you need) and it is related to
database purging which can ...
04-10-2013
Hi Patrick,In the ACS View Reports (Monitoring & Reports > Reports >
Catalog > AAA Protocol) you can...
01-19-2013
same-security-traffic permit intra-interface has to be enabled on the HQ
(ASA1) as this is where you...
01-19-2013
Yes I'm aware the the document is about VPN Client, however the idea is
the same.You need to do a u-...
01-19-2013
Hi,you need to configure so called "hairpinning". Check the below
document:http://www.cisco.com/en/U...
12-25-2012
Jiri Zvolanek wrote: Hello.I think you have problem in ASA
configuration. Here´s the reason."access-...
Public Statistics
| Date Registered | 12-18-2012 03:48 AM |
| Date Last Visited | 10-16-2019 04:42 AM |
| Total Messages Posted | 11 |
| Total Helpful Votes Received | 16 |
