Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About dharmendra2shah
09-07-2018
dharmendra2shah
Member since
07-19-2006
Beginner
04-30-2014
03:41 PM
Marvin, I ended up opening a TAC case with Cisco. It appears that I was missing the following RED highlighted portion in the tunnel group configuration : tunnel-group XXX-VPN-Test-Users webvpn-attributes group-alias XXX-VPN-Test-Users enable group-url https://XXX.XXX.XXX.XXX.XXX/ XXX-VPN-Test-Users enable I thought you would be interested in knowing. Ds
... View more
04-29-2014
02:47 PM
Martin, I am still getting the same error message. What am I missing? <ServerList> <HostEntry> <HostName>XXX-VPN-Test-Users</HostName> <HostAddress>XXX.XX.34.132</HostAddress> <UserGroup>XXX-VPN-Test-Users</UserGroup> <PrimaryProtocol>SSL</PrimaryProtocol> </HostEntry> </ServerList> </AnyConnectProfile> Ds
... View more
04-29-2014
12:57 PM
Marvin, We are using the profile editor provided in the Cisco ASA firewall. See below snapshot of the partial .xml file . Let me know your thoughts. <ServerList> <HostEntry> <HostName>XXX-VPN-Test-Users</HostName> <HostAddress>XXX.XX.34.132</HostAddress> <UserGroup>XXX-VPN-Test-Users</UserGroup> </HostEntry> </ServerList> </AnyConnectProfile>
... View more
Created by
dharmendra2shah
in VPN and AnyConnect
in VPN and AnyConnect
04-29-2014
11:48 AM
04-29-2014
11:48 AM
Experts, We are in a process of replacing Cisco IPSec (IKEv1) VPN client with Cisco Secure Anyconnect Mobility Client using SSL technology. We are pre-deploying the VPN client with the vpnconfiguration.xml file to the end users. In this way we control the VPN settings for the users. We have also provided the FQDN (resolvable on the Internet) of our ASA firewall (VPN Concentrator) in the vpnconfiguration.xml file. When the user tries to connect using the vpnconfiguration.xml file he receives a message “invalid host entry. please re-enter”. Even if we put the IP address of the ASA firewall in the vpnconfiguration.xml file we get the same error message. However if we manually enter the FQDN in the Cisco Secure Anyconnect Mobility Client. We are not sure we are missing. Ds
... View more
Labels:
Created by
dharmendra2shah
in Switching
in Switching
07-18-2013
07:37 AM
07-18-2013
07:37 AM
We were able to migrate from old 6500 (Sup 720) to the new 6500 (Sup 2T). Everything is working fine. Except some of the applications who uses oracle in the backend are having frequent disconnects. Is anyone aware of the known problems?
... View more
Created by
dharmendra2shah
in Switching
in Switching
05-03-2013
07:38 AM
05-03-2013
07:38 AM
Thanks for the heads up Darren !!! I am sure we would have the same problem but now we know what to do. Ds
... View more
Created by
dharmendra2shah
in Switching
in Switching
04-29-2013
10:54 AM
04-29-2013
10:54 AM
Thanks!!!
... View more
Created by
dharmendra2shah
in Switching
in Switching
04-29-2013
10:45 AM
04-29-2013
10:45 AM
Reza- Thanks for the head-up on QoS and I like your idea of using HSRP & VRRP and migrating 1 layer 3 interface at a time. But we are running GLBP on 6500 right now. I am assuming we should be able to do the same thing what you explained above with GLBP as well? Ds
... View more
Created by
dharmendra2shah
in Switching
in Switching
04-29-2013
06:43 AM
04-29-2013
06:43 AM
All- We recently purchased 2 Cisco 6500 series switches (with Sup 2T). These switches will be replacing our old 2 6500 series switches (with Sup 720). We have 70 vlans and 90+ closet switches (2900) connecting the core switches We have 2 WLC connected to the core switch. We also have a 1 x 1 connection to a VSS switch which in turn connects to our Server Co-Location data center utilizing IPSec & GRE tunnel to connect to our Server Co-Location data center. Our routing protocol is EIGRP. Our VTP domain at Server Co-Location is separate from our location “A” campus. I was wondering what is the best way to migrate our Core switches at location “A” campus. The requirement is we would like to replace these switches with minimum downtime. Ds
... View more
Labels:
Created by
dharmendra2shah
in Policy and Access
in Policy and Access
04-19-2013
07:19 AM
04-19-2013
07:19 AM
Tarik- I am using supplicant provisioning wizard and we are also using SCEP to provision certificates for iPads. We have 150+ corporate issued iPads. The purpose of using ISE was to reduce our work, do thing efficiently and get away from MAC address filters which we are using currently. They are applied on the WLC’s. You solutions is again suggesting to rely on MAC addresses which I doing anyways without ISE. I just don’t see any value addition with ISE. I am just frustrated with Cisco. Hopefully we should hear from Cisco about ISE MDM solution. Ds
... View more
Created by
dharmendra2shah
in Policy and Access
in Policy and Access
04-19-2013
06:38 AM
04-19-2013
06:38 AM
Tarik- We are using AD groups to keep the bad boys away. However here is a scenario where the user can connect his personal iPad to our network. For Eg: James is authorized to use corporate iPad and is a member of AD “iPad_Users”. Since he is the member of that group he can easily bring his personal iPad and connect to corporate network. Do you have a solution for this? George- I agree with you. Integrating iPad with MDM is the only hope. But when is Cisco going to support this? They have been taking about this for almost 6 months. We are already using Air Watch as our MDM server. To me ISE is a dead investment because it is not solving any purpose or maybe I am missing something. Ds
... View more
Created by
dharmendra2shah
in Policy and Access
in Policy and Access
04-18-2013
08:36 AM
04-18-2013
08:36 AM
We are evaluating ISE right now. I am using TrustSec How to Guide: Using Certificates for Differentiate Access. http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_60_byod_certificates.pdf After getting help from this support forum I was able to get the self registration working but there is no way I can differentiate Corporate issued iPad & Personal iPad. Users bringing personal iPad can also go through self registration process fine and are able to access corporate network. What is the best way to stop them? Any help on the authorization profile will be appreciated. Ds
... View more
Labels:
01-25-2013
11:15 AM
That was it Jouni. As soon as I added "no sysopt noproxyarp outside" The web site started working from outside world. Ds
... View more
01-25-2013
08:56 AM
Jouni- I have not tried yet. I will try that later in the afternoon. I will let you know right away. Ds
... View more
01-24-2013
03:31 PM
Thanks Jouni- I think it might be : sysopt noproxyarp outside. I was troublshooting application performance for site to site VPN. I might have enabled that command. Things did not break until we rebooted the ISP modem. It all makes sense now because the ISP was also saying that the arp is incomplete for the web server IP. I will try disabling the command and see if that fixes the problem. This time I am quite positive. Ds
... View more
04-30-2014 03:41 PM
Marvin,I ended up opening a TAC case with Cisco. It appears that I was
missing the following RED hig...
04-29-2014 02:47 PM
Martin,I am still getting the same error message. What am I missing?
XXX-VPN-Test-Users
XXX.XX.34....
04-29-2014 12:57 PM
Marvin,We are using the profile editor provided in the Cisco ASA
firewall.See below snapshot of the ...
Created by
dharmendra2shah
in VPN and AnyConnect
04-29-2014 11:48 AM
04-29-2014 11:48 AM
Experts,We are in a process of replacing Cisco IPSec (IKEv1) VPN client
with Cisco Secure Anyconnect...
Created by
dharmendra2shah
in Switching
07-18-2013 07:37 AM
07-18-2013 07:37 AM
We were able to migrate from old 6500 (Sup 720) to the new 6500 (Sup
2T). Everything is working fine...
Created by
dharmendra2shah
in Switching
05-03-2013 07:38 AM
05-03-2013 07:38 AM
Thanks for the heads up Darren !!! I am sure we would have the same
problem but now we know what to ...
Created by
dharmendra2shah
in Switching
04-29-2013 10:45 AM
04-29-2013 10:45 AM
Reza-Thanks for the head-up on QoS and I like your idea of using HSRP &
VRRP and migrating 1 layer 3...
Created by
dharmendra2shah
in Switching
04-29-2013 06:43 AM
04-29-2013 06:43 AM
All-We recently purchased 2 Cisco 6500 series switches (with Sup 2T).
These switches will be replaci...
Created by
dharmendra2shah
in Policy and Access
04-19-2013 07:19 AM
04-19-2013 07:19 AM
Tarik-I am using supplicant provisioning wizard and we are also using
SCEP to provision certificates...
Created by
dharmendra2shah
in Policy and Access
04-19-2013 06:38 AM
04-19-2013 06:38 AM
Tarik-We are using AD groups to keep the bad boys away. However here is
a scenario where the user ca...
Created by
dharmendra2shah
in Policy and Access
04-18-2013 08:36 AM
04-18-2013 08:36 AM
We are evaluating ISE right now. I am using TrustSec How to Guide: Using
Certificates for Differenti...
01-25-2013 11:15 AM
That was it Jouni. As soon as I added "no sysopt noproxyarp outside"The
web site started working fro...
01-25-2013 08:56 AM
Jouni-I have not tried yet. I will try that later in the afternoon. I
will let you know right away. ...
Public Statistics
| Date Registered | 07-19-2006 11:32 AM |
| Date Last Visited | 09-07-2018 12:03 AM |
| Total Messages Posted | 69 |
| Total Helpful Votes Received | 15 |
.jpg "Hall of Fame Master"){kind=icon}
