This might sound strange but I want to have a policy on a 2110 FTD Appliance that does not use Security Intelligence.   The firewall is an internal device that is used to screen PCI users from the rest of the network, as such it is not able to communicate with the outside world - so I don't need the DNS scannig features - also I haven't bought a threat license for the devices.   I have deleted the DNS Feeds but it still seems to want to use this.   Is it possible to remove the Security Intelligence section completely - or is this a way to force you to buy a threat policy for every firewall?   Thanks   Giles ... View more

I'm not sure if this possible so if someone could help me that would be good.   We want to lock down our ISE policies so that unauthenticated machines get very limited access. However our desktop support team still wants to be able to build PCs at desks.   To do this they need access to loads of AD and SCCM servers, which the unauth acl will not allow them to access.   They are happy to add the endpoints manually into a specific group. But may forget to take them out after the machine has been built - is it possible to automatically remove any endpoint in a specified group on a scheduled basis? ... View more

We are shortly upgrading some of our inter-site links from 1Gb to 10Gb. As part of that work I will be changing the reference bandwidth on the core switches from 2Gb to 100Gb (giving a bit of headroom over the 10GB circuits as we already have some 20GB links). This is nice and easy all I have to do is enter the OSPF process and type auto-cost reference-bandwidth 100 Gbps. However we also have a large number of ASA firewalls running as part of OSPF - these all seem to be using a reference bandwidth of 100Mbps. as you can see in the screen extract below PEG-VFW01/peg-dfg-vfw01# sh ospf Routing Process "ospf 1" with ID 172.31.22.1 Start time: 17:03:37.230, Time elapsed: 6w1d (lines omitted) Reference bandwidth unit is 100 mbps How can I change the reference bandwidth to 100Gbps. Looking at the cisco documentation it appears you can do that using OSPF V3 but as I am not running IPV6 I don't want or need to enable that. Any suggestions welcome? Thanks GIles ... View more

We have just installed a set of 5585 firewalls running multiple virtual contexts. What I want to do is to back up the system context (the other contexts are managed separately) Adding the device in Prime works perfectly and the configuration is backed up - almost. What doesn't appear to be backed up are the security keys. I think either the system is hiding them or it is not running the more running-config command to export the keys. Any suggestions on how to get this to work. Thanks Giles ... View more