Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mitchen
Stats
Member since
10-12-2004
297
Posts
23
Helpful
0
Solutions
02-06-2018
11:17 AM
@Rahul Govindan If possible, could you be able to elaborate on your suggested workaround a little more? I'm struggling to work out exactly how to do it? Thanks.
... View more
02-05-2018
07:00 AM
Hi Rahul,
thanks - that's what i thought. Will have to have a re-think about how we achieve this then!
... View more
02-05-2018
04:54 AM
I want to set up a site-to-site IPSEC VPN between 2 locations, where I am the administrator for Site A's Cisco ASA firewalls and Site B is a 3rd party company:
Site A: 10.10.10.0/24
Site B: 192.168.20.0/24
From Site A's Cisco ASA firewall, I want to be able to block anything inbound from Site B (that hasn't been initiated from Site A) and I want to allow ALL outbound traffic from Site A to Site B (and leave it to Site B to decide if there is any specific traffic they want to block)
How can I achieve this with a VPN filter at Site A?
(Note: using "no sysopt connection permit-vpn" and interface ACLs isn't an option due to the large number of VPNs already in use so I'd like to be able to do this using VPN filters)
Thanks.
... View more
- Tags:
- asa
- ipsec
- vpn filter
Labels:
10-12-2017
02:37 AM
Hi,
I've recently started at a new company - as usual, no documentation etc!
Anyway, it seems we have recently been introducing Apple Macs to our previously Windows-only environment. However, the Mac users are unable to connect to our VPN (ASA5545 running 9.6 software)
I looked into it and I think I can see what the problem is.
It seems they are still using Cisco Secure Desktop (I'm a bit puzzled by that as I thought it was now obsolete?) and there are Pre-Login policies defined.
The pre-login policy checks if the connecting device is a Windows device with a particular registry setting then assigns it to a "Secure Device" DAP.
When the Mac connects, it obviously doesn't meet that criteria and it is assigned a "Non-Secure Device" DAP which means it's only permitted as a clientless connection with restricted access.
Therefore, when our MAC users attempt to connect with AnyConnect client, it fails after authentication with the message "unauthorised connection mechanism"
I have a couple of questions:
1) Does the logic above sound correct in identifying the issue?
2) What would be the best way to fix this to allow Mac users to connect via AnyConnect client and still maintain security? Should we simply create a new prelogin policy that checks for a Mac OS and e.g. a particular file? Then assign it to a "Secure Mac device" DAP with similar permissions as the "Secure Device" DAP for our Windows users? Or is there a better way of achieving this?
Any thoughts/advice on this would be welcome! Thanks.
... View more
Labels:
09-28-2016
03:13 PM
Pretty much along the same lines as the other thread:
- established site to site IPSEC VPN as a "short-term" tactical solution
- strategic solution was to merge the 2 networks into a single MPLS based solution
- standardised on Cisco 800 series routers at branches across the estate
- redeployed firewalls into a multi-tiered solution (Fortigate and Cisco)
The complexities of merging 2 networks (both technical and political challenges) should not be underestimated!
Hope that is of some help.
... View more
Hi,
Apologies for the delay responding.
Well, this actually turned out to be a bit of a long drawn out story.
However, to try to summarise - what essentially happened was along the lines of that suggested in the posts above. First of all we established a site-to-site VPN between the 2 networks - this was intended as a short-term tactical solution but, in typical fashion, lasted far longer than originally anticipated.
Eventually the 2 networks were merged into a single MPLS based solution (which was more of a challenge than it might sound, given the different ISPs involved, different operating models, different architectures etc)
The one thing I will say is that, when it came to the full merger of the 2 networks it was by no means a trivial task so I would urge anyone undergoing a similar task not to underestimate the complexity of it all (both technically and politically!)
Hope that helps.
... View more
11-09-2015
09:17 AM
Hi Dinesh,
that's great, thanks. That seems to have worked!
As a side topic - how would I actually go about checking the encryption algorithms being negotiated with the clients to determine whether RC4 and DES can indeed be disabled?
... View more
Created by
mitchen
in Network Security
in Network Security
11-09-2015
05:06 AM
11-09-2015
05:06 AM
Hi,
the identity certificate on our ASA5545 (running 8.6 software) is due to expire soon. I understand the process to renew means obtaining a new certificate and installing it on the ASA.
So, I have obtained a new certificate from the CA (Entrust) and installed on the ASA.
However, when I try to bind the new certificate to my outside interface using ASDM I get the error:
"At least one encryption algorithm must be selected"
For the currently binded certificate, the list of available algorithms I have listed on ASDM are:
AES256-SHA1
AES128-SHA1
3DES-SHA1
RC4-SHA1
RC4-MD5
DES-SHA1
DHE-AES128-SHA1
DHE-AES256-SHA1
NULL-SHA1
And there is nothing on the list of Active Algorithms.
However, "show ssl" on the CLI gives the following:
show ssl Accept connections using TLSv1 and negotiate to TLSv1 Start connections using TLSv1 and negotiate to TLSv1 Enabled cipher order: rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1 Disabled ciphers: des-sha1 rc4-md5 null-sha1 SSL trust-points: OUTSIDE interface: Entrust_trustpoint_duetoexpire
So, I'm confused?
What should I be selecting for the available algorithms in order to bind the new certificate to the interface? Will there be any impact to existing connections? How do I revert to the previous certificate (still has a week left!) if there are any issues? (Can I simply choose to bind the old certificate to the interface again and all will be back as it was while we examine what went wrong?)
Any help would be appreciated!
... View more
Labels:
Created by
mitchen
in Network Security
in Network Security
11-03-2015
04:46 AM
11-03-2015
04:46 AM
Hi,
we have to renew our SSL certificate (for AnyConnect VPN) with Entrust and I'm slightly confused over SHA1/SHA2 so thought I'd clarify on here first!
Our ASA is running version 8.6
Our current SSL certificate from Entrust is SHA1.
Can we renew the SSL certificate from Entrust but this time choose SHA2 for the certificate and simply follow the steps contained in:
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html
i.e.
- Generate new RSA key pair (size 2048bit?)
- Generate Certificate Signing Request (CSR) on ASA
- Use CSR to submit certificat request to Entrust (selecting SHA2 for the certificate from Entrust options)
- Install the new certificate on the ASA
- Bind new certificat to outside interface
And, after following those steps, we should then have our renewed certificate (SHA2 instead of SHA1) in place - and AnyConnect clients will be able to connect without any issue?
Is it as straightforward as that or is there anything I am missing or need to be careful of?
Thanks.
... View more
Labels:
10-08-2015
08:52 AM
Thanks for the response - we have actually debated your suggestion internally a few times and could never really make our mind up over the best solution but I will give you some background to elaborate on our thinking! In actual fact, our VPN hub uses the same ISP as the individual branches and the IP SLA1 target is really the "default gateway" for our ISP from the VPN hub (effectively the same thing as using our own VPN hub though we have it configured not to respond to ICMP so it was simpler just to use the ISP gateway as the target). The main reason we've used an "internet" device for IP SLA2 is that we have had problems with this ISP's internet transit in the past and this always gave us a good indication of when that sort of problem was happening - we are becoming more and more dependent on internet connectivity at the branch sites for various business activities so it was always good to have a "heads up" on any problems in that area. In fact, when we saw the IP SLA2 drop on our monitoring for all those devices this morning we initially thought "oh no! Here we go again, internet issues" but on investigating further, the only apparent problem this time seemed to be the lack of ICMP response from the IP SLA2 target for those affected devices. To confuse things further, all of a sudden, we are now happily seeing ICMP responses from this particular target from the devices that were affected. I contacted the ISP again but they claim not to have taken any action and are still unable to see any sign of a problem. It would just be nice to get an idea of why it might have happened but it looks like it will remain unsolved!
... View more
10-08-2015
06:39 AM
We have a large number of branches with Cisco887VAG routers. They are set-up with 2 x IP SLA monitors, which are tracked such that if both IP SLA's fail then the router will switch from ADSL to it's 3G connection. IP SLA 1 points to a device on our ISP's network and IP SLA 2 points to a device on the Internet (the idea being that if one fails, it may not necessarily indicate an IP connectivity issue - could just be that particular device that is down but if both fail we can be more confident there is a problem with connectivity over ADSL so we should failover to 3G) We also monitor the IP SLA's via our monitoring station (using SNMP) This morning, at exactly the same time, we noticed that IP SLA 2 started failing across a large number of devices (but by no means them all) Sure enough on logging into the routers concerned, we could see that the IP SLA was showing a timeout and attempts to ping the address used by the SLA monitor also timed out. Previously, this sort of thing has been an indication of a problem with our ISP's internet transit - however, on this occasion, everything else seemed fine - apart from ICMP communications with this particular address. We could ping other internet addresses without issues and our sites were not reporting any comms issues. I logged with the ISP but they say they are not blocking any traffic. I tried rebooting a few routers but they could still not get ICMP response from this particular internet address. I've ended up changing the address used by the IP SLA 2 monitor but I'm worried the same thing could happen again and also curious as to what could be "blocking" the ICMP traffic in the first place. I can't see how anything at our end (or on the routers themselves) could be at fault so but, at the same time, the ISP is insistent there are no issues and that they are not interfering with the ICMP traffic. Does anyone have any idea what the cause of such an issue could be? I guess it could be the internet server that we are monitoring (We don't own it so I guess technically/morally we shouldn't be using it!) that has decided to block ICMP from certain of our addresses but I just can't see them doing that (its a publically accessible DNS server which I'm sure you can probably guess where!). Thanks.
... View more
Labels:
06-10-2015
06:26 AM
Well, never really managed to get to the bottom of this but all the sites eventually managed to restore VPN connectivity. For the majority of them, we had left their ADSL cables disconnected for a decent amount of time (some overnight) before reconnecting them and all came back up. I don't know if there was any significance in that at all or if it was just coincidence. But there were a couple that just re-established VPN connectivity without any action at all on our part (not even a reboot of the router) Very puzzling.
... View more
06-09-2015
05:27 AM
Bizarrely, some of the lines (that we had left disconnected overnight) came back up no problem when we reconnected their ADSL cables this morning. However, the others remain down as far as VPN connectivity is concerned but authenticated and working according to our ISP (Struggling to ascertain from the sites what they can and can't do - we are the victims of our own draconian security as we nail them down quite heavily on what they can and can't do themselves so when we can't actually connect to their machines it's difficult to find out what's possible and what's not!) We got one site to switch off their router for 30minutes and then switch it back on again - made no difference. Then got them to switch it off again, in the meantime, I reconfigured another router with their ADSL account details, connected it to one of the ADSL lines in the office and it worked fine? Could establish VPN connectivity without issue? I have to admit I'm baffled.
... View more
02-06-2018
@Rahul Govindan If possible, could you be able to elaborate on your
suggested workaround a little mo...
02-05-2018
Hi Rahul, thanks - that's what i thought. Will have to have a re-think
about how we achieve this the...
10-12-2017
Hi, I've recently started at a new company - as usual, no documentation
etc! Anyway, it seems we hav...
09-28-2016
Pretty much along the same lines as the other thread: - established site
to site IPSEC VPN as a "sho...
11-09-2015
Hi Dinesh, that's great, thanks. That seems to have worked! As a side
topic - how would I actually g...
11-09-2015
Hi, the identity certificate on our ASA5545 (running 8.6 software) is
due to expire soon. I understa...
Created by
mitchen
in Network Security
11-03-2015
11-03-2015
Hi, we have to renew our SSL certificate (for AnyConnect VPN) with
Entrust and I'm slightly confused...
10-08-2015
Thanks for the response - we have actually debated your suggestion
internally a few times and could ...
06-10-2015
Well, never really managed to get to the bottom of this but all the
sites eventually managed to rest...
Public Statistics
| Date Registered | 10-12-2004 03:57 AM |
| Date Last Visited | 05-22-2019 12:07 AM |
| Total Messages Posted | 297 |
| Total Helpful Votes Received | 23 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 5 | |
| 4 | |
| 4 | |
| 4 |
.jpg "VIP Advocate"){kind=icon}
Helpful Votes From
