What is it used for and what happens when it is enabled? What is the impact to users and is there anything else in the network that has to be done for it to not impact users? From what I have read so far, it is an encryption mode, but for what and how does it work for the Web Security? ... View more

Reviewing a setup, and noticed in the later version of code, 8.0 for example, there are two methods for access.  Since FF and Safari have issues authenticating access when browsing, and IE does not, would the transparent user ID work the same way for authenticated users, and how would that work with AD? ... View more

Just an FYI for whoever encounters this. Seeing this happening with EX5 as well. Mainly on 24 port 2960 switches, though did see it once on a 48 as well.   *    1 28    WS-C2960X-24PS-L   15.0(2)EX5            C2960X-UNIVERSALK9-M     ... View more

I have a site to site VPN between a 5520 and 5505, both have static IPs. There are 3 /16 subnets that have tunnels built. What we are seeing is if there is some internet glitch that causes the tunnels to drop, 2 of the 3 will work, the third does not come back right away.   On both ends there is an IPS SA built for all three networks, but only two are accumulating packet counts. Eventually the third tunnel was start passing traffic again. If I do a hard reset of the VPN tunnel by issuing a clear cry ips sa peer on the 5520, or just a clear cry isa sa on the 5505 all 3 tunnels will come up fine. I have syslog enabled to send all VPN logs to a server and I am seeing all 3 tunnels building properly, so I am stumped as to why one of three fail to pass traffic when there is an internet glitch. ... View more

I have been trying to get this to work with a Microsoft CA on 2012. I get through the steps on the ASA, and am seeing the 3 certs being loaded to the ASA from the server.   When I connect to the VPN on the mobile device, in this case an iphone, I log in OK, it synchronizes, then obtains certificate, and this is where it fails.   Certificate Enrollment failed.   Diagnostic log shows Certificate Enrollment - Request Forwarded   Does this twice then disconnects with the failure message.   I am trying to get this setup to replace the ASA CA server for Ondemand VPN.  Right now I am not sure what debug I can run to check the transactions between client and server, or if I am missing something in the configuration.   I am running ASA 5512X with code 9.0(1), ASDM 7.1(5), and Anyconnect Mobile 3.0.12119   ... View more

When doing a traceroute on a 2900, I am seeing returns of the destination IP instead of the real internet IP.   #trace 4.2.2.1 sou g0/0.102 Type escape sequence to abort. Tracing the route to 4.2.2.1 VRF info: (vrf in name/id, vrf out name/id)   1 10.100.102.85 [AS ] 0 msec 0 msec 4 msec   2 10.255.255.30 [AS ] 0 msec 4 msec 0 msec   3 4.2.2.1 [AS ] 0 msec 4 msec 0 msec   4 4.2.2.1 [AS ] 4 msec 0 msec 4 msec   5 4.2.2.1 [AS ] 0 msec 4 msec 0 msec   6 4.2.2.1 [AS ] 0 msec 4 msec 0 msec   7 4.2.2.1 [AS ] 4 msec 4 msec 4 msec   8  *  *  *   9 4.2.2.1 [AS ] 0 msec 4 msec 0 msec  10  *  *  *  11 4.2.2.1 [AS ] 0 msec 0 msec 0 msec If I enable DNS lookup, the IP is replaced with the domain name used such as yahoo.com or google.   #trace 8.8.8.8 sou g0/0.102 Type escape sequence to abort. Tracing the route to google-public-dns-a.google.com (8.8.8.8) VRF info: (vrf in name/id, vrf out name/id)   1 10.100.102.85 [AS ] 20 msec 20 msec 8 msec   2 10.255.255.30 [AS ] 4 msec 4 msec 16 msec   3 google-public-dns-a.google.com (8.8.8.8) [AS ] 28 msec 32 msec 32 msec   4 google-public-dns-a.google.com (8.8.8.8) [AS ] 28 msec 24 msec 36 msec   5 google-public-dns-a.google.com (8.8.8.8) [AS ] 28 msec 16 msec 12 msec   6 google-public-dns-a.google.com (8.8.8.8) [AS ] 12 msec 8 msec 24 msec   7 google-public-dns-a.google.com (8.8.8.8) [AS ] 24 msec 20 msec 24 msec   8 google-public-dns-a.google.com (8.8.8.8) [AS ] 40 msec 24 msec 16 msec   9 google-public-dns-a.google.com (8.8.8.8) [AS ] 16 msec 24 msec 20 msec  10 google-public-dns-a.google.com (8.8.8.8) [AS ] 24 msec 16 msec 16 msec  11 google-public-dns-a.google.com (8.8.8.8) [AS ] 16 msec 16 msec 20 msec  12 google-public-dns-a.google.com (8.8.8.8) [AS ] 48 msec 12 msec 16 msec  13 google-public-dns-a.google.com (8.8.8.8) [AS ] 32 msec 32 msec 36 msec  14  *  *  *  15 google-public-dns-a.google.com (8.8.8.8) [AS ] 24 msec 28 msec 28 msec     I am also seeing our ASN in the trace.   I have never seen this before on any router, switch or PC. What could be causing this?  If a client behind the router does a trace, they get  *** for each hop beyond #2 which is the firewall until the final destination. ... View more

Bug ID CSCur00930  lists version 9.1(2.13058.1) as affected.   Does this mean ONLY 9.1(2.13058.1) is affected, or does it mean 9.1(2.13058.1) and lower are affected?  ... View more

I need to temporarily transfer the phone proxy configuration from one ASA to a temporary one so that the existing one can be upgraded and put into a failover cluster offline.   I did a full backup and restore to the temp unit, and got some errors specifically to this. ..............ERROR: Keypair _internal_UC-Proxy_SAST_0 doesn't exist. *** Output from config line 534, " keypair _internal_UC-Pr..." ERROR: Keypair _internal_UC-Proxy_SAST_1 doesn't exist. *** Output from config line 540, " keypair _internal_UC-Pr..." ERROR: Keypair _internal_PP_UC-Proxy doesn't exist. *** Output from config line 546, " keypair _internal_PP_UC..." ERROR: Keypair CCM-Pub doesn't exist. *** Output from config line 550, " keypair CCM-Pub" ERROR: Keypair CCM-Sub doesn't exist. *** Output from config line 554, " keypair CCM-Sub" ERROR: Keypair _internal_UCM-CCM_SAST_0 doesn't exist. *** Output from config line 587, " keypair _internal_UCM-C..." ERROR: Keypair _internal_UCM-CCM_SAST_1 doesn't exist. *** Output from config line 593, " keypair _internal_UCM-C..." ERROR: Keypair _internal_PP_UCM-CCM doesn't exist. *** Output from config line 599, " keypair _internal_PP_UC..." .ERROR: Public key contained in the device certificate doesn't match the device's public key <Default-RSA-Key> configured for trustpoint _internal_UC-Proxy_SAST_0.   Did something not get backed up from the in service unit? Are there any other steps to take, other than reconfigure the phone proxy from scratch?   ... View more

This used to work fine, until recently, now it just hangs when I attempt to use it.  Doesn't matter which version ASDM, from 6.4 though 7.15.  I start it, put in my CCO credentials, then wait as it just sits there. ... View more

Hi, been looking to find out what all devices besides Samsung are supported for Anyconnect. Example would be Motorola Mini and Maxx.   The list seems kind of short, http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/rn-ac3-0-android.html#pgfId-1256241 Not specifying Motorola in the list on that link. ... View more