I'd like to use ASA WCCP to redirect to a couple of Cisco WSA appliances for redundancy. I want to have a dedicated Primary WSA appliance which will service all WCCP requests and a Backup WSA appliance only to be used If the Primary fails.   I have both WSA in the same service group. WCCP requests are randomly being load balanced across both WSA's. I have tried manipulating the WCCP weights on the WSA's and traffic still load balances.   I also tried a separate service group for each WSA and the traffic is still being load balanced.   Is it possible to redirect all WCCP packets to a Primary WSA and only use the backup in the event of a primary WSA failure.   Any thoughts appreciated.   Ian ... View more

My WSA appliances can service http/https traffic when configured in explicit forward mode (no WSA https proxy enabled). However I am unable to get Transparent mode https redirection to work unless I enable https proxy mode on the WSA.   An ASA is doing the WCCP redirection for http/https traffic. It appears that http redirection works as expected.   Could somebody explain why http/https work in explicit proxy mode without https proxy enabled on the WSA and is there a way to get https rwccp redirection to work in Transparent mode without https proxy enabled.   thanks   Ian ... View more

Good afternoon,   Im am in the process of installing a new Cisco WSA S690 appliance. I notice that the System status Led is flashing amber. I can find no documentation on how to troubleshoot this issue on CCO. Any assistance would be appreciated.  AsyncOS Version 11.5.1.125. I notice that there is no CIMC Port either.   thanks   Ian   ... View more

Hi community, I have configured transit routing between 2 L3Outs in the same Tenant/VRF. Routing between L3Outs is working, however I have no contracts configured between the L3Outs and believe that this shouldn't work in this way. ACI Ver deployed is 2.2.3(f). Any Cisco documentation I have looked at always show a provide/consume contract configured between the L3Outs.   I would appreciate if anybody has had a similar issue or can advise on what may be wrong with the configuration providing that contracts are required? thanks   Ian         ... View more

Hi Community,   I have a situation where I can no longer Login to the OOB Management Interface via SSH on both FTD 2120 devices which are part of an HA pair.   The FTD HA pair is in production on Ver 6.2.2.2-109 and managed by FMC.   They have been accessible previously via SSH, however although not 100% sure I believe that since Upgrading to 6.2.2.2-109 I can no longer Login via SSH to the admin account. Access is denied to this account. Has anybody come across this issue before and are there any recommendations to resolve the access problem without any loss of service.   thanks   Ian ... View more

Hi,   I have created a malware file policy to block malware for PDF & Executables. When I attach the malware file policy to my Access Control Policy acl I receive a warning " Configured Ports will prevent the file policy from being triggered" The acl has a destination port of UDP-6064.   I have no issues when applying the malware policy to acls with destination TCP ports.   Any help would be appreciated.   thanks   Ian     ... View more

HI all,   I have noticed that I have many drops in Firesight Management Centre connection table. The drops are between my Internal DNS and ISP's dns servers. They are documented as "Malware-Other dns request with long hostname segment - possible data exfiltration attempt" Periodically i have DNS issues where internal clients web browsing is slow of fails altogether. Im unsure whether the browing issues are related to the connection table drops. Any thoughts would be appreciated.   thanks   Ian ... View more

Hi, I have an EPG configured in a User Tenant with a requirement to access a DHCP server located Externally over a L3Out. The EPG and L3Out are both in the same Tenant-VRF. I have created a DHCP Relay Provider within the User Tenant with the EPG type set as L3 External Network. The relevant BD in the User Tenant has been configured to Consume the DHCP Relay Provider. Hosts within the EPG are unable to obtain DHCP allocated IP addresses. Hosts within the EPG are able to Ping the DHCP server. ACI Firmware Ver 2.2.2f. Any advice would be appreciated. thanks Ian ... View more

Good afternoon, Are there any issues configuring ACI to use SNMP V3. The SNMP management station can poll the ACI APIC's when configured to use V2. However the APIC's do not respond to management polls when configured to use SNMP V2. Any help appreciated. Ian ... View more