I was reading there is support of connector style umbrella web filtering. So the steps mention utilizing an api based on the company and network device. umbrella on ASA With that being said i imagine this takes care of dynamic ip address issues when assigning an dynamic IP site to your MSP dashboard. Meaning if the ip changes they still will be processed by policy? ... View more

Today's logstash conf file is for AMP for endpoints. You will need an api created inside of the amp cloud dashboard. Inside of the two .sh files place the api key in place of yourkeyhere. You will also need the two .sh files i am providing inside of your /etc directory on linux. The amp.sh needs an entry in /etc/crontab like so */5 * * * * root /etc/amp.sh so it runs every 5 mins. It will produce the file /etc/run-amp.sh which i am also providing. It creates the curl line with the proper previous 5 mins command. Make sure you make the owner of these files logstash. Last but not least is the amp.conf file for logstash. This takes the ingested json and creates parsed data for you. I was able to create some nice charts and graphs in kibana of the data. Make sure you remove the .txt part of the files before using. If you get stuck anywhere let me know.  https://api-docs.amp.cisco.com/api_resources?api_host=api.amp.cisco.com&api_version=v1   ... View more

Today's logstash conf file is for Cognitive threat analytics. You will need an api created inside of CTA cloud dashboard. You will also need taxii log adapter setup. If you need help here is the wiki taxii log adapter wiki  If you really get stuck feel free to send me a message. In the upcoming days I will be posting conf files for FirePower snort, Security Intelligence alerts, Threat intelligence director via Firepower manager API, Cisco AMP for endpoints, and Meraki Security Alerts (AMP and SNORT).        In order to use the attached conf file please remove the .txt from the filename.  ... View more

I cannot ssh to the inside of the asa via vpn when the inside ip is a BVI. I enabled management access inside and i received tcp intercept drops my connection. If I enable management access via a specific interface like inside_1->inside_7 i get cannot locate egress interface. How do you enable management access inside when using a BVI inside interface using 9.8.1 code? ... View more

So I have been playing with this release and noticed some things. It seems even if I have an acl applied to the individual bvi interfaces like inside_1-Inside_7 permitting ip any any, Same-security traffic command is mandatory. As soon as I remove that traffic stops between host associated with the same bvi. Also, where is the proper place to put an egress acl? Inbound direction of inside_1 or the bvi interface inside? ... View more