Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Antonio Macia
09-04-2019
Stats
Member since
01-18-2010
122
Posts
11
Helpful
4
Solutions
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
08-21-2019
02:13 AM
08-21-2019
02:13 AM
I've noticed that the installation of AMP enabler module in AnyConnect does not use the local machine proxy configuration no matter whether I configure the proxy in the AMP policy or not. Is there any way to force the connector to use the proxy? On those situations where the outgoing traffic is blocked and only allowed when the proxy is used, this is really necessary.
... View more
- Tags:
- AMP Enabler
Labels:
Created by
Antonio Macia
in Advanced Threats
in Advanced Threats
08-20-2019
03:04 AM
08-20-2019
03:04 AM
Hello, I've noticed that the installation of AMP enabler module in AnyConnect does not use the local machine proxy configuration no matter whether I configure the proxy in the AMP policy or not. Is there any way to force the connector to use the proxy? On those situations where the outgoing traffic is blocked and only allowed when the proxy is used, this is really necessary. Regards.
... View more
Labels:
Created by
Antonio Macia
in Advanced Threats
in Advanced Threats
05-27-2019
11:57 AM
05-27-2019
11:57 AM
Thanks Thorsten, I'll do. In my opinion is a very important feature for the uses cases I mentioned above.
... View more
Created by
Antonio Macia
in Advanced Threats
in Advanced Threats
05-25-2019
11:03 AM
05-25-2019
11:03 AM
Hello, For those use cases where the administrators don't have access or no longer manages the computer, is it possible to trigger a connector uninstall from the Cloud? Let's say that a laptop is stolen and we don't want to keep this connector consuming licenses or generating events. Or, with BYOD, the company let their employees install the connector on their personal computer, but once the employee leaves the company, the connector must be uninstalled remotely. What is the approach for this? Regards.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-10-2019
09:32 AM
04-10-2019
09:32 AM
Thanks mate!
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-09-2019
02:21 PM
04-09-2019
02:21 PM
I see your point RedNectar. So in a brownfield deployment in network centric mode, having the port-group to VLAN-BD-EPG mapping and the gateway configured in the BD, to move to application centric mode I would have to create additional port-groups mapped to new VLANs and EPGs within the same BD, so there's no need to change the VMs IPs which is critical in a production environment. I would just need to connect the VMs to the new port-groups. Am I right? Thanks.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-05-2019
01:44 PM
04-05-2019
01:44 PM
Thanks, option 3 is the scenario I'm looking for. It corroborates my suspicions then, but I was hoping that there was some way to minimize the number of physical domains per server.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-05-2019
10:04 AM
04-05-2019
10:04 AM
Hello Omamenko, Thanks for your reply. Having a single physical domain wouldn't match the scenario at the bottom left of the image which is not possible in ACI? Did you try this set up and work? On the other hand, the use of the per-port VLAN feature is precisely to deal with scenario where the same VLAN is used in the same switch for different EPGs, am I right? Regards.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-04-2019
07:28 AM
04-04-2019
07:28 AM
Hello, Trying to understand the best practice for VLAN to EPG to BD mapping and leaf connectivity. Let's say we have a number of virtual machines running on different VMware hosts all connected to the same leaf. These VMs belong to the same VLAN. The VLAN pool is static since we don't have distributed virtual switches (no VMware enterprise license). We want to separate the VMs in different EPGs. Per the recommendations below I should create one physical domain per server to make this possible, right? There's no way to reduce the number of physical domain objects if all the servers will share the same VLAN pool? What if the hosts are connected in VPC fashion to two leaves? Regards.
... View more
Labels:
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
03-07-2019
08:44 AM
03-07-2019
08:44 AM
Actually, for SCCM to report the proper deployment of the profile configuration file it checks if the file resides in the folder, but since it quickly disappears, SCCM is not able to, that's why we are trying a different approach like checking the profile name at the AnyConnect registry level. Also, if that file generates another file in a different folder then it would be a feasible solution.
... View more
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
03-07-2019
02:54 AM
03-07-2019
02:54 AM
Hello, Is it possible to get the NAM profile name applied from any Windows registry key? We need to check that the NAM profile is correctly applied using SCCM and, since the configuration.xml file disappears from the folder once AnyConnect processes it, we need a mechanism to check that the endpoint is properly configured. Thanks.
... View more
Labels:
12-11-2018
03:58 AM
Hello, Per the Trustsec documentation here, there is a restriction in the 3750X and SGT: "Cisco TrustSec enforcement is supported on only eight or fewer VLANs on a VLAN-trunk link. If more than eight VLANs are configured on a VLAN-trunk link and Cisco TrustSec enforcement is enabled on those VLANs, the switch ports on those VLAN-trunk links will be errordisabled" So, I pressume that if I enable intra-vlan enforcement for more than 8 x VLANs spanning among different switches the trunk will go to errordisable, right? Anybody experimented this? Regards.
... View more
Labels:
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
09-13-2018
06:20 AM
09-13-2018
06:20 AM
Hello,
Is it possible to install AnyConnect and the AMP Enabler module in mode pre-deployment, without using ASA or ISE? Umbrella module can be deployed in this way, but can't find any references for AMP Enabler.
Regards.
... View more
Labels:
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
09-05-2018
06:50 AM
09-05-2018
06:50 AM
Hello,
I followed these two references below from MS and Cisco. Anyway, I hopefully plan to blog the whole process shortly. I'll update the post upon I post it.
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-custom-apps
https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/webvpn-configure-users.html
Good luck!
... View more
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
08-06-2018
11:49 PM
08-06-2018
11:49 PM
Thanks Mohammed,
I'll discuss this caveat with the client.
Regards.
... View more
08-21-2019
I've noticed that the installation of AMP enabler module in AnyConnect
does not use the local machin...
08-20-2019
Hello, I've noticed that the installation of AMP enabler module in
AnyConnect does not use the local...
Created by
Antonio Macia
in Identity Services Engine (ISE)
07-31-2019
07-31-2019
As a workaround I configured a dummy SSID profile with the proxy
settings, in this way the settings ...
07-31-2019
Hello,I will finally use the restricted ACL and instruct the user to
manually open a browser for dow...
07-30-2019
Let me summarize my authorization rules: * First rule for on-boarding
(bottom one). Catches PEAP aut...
Created by
Antonio Macia
in Identity Services Engine (ISE)
07-30-2019
07-30-2019
It is the same than the administration portal. I use the default group.
When I access using the brow...
07-30-2019
Thank you Paul, The ACL worked and there are no more browser pop-ups.
However, now during the initia...
Created by
Antonio Macia
in Identity Services Engine (ISE)
07-30-2019
07-30-2019
Hi, It says "AnyConnect cannot verify server: xxxxx.corporatedomain
Certificate is not trusted"I've ...
Created by
Antonio Macia
in Identity Services Engine (ISE)
07-30-2019
07-30-2019
Hello, Every time the AnyConnect posture process starts, it warns about
untrusted certificate for th...
07-29-2019
Thank you Paul,In our case, since it is a fully BYOD scenario, we use
the CPP for NSP and AC install...
07-29-2019
Hello hslai, Sorry, but I don't understand how this can help. Per my
understanding, the portal is tr...
07-29-2019
Hello hslai, Sorry, but I don't understand how this can help. Per my
understanding, the portal is tr...
Created by
Antonio Macia
in Identity Services Engine (ISE)
07-29-2019
07-29-2019
Hello, In a wired-only BYOD scenario, it is not possible to
automatically configure the proxy in the...
07-25-2019
Hi, After a BYOD device has correctly enrolled and installed AnyConnect
successfully, every time the...
Public Statistics
| Date Registered | 01-18-2010 02:18 PM |
| Date Last Visited | 09-04-2019 01:41 AM |
| Total Messages Posted | 122 |
| Total Helpful Votes Received | 11 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Advocate"){kind=icon}
