Hello, I have a customer who has multple AD forests and an ISE deployment running 1.1.3. The customer scenario is as follows - there is an Internal AD forest (internal users) and an External AD forest (external users such as consultants). The objective is to use Cisco ISE to authenticate and authorize the users in both AD forests. CIsco ISE is connected to the Internal AD forest. We know that multiple AD support is coming in 2014 with versioon 1.3 - other options such as LDAP/EAP-TLS are not a viable option for the customer. 1.       Currently  – the Internal AD forest has an External, Non-transitive – one-way trust with the External Forest      a.       The objective here is to use a feature called Selective Authentication  in order to filter the outgoing requests from the External Forest to the Internal Forest – this is a selective trust feature that can be used to control access to specific resources in Internal Forest and for authentication between Internal/External Forest via Cisco ISE      b.      Preliminary testing has shown that a one way trust seems to work for Cisco ISE authentication/authorization      c.       Further testing is underway to test the Selective Authentication feature (ie restrict access to specific resources etc…) Question : has any one used this and is this a supported method by Cisco (I know they mention a mutual trust relationship is required)?      2.       We are exploring a second scenario - the Internal AD forest will have an External, Non-transitive – two-way trust with the External Forest      a.       Same objectives as in  1 – we would attempt to use the Selective Authentication in the following fashion (this is an example)           i.      External Forest has outgoing filter to allow access to specific resources in Internal Forest, and for authentication           ii.      Internal Forest has incoming filter to deny access to all resources in External Forest In this case we would filter so it resembles a 1 way trust relationship - anyone try this, anyone know if this would be a supported method by Cisco? Thanks in advance for your replies. Robert C. ... View more

Hello, I am running a Cisoc IPS (part of the 5525-X) and have two questions for anyone who can help : 1 - I am running into a lot of signature 31939 Samba Session Setup AndX Security Blob Length Denial Of Service messages - I am not familiar with this signature - anyone have any experience with it   - any countermeasures that I should look into;   - how can I tune this signature - too many are being triggered over the period of a day   - could this be a false positive - it is not only from 1 source 2 - performance related question - I often see the inspection load climb to 75% and above for sustained periods of time - any when I look at the firewall side I think I might be sending 200 Mbps - what is the performance of the IPS - performance limits - would there be any tuning to aid in the perfomance of the unit Thank-you, Robert Cianci ... View more

Hi, I am running an environment with FWSM modules (version 4.1.5) and ASDM version 6.2(2)F. I notice that the hit counters are not accurate when looking at ASDM. The rule I am looking at has  "default" logging enabled - I see not hits on the rule but I know that packets are going through. When I change the logging level to say "emergency" I see the hit come through. I see this behavoir for tcp and udp rule types. I read in a different post that only tcp first time connections are recorded in the hits - subsequent packets are not in the hits counters. Also I read that ASDM has csome limitations when it makes requests to the FWSM via HTTPS. Does anyone have additional information or  point me to some documentation .... Thanks in advance, Bob ... View more