About ROBERTO TACCON

ROBERTO TACCON · ‎11-18-2016

check also https://supportforums.cisco.com/discussion/13165791/blacknurse-icmp-flooding

ROBERTO TACCON · ‎11-18-2016

please note also that 1) the bug does not affect only ICMP type 3 code 3 http://www.blacknurse.dk/blacknurse.pdf 2) http://www.blacknurse.dk/Gupta.txt We would kindly like to inform you about some interesting results in our experiments with "unassigned" icmp-types http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml When flooding cisco asa's (a handfull older as well newer models) with "unassigned" icmp type=1, type=2, etc it seems that the asa is computing the "number of connections / sec" differently: X "normal" ICMP's / sec => X connections / sec BUT X "unassigned" ICMP's / sec => one single connection ! in other words: DOS-flooding with "unassigned" types is INVISIBLE in the asa connection statistics ;-)

ROBERTO TACCON · ‎11-17-2016

Please ntoe that if you have firewall feature enabled (ZBF) still be a problem. For example check the Cisco ASA: http://www.blacknurse.dk/testresults.txt - When mitigating using: icmp deny any unreachable outside icmp deny any time outside the reduction in load is less than 50% on packets towards the ASA outside IP, but it does not affect the load of packets towards hosts behind the ASA550. On 5515-X it did not prevent 100% CPU on 50k packets per second with type 3 ICMP packets.

ROBERTO TACCON · ‎09-05-2015

Have you try the version 9.5(1) ?

ROBERTO TACCON · ‎05-02-2015

Why 38160003*8 = 305280024/1024*1024 = 291 Mbps(Approx) ?!? Storage (Kilo = 1024 bits) Bandwidth (Kilo = 1000 bits) http://physics.nist.gov/cuu/Units/binary.html so 38160003 = megabits 305.280024

ROBERTO TACCON · ‎11-01-2014

Cisco Context Directory Agent http://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/release_notes/cda10_rn.htmlhtml http://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/Install_Config_guide/cda10.html

ROBERTO TACCON · ‎08-28-2014

Hello Jay, It's NOT possible to access the 43 ASA Version 9.2 and Interesting TAC Cases August 26, 2014 https://supportforums.cisco.com/document/12285146/tac-security-podcast-episode-43-asa-version-92-and-interesting-tac-cases "You are not authorized to access this page." Please can you check ?

ROBERTO TACCON · ‎08-21-2014

Hello Peter, have you try to contact the Cisco TAC for an official check/verification about the problem ? As the these switches WS-C2960S-48TS-S and WS-C2960S-48FPS-L have "Enhanced Limited Lifetime Warranty HW (ELLW) ( WARR-ELTD-LIFE-HW)" you can ask for a check/Hardware Replacement. Best Regards P.S.: please can you insert in email loop also me roberto@ipnetworks.it

ROBERTO TACCON · ‎08-15-2014

Please also note/check the security concerns vs the HADWARE supported/performance on the ASAs: Hardware and or Software only supported on single or multi-core platforms (check with the TAC) http://www.cisco.com/c/en/us/products/collateral/security/adaptive-security-appliance-asa-software/qa_c67-712934.html Q. Is next generation encryption available on all ASA platforms? A. No. Next Generation Encryption is fully supported on the ASA 5585-X, 5500-X Series, and 5580, as well as on the Catalyst 6500 Series ASA Services Module. It can only be partially supported on the ASA 5505, 5510, 5520, 5540, and 5550 due to hardware limitations. AnyConnect 3.1 or greater and an AnyConnect Premium License are also required to use next generation encryption for remote access connections.

ROBERTO TACCON · ‎04-23-2014

https://supportforums.cisco.com/discussion/11696331/android-smartphone-l2tp-ipsec-vpn-ios

ROBERTO TACCON · ‎04-23-2014

Why on the Cisco 2911 there's the permit ip 192.168.1.0 0.0.0.255 host 3.3.3.3 ? However have you configured on the Cisco ASA : sysopt connection preserve-vpn-flows http://www.cisco.com/c/en/us/td/docs/security/asa/asa81/config/guide/config/intro.html#wp1053814

ROBERTO TACCON · ‎04-23-2014

>Do I need to buy a new license with image upgrade ???? NO But check the: 1) https://supportforums.cisco.com/document/48646/asa-83-upgrade-what-you-need-know 2) migrate the configuration from 8.21 to 9.03 asking cisco TAC help

ROBERTO TACCON · ‎07-29-2013

Hello Jennifer, please can you indicate: - which protocols can be transparently redirected - how to configure the CWS on Cisco ASA and Cisco routers using cli - are there an evaluation license to test the CWS - which are the limits of the CWS (in terms of Cisco ASA/ISRG2 and concurrent number of users, bandwidth, ...) - is there an ordering guide (part numbers for Cisco ASA and ISRG2) Thanks

ROBERTO TACCON · ‎02-13-2013

Which software version are you using ? check this BUG CSCty32412 https://supportforums.cisco.com/thread/2149125 ASA: Anyconnect u-turn to ipsec tunnel fails Symptom: ASA after a upgrade to 8.4.3.1 or later, anyconnect traffic that will uturn (hairpin) to a ipsec lan to lan tunnel is dropped. The show asp drop shows the following reason: Expired VPN context (vpn-context-expired) No log message is generated for the drops. Issue is seen on ASA 8.2.5.26 as well Conditions: Anyconnect client uturns into a ipsec lan to lan tunnel. Fixed-In 8.4(4) 9.0(1) 9.1(1) 9.0(0.99) 8.4(3.105) 100.8(33.3)M 100.8(0.126)M 8.2(5.29) 100.7(13.73)M 100.7(6.78)M 100.8(11.20)M 100.9(2.1)M 100.8(27.7)M 100.9(0.1)M 8.4(4.99) 100.8(34.1)M

ROBERTO TACCON · ‎02-09-2013

With the latest release 9.1 you can buy and use the asa CX SOFTWARE module

Date Registered	‎03-17-2001 10:10 AM
Date Last Visited	‎12-11-2018 01:19 PM
Total Messages Posted	393
Total Helpful Votes Received	57

check also

please note also that

Please ntoe that if you have

Have you try the version 9.5

Why38160003*8 = 305280024

Cisco Context Directory Agent

Hello Jay,It's NOT possible

Hello Peter,have you contact

Please also note/check the

https://supportforums.cisco

Why on the Cisco 2911 there's

>Do I need to buy a new

Ask the Expert: Cisco Cloud Web Securit...

Re: Changing SSL to IPSec in ASA5510

Block P2P torrents (BitTorrent etc.)