About infrateam

infrateam · ‎02-16-2019

Did you fix this? I have this problem too.

infrateam · ‎01-07-2019

This does not work for me: CIN-SL-5506# show reload Reload scheduled for 03:00:00 IST Wed Jan 9 2019 (in 15 hours and 26 minutes) by admin from ssh (remote 192.168.10.159) CIN-SL-5506# CIN-SL-5506# show module sfr Mod Card Type Model Serial No. ---- -------------------------------------------- ------------------ ----------- sfr FirePOWER Services Software Module ASA5506 JADxxxxxxxx Mod MAC Address Range Hw Version Fw Version Sw Version ---- --------------------------------- ------------ ------------ --------------- sfr 4001.xxxx.xxxx to 4001.xxxx.xxxx N/A N/A 6.2.3.8-51 Mod SSM Application Name Status SSM Application Version ---- ------------------------------ ---------------- -------------------------- sfr ASA FirePOWER Up 6.2.3.8-51 Mod Status Data Plane Status Compatibility ---- ------------------ --------------------- ------------- sfr Up Down Can you give more info or context as to the specific steps you took, the appliance model etc? May be I am not doing something exactly like you did?

infrateam · ‎05-06-2018

You need to select the new cert you imported to be used. Sounds like although you imported the new cert, it’s sitting idle and the VPN config is still using the old cert.

infrateam · ‎03-07-2018

Thank you John and Marvin for firstly the excellent first post stating exactly what is needed and secondly to Marvin for taking it onboard and responding with the concise help! I did look for this earlier in the week and the Cisco documentation doesn't give these instructions or notes at all... I knew that regenerating a CSR was not the right way to go. I thought I'd add some additional info in case anyone needs it. After downloading your renewed SSL cert bundle from your cert authority, here's the steps you need to get the PFX file that you can then import into your ASA via ASDM: 1. You might need to create a cert 'bundle' if your CA has given you the server cert and separate root and intermediate certs. You do this by opening up all of the files with a text editor and making a new notepad file. Copy and paste everything from each cert into the one file. The server cert is first, followed by the intermediate and then root certs. Save the new file as .crt like the others and it should open in windows fine. 2. Use a linux shell with openssl (I use windows bash.exe for this) and create the pfx file. You need the 2 files that are 1) your certs private key file and 2) the new cert bundle you just created (you will be asked to set a password for it):: openssl pkcs12 -export -out new-asa.pfx -inkey private.key -in bundled.crt 3. now you can import the pfx into the ASA using the password. I actually created a new trustpoint, since the private key was being imported again.. although I'm not sure if I could have re-used the same trustpoint as before. :)

infrateam · ‎08-02-2016

Depends on if the APs support LAG.

infrateam · ‎08-02-2016

OP I raised a TAC for this issue back in April 2015. You must use DTLS for phones, else they fall back to using TCP. The result is extremely poorly working phones. Have you tested this?

infrateam · ‎05-08-2016

This is wrong: LACP and PAgP are not supported on the controller "Make sure the port-channel on the switch is configured for the IEEE standard Link Aggregation Control Protocol (LACP), not the Cisco proprietary Port Aggregation Protocol (PAgP)."Controller only supports the on mode of the LAG. This should say "Make sure the port-channel on the switch is configured to channel unconditionally without a negotiation protocol; IE channel-group mode on" The text above first says that LACP is not supported on the WLC, but then the next part says to make sure you enable LACP. The OP is confused about the command channel-group x mode on. The "on" means that physical link will be within a port-channel without negotiation.

infrateam · ‎03-04-2016

It's okay, after over an hour of searching Google AND Cisco.com and using Google to search Cisco.com I eventually found the documentation: http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-1/mobility_express/b_Mobility_Express_Deployment_guide/b_Mobility_Express_Deployment_guide_chapter_01100.html#task_7B18649C99D94D2BB551EDDEB16B6601

infrateam · ‎03-04-2016

I am now done testing the 1832 I have with our 2504 WLC. And I would like to put the AP back to the autonomous mobility express image and having some troubles. I have broke the boot sequence and issued tftpboot, which downloaded the .bin file which I extracted from the mobility express .tar image. However I can't see how after the AP has downloaded the .bin, how to tell the AP to boot it. (RNAQ-C7) # tftpboot Full duplex link Port:2 speed 1000Mbps Using eth0 device TFTP from server 192.168.1.254; our IP address is 192.168.1.1 Filename 'part.bin'. Load address: 0x44000000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############################# done Bytes transferred = 32865897 (1f57e69 hex) (RNAQ-C7) # dir Unknown command 'dir' - try 'help' (RNAQ-C7) # help ? - alias for 'help' base - print or set address offset bootipq - bootipq from flash device chpart - change active partition cmp - memory compare cp - memory copy crc32 - checksum calculation echo - echo args to console env - environment handling commands ethreg - ethreg - Switch/PHY Reg rd/wr utility exit - exit script false - do nothing, unsuccessfully go - start application at address 'addr' help - print command description/usage i2c - I2C sub-system iminfo - print header information for application image imxtract- extract a part of a multi-image ipq_nand- Switch between SBL and Linux kernel page layout. loadb - load binary file over serial line (kermit mode) loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range md - memory display mm - memory modify (auto-incrementing address) mtdparts- define flash/nand partitions mtest - simple RAM read/write test mw - memory write (fill) nand - NAND sub-system nm - memory modify (constant address) pci - list and access PCI Configuration Space ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables printmfgenv- Print manufacture information data printshenv- printshenv- print shared environment variables reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage saveshenv- saveshenv - save shared environment variables to persistent storage setenv - set environment variables setshenv- setshenv - set shared environment variables sf - SPI flash sub-system showvar - print local hushshell variables smeminfo- print SMEM FLASH information source - run script from memory test - minimal test like /bin/sh tftpboot- boot image via network using TFTP protocol true - do nothing, successfully ubi - ubi commands usb - USB sub-system verify_bl- Cisco Bootloader signature verify verify_lx- Cisco Image signature verify version - print monitor, compiler and linker version (RNAQ-C7) # showvar HUSH_VERSION=0.01 How do I revert back to autonomous?

infrateam · ‎03-04-2016

Hi, yes I have my 1832 working fine with my 2504 WLC. Did you read the release notes? You need WLC version 8.1 at least. My next problem is getting the 1832 back to autonomous mode!

infrateam · ‎03-03-2016

Interested to know if the IM address can be changed via the jabber-config.xml as this doesn't seem like a normal config change. The config file is for the jabber application config as I understood and the IM address is not an end-user application setting.

infrateam · ‎02-28-2016

Cisco : Why has this not been addressed yet? You are misleading your customers. I'll raise a TAC case to have this resolved if it's not picked up. Thanks

infrateam · ‎11-30-2015

Just an FYI here as I did plan on changing the IM address scheme for our org. to use email address rather than userID@domain so as to make things a bit easier for signing in. However I've made some other recent changes and now I think the IM address scheme change is redundant. My env.: CUCM / IMP 11.0 MRA via Expressway's 8.6 Active Directory with Windows 2012 server SAML SSO with ADFS on Windows 2012 server Because of the SSO implementation for on-premise and MRA, we can sign in using email address such as " firstname.lastname@domain.com "; or we can use the old method " flastname@internal.domain.com " where flastname is really the first initial, then lastname. Because of the @domain.com portion and the @internal.domain.com portion I have multiple SRV records internally and externally for the autodiscovery to work regardless or what login name is entered. I recently heard that autodiscovery is not implemented in later jabber releases so I'm not sure if these are still required. For the SSO Sign in, I ran a powershell command (found from google, because I'm not a MS person but I know how to use google ) which means users can use their email address as their username or their user ID as normal. Once signed in, internal users are found through the LDAP, or are populated automatically through Active Directory groups. I have 3 groups for all users (40 people in the company) and this covers all sites. IM address for internal people is the flastame@internal.domain.com (our internal domain is a sub domain of the external domain). The IM address for internal users is transparent and never actually typed out by anyone. For XMPP federation, external parties can send messages to our email addresses such as firstname.lastname@domain.com . This is done directly to IMP through our firewall (not via Expressways). So to summarise, users can log in using email address and external parties send IM's to our internal users via their email address. The only area where the userID@domain IM address is in use is internally which is benign / transparrent to our users. Hope this helps.

infrateam · ‎10-28-2015

Thanks for the helpful info! However, I needed to reboot my standby ASA for it to go "Secondary - Standby Ready" because it kept saying failed, even after following both of your points. Thanks

infrateam · ‎10-27-2015

Yep :) In the case where no routing protocol is used at all, you are left with static routing. Meaning, you will need to configure individual routes manually into the configuration of the asa. This configuration is static and does not change by itself. Once you configure it, the route will stay in place permanently.

infrateam · 02-16-2019 06:14 AM

Did you fix this? I have this problem too.

infrateam · 01-10-2019 09:49 PM

Steps to create a working ssl certificate with Windows server CA: go to your windows CA and go to "m...

infrateam · 01-10-2019 07:57 PM

@Marvin Rhoads Thanks for the info although I could not find any such detail in the config guide: ht...

infrateam · 01-07-2019 10:06 PM

This does not work for me: CIN-SL-5506# show reload Reload scheduled for 03:00:00 IST Wed Jan 9 2019...

infrateam · 05-06-2018 08:45 AM

You need to select the new cert you imported to be used. Sounds likealthough you imported the new ce...

infrateam · 03-07-2018 08:01 PM

Thank you John and Marvin for firstly the excellent first post stating exactly what is needed and se...

infrateam · 08-02-2016 12:53 AM

Depends on if the APs support LAG.

infrateam · 08-02-2016 12:50 AM

OP I raised a TAC for this issue back in April 2015. You must use DTLS for phones, else they fall ba...

infrateam · 07-28-2016 10:52 PM

I didn't need the screenshots in the end because the link I supplied in the previous post helped me ...

infrateam · 05-08-2016 06:43 PM

This is wrong: LACP and PAgP are not supported on the controller "Make sure the port-channel on the ...

infrateam · 03-04-2016 12:30 AM

It's okay, after over an hour of searching Google AND Cisco.com and using Google to search Cisco.com...

infrateam · 03-04-2016 12:16 AM

I am now done testing the 1832 I have with our 2504 WLC. And I would like to put the AP back to the ...

infrateam · 03-04-2016 12:10 AM

Hi, yes I have my 1832 working fine with my 2504 WLC. Did you read the release notes? You need WLC v...

infrateam · 03-03-2016 07:09 PM

Interested to know if the IM address can be changed via the jabber-config.xml as this doesn't seem l...

infrateam · 02-28-2016 07:33 PM

Cisco : Why has this not been addressed yet? You are misleading your customers. I'll raise a TAC cas...

Date Registered	‎08-18-2014 09:24 PM
Date Last Visited	‎06-26-2019 01:40 AM
Total Messages Posted	95
Total Helpful Votes Received	20

Re: SIP 503 Service Unavailable Unable ...

Re: CSCvd53884 - ASA FirePOWER module d...

Re: SSL Certificate renewal instructi...

Re: SSL Certificate renewal instructi...

Depends on if the APs support

OP I raised a TAC for this

This is wrong:

It's okay, after over an hour

1832 Lightweight to Autonomous

Hi, yes I have my 1832

Re: Jabber IM address being displayed w...

Cisco : Why has this not been

Re: Jabber IM address being displayed w...

Thanks for the helpful info!

Yep :)

Re: SIP 503 Service Unavailable Unable to find a device handler for the request received on port

Re: unable to import a new HTTPS-certificate in Firepower Management Center

Re: unable to import a new HTTPS-certificate in Firepower Management Center

Re: CSCvd53884 - ASA FirePOWER module data plane down after reload of module

Re: SSL Certificate renewal instructions