Introduction: This document explains about white-listing the clocked email address by ESA. Problem: Email address is being blocked due to poor reputation by the ESA(Email Security Appliance). How can we white list this email address? Solution: To blacklist or drop the mail when you see a certain sender's email address or domain, you need to use a combination of a new Incoming Mail Policy and Incoming Content Filter.     1) From the Web GUI, choose Mail Policies > Incoming Mail Policy.  Create a new Incoming Mail Policy.  You can label the policy, "Block-Sender-Domains."  Select the "Sender" option and put in the sender's email address or domain that you want to block.     2) Submit and Commit Changes.     3) Go back to Mail Policies > Incoming Mail Policy. You should now see an additional incoming mail policy called "Block-Sender-Domain" that is above the Default Policy.  All mail coming from this sender's domain will be matching only this incoming mail policy.     4) Now create an incoming content filter that will drop the message. Choose Mail Policies > Incoming Content Filter. Create a new filter called "Always_drop."     5) For the condition, leave this empty.     6) For the action, set it to drop the message.     7) Click Submit.     8) After creating the incoming content filter, enable it on the correct incoming mail policy.  Also, when you were modifying the "Block-Sender-Domains" mail policy, you should disable the anti-spam, anti-virus, and virus outbreak filters to not waste resources.  So, for the "Block-Sender-Domains" mail policy click on the anti-spam link and select Disable and Submit.  Repeat for the anti-virus scanning and outbreak filter. For the content filters, set it to Yes and enable the content filter that was created in Step 4, "Always_drop."     9) Submit and Commit the changes. Source: https://supportforums.cisco.com/discussion/11835876/how-can-i-whitelist-single-email-address-mikefoofoocom-get-blocked-poor Reference: http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118204-qanda-esa-00.html http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118551-qa-esa-00.html ... View more

Introduction: This document explains about the issues faced in accessing ASA through SSH. Problem: After making the following configuration on ASA still SSH access does not work fine:ssh 10.60.0.0 255.255.0.0 outside ssh 10.60.0.0 255.255.0.0 dmz ssh 10.60.0.0 255.255.0.0 inside ssh timeout 5 How can we solve this SSH access issue? Solution: Perform the following configuration to have successful SSH access to the ASA: 1) You need a public/private keypair configured: asa(config)# crypto key generate rsa general-keys modulus 2048 2) Must have a username: asa(config)# username testuser password testpass and the system should know where your useraccounts are: asa(config)# aaa authentication ssh console LOCAL 3)Configuration to choose the SSH version(SSHv2): asa(config)# ssh version 2 Reference: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/69373-ssh-inside-out-pix7x.html Source: https://supportforums.cisco.com/discussion/11581111/how-enable-ssh-asa-5525 https://supportforums.cisco.com/discussion/11316931/cannot-ssh-telnet-cisco-asa-5580 ... View more

Introduction: This document explains about the secondary ACS registration issue with the Primary ACS. problem: When user tries get the secondary ACS registered to primary ACS, the error "This System Failure occured: Registration failed due to Invalid Certificate. Your changes have not been saved. Click OK to return to the list page" is seen. How this error can be solved? The same works fine with ACS 5.4. Solution: Support for Trust Communication between Nodes in a Deployment—ACS introduces the Trust Communication feature to provide additional security for communication between the ACS instances in your deployment. When you enable trust communication in an ACS deployment, the primary and the secondary ACS instances verify their respective CA certificates before establishing a secure tunnel for communication. If the corresponding CAs are valid, they establish a secure tunnel between them. After a successful registration, the primary instance database is replicated to the newly added secondary instance. If the CA of an ACS instance is invalid, the ACS deployment rejects that ACS instance. You can enable trust communication on both the primary and secondary ACS instances. Or, you can enable it on either the primary ACS instance or the secondary ACS instance. However, for increased security, Cisco recommends that you enable trust communication on all the nodes in your deployment. If trust communication between nodes is enabled then there is no need to import the server certificate of the node joining the deployment in the trust list. Source: https://supportforums.cisco.com/discussion/12010171/problems-acs-55-trial-and-primary-secondary-node-registration ... View more

Introduction: This document explains about the issue faced with AnyConnect Always-on feature on ios and Android phones.   Problem: AnyConnect Always-on feature works fine with Windows PC but the same does not work with ios or android supported mobiles. Why this feature does not work in mobile platform?   Solution: Always on and TND is not supported on mobile platforms. Please find below the reasons why Always On feature is not supported in ios and android mobiles:. 1) Always On (enforced) VPN - Including Web Security Appliance tie-ins  * Always On cannot be implemented on iOS because of limitations in the operating system. Also, this functionality might not be at all desirable from a user perspective, as it would have ramifications for battery life and could be chatty as the iPhone moved from wifi to 3G and back under poor signal conditions. 2) Trusted Network Detection TND is not possible on iOS due to limitations in the operating system. The next-best thing is to use the iOS "VPN on Demand" functionality, which can be used to direct AnyConnect to launch whenever specified hosts are contacted. Reference: Always-on VPN Source: https://supportforums.cisco.com/discussion/12527316/anyconnect-always-not-work ... View more

Introduction: This document explains about the issue that user faces when using VPN Client 5.00.07.0410 on Windows 7 machines.   Problem: When using VPN Client 5.00.07.0410 on windows 7 machine and the user double-clicks the Cisco VPN Client icon, the lock shows up in the system tray, and the application shows in the taskbar. User gets a glimpse of the window when you double-click the taskbar icon, or single click it and choose the application from the list. However, we are not able to actually get the window to be visible. This of course makes it impossible for the user to click the "connect" button.How this issue can be resolved? Solution: If the user is having VPN client installed on Windows 7 perform the following steps: 1.       Hold the Alt key, press Tab key until the VPN Client window is highlighted. Release Alt. 2.       Hold the Windows key and press the right arrow key once. This should bring the window back on screen.   If the above solution does not work or if the user has XP, trying the below steps will resolve the issue: 1.     Alt-tab to the Cisco window 2.     Press Alt+Space. 3.     Press M. 4.     Press any Arrow key. 5.     Move the mouse. The window position should now follow the mouse cursor. Source: https://supportforums.cisco.com/discussion/11186511/vpn-client-and-windows-7-window-wont-show ... View more

  Introduction: This document explains an issue the user faces when trying to connect to ASA using Cisco AnyConnect. Problem" When we try to connect to ASA using Cisco AnyConnect client, the warning message "Security Warning : Untrusted VPN Server Certificate" appears. There is no option to Trust or import the certificate so that the warning is not seen the next time. AnyConnect version used is 3.1.05152. The waring is as shown below: Solution1: Upgrading the AnyConnect to version 3.1.06073 or higher will resolve this warning issue as this issue was seen with the AnyConnect version 3.1.05152. Solution2: The user can also purchase a certificate for the ASA and install it in the ASA. Also the user can generate a strong self signed certificate (using a 2048-bit RSA key). This certificate is required to be downloaded by the Client and installed in their trusted root CA store. If you use a fully qualified domain name (FQDN) for the VPN users to access the ASA that should be the Common Name (CN) in the certificate. Source: https://supportforums.cisco.com/discussion/12328761/cisco-anyconnecthow-hide-security-warning-untrusted-certificate ... View more

  Introduction Cisco ISE can be configured to enable strong client suppression when an authentication request from an endpoint fails five times with the same failure reason. Strong suppression rejects every request that it receives from that endpoint without processing it and is active for the configured Request Rejection interval in minutes. Only after the interval expires, the Cisco ISE will process the authentication request from that particular endpoint. If the request again fails with the same failure reason or a different one, the endpoint’s strong suppression is not renewed. It is renewed only if the request again fails five times with the same failure reason. Configuration 1) Navigate to Administration > System > Settings > Protocols > RADIUS. 2) In the RADIUS settings Check the " Suppress Anomalous Clients" check box to detect the clients for which the authentications fail repeatedly. A summary of the failures will be reported every Reporting Interval. 3)Under Anomalous Client Detection section provide the following details: a) Detection Interval - Time interval in minutes for the clients to be detected. b) Reporting Interval - Time interval in minutes for the failed authentications to be reported. c) Reject Requests After Detection - Ensure that this check box is checked to reject the requests after the clients are detected. The requests for anomalous clients will be rejected in every Request Rejection Interval. d) Request Rejection Interval - This is the time interval in minutes for which the requests will be rejected. This option is available to be configured only when you have checked the "Reject Requests After Detection" checkbox as mentioned in the previous step. e) Suppress Repeated Successful Authentications - This check box should be checked to prevent repeated reporting of successful authentication requests in last 24 hours that have no changes in identity context, network device, and authorization. f) Accounting Suppression Interval - The time interval in seconds for which the reporting of accounting requests are to be suppressed.  g) Long Processing Step Threshold Interval - This parameter is to set the maximum time allowed for each step in the authentication process to be completed. If the time exceeds in a specific step, this is highlighted in the authentication details report. 4) Above steps completes the configuration of Anomalous Clients Suppression. Find the image below for more information about the configuration steps: Problem Specific set of users/devices are temporarily blocked by ISE from making connection attempts. How can we ensure that the devices are allowed to make connection attempts without any issues? Solution This issue occurs when the user/device is detected to be anomalous and hence the request from these users/devices are rejected untill the "Request Rejection Interval" expires. Reducing the interval to a lower time or disabling the option of rejecting the requests from the clients detected will solve this issue. Source https://supportforums.cisco.com/discussion/12489946/ise-troubleshooting-help https://supportforums.cisco.com/discussion/11995281/ise-12-anomalous-client-suppression ... View more

  Problem: Scenario 1: When the ASAs with AIP-SSM modules are configured as failover pair the AIP-SSM configuration from the Active ASA does not get replicated to the Standby ASA when the failover takes place. Why this happens and how can we solve this issue?   Scenario 2: User needs to get few clarification on  ASA active/standby failover, involving CSC SSM module. Current status there is production firewall running in ASA8.3.1, along with CSC module 6.3. Recently purchased another identical unit of firewall, so these will do in Active/Standby failover mode. Question 1 The new purchase ASA unit CSC module license was not acitviate and installed yet (customer misplace the PAK paper license). User questions that is it possible to set up the failover in the condition of one CSC SSM in operation mode, whilst another CSC status down because no license install on it? Question 2 New firewall will the standby unit, beside configure on the failover, do he need to load AnyConnect image to the new firewall as well? Question 3: Can he just update the ASA version of the production firewall from 8.3.1 to 8.4.2? Would this cause any syntax error? Resolution: Scenario 1: If you have two ASAs in a failover configuration and each has an AIP-SSM, you must manually replicate the configuration of the AIP-SSMs. Only the configuration of the ASA is replicated by the failover mechanism. The AIP-SSM is not included in the failover.   First, the AIP-SSM operates independently of the ASA in terms of failover. For failover, all that is needed from an ASA perspective is that the  AIP modules be of the same hardware type. Beyond that, as with any other portion of failover, the configuration of the ASA between the active and standby must be in sync.   As for the set up of the AIPs, they are effectively independent sensors. There is no failover between the two, and they have no awareness of each other. They can run independent versions of code. That is, they do not have to match, and the ASA does not care about the version of code on the AIP with respect to failover.   Scenario 2: As long as the hardware is exactly the same you should be able to HA pair them however I'd strong suggest licensing both CSC modules. Yes, you need to have the same versions of the AnyConnect image on both units since the version is listed in the  running config under the webvpn section.  Going from 8.3.1 to 8.4.2 will be fine, the syntax is similar.   Source:https://supportforums.cisco.com/message/3820678#3820678 ... View more

    Problem OSD message is seen on the screen after the 2900 series PTZ camera restarts. How can we avoid this OSD message?   Scenario 2: User have problem with adding cameras to media server. When he is adding some cameras he see error shown below: Operation failed: Media server reported the error Failed to create MediaServer capture driver for archName bd484b3b-6028-4896-9713-b470eaaaf2ad_vs1_r periphId 10007 Some times it appears with cameras which worked before.May be someone faced with this kind of problem. What can cause this problem.   Resolution Follow the steps below to configure the 2900 series PTZ camera through VSOM to avoid this OSD message:   1. Using IE, browse to the IP address of the camera to enter the cameras web interface. 2. Login (hint: default login is admin admin) and then click on Settings   3. Under the Camera Configuration tab click on OSD (Menu will display over image) 4. Navigate down to <DOME SETTINGS> using the DOWN ARROW of the PTZ control left of the image using the SCROLL DOWN ARROW of the PTZ control left of the image. 5. Click on the OPEN IRIS button to select and the DOME SETTINGS menu will be displayed. 6. Navigate down to <POWER UP> and then click on the OPEN IRIS button. 7.  Power up action menu displays, click on the Open IRIS OPEN again.  (Arrow next to Power up action will change to an asterisk). Default setting is AUTO SCAN. 8. Use the PTZ "UP ARROW" button to change the setting until "PRESET 1" is listed. (Ensure not to select Pattern1 ) 9. Click on the OPEN IRIS button to save it and asterisk(*) will change back to an arrow. 10. Click the PTZ "DOWN ARROW" until the arrow is next to BACK and then click on the OPEN IRIS button to return to the Dome Settings menu. 11. Navigate down to <PRESETS> using the PTZ "DOWN ARROW" and click on the OPEN IRIS button.  It will move and say acquiring preset. 12. Navigate down to <EDIT PRESET SCENE> using the PTZ "DOWN ARROW" and click on the OPEN IRIS button. 13.  Now move your camera to where you want the home position to be, primary  view for the camera, if already where you want it, just move it  slightly.  This will initiate the camera move to get rid of the OSD menu  upon camera reboot. 14. After you have moved the camera to where you want it click on the OPEN IRIS button to save. 15. Navigate down to BACK and click on the OPEN IRIS to go back to the DOME SETTINGS menu. 16. Navigate down to BACK and click on the OPEN IRIS to go back to the main camera menu. 17. Navigate down to REBOOT SYSTEM (NOT reset camera or cycle camera power) and click on the OPEN IRIS start the Reboot    Click once more on the OPEN IRIS button to continue.   Camera will now display REBOOTING and you can watch it reboot and go to the normal Configuring menu OSD and then move to your "PRESET 1" position and the OSD menu will be GONE.   Scenario 2: Solution: 1. VSM version is 7.2.0 2. Camera models are 3520, 6020, 6030 3. We are creating camera specific templates for each type of camera 4. From VSOM [localadmin@localhost ~]$ sudo /usr/sbin/lsof -p  $(/sbin/pidof xvcrman) | grep -c smd lsof: no process ID specified lsof 4.78  latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/  latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ  latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man  usage: [-?abhlnNoOPRstUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s]  [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]]  [-p s] [+|-r [t]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [-Z [Z]] [--] [names] Use the ``-h'' option to get more help information. From Media Server [localadmin@MediaServer6 ~]$ sudo /usr/sbin/lsof -p  $(/sbin/pidof xvcrman) | grep -c smd 4054 I would recommend to upgrade to 7.2.2 or open a TAC case for further assistance on this issue.   Source: https://supportforums.cisco.com/thread/2138978?tstart=0 https://supportforums.cisco.com/discussion/12325986/problem-adding-camera-media-server ... View more

    Problem User tries to do EAP Chaining with PEAP but this is not working. How can we make this work? Resolution EAP chaining works with EAP-FAST and does not work with PEAP. It will be a bit more complex than using PEAP as we will be using EAP-FAST, EAP-MS-CHAPv2 and EAP-TLS. EAP Chaining requires both a supplicant on the client device and a RADIUS server that support the technology.   In Cisco ISE, Release 1.1.1, Extensible  Authentication Protocol (EAP) chaining solution allows you to  authenticate both the machine and user in the same EAP-FAST  authentication in a configurable order. When an EAP-FAST authentication  result is determined, Cisco ISE allows you to apply an authorization  policy, depending on the result of both authentications. When EAP  chaining is turned off, Cisco ISE performs the usual EAP-FAST  authentication.   Refer to EAP Chaining deployment for more information on EAP-Chaining process along with requirements   Source:https://supportforums.cisco.com/thread/2179660?tstart=0 ... View more

    Problem After upgrading AnyConnect package on AS from 3.0 to 3.1 getting error that the certificate is untrusted and have to accept the certificate when trying to automatically login to the website. Is it possible to disable the strict trust setting to avoid this error? Resolution It is strongly recommended that Strict Certificate Trust for the AnyConnect client is enabled for the following reasons:   •With the increase in targeted exploits, enabling Strict Certificate  Trust in the local policy helps prevent man in the middle attacks when  users are connecting from untrusted networks such as public-access  networks.   •Even if you use fully verifiable and trusted certificates, the  AnyConnect client, by default, allows end users to accept unverifiable  certificates. If your end users are subjected to a man-in-the-middle  attack, they may be prompted to accept a malicious certificate. To  remove this decision from your end users, enable Strict Certificate  Trust.   Refer to Enable Strict Certificate Trust in the AnyConnect Local Policy for more information.     Still it is possible to disable Strict Trust Setting by using the local policy editor.   This can also be done manually.   The profile editor can be found as anyconnect-profileeditor-win-3.1.01065-k9.exe at Standalone Profile Editor package on Windows platforms.   Source:https://supportforums.cisco.com/thread/2179230?tstart=0 ... View more

    Problem The overview page in the IronPort Email Security Appliance shows a message that reporting is disabled. How can we enable reporting? Resolution Follow the steps below to enable reporting on the IronPort Email Security Appliance:   1)Use the diagnostic command to check RAID disks, view and clear cache information, and to test connectivity to other mail servers. esa> diagnostic Choose the operation you want to perform: - RAID - Disk Verify Utility. - DISK_USAGE - Check Disk Usage. - NETWORK - Network Utilities. - REPORTING - Reporting Utilities. - TRACKING - Tracking Utilities. - RELOAD - Reset configuration to the initial manufacturer values.   2)Choose reporting as shown below which shows the current reporting status: []> REPORTING   The reporting system is currently disabled. Choose the operation you want to perform: - DELETEDB - Reinitialize the reporting database. - ENABLE - Enable the reporting system.   3)Now enter ENABLE to enable reporting. []> ENABLE Reporting enabled. The reporting system is currently enabled.   4)Choose the operation you want to perform: - DELETEDB - Reinitialize the reporting database. - DISABLE - Disable the reporting system. []> Now click Enter key twice. This enables the reporting on Cisco Email Security Appliance.   Now, the Overview page, you could see that the reporting is enabled or "No data available" if appliance is idle.   Reference Link: Cisco Email Security Appliance Command Reference   Source:https://supportforums.cisco.com/thread/2179703?tstart=0 ... View more

    Problem ACS 5.2 shows only 100 pages of logs and so only the logs for few hours is seen and unable to see the log for the entire day. How can we see the log for the entire day without missing them? Resolution The ACS 5.x was designed to keep only 100 pages of logs. This unit  generates a lot of information that will saturate the server if  everything is stored in the internal hd, so there is an option to send  these logs to an external Syslog server, this option is located under  System Administration/Log Configuration.   Configuring Per-Instance Remote Syslog Targets:   Step 1: Select System Administration > Configuration > Log Configuration > Logging Categories > Per-Instance, then click Configure.   Step 2: Perform any one of the following:   Click the name of the logging category you want to configure. Select the radio button associated with the name of the logging category you want to configure, and click Edit.     Step 3: Click the Remote Syslog Target tab.   Available targets: List of available targets. You can select a target from this list and move it to the Selected Targets list. Selected targets: List of selected targets. You can select a target from this list and move it to the Available Targets list to remove it from your configuration.   Displaying Logging Categories   Step 1 Select System Administration > Configuration > Log Configuration > Logging Categories > Per-Instance, and click Configure.   Step 2: After clicking on Configure you need to complete the following enteries.   Name Expandable tree structure of AAA services logging categories. Edit  Click to display a selected Logging Categories > Edit: "lc_name" page, where lc_name is the name of the logging category       There are two changes related to this logging functionality in ACS 5.4: Even though report generated can still only be of 100 pages, there is an  option for the user to export the report to CSV file and include records more than the content of 100 pages. User can generate the report based on timestamp as well. So can reduce the  granularity of each set of data and retrieve / view the data in smaller  chunks. Refer to Exporting Report Data for more information about the ability to export report data to an Excel  spreadsheet as a comma-separated values (.csv) file, pipe-separated  values (.psv) file, or a tab-separated values (.tsv) file.   Refrence Source:https://supportforums.cisco.com/thread/2182193?tstart=0 Configuring Per-Instance Remote Syslog Targets ... View more

    Introduction: This document discuss about the particular error of ISE 1.1. Before that you need to undertsand: What is ISE? ISE stands for Identity Services Engine (ISE) it is a next-generation identity and policy-based network access platform that enables enterprises to enforce compliance, enhance infrastructure security, and streamline their service operations.   The ISE platform combines authentication, authorization, posture, profiling, and guest management services in a single unified appliance. A single management console for configuring and administering services enables consistency and simplifies administration. Fewer boxes are needed because multiple services can run on a single node.   Benefits of Identity Services Engine:   Unified Policy Management Administrators no longer have to manage multiple administrative consoles.ISE provides a single console where authentication, authorization, posture, guest, and profiling policies can be created and managed.   Context Aware Enforcement ISE gathers information from devices, the infrastructure, and services to enable organizations to build richer contextual policies that can be enforced centrally across the network. The ISE tracks all users and devices connected to the network, acting as a single source of information for connected user and device identity and location, as well as the health of the endpoint.   System-wide Visibility The ability to discover, identify, and monitor all IP-enabled endpoint devices gives IT teams complete visibility of both users and “headless” devices on the corporate network.   Dynamic Access Control The Cisco ISE combines AAA, posture, profiling, and guest management capabilities in a single appliance to enforce dynamic access control. The Identity Services Engine can be deployed across the enterprise infrastructure, supporting 802.1x wired, wireless, and VPN networks.   Problem When viewing on the secondary node in ISE 1.1 the user gets an error and the browser fails to get the information about the primary node. Everything works fine when the user is viewing on the primary node. How this issue can be resolved? Resolution If you are using a self signed certificate then you have to login to the  secondary node and then trust that certificate you will be using. Now you will be able to see each and every information about the primary node on the secondary node.   While accessing the secondary ISE always use the full domain name and then accept the security warning. Now re-login into the secondary node and you will be able to view the information successfully. Using FQDN to access the secondary ISE or secondary node will solve the issue.   Refer to Configuration of a Cisco ISE Node for more information on how to configure ISE primary and secondary nodes.   Also refer to Release Notes for more information on Cisco Identity Services Engine, Release 1.1.x     Source:https://supportforums.cisco.com/thread/2168895?tstart=0 ... View more

  Introduction This document deals with the different types of authentication methods that can be used for AnyConnect VPN on ASA. Types of authentication Following is the list of authentication methods available for AnyConnect VPN:   • RADIUS • RADIUS with Password Expiry (MSCHAPv2) to NT LAN Manager (NTLM) • RADIUS one-time password (OTP) support (state/reply message attributes) • RSA SecurID (including SoftID integration) • Active Directory/Kerberos • Embedded Certificate Authority (CA) • Digital Certificate/Smartcard (including Machine Certificate support), auto- or user-selected • Lightweight Directory Access Protocol (LDAP) with Password Expiry and Aging • Generic LDAP support • Combined certificate and username/password multifactor authentication (double authentication). Encryption Methods Various encryption methods supported by AnyConnect VPN are listed below: Strong encryption, including AES-256 and 3DES-168. (The security  gateway device must have a strong-crypto license enabled.)   Next-Generation Encryption, including NSA Suite B algorithms, ESPv3  with IKEv2, 4096-bit RSA keys, Diffie-Hellman group 24, and enhanced  SHA2 (SHA-256 & SHA-384). (Only applies to IPsec IKEv2 connections.  Cisco AnyConnect Premium license required.)   From security standpoint, it does not matter much which Encryption method is being used since IKE will anyway encrypt the traffic between the client and the  head end.   Reference: Cisco AnyConnect Secure Mobility Client Data Sheet Release Notes for Cisco AnyConnect Secure Mobility Client   Source:https://supportforums.cisco.com/thread/2181165?tstart=0 ... View more