I posetd this is Firepower forum, but I think it could be related to ASA aswell - sorry for double posting:   Heelo Forum,   I seem to have run into a Management issue, after upgrading FXOS/ASA bundle software on Firepower hardware I run FP-2130 hardware and ASA VA, in CONTEXT mode    Problem seem to me like the ASA OID has changed and is now the same as the FXOS SysObjectId, making it incorrect for my NMS to handle I am sure this WAS true back in the days (As I have noted it down adding to NMS):   FPR-2110 FXOS OID 1.3.6.1.4.1.9.1.2404 ASA SC OID 1.3.6.1.4.1.9.1.2317   FPR-2130 OID 1.3.6.1.4.1.9.1.2406 ASA SC OID 1.3.6.1.4.1.9.1.2319 Looks like Current 2110 and 2130 when in Context modes, reports SNMP SYSOBJECTID, same OID as the Firepower FXOS OID, and not the ASA SC OID !   TRUE TODAY: ASA context, (ASA running on Firepower 2130 hardware:) snmpwalk.exe -M mibs -v 2c -c REMOVED 10.666.666.14 1.3.6.1.2.1.1.2 iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.9.1.2406 Firepower Management Interface (FXOS) snmpwalk.exe -M mibs -v 2c -c REMOVED 10.666.666.11 1.3.6.1.2.1.1.2 iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.9.1.2406   THEY ARE THE SAME ! Or is it just me ?   version is FXOS Version 2.3(1.131) / ASA  Version 9.9(2)40  ... View more

AAA question -  ASA IPSEC-IKEv2 VPN I had this posted in the VPN sub-group, but noone seems to have any input, so I'll try my luck in this group ...   Setup ---------- ASA5525-X running ASA-OS 9.8(2)35, configured as a VPN Headend gateway, using Native windoze 10 embedded VPN client. (This translates into Old school IPSEC Remote Access VPN, but using IKEv2 Policies) AAA is done using Certificates and LDAP attribute mappings. Also, I'm using CRL, and certificate mappings. As such the setup is working. NB: This setup is NOT related to SSL-VPN using AnyConnect ! Issue ---------- The Authorization is done using LDAP integration, where username is derived from the certificate. Due to company policies, I need to add the lookup, that the username taken from certificate, must match a group membership (memberOf) This is normally no issue, and is done many places, for user authentication ... BUT in this case its computer accounts, not user accounts, hence the real AD username has a $-sign at the end of the username! This conflicts with the CN subject field containing the username, as this cannot contain $-sign Result is that I never get a match, f.ex on joescomputer.example.com, as the AD username for the computer account actually is JOESCOMPUTER$ I want to check if the computer-account located in AD group "Domain Computers", or a different other group for that matter, is present and if its enabled or disabled. So how to go about this?  - Some ASA trick ?  - Some Certificate trick ?  - Learn LUA ?  - Any MS AD trick ? Please comment and advice ... View more