Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About babiojd01
babiojd01
Member since
06-02-2014
Beginner
02-14-2019
04:09 AM
So the tunnel is up and works perfectly. It appears as if the syn goes through the tunnel into AWS bu is going around the ASAv connecting to the device that is supposed to be behind inside. The syn ack is coming from the EC2 but actually goes in the inside interface of the ASAv. ASAv sees this and drops it because the initial connection never originated from outside to inside. So effectively its bypassing outside.Almost feels like a routing issue where i need to force packets into the outside interface of the ASA.
... View more
02-13-2019
07:15 PM
So i have been playing around with a basic scenario of a linux ec2 vm on the inside subnet of the ASAv. A vpn to the VPC and a static route to my remote subnet (opposite side of the vpn). I have tried custom route tables, routes on the ec2 vm, and route tables directly to an interface. Nothing works! It appears that the initial packet goes around the ASA to the ec2 vm then the return syn ack comes through the inside interface from the vm and is dropped because it was never initiated through the outside beings it went around it. What is the trick in order to force it through the outside and not around the firewall. My test was not from within the VPC but from the remote side of the vpn.
... View more
- Tags:
- ASAv
- aws
- Publiccloud
Labels:
Created by
babiojd01
in Smart Net Total Care Portal and Collector Discussions
in Smart Net Total Care Portal and Collector Discussions
02-04-2019
11:44 AM
02-04-2019
11:44 AM
Can you please help? Cannot generate a cspc entitlement.
... View more
11-24-2018
06:30 AM
You need to convert the json output into cef or something readable by arcsight. I did some reading in their forums and it looks like it can parse json with a little work on your part.
... View more
11-23-2018
10:35 PM
I was reading there is support of connector style umbrella web filtering. So the steps mention utilizing an api based on the company and network device. umbrella on ASA With that being said i imagine this takes care of dynamic ip address issues when assigning an dynamic IP site to your MSP dashboard. Meaning if the ip changes they still will be processed by policy?
... View more
- Tags:
- Umbrella
Labels:
11-02-2018
10:30 AM
What i do is create zones for outside and dmz. I then apply the Security Over Connectivity linking source zone of outside to destination zone of dmz. My variables then become $homenet and $external_net = !$homenet. What Marvin said works as well.
... View more
Created by
babiojd01
in Cloud Security
in Cloud Security
09-17-2018
05:38 AM
09-17-2018
05:38 AM
the acl used that maps the class map can have a deny entry first for addresses you want to bypass.
... View more
Created by
babiojd01
in Security Documents
in Security Documents
09-17-2018
04:17 AM
09-17-2018
04:17 AM
So the trick is to comment out some sections of the nessus.pl script. I was able to get it to work last night. There are sections where it tells the script to croak if it fails. If you comment those out it will continue on and not stop. Send me a mail if you want the details.
... View more
Created by
babiojd01
in Security Documents
in Security Documents
09-16-2018
01:47 PM
09-16-2018
01:47 PM
I am getting the same hash error. How do we fix it?
... View more
Created by
babiojd01
in Security Documents
in Security Documents
09-15-2018
09:39 AM
09-15-2018
09:39 AM
One issue i found is that if the malware is network based the virus name "c2=" doesn't show up. It does show up for alerts that are amp for endpoint though. Meaning if you have amp for endpoints connected to your FMC.
... View more
Created by
babiojd01
in Security Documents
in Security Documents
09-12-2018
03:58 AM
09-12-2018
03:58 AM
I take it that this will forward fireamp events as well?
... View more
Created by
babiojd01
in Security Documents
in Security Documents
09-11-2018
10:31 AM
09-11-2018
10:31 AM
Today's logstash conf file is for AMP for endpoints. You will need an api created inside of the amp cloud dashboard. Inside of the two .sh files place the api key in place of yourkeyhere. You will also need the two .sh files i am providing inside of your /etc directory on linux. The amp.sh needs an entry in /etc/crontab like so */5 * * * * root /etc/amp.sh so it runs every 5 mins. It will produce the file /etc/run-amp.sh which i am also providing. It creates the curl line with the proper previous 5 mins command. Make sure you make the owner of these files logstash. Last but not least is the amp.conf file for logstash. This takes the ingested json and creates parsed data for you. I was able to create some nice charts and graphs in kibana of the data. Make sure you remove the .txt part of the files before using. If you get stuck anywhere let me know.
https://api-docs.amp.cisco.com/api_resources?api_host=api.amp.cisco.com&api_version=v1
... View more
Created by
babiojd01
in Security Documents
in Security Documents
09-10-2018
09:04 PM
09-10-2018
09:04 PM
Today's logstash conf file is for Cognitive threat analytics. You will need an api created inside of CTA cloud dashboard. You will also need taxii log adapter setup. If you need help here is the wiki taxii log adapter wiki
If you really get stuck feel free to send me a message. In the upcoming days I will be posting conf files for FirePower snort, Security Intelligence alerts, Threat intelligence director via Firepower manager API, Cisco AMP for endpoints, and Meraki Security Alerts (AMP and SNORT).
In order to use the attached conf file please remove the .txt from the filename.
... View more
07-13-2017
06:30 AM
Can someone make this module available for FSM6 or 6.2 Please? Its gone after upgrading.
... View more
05-26-2017
05:33 AM
Thanks Dennisperto,
I hope cisco can come back and state is it behavior or is it not possible? I see nothing in the documentation that says it isn't and if it isn't why can we execute the command? The error I get while watching asdm log is tcp intercept. I don't even have that enabled. In order to get access to the asdm I used the outside interface and created a pat for the firepower module so I could reach that as well.
... View more
Created by
babiojd01
in Smart Net Total Care Portal and Collector Discussions
02-04-2019 11:44 AM
02-04-2019 11:44 AM
Can you please help? Cannot generate a cspc entitlement.
11-24-2018 06:30 AM
You need to convert the json output into cef or something readable by
arcsight. I did some reading i...
11-23-2018 10:35 PM
I was reading there is support of connector style umbrella web
filtering. So the steps mention utili...
11-15-2018 10:15 AM
https://software.cisco.com/download/home/286312080/type you are able to
use ASA software build speci...
11-15-2018 06:48 AM
I take it you will be using the ASA OS on that device? From what i
recall you can use all ftd on it ...
11-02-2018 10:30 AM
What i do is create zones for outside and dmz. I then apply the Security
Over Connectivity linking s...
10-17-2018 05:25 AM
I have 2 questions. 1. Is there a reason to have network objects created
in a separate domain away f...
Public Statistics
| Date Registered | 06-02-2014 10:54 AM |
| Date Last Visited | 05-22-2019 12:07 AM |
| Total Messages Posted | 96 |
| Total Helpful Votes Received | 15 |
.jpg "VIP Advisor"){kind=icon}
.jpg "Hall of Fame Master"){kind=icon}
