Hi We want to deny all outbound web access except to a group of about 10 whitelist URL domains on an ASA 5525-X with FirePOWER services. Is it possible to do this on the ASA without an add-on FirePower license? Will this have a significant performance impact? ... View more

I have 46 Nortel / Avaya Meridian Option 11 voice switches which currently use point-point 2Mbps and voice VPN MCDN interconnections into a CS1000e central site. They are on various software releases from 23.47 to Succession v4.5. I also have 14 Norstars which are linked with 2Mbps interfaces. I need to get rid of the 2MBps circuits and voice VPN as quickly as possible to meet a budget target. I'm looking at using IOS routers as VoIP gateways. Can the Meridians and Norstars interface using QSig to a standard Cisco IOS router? Would I lose any features compared with MCDN? Should I consider retro-fitting ITG cards into these switches rather than using a router? What protocol should I use with the CS1000e interface - SIP or H.323?     ... View more

I'm confused why a H.323 gatekeeper deducts 128kbps from the bandwidth pool for each G.711 call, which only consumes 80k, and then only deducts 16k for a G.729a call, which actually consumes 24k. Does it mean that a H.323 gatekeeper is useless for environment where you have different bandwidth codecs? Can anyone explain the reasoning as to how these weird values got into the standard?   ... View more

I've been asked to provide Internet Watch Foundation filtering on a router facing off to an ISP. This is a list of 8-900 URLs which is updated daily. Could this be done using NBAR on the ASR1000 or 9000? Has anyone done anything like this before? I'm sort of thinking of some sort of TCL script to do the update. ... View more

We are putting Multicast over DMVPN and we are concerned about the CPU impact on our hub router (ASR-1002X). Has anybody got experience of the performance impact of multicast and what drives the CPU utilisation?  The intended traffic is mainly Microsoft Software Patch Distribution (MSSC / SCCM), and is deploying Windows patches to groups of PCs at the spoke sites. We will have about 200 DMPVN - IPSec tunnels per router receiving the multicast. The multicast traffic will originate at the same site as the DMVPN hub, ... View more

Has anyone used low end Buffalo or QNAP NAS boxes for backing up CUCM? I can get a Buffalo 1TB unit for $200, and it alledgely supports SFTP with a simple configuration tweak, but is it compatible with the Cisco SFTP client?  I'd be interested to hear of any experiences positve or negative. ... View more

Dear ASA gurus I have an ancient Alteon load balancer which only supports HTTP and telnet access. Our management people only allow HTTPS through the management firewall farm, and don't want to change this policy.  So I need a low cost HTTPS to HTTP conversion, ideally on Cisco hardware like an ASA5505. It only needs one concurrent user. Is there a way to configure an ASA 5505 to terminate the inbound HTTPS seession and re-originate a HTTP management session to the Alteon? It looks to me as if the Clientless SSL VPN might do the job. Is there a way to do a SSH to telnet conversion on the ASA, or on a router? All ideas gratefully accepted! ... View more

I have the requirement to allow the customer to login to the router, and to use their own AD for authentication, whilst maintaining our own TACACS access for management. Obviously, I could do an integration between our TACACS server and the customer's AD, but this involves blowing lots of holes in our firewalls and much grief all round. So what I would like to do is: For default login (say SMITHJ) authenticate via our TACACS+ For customer login (say john.doe@contoso.com ) authenticate via customer owned RADIUS onto the customer's AD. At a push, I could install a TACACS+ server in the customer domain to proxy onto their AD if it is not possible to do this with RADIUS. Is this possible? If so a config would be much appreciated. ... View more

I am looking at branch router models & spec for DMVPN. I am being told that I need a mininum of 2911 for a 10Mbps access circuit to a branch location. This seems strange as the mGRE is CEF switched and the IPSec is in hardware. I would expect a 1941 to be able to saturate a 10Mbps circuit with IPSec traffic on a normal point-point link. Does anyone have real-world performance figures for 1941/ 29xx / 39xx / 39xxe ? ... View more

I've got 7942G phones with firmware 8-3-4.16, running to CUCM 7.1.2 in non-Secure mode. When the phone boots, it looks for the CTLSEP<MAC>.TLV file to download a Certificate Trust List, which it can't find. Is this correct behaviour? How can we stop it, as it is clogging up the logs and causing memory leak problems on the firewalls. ... View more

I have a group of users at a remote site who use the AnyConnect SSL VPN client over a DSL line. However, they now want to share an ethernet-attached Xerox Workcentre 5775 printer. The printer is a sophisticated multi-functional device which can scan into a shared drive back at HQ. It also needs to be supported by our helpdesk who are back at HQ, and need access into the box. Is there any way that I can connect the printer to the network with a hardware client? I remember that there was a hardware box for the VPN 3000 series that did this. Presumably a low end router might do the trick. Has anyone had any experience with split tunnelling to Xerox printers - if so, please can you share the config! ... View more