check also https://supportforums.cisco.com/discussion/13165791/blacknurse-icmp-flooding ... View more

please note also that 1) the bug does not affect only ICMP type 3 code 3 http://www.blacknurse.dk/blacknurse.pdf 2) http://www.blacknurse.dk/Gupta.txt We would kindly like to inform you about some interesting results in our experiments with "unassigned" icmp-types http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml When flooding cisco asa's (a handfull older as well newer models) with "unassigned" icmp type=1, type=2, etc it seems that the asa is computing the "number of connections / sec" differently: X "normal" ICMP's / sec => X connections / sec BUT X "unassigned" ICMP's / sec => one single connection ! in other words: DOS-flooding with "unassigned" types is INVISIBLE in the asa connection statistics ;-) ... View more

Please ntoe that if you have firewall feature enabled (ZBF) still be a problem. For example check the Cisco ASA: http://www.blacknurse.dk/testresults.txt - When mitigating using: icmp deny any unreachable outside icmp deny any time outside the reduction in load is less than 50% on packets towards the ASA outside IP, but it does not affect the load of packets towards hosts behind the ASA550. On 5515-X it did not prevent 100% CPU on 50k packets per second with type 3 ICMP packets. ... View more

Have you try the version 9.5(1) ? ... View more

Why 38160003*8 = 305280024/1024*1024 = 291 Mbps(Approx) ?!?     Storage (Kilo = 1024 bits) Bandwidth (Kilo = 1000 bits) http://physics.nist.gov/cuu/Units/binary.html     so 38160003 = megabits 305.280024   ... View more

Cisco Context Directory Agent   http://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/release_notes/cda10_rn.htmlhtml     http://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/Install_Config_guide/cda10.html ... View more

Hello Jay, It's NOT possible to access the 43 ASA Version 9.2 and Interesting TAC Cases August 26, 2014 https://supportforums.cisco.com/document/12285146/tac-security-podcast-episode-43-asa-version-92-and-interesting-tac-cases "You are not authorized to access this page."   Please can you check ? ... View more

Hello Peter, have you try to contact the Cisco TAC for an official check/verification about the problem ? As the these switches WS-C2960S-48TS-S and WS-C2960S-48FPS-L have "Enhanced Limited Lifetime Warranty HW (ELLW) ( WARR-ELTD-LIFE-HW)" you can ask for a check/Hardware Replacement. Best Regards P.S.: please can you insert in email loop also me roberto@ipnetworks.it ... View more

Please also note/check the security concerns vs the HADWARE supported/performance on the ASAs: Hardware and or Software only supported on single or multi-core platforms (check with the TAC)   http://www.cisco.com/c/en/us/products/collateral/security/adaptive-security-appliance-asa-software/qa_c67-712934.html Q. Is next generation encryption available on all ASA platforms? A. No. Next Generation Encryption is fully supported on the ASA 5585-X, 5500-X Series, and 5580, as well as on the Catalyst 6500 Series ASA Services Module. It can only be partially supported on the ASA 5505, 5510, 5520, 5540, and 5550 due to hardware limitations. AnyConnect 3.1 or greater and an AnyConnect Premium License are also required to use next generation encryption for remote access connections.   ... View more

https://supportforums.cisco.com/discussion/11696331/android-smartphone-l2tp-ipsec-vpn-ios   ... View more

Why on the Cisco 2911 there's the permit ip 192.168.1.0 0.0.0.255 host 3.3.3.3 ?   However have you configured on the Cisco ASA : sysopt connection preserve-vpn-flows http://www.cisco.com/c/en/us/td/docs/security/asa/asa81/config/guide/config/intro.html#wp1053814         ... View more

Hello Jennifer, please can you indicate: - which protocols can be transparently redirected - how to configure the CWS on Cisco ASA and Cisco routers using cli - are there an evaluation license to test the CWS - which are the limits of the CWS (in terms of Cisco ASA/ISRG2 and concurrent number of users, bandwidth, ...) - is there an ordering guide (part numbers for Cisco ASA and ISRG2) Thanks ... View more

With the latest release 9.1 you can  buy and use the asa CX SOFTWARE  module ... View more