Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Patrick Moubarak
09-09-2019
Patrick Moubarak
Enthusiast
Computer engineer graduated from McGill university, currently working in Montreal for ESI Technologies as a telecommunications consultant, specialized in Cisco products
Recent Badges
Stats
Member since
05-05-2008
175
Posts
44
Helpful
20
Solutions
Created by
Patrick Moubarak
in Cisco Bug Discussions
in Cisco Bug Discussions
04-04-2019
12:14 PM
04-04-2019
12:14 PM
seems to be still an issue. we are running into the same problem with Apple iOS devices: https://community.cisco.com/t5/identity-services-engine-ise/ise-2-4-patch-6-ios-12-2-onboarding-issues/m-p/3830842 Patrick
... View more
Created by
Patrick Moubarak
in Switching
in Switching
06-01-2018
12:53 PM
06-01-2018
12:53 PM
It seems that ISE is rejecting the MAB authentication for the IP phone.
What does your ISE Operations Log say?
Patrick
... View more
Created by
Patrick Moubarak
in Policy and Access
in Policy and Access
04-24-2018
05:18 AM
04-24-2018
05:18 AM
We just ran into the same issue with VM based on SNS-3415 and contacted TAC.
I am wondering why Cisco did not include this hotfix in the patch bundles; the bug tool says there has been 117 TAC cases related to this issue.
... View more
02-07-2018
08:10 AM
Thanks Bogdan, I just tried it and it works like a charm!
The FMC doc under ECMP routing says it is not supported across different interfaces.
https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/routing_overview_for_firepower_threat_defense.html#ID-2101-0000004d
It is the same text as ASA doc before the zone feature was introduced, they just forgot to correct it. They should have a reference to the FlexConfig zone name ecmp.
Patrick
... View more
02-07-2018
07:17 AM
ASA 9.3(2) introduced the concept of zones with ECMP support across different interfaces (in the same zone):
You can group interfaces together into a traffic zone to accomplish traffic load balancing (using Equal Cost Multi-Path (ECMP) routing), route redundancy, and asymmetric routing across multiple interfaces.
Any idea when FTD will support this? the interface zone in FMC seems to be for Snort, not for ASA Lina, only nameif is present in Lina CLI:
firepower# show nameif Interface Name Security Ethernet1/5 inside1 0 Ethernet1/6 inside2 0
firepower# show zone firepower#
EIGRP neighbors come up on both interfaces but routes are only present on inside1.
Is there a recommended design for FTD using L3 routing to 2 Nexus switches? I can't have EIGRP neighbors on vPC VLANs... so I opted for L3 routed interfaces between the 2 Nexus and between each Nexus and FTD.
Thanks
Patrick
... View more
Labels:
Created by
Patrick Moubarak
in Cisco Bug Discussions
in Cisco Bug Discussions
01-19-2018
08:29 AM
01-19-2018
08:29 AM
Yeah I saw that bug.
I just found a workaround. Since I am using a private (internal) certificate for ISE admin and EAP, it has to be trusted in the MAC trust store manually before continuing the BYOD onboarding process, same behavior as iOS 10.3+ documented in bug CSCvd38467
Cisco recommends using public certificates for BYOD, now I know why!
Patrick
... View more
Created by
Patrick Moubarak
in Cisco Bug Discussions
in Cisco Bug Discussions
01-19-2018
07:23 AM
01-19-2018
07:23 AM
Thanks Francesco, we are looking into patching but it doesn't seem like a known issue listed on bug toolkit or in the release notes.
I am wondering if it is caused by the ISE admin and EAP certificates being generated by an internal CA instead of public. I know iOS 10.3.+ does not like that and requires an extra step to trust the certificate manually during onboarding, maybe MAC OS is even stricter now.
Patrick
... View more
Created by
Patrick Moubarak
in Cisco Bug Discussions
in Cisco Bug Discussions
01-18-2018
01:13 PM
01-18-2018
01:13 PM
I am running into an issue with ISE 2.2 patch 4 running the latest SPW for MAC OS X with the latest HighSierra update 10.13.2. BYOD flow does not work, it fails inside the Cisco Network Setup Assistant at the early step of downloading profiles. It shows 2 popups for ISE certificate to be trusted then fails to actually import them into the certificate store.
anybody experiencing the same issue?
... View more
Labels:
Created by
Patrick Moubarak
in VPN and AnyConnect
in VPN and AnyConnect
11-01-2017
07:55 PM
11-01-2017
07:55 PM
From memory UDP source and destination are both 500. But then what about NAT-Traversal...
Looked up the RFC :
https://tools.ietf.org/html/rfc3947#section-3
The detection of support for NAT-Traversal and detection of NAT along
the path between the two IKE peers occurs in IKE [RFC2409] Phase 1.
The NAT may change the IKE UDP source port, and recipients MUST be
able to process IKE packets whose source port is different from 500.
Do you support nat-t on your ASA? Enabled by default as of 8.0(2)
crypto isakmp nat-traversal
Hope that helps! Patrick
... View more
Created by
Patrick Moubarak
in Security Management
in Security Management
11-01-2017
07:44 PM
11-01-2017
07:44 PM
I added AlienVault OTX as a start...
... View more
Created by
Patrick Moubarak
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
11-01-2017
07:32 PM
11-01-2017
07:32 PM
RSPAN is layer 2 (so you have to transport the L2 VLAN over L3 MPLS).
Have you looked at ERSPAN which uses GRE encapsulation?
I have used ERSPAN to AlienVault VM since I was not able to RSPAN at layer 2 to UCS...
We ran into an issue at some point when AlienVault moved from Snort to Suricata but the support fixed it.
Patrick
... View more
Created by
Patrick Moubarak
in Firewalls
in Firewalls
11-01-2017
06:47 PM
11-01-2017
06:47 PM
Yes, ASA runs its own inspect and sends a copy of the packets to the Firepower module.
Firepower runs preprocessor and other advanced security (IPS, AMP...) on the connections and instructs the ASA to drop or reset a connection if needed.
Hope that helps.
... View more
Created by
Patrick Moubarak
in Cisco Bug Discussions
in Cisco Bug Discussions
11-01-2017
06:38 PM
11-01-2017
06:38 PM
Hotfix D is now available for the 2100 series:
Cisco_FTD_SSP_FP2K_Hotfix_D-6.2.2.1-2.sh.REL.tar
https://www.cisco.com/c/en/us/td/docs/security/firepower/hotfix/Firepower_Hotfix_Release_Notes/Firepower_Hotfix_Release_Notes_chapter_011.html
... View more
Created by
Patrick Moubarak
in Policy and Access
in Policy and Access
09-22-2017
07:32 AM
09-22-2017
07:32 AM
Thanks a lot for the information. I upgraded 2.1 patch 3 to patch 5 (to fix a backup bug) then took a backup and ran the upgrade to 2.2 18 hours later, I cannot SSH into the VM or access the GUI. I actually get a login prompt via SSH and get the banner then nothing happens when I enter the password, the prompt just freezes: login as: admin BANNER... admin@10.23.83.157's password: Maybe the best strategy is a fresh 2.2 and restore Patrick
... View more
Created by
Patrick Moubarak
in Advanced Threats
in Advanced Threats
11-13-2015
01:22 PM
11-13-2015
01:22 PM
Thank you all for the great insights. The information provided is very helpful. Patrick
... View more
Created by
Patrick Moubarak
in Identity Services Engine (ISE)
04-04-2019
04-04-2019
Thank you.The customer will contact GoDaddy support or just end up
generating a different certificat...
04-04-2019
seems to be still an issue.we are running into the same problem with
Apple iOS
devices:https://commu...
Created by
Patrick Moubarak
in Identity Services Engine (ISE)
04-02-2019
04-02-2019
Hi,We recently upgraded an ISE 2.2 patch 11 deployment to 2.4 patch 6.We
also changed the ISE 802.1x...
06-01-2018
It seems that ISE is rejecting the MAB authentication for the IP phone.
What does your ISE Operation...
04-24-2018
We just ran into the same issue with VM based on SNS-3415 and contacted
TAC. I am wondering why Cisc...
02-07-2018
Thanks Bogdan, I just tried it and it works like a charm! The FMC doc
under ECMP routing says it is ...
02-07-2018
ASA 9.3(2) introduced the concept of zones with ECMP support across
different interfaces (in the sam...
Created by
Patrick Moubarak
in Cisco Bug Discussions
01-19-2018
01-19-2018
Yeah I saw that bug. I just found a workaround. Since I am using a
private (internal) certificate fo...
Created by
Patrick Moubarak
in Cisco Bug Discussions
01-19-2018
01-19-2018
Thanks Francesco, we are looking into patching but it doesn't seem like
a known issue listed on bug ...
Created by
Patrick Moubarak
in Cisco Bug Discussions
01-18-2018
01-18-2018
I am running into an issue with ISE 2.2 patch 4 running the latest SPW
for MAC OS X with the latest ...
Created by
Patrick Moubarak
in VPN and AnyConnect
11-01-2017
11-01-2017
From memory UDP source and destination are both 500. But then what about
NAT-Traversal... Looked up ...
Created by
Patrick Moubarak
in Security Management
11-01-2017
11-01-2017
I added AlienVault OTX as a start...
11-01-2017
RSPAN is layer 2 (so you have to transport the L2 VLAN over L3 MPLS).
Have you looked at ERSPAN whic...
11-01-2017
Yes, ASA runs its own inspect and sends a copy of the packets to the
Firepower module. Firepower run...
Public Statistics
| Date Registered | 05-05-2008 09:10 AM |
| Date Last Visited | 09-09-2019 01:34 AM |
| Total Messages Posted | 175 |
| Total Helpful Votes Received | 44 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 1 | |
| 1 | |
| 5 | |
| 1 |
