Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Antonio Macia
Online
Antonio Macia
Member since
01-18-2010
Beginner
Created by
Antonio Macia
in Advanced Threats
in Advanced Threats
05-27-2019
11:57 AM
05-27-2019
11:57 AM
Thanks Thorsten, I'll do. In my opinion is a very important feature for the uses cases I mentioned above.
... View more
Created by
Antonio Macia
in Advanced Threats
in Advanced Threats
05-25-2019
11:03 AM
05-25-2019
11:03 AM
Hello, For those use cases where the administrators don't have access or no longer manages the computer, is it possible to trigger a connector uninstall from the Cloud? Let's say that a laptop is stolen and we don't want to keep this connector consuming licenses or generating events. Or, with BYOD, the company let their employees install the connector on their personal computer, but once the employee leaves the company, the connector must be uninstalled remotely. What is the approach for this? Regards.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-10-2019
09:32 AM
04-10-2019
09:32 AM
Thanks mate!
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-09-2019
02:21 PM
04-09-2019
02:21 PM
I see your point RedNectar. So in a brownfield deployment in network centric mode, having the port-group to VLAN-BD-EPG mapping and the gateway configured in the BD, to move to application centric mode I would have to create additional port-groups mapped to new VLANs and EPGs within the same BD, so there's no need to change the VMs IPs which is critical in a production environment. I would just need to connect the VMs to the new port-groups. Am I right? Thanks.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-05-2019
01:44 PM
04-05-2019
01:44 PM
Thanks, option 3 is the scenario I'm looking for. It corroborates my suspicions then, but I was hoping that there was some way to minimize the number of physical domains per server.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-05-2019
10:04 AM
04-05-2019
10:04 AM
Hello Omamenko, Thanks for your reply. Having a single physical domain wouldn't match the scenario at the bottom left of the image which is not possible in ACI? Did you try this set up and work? On the other hand, the use of the per-port VLAN feature is precisely to deal with scenario where the same VLAN is used in the same switch for different EPGs, am I right? Regards.
... View more
Created by
Antonio Macia
in Application Centric Infrastructure
in Application Centric Infrastructure
04-04-2019
07:28 AM
04-04-2019
07:28 AM
Hello, Trying to understand the best practice for VLAN to EPG to BD mapping and leaf connectivity. Let's say we have a number of virtual machines running on different VMware hosts all connected to the same leaf. These VMs belong to the same VLAN. The VLAN pool is static since we don't have distributed virtual switches (no VMware enterprise license). We want to separate the VMs in different EPGs. Per the recommendations below I should create one physical domain per server to make this possible, right? There's no way to reduce the number of physical domain objects if all the servers will share the same VLAN pool? What if the hosts are connected in VPC fashion to two leaves? Regards.
... View more
Labels:
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
03-07-2019
08:44 AM
03-07-2019
08:44 AM
Actually, for SCCM to report the proper deployment of the profile configuration file it checks if the file resides in the folder, but since it quickly disappears, SCCM is not able to, that's why we are trying a different approach like checking the profile name at the AnyConnect registry level. Also, if that file generates another file in a different folder then it would be a feasible solution.
... View more
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
03-07-2019
02:54 AM
03-07-2019
02:54 AM
Hello, Is it possible to get the NAM profile name applied from any Windows registry key? We need to check that the NAM profile is correctly applied using SCCM and, since the configuration.xml file disappears from the folder once AnyConnect processes it, we need a mechanism to check that the endpoint is properly configured. Thanks.
... View more
Labels:
12-11-2018
03:58 AM
Hello, Per the Trustsec documentation here, there is a restriction in the 3750X and SGT: "Cisco TrustSec enforcement is supported on only eight or fewer VLANs on a VLAN-trunk link. If more than eight VLANs are configured on a VLAN-trunk link and Cisco TrustSec enforcement is enabled on those VLANs, the switch ports on those VLAN-trunk links will be errordisabled" So, I pressume that if I enable intra-vlan enforcement for more than 8 x VLANs spanning among different switches the trunk will go to errordisable, right? Anybody experimented this? Regards.
... View more
Labels:
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
09-13-2018
06:20 AM
09-13-2018
06:20 AM
Hello,
Is it possible to install AnyConnect and the AMP Enabler module in mode pre-deployment, without using ASA or ISE? Umbrella module can be deployed in this way, but can't find any references for AMP Enabler.
Regards.
... View more
Labels:
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
09-05-2018
06:50 AM
09-05-2018
06:50 AM
Hello,
I followed these two references below from MS and Cisco. Anyway, I hopefully plan to blog the whole process shortly. I'll update the post upon I post it.
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-custom-apps
https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/vpn/asa-97-vpn-config/webvpn-configure-users.html
Good luck!
... View more
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
08-06-2018
11:49 PM
08-06-2018
11:49 PM
Thanks Mohammed,
I'll discuss this caveat with the client.
Regards.
... View more
08-06-2018
07:52 AM
Hi there,
Is it possible to perform SSO on mobile devices running AnyConnect and Per-App VPN, but not joined to the domain? I need to migrate an existing environment using F5 Edge Client that has this functionality working but can't see any reference on how to perform this on Cisco and AnyConnect.
The use case consists on users accessing internal resources from their mobile phones (iOS, Android) without having to authenticate again since the Edge Client provides the user credentials transparently.
Regards.
... View more
Labels:
Created by
Antonio Macia
in VPN and AnyConnect
in VPN and AnyConnect
07-25-2018
07:24 AM
07-25-2018
07:24 AM
Hello,
I'm testing SAML authentication using Azure AD as IdP and the ASA as the SP. Login works fine but the logout fails because the ASA is sending the wrong URL.
Although I've configured the valid URL:
url sign-out https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
Looking at the requests performed by the browser during the logout, the URL requested is:
https://login.microsoftonline.com/common/wsfederationwa=wsignout1.0 without the '?' so the browsers receives a not found error from the server.
Anyone has this working with Azure?
Regards.
... View more
- Tags:
- saml
Labels:
You Have No Messages
Public Statistics
| Date Registered | 01-18-2010 02:18 PM |
| Date Last Visited | 07-11-2019 12:55 PM |
| Total Messages Posted | 108 |
| Total Helpful Votes Received | 11 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Advocate"){kind=icon}
