Tell me which part isn't clear to explain. The statement mentions to have seperate cert in each trustpoint which I mentioned. ... View more

That's true in the sense if an attacker manage to get the client certificate then he can authenticate successfully. The private key is used in l2l vpn but not anyconnect as I mentioned earlier. Not sure why tac insisted on private key. You can ask them but its not used in anyconnect definitely ... View more

For question two, you can't combine multiple certificates to single trustpoint. Having multiple TPs allow to have different settings for them such as binding private key, crls, ocsp, storage, etc. PKI import command will allow you to import the certificate but you still need to authenticate with CA to make sure that certificate is validated. If you import with authentication, you can still authenticate but you are at security risk that its invalid certificate. ... View more

The private key doesn't need to be there. Client VPN doesn't perform mutual authentication. Its only client to server authentication using the certificate. Therefore, if you export the cert and import in other machine that still works. The best practice is to use combination of AAA and Cert auth to validate the machine and user identity but if you can implement measures on machines that certificates can be exported and imported on other machines using their party tools then it should be fine. This is unlike l2l vpn using certificates which require private key at both sides and perform mutual auth. ... View more

You need dot1x to move the VLAN. There is no otherway for dynamic vlan allocation. ... View more

You can do. The SPDs (which is the database holding the crypto acls) will decide which crypto SA will be used depending which SPD is matched and assuming that we don't have an overlap. ... View more

check the cpu and memory of both devices. Also, it can be the internet routing between the sites. ... View more

I suggest to use 5516 for all. I think Cisco will phaseout the small units soon because of their roadmap of features and the limited specs of the small units (memory/cpu). Similar to 5506 cisco didn't release EOL and they are still selling it but you can't get the new image. When it comes to performance, if ssl interception isn't on, then the numbers should hold. If you have ssl interception then its completely different. ... View more

See, your config has the ip in global pool as 10.10.10.1. In this case it won't work because the IP which the phone will try to communicate with is different (natted IP). I believe natting breaks digest authentication. I don't think this will work through nat. ... View more

Hi, When the server is sending 401 challenge your client is sending register without username/password/realm. Do you have digest user created on server and configured in client. ? ... View more