Documentation This configuration example is meant to be interpreted with the aid of the official documentation from the configuration guide located here: https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.4/05Security/Configuring_the_18.4_Security_Virtual_Image_for_IPS%2F%2FIDS_and_URL_Filtering Prerequisites and disclaimers This deployment guide assumes that the controllers and the edges have been successfully deployed and are operational. For firewall ports that need to be open for device on-boarding please refer this link: https://sdwan-docs.cisco.com/Product_Documentation/Getting_Started/Viptela_Overlay_Network_Bringup/01Bringup_Sequence_of_Events/Firewall_Ports_for_Viptela_Deployments Upload the image for virtual service if you intent to test IPS/IPS and/or URL-F Click Maintenance >> Software Repository then choose the "Virtual Images" tab and upload the App Hosting tar file to the software repository. Security policy does not support CLI device template.  Please attach security policy only to feature device template. ISR platforms need to have minimum 8 GB DRAM and 8 GB of FLASH if IPS/URL-F functions are required.  If configuring DNS/web-layer Security, log into your Umbrella Portal and copy the API token so we can configure the DNS security section on vManage. Under Deployments >> Network Devices >> Choose the API token on the far right corner and copy the long string of numbers to clip board.   This token needs to be populated (pasted from clip board) under the vManage settings like shown below under "Umbrella API Token": Download Software images Release Notes for both 16.10.1 and 18.4: https://sdwan-docs.cisco.com/Product_Documentation/Getting_Started/Release_Notes/010Release_Notes_for_IOS_XE_SD-WAN_Release_16.10_and_SD-WAN_Release_18.4 16.10.1 Software Download Link for ISR 1K/4K and ASR: ISR 1K: https://software.cisco.com/download/home/286321996/type/286321980/release/16.10.1 ISR 4K: https://software.cisco.com/download/home/286321991/type/286321980/release/16.10.1 ASR1K: https://software.cisco.com/download/home/286321999/type/286321980/release/16.10.1 18.4 vManage New Deployment Download Link: https://software.cisco.com/download/home/286320995/type/286321039/release/18.4.0 18.4 vManage upgrade image download Link: https://software.cisco.com/download/home/286320995/type/286321394/release/18.4.0 Configuring Security Template    Click under Configuration >> Security and click "Add Security Policy" and pick one of the features that you like to implement or if you need more than one choose the "custom" option and proceed. Firewall Policy Click on "Add Firewall Policy" choose "Create New" and proceed. Give the policy a name and description as shown below and start creating sequence rule. If you need to configure permission for DIA (Direct Internet Access) for example only allow http, https, dns follow the screen shots for below: To allow http, click add sequence rule, click on the protocol tab and in the search field type http and choose it. Click on the "Actions" tab and choose "Inspect".  This will allow the response traffic to come through automatically. Repeat this for https Instead of adding two sequences for http and https you can combine both in one sequence by choosing the following: Choose "Destination Port" and type "80 443" and then click the protocol tab and type "6" for tcp.   For dns if you choose application protocol, the tool will pick both tcp and udp protocols for port 53. To only pick udp, choose the destination port 53 and then type protocol 17.  Once you get all the rules configured, click on the very top "Apply Zone-Pairs", click "New Zone List" give it a name such as "INSIDE" and specify the VPN "1".    Repeat this for OUTSIDE and VPN 0. This completes the Firewall policy.  Intrusion Prevention Moving on to IPS, click on "Add Intrusion Prevention policy".  Give the policy a name and proceed with choosing a Signature Set, Inspection Mode.  Optionally one could under configure a Signature Whitelist by importing or creating a new file on the local computer and set the "Alerts Log Level".  Once done make sure to apply the policy to all or only selected Target VPNs. URL-Filtering Click "Add URL Filtering Policy" and choose "create new". Give it a policy name and proceed with choosing the categories using the down arrow.   Choose whether to block or allow (with block, all categories are allowed but those blocked and vise versa) Choose the categories from the search option Choose the Web Reputation Under Advanced choose create a new URL list for White or Black List.  Eg. whitelisted URLs bypass all URL filtering policy. Blacklisted URL's are immediately dropped without further processing the URL filtering policy. Under the Block Page Content the "Default Content Header" cannot be changed  (we will hide/remove this from the UI for FCS). Under "Content Body" you can type a message or add the help desk number that the users could call if needed.    Fill the rest of the items and make sure to apply the policy to all or only selected target VPNs. DNS/web-layer Security   Start configuring DNS/web-layer security feature "Add DNS security Policy" and choose "create new" give it a policy name and proceed. Since we have already keyed in the Umbrella Token ID under settings, Umbrella Registration Status shows "green" configured. Now create an optional domain bypass list for DNS requests (for internal company only websites) that do not need to be re-directed to Umbrella.  DNScrypt is enabled by default which will encrypt the DNS packets with the EDNS headers of client IP etc. and be sent to the umbrella cloud.   Make sure to apply the policy to all or only selected target VPNs. Make sure to apply the policy to all or only selected VPNs. Then, go next and review the policy summary page:   Make sure to uncheck the box that says 'Allow Internet Traffic to VPN 0 if VPN 0 is not in a zone'.  Checking this will allow all traffic without being inspected by the firewall. Attach the security policy to the device template Before attaching the security policy to the device template, since the IPS and URL-F features are container based, we need to upload the image for App Hosting. If you haven't done this already, now is the time to do this. Click Maintenance >> Software Repository then choose the "Virtual Images" tab and upload the App Hosting tar file to the repository.   Next, go to the Configuration >> Templates choose the template that is attached to the device then click on the far left ... and choose edit. Now, scroll all the way down choose the security policy that we just configured and also choose the UTD "Factory Default_UTD_Template" if you are deploying IPS or URL-F. Now, attach the device(s) to the template as shown below. This process takes a few minutes (up to 10 minutes) so, please be patient and watch the progress by clicking on the "Tasks". Overall Dashboard Firewall  Toggle between Inspected VS Dropped, click on 1h, 3h, 6h and click at any point on the trend for further drilling down. IPS Toggle between "By Severity" or "By Count" to further drill-down by signature name on the bottom that will show more details about the 5-tuples responsible for triggering the signature. URL-F Toggle between "Blocked" VS "Allowed" and click on certain color band to get more details about the number of sessions processed by all the devices in the enterprise for the particular category. Device Specific Dashboard Click under Monitor >> Network and choose the device in question and choose one feature at a time under "Security Monitoring" Choose all different options and drill downs.  This dashboard has "Umbrella DNS re-direct" as well.   Real Time Data Under the device specific dashboard, you can get some real time stats on the security features. For example if you click under Monitor >> Network >> Choose the device >> Real Time (very bottom on the left pane).      You can type "Policy Zone" and get FW statics real time as shown below:     You can type "UTD" and get IPS statics real time as shown below:   You can type "Umbrella" and get Umbrella (DNS/web-layer security) statics real time outputs as shown below:                 ... View more

Router Upgrade Unable to upgrade image - stuck in rommon System Bootstrap, Version 16.7(3r), RELEASE SOFTWARE Copyright (c) 1994-2017 by cisco Systems, Inc. Current image running: *Upgrade in progress* Boot ROM0 Last reset cause: BootRomUpgrade ISR4331/K9 platform with 16777216 Kbytes of main memory rommon 1 > Upgrade the image to IOS-XE CCO image 16.10.1 which will automatically upgrade the rommon. If upgrading to 16.10.1 IOS-XE SD-WAN image then rommon upgrade has to be done manually. Watch the video here: https://youtu.be/qugfIlEmSEM Template Error Unable to attach template with security [5-Jan-2019 7:34:40 UTC] Configuring device with feature template: Single_Site_Dual_Homed_CSR1000v_Device_Template_Sec_Policy_For_Compliance [5-Jan-2019 7:34:40 UTC] Generating configuration from template [5-Jan-2019 7:34:47 UTC] Checking and creating device in vManage [5-Jan-2019 7:34:53 UTC] Device is online [5-Jan-2019 7:34:53 UTC] Updating device configuration in vManage [5-Jan-2019 7:34:59 UTC] Pushing configuration to device [5-Jan-2019 7:36:27 UTC] Pre config validation failed. Device is not configured to accept new configuration. Error while doing pre config validation of type utd for CSR-6FEA589A-A60F-4445-87A8-1F65F9B5CFC2-100.100.30.1. Error Reason: Failed to get cpu share, memory and disk specs Solution: It appears that the router previously had app-hosting configured and now you are trying to attach a template which would require app-hosting again.  It is not able to get the CPU and memory it needs (‘cos it already is running and has acquired CPU and memory). Use CLI stop and uninstall container using the following commands and make sure there is no service running when you issue "show app-hosting list" SD-WAN-Router#app-hosting stop appid utd SD-WAN-Router#app-hosting uninstall appid utd then attach the template again. Make sure the matching app-hosting image file is loaded to the software repository prior to attaching the template. Unable to attach template While attaching template even before configuring security policies, it fails. Error on line 22: invalid value for: address in /vmanage-cfs:templates/vmanage-cfs:template [vmanage-cfs:template-name='vip_internal_temp_device_CSR-c3d127e1-a15c-4d5d-b687-741670093000'] /vmanage-cfs:vpn/vmanage-cfs:vpn-instance[vmanage-cfs:vpn-id='1']/vmanage-cfs:interface[vmanage-cfs: if-name='GigabitEthernet1']/vmanage-cfs:ip/vmanage-cfs:address: "192.168.30.1" is an invalid value. Looks like the IP address that is configured does not include a mask.  Try configuring IP address with 192.168.30.1/24 and it should work. Controllers Issues  vManage Cert shows error This is not an issue as vManage web cert is always self-signed Linking smart account in vManage results in credential error             Failed to connect to server Issuing "show sdwan cert serial" shows error below: Router#show sdwan certificate serial Failed to connect to server  "Failed to connect to server" message, this is due to the PNP process running, which blocks access to the viptela service running on the ISR.  You can run "pnpa service discovery stop" and then it will let you run the show command. Try the "show crypto pki certificates CISCO_IDEVID_SUDI" command.  Using the SUDI serial number, PID, and serial number add the device to the PNP portal following the guide outlined in the video (https://www.youtube.com/watch?v=qugfIlEmSEM) Export the Provisioning File from Plug and Play connect under Controller Profiles. Control Connections drop with NAT enabled for DIA When NAT is configured on cEdge interface to access internet traffic, the control connections drop after few minutes and configurations rolleback. NAT configurations appear to create NAT translations for control connections as well. ip nat inside source list nat-dia-vpn-hop-access-list interface GigabitEthernet0/0/0 overload ip nat translation tcp-timeout 60 ip nat translation udp-timeout 1 interface GigabitEthernet0/0/0 description Internet Circuit no shutdown arp timeout 1200 ip address dhcp client-id GigabitEthernet0/0/0 ip dhcp client default-router distance 1 ip mtu 1500 ip nat outside mtu 1500 negotiation auto service-policy output shape_GigabitEthernet0/0/0 exit Make sure vManage is at least on 18.3.1 as there is config push issue in previous code with cEdge. Remove NAT and verify if Control connection comes up. If control connection comes up without NAT then push the NAT configurations again. Using the feature template or CLI, make sure that default route to VPN0 under the service VPN is added. If the configuration push is successful and device did not roll back verify all control connections show sdwan control local-properties show sdwan control connections show ip nat translations Device may still show control connection to vManage getting NAT translations and is down. The control connection to vSmart and vBond are up. TCP Dump on ISR shows connection is getting RST from either vManage or Modem in the path. Capture on vManage confirms that vManage is resting the connection The cEdge is selecting a random high number port for the control connection formation to vManage. This, in itself, isn’t necessarily a problem as the connection can still form with vManage using that port for communication. The second, and main problem, is that we confirmed with packet captures on the cEdge that it was NATing the initial SYN towards vManage but the ACK and future packets were not. Since this traffic is sourced by the CPU on the cEdge, it shouldn’t be NATed. Check if there is a NAT ACL that is matching on WAN IP and forcing the translation for even control CPU generated connections. show ip access-list dynamic Solution: The bug involves an issue where control packets may be treated as datapath traffic. Because of that, some of the traffic gets NATed unexpected, which in this case is the TCP SYN when we try to build the control connection. The ACK is properly treated as control and is not NATed and this is the reason we see differences in the source port on the vManage capture before it resets the connection. To workaround this, we need to convert vManage to use DTLS for now. This bug will be fixed in the GA release but wasn’t picked up in time for the EFT build. This needs to be done for all controllers, not just vManage. vBond already uses DTLS. There is no preference. With DTLS udp connections will be torn down quicker than TCP connections on any intermediate NAT box. To change the control connection in CLI go to Security->Control-> Protocl and select DTLS vManage doesn’t show images in the repository This is a known issue where vManage is not able to show the images in repository. This fix is committed for next release. Error when trying to apply the security policy   security policy will not work if the virtual app file is not copied to the software repository and the factory default template is not picked for UTD. This is mandatory step for IPS and UTD features before attaching the template Also verify the VPNs are correctly listed in the CLI policy. If VPN2 is used in the security policy, but that is not defined on the device template, then security policy will fail. Firewall Config push may fail with ZBFW and IPS policy Try to configure the template without preview. May get below error If the ZBFW policy and IPS policy name is the same, the config push may fail. To fix the issue, have unique names. This behavior will be fixed in upcoming releases. Firewall dashboard does not populate data Double check and make sure the firewall is building sessions. Connect to the router via CLI and issue the following command and make sure session are being built and they show up in "SIS_OPEN" state. Raleigh-CSR#sh policy-map type inspect zone-pair sessions   Zone-pair: ZP_INSIDE_OUTSIDE_FIREWALL-TEST   Service-policy inspect : FIREWALL-TEST     Class-map: FIREWALL-TEST-seq-1-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-1-acl_       Inspect         Established Sessions          Session ID 0x0005454C (192.168.10.10:33284)=>(52.11.201.245:443) https SIS_OPEN           Created 00:07:05, Last heard 00:07:05           Bytes sent (initiator:responder) [1164:3826]       Service-policy inspect avc : My-drop-app-list-pm_         Class-map: My-drop-app-list-cm0_ (match-any)             0 packets, 0 bytes           30 second offered rate 0000 bps, drop rate 0000 bps           Match: protocol attribute application-family peer-to-peer             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol attribute application-family webmail             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk-chat             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol youtube             0 packets, 0 bytes             30 second rate 0 bps           Deny         Class-map: class-default (match-any)             4847090 packets, 3040398370 bytes           30 second offered rate 160000 bps, drop rate 0000 bps           Match: any           Allow     Class-map: FIREWALL-TEST-seq-11-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-11-acl_       Pass         15 packets, 1470 bytes     Class-map: FIREWALL-TEST-seq-21-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-21-acl_       Inspect         Established Sessions          Session ID 0x00054724 (192.168.10.10:53865)=>(208.67.222.222:53) dns SIS_OPEN           Created 00:00:09, Last heard 00:00:04           Bytes sent (initiator:responder) [154:0]                  Half-open Sessions          Session ID 0x00054726 (192.168.10.10:35795)=>(208.67.220.220:53) dns SIS_OPENING           Created 00:00:01, Last heard 00:00:01           Bytes sent (initiator:responder) [81:0]     Class-map: FIREWALL-TEST-seq-31-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s31-l4-cm_         Match: protocol https           0 packets, 0 bytes       Inspect     Class-map: FIREWALL-TEST-seq-41-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s41-l4-cm_         Match: protocol http           0 packets, 0 bytes       Inspect     Class-map: class-default (match-any)         Match: any       Drop         672 packets, 60480 bytes IPS How to verify IPS is functioning? Make sure to issue the command "show utd engine standard status" and make sure the engine status is Green. Also make sure that the signature package file name below "29111.8.s" has a ".s" indicating it is subscriber signature set and not have ".c" to indicate community signature set that comes default with the virtual app-hosting image. Raleigh-CSR#sh policy-map type inspect zone-pair sessions   Zone-pair: ZP_INSIDE_OUTSIDE_FIREWALL-TEST   Service-policy inspect : FIREWALL-TEST     Class-map: FIREWALL-TEST-seq-1-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-1-acl_       Inspect         Established Sessions          Session ID 0x0005454C (192.168.10.10:33284)=>(52.11.201.245:443) https SIS_OPEN           Created 00:07:05, Last heard 00:07:05           Bytes sent (initiator:responder) [1164:3826]       Service-policy inspect avc : My-drop-app-list-pm_         Class-map: My-drop-app-list-cm0_ (match-any)             0 packets, 0 bytes           30 second offered rate 0000 bps, drop rate 0000 bps           Match: protocol attribute application-family peer-to-peer             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol attribute application-family webmail             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk-chat             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol youtube             0 packets, 0 bytes             30 second rate 0 bps           Deny         Class-map: class-default (match-any)             4847090 packets, 3040398370 bytes           30 second offered rate 160000 bps, drop rate 0000 bps           Match: any           Allow     Class-map: FIREWALL-TEST-seq-11-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-11-acl_       Pass         15 packets, 1470 bytes     Class-map: FIREWALL-TEST-seq-21-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-21-acl_       Inspect         Established Sessions          Session ID 0x00054724 (192.168.10.10:53865)=>(208.67.222.222:53) dns SIS_OPEN           Created 00:00:09, Last heard 00:00:04           Bytes sent (initiator:responder) [154:0]             Half-open Sessions          Session ID 0x00054726 (192.168.10.10:35795)=>(208.67.220.220:53) dns SIS_OPENING           Created 00:00:01, Last heard 00:00:01           Bytes sent (initiator:responder) [81:0]     Class-map: FIREWALL-TEST-seq-31-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s31-l4-cm_         Match: protocol https           0 packets, 0 bytes       Inspect     Class-map: FIREWALL-TEST-seq-41-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s41-l4-cm_         Match: protocol http           0 packets, 0 bytes       Inspect     Class-map: class-default (match-any)         Match: any       Drop         672 packets, 60480 bytes Dashboard does not populate any data for IPS Both overall dashboard as well as device specific dashboards do not show IPS events even though there is some traffic that would trigger signatures are seen by the router. 1. Make sure subscriber signature set is running.  The default that comes is the free community signature set with only about 600 signaures. Use the IPS signature update (under settings) and provide CEC credentials and get the subscriber signature set.     2. Issue the following command and make sure subscriber signature package has been downloaded. Either by going to Monitor >> Network >> Choose Router >> Intrusion Prevention   OR 3. Via CLI connect to the router and issue the following command and make sure the subscriber signature package has been downloaded. Cary-CSR#sh utd engine standard threat-inspection signature update status Current signature package version: 29111.35.s Current signature package name: UTD-STD-SIGNATURE-29111-35-S.pkg ========> S indicates subscriber sig Previous signature package version: 29111.34.s --------------------------------------- Last update status: Successful --------------------------------------- Last successful update time: Fri Jan 4 03:30:16 2019 UTC Last successful update method: Manual Last successful update server: None Last successful update speed: 3917236 bytes in 20 secs --------------------------------------- Last failed update time: None Last failed update method: None Last failed update server: None Last failed update reason: None --------------------------------------- Last attempted update time: Fri Jan 4 03:30:16 2019 UTC Last attempted update method: Manual Last attempted update server: None --------------------------------------- Total num of updates successful: 5 Num of attempts successful: 5 Num of attempts failed: 0 Total num of attempts: 5 --------------------------------------- Next update scheduled at: None --------------------------------------- Current status: Idle URL-F Error when updating the device template with the Security Policy Confirm virtual image for IPS and URL-F were uploaded On the protocol/destination port, in this case we need to give the protocol number, mainly it will be TCP Or UDP. If no protocol is defined then both TCP & UDP are used. Performance Issues with URL-F and IPS Policy is applied to VPN1 and seeing worst performance when DIA is disabled and sent traffic through DC. case1) With DIA and Url filter and IPS turned ON, everything works normal. case2) When we disable DIA and keeping the URL filter and IPS turned ON, we do see the response is pretty slow. case3) When we disable DIA, URL and IPS all of them turned OFF, everything works as normal and the requests from client behind the router are relatively fast. -  It does take upto 10 mins for the IPS to work normally after applying the policy. This is expected from container perspective, DT team also confirmed this behavior. After 10mins we do see things working normal. DNS/web-layer Security DNS Request not resolving In case we have 2 default routes on underlay and one is not having internet reachability (assume it is MPLS) and DNS resolution doesn't work due to ECMP. Need to implement static routes for RFC1918 subnets pointing to MPLS next-hop and default route to internet next-hop. Umbrella Registration failing   ISR4331-1#sh sdwan umbrella device-registration umbrella-ios-oper-data umbrella-dev-reg-data 1 status UNKNOWN tag vpn1 device-id "" description "Domain lookup failed for 'api.opendns.com',retrying"   Check if DNS is working, ping Google we get the following: ISR4331-1#ping www.google.com % Unrecognized host or address, or protocol not running. The device needs to be configured with a DNS service and domain look-up enabled from vManage. Under the VPN0 template, add DNS Server. Verify the running configurations sh sdwan running-config | | name-server ip name-server 8.8.8.8 We have two interfaces, an INET and MPLS. Traffic utilizing the MPLS next hop is using a source IP of the INET interface and traffic utilizing the INET next hop is using a source IP of the MPLS interface The FIB shows the correct interface mapping, but traffic flows appear to ignore the source IPs. G0/0/0 is INET and gi0/0/1 is MPLS ISR4331-1#sh ip cef Prefix Next Hop Interface 0.0.0.0/0 10.1.5.1 GigabitEthernet0/0/0 10.2.5.1 GigabitEthernet0/0/1 0.0.0.0/8 drop 0.0.0.0/32 receive 10.1.5.0/28 attached GigabitEthernet0/0/0 10.1.5.0/32 receive GigabitEthernet0/0/0 10.1.5.1/32 attached GigabitEthernet0/0/0 10.1.5.3/32 receive GigabitEthernet0/0/0 10.1.5.15/32 receive GigabitEthernet0/0/0 10.2.5.0/28 attached GigabitEthernet0/0/1 10.2.5.0/32 receive GigabitEthernet0/0/1 10.2.5.1/32 attached GigabitEthernet0/0/1 10.2.5.2/32 receive GigabitEthernet0/0/1 10.2.5.15/32 receive GigabitEthernet0/0/1 127.0.0.0/8 drop 192.0.2.0/30 attached VirtualPortGroup1 192.0.2.0/32 receive VirtualPortGroup1 192.0.2.1/32 receive VirtualPortGroup1 192.0.2.2/32 attached VirtualPortGroup1 192.0.2.3/32 receive VirtualPortGroup1 224.0.0.0/4 drop 224.0.0.0/24 receive 240.0.0.0/4 drop 255.255.255.255/32 receive The DNS/Traffic is taking the route of MPLS because of ECMP. Need to implement static routes for RFC1918 subnets pointing to MPLS next-hop and default route to internet next-hop. Verify Umbrella registration now ISR4331-1#sh sdwan umbrella device-registration umbrella-ios-oper-data umbrella-dev-reg-data 1 status UNKNOWN tag vpn1 device-id "" description "Socket connection failed for'api.opendns.com',retrying" Verify DNS is resolving ping opendns.com from the transport VPN Match the Umbrella token from Umbrella and the one that is configured in vManage. Verify that “allow-services all” is configured under the interface facing the internet. Now verify Umbrella registration with “sh umbrella config” - should show the device registered and with a valid org ID. The Security push fails after Umbrella is detached from the policy 11-Oct-2018 21:34:15 UTC] Configuring device with feature template: 4331-Branch-v1-GreatWALL [11-Oct-2018 21:34:15 UTC] Generating configuration from template [11-Oct-2018 21:34:24 UTC] Checking and creating device in vManage [11-Oct-2018 21:34:32 UTC] Device is online [11-Oct-2018 21:34:32 UTC] Updating device configuration in vManage [11-Oct-2018 21:34:44 UTC] Pushing configuration to device [11-Oct-2018 21:34:55 UTC] Failed to process device request. Error response : rpc-reply error: <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="10"> <rpc-error> <error-type>application</error-type> <error-tag>invalid-value</error-tag> <error-severity>error</error-severity> <error-message unknown:lang="en">inconsistent value: Device refused one or more commands</error-message> <error-info> <severity xmlns="http://cisco.com/yang/cisco-ia">error_cli</severity> <detail xmlns="http://cisco.com/yang/cisco-ia"> <bad-cli> <bad-command>utd engine standard multi-tenancy</bad-command> <error-location>0</error-location> <parser-response>%Config update in progress; please wait and retry</parser-response> </bad-cli> <bad-cli> <bad-command> no web-filter block page profile block-GreatWall_URL</bad-command> <error-location>5</error-location> <parser-response/> </bad-cli> </detail> </error-info> </rpc-error> </rpc-reply> Umbrella can be detached by going to Config > Security > go to one of the tabs (say firewall) click the ... and select "detach" Wait for UTD Engine status to turn green and push the policy again monitor -> network -> device -> realtime -> "UTD Engine Status" To fix the issue a) sufficient time was given to avoid error "config update in progress" b) Security Policy was detached from Device template and modified and reattached.           ... View more

Ent. Firewall App Aware 1. Does App Aware FW use OpenAppID or NBAR? ANS: AppFW uses NBAR/SD-AVC for application detection.   2. Will TLS1.3 impact FW and App Aware policies? ANS: TLS1.3 will impact App Aware policy. SD-AVC can help to some extent to identify certain applications.   3. Where/how is logging being handled? ANS: Logging today is through Syslog server and vManage notifcation.   Intrusion Prevention 1. When will vEdge devices have IDS/IPS and URL-F? ANS: They will not.   2. Do you manage the IPS with FMC or how is that IPS managed or is that managed by Cisco? ANS: vManage is used to manage SD-WAN security.    3. Will the ips capability support custom signatures and nested policies? ANS: No custom signature or nested policies for Dec release. We will plan it for future releases.   URL-Filtering 1. Is the url filtering for http and tls or just http? ANS: Since we do not support SSL decryption, for tls (< 1.3) certificates are examined for domain name and filtering is based on domain name.   2. Does it support time-based URL rules? ANS: No.   3. When configuring a URL Filtering Policy, what does "Web Reputation" do exactly? ANS: Each URL has a reputation score associated with it. The reputation score range is from 0-100, and it is categorized as: high-risk (reputation score (0-20), suspicious (0-40), moderate-risk (0-60), low-risk(0-80), and trustworthy(0-100). Based on the reputation score of a URL and the configuration, a URL is either blocked or allowed. If the user defines a reputation threshold, all the URLs, with a reputation score lower than the user-defined threshold will be blocked.   DNS/web-layer Security 1. Are you redirecting the traffic through Umbrella like a proxy or just redirecting the query?  Almost all of my customers do not want to tunnel through traffic through Cisco Umbrella. ANS: Like a proxy, not tunnel.   2. For Umbrella security, once the network device is sending DNS traffic can you apply policies to that site based on the internal subnet? ANS: You need to map them to VPNs and apply DNS/web-layer security to VPNs.   3. Umbrella scrutinizes EVERY dns query? ANS: There is an option to skip certain domains using "Local Domain Bypass"             ... View more

  Documentation OpenDNS Documentation: https://docs.opendns.com/product/hardware/cisco-umbrella-isr4k/ Cisco Documentation: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_utd/configuration/xe-16/sec-data-umbrella-branch-xe-16-book.html Prerequisite and code download links Code Download Link: https://software.cisco.com/download/type.html?mdfid=284389362&catid=null ISR-4K must be running Polaris (16.3) image or above Security K9 license enabled on the router Goal To configure OpenDNS connector on the ISR such that it redirects all the DNS traffic except local domain traffic to the OpenDNS DNS resolvers. Limitations/Restrictions OpenDNS will not have any effect on the following if configured. Meaning traffic will not be filtered based on OpenDNS policies configured on the portal. Loading a page using IP address Using a proxy on the browser Topology How OpenDNS works All DNS traffic is intercepted by the ISR; if it is a local domain query, then the DNS packet will not be changed and forwarded to OpenDNS DNS resolvers, otherwise the ISR will add ENDS records to the query and forward it to OpenDNS cloud. Based on the policies configured on the OpenDNS portal if the HTTP client is trying to browse to a page that is blocked or malicious, then OpenDNS sends their blocked page IP address as DNS response. HTTP client will send HTTP request to OpenDNS cloud IP address and OpenDNS provides the reason for blocking the content in the HTTP response. Step by Step Configuration Upgrade the router image to Polaris (16.3) or higher image   ISR-4321-OpenDNS #copy tftp: flash: Address or name of remote host [10.10.20.2]? Source filename [ isr4300-universalk9.16.03.06.SPA.bin ]? Destination filename [ isr4300-universalk9.16.03.06.SPA.bin ]? Accessing tftp://10.10.20.ftp://10.10.20.2/ isr4300-universalk9.16.03.06.SPA.bin / isr4300-universalk9.16.03.06.SPA.bin .bin Loading isr4300-universalk9.16.03.06.SPA.bin from 10.10.20.2 (via GigabitEthernet0/0/1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 509907627 bytes] 509907627 bytes copied in 414.230 secs (1230977 bytes/sec)   Upgrade rommom Once you upgrade to 16.3 or higher we also need to upgrade the rommon. Pls. follow the steps below. Download the  isr4200_4300_rommon_167_3r_SPA.pkg image from here: Cisco 4321 Integrated Services Router - Cisco and upload it to flash. Then upgrade using the "upgrade" command. ISR-4321-OpenDNS # copy tftp flash: Address or name of remote host []? 10.10.20.2 Source filename []?  isr4200_4300_rommon_167_3r_SPA.pkg Destination filename [ isr4200_4300_rommon_167_3r_SPA.pkg ]? Accessing t ftp://10.10.20.2/ isr4200_4300_rommon_167_3r_SPA.pkg ... Loading isr4200_4300_rommon_167_3r_SPA.pkg from 10.10.20.2 (via GigabitEthernet0/0/1): !!!!!!!!!!! [OK - 2646988 bytes]   CWS-Tunnel-RTR# upgrade rom-monitor filename bootflash: isr4200_4300_rommon_167_3r_SPA.pkg R0 Chassis model ISR4321/K9 has a single rom-monitor. Upgrade rom-monitor Target copying rom-monitor image file selected : 0 Booted : 0 Reset Reason: 0 Info: Upgrading entire flash from the rommon package 4259840+0 records in 4259840+0 records out 262144+0 records in 262144+0 records out 655360+0 records in 655360+0 records out 4194304+0 records in 4194304+0 records out File  is a FIPS ROMMON image FIPS-140-3 Load Test on  has PASSED. Authenticity of the image has been verified. Switching to ROM 1 8192+0 records in 8192+0 records out Upgrade image MD5 signature is b702a0a59a46a20a4924f9b17b8f0887 4259840+0 records in 4259840+0 records out 4194304+0 records in 4194304+0 records out 4194304+0 records in 4194304+0 records out 262144+0 records in 262144+0 records out Upgrade image MD5 signature verification is b702a0a59a46a20a4924f9b17b8f0887 Switching back to ROM 0 ROMMON upgrade complete. To make the new ROMMON permanent, you must restart the RP. Once the upgrade is done reload the router.  Make sure to issue "show platform" and verify the rommon upgrade was successful. The firmware version should show 16.7(3r). Import CA certificate to the trust pool Communication for device registration to the OpenDNS server is via HTTPs. This requires a root certificate to be installed on the router. ISR-4321-OpenDNS(config)#crypto pki trustpool import terminal % Enter PEM-formatted CA certificate. MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83 nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f /ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0 /RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6 Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1 oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl 5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA 8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC 2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0 j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz % End with a blank line or "quit" on a line by itself. quit % PEM files import succeeded. Get the token to register the device Log into the OpenDNS portal https://login.opendns.com/?return_to=https://dashboard2.opendns.com/https://login.opendns.com/?return_to=https://dashboard2.opendns.com/ Then follow the screen shot to get the "Token" or if this is brand new setup generate a fresh "Token".   Configure local domains (optional) DNS queries destined to local domain will remain untouched and will not be redirected to OpenDNS cloud. parameter-map type regex dns_bypass pattern www.cisco.com pattern .*eisg.cisco.* Configure the token Configure the token that you got from the OpenDNS portal and add the optional local domain configured in the above step. ISR-4321-OpenDNS(config)#parameter-map type opendns global ISR-4321-OpenDNS(config-profile)#token 0F322FEC26991C2B562D3C7FF844E0001C70E7 ISR-4321-OpenDNS(config-profile)#local-domain dns_bypass Enable OpenDNS out Enable OpenDNS out on the interface facing the internet ISR-4321-OpenDNS(config-if)#int g0/0/0 ISR-4321-OpenDNS(config-if)#opendns out  ===> command has been changed to "umbrella out" Enable OpenDNS in Enable OpenDNS in on all the interfaces that are interested in redirecting DNS traffic to the OpenDNS cloud.  Each interface should include a "tag" so you can configure policies based on the "tag" on the OpenDNS portal. In this case we have used the "tag" as "inside-network" ISR-4321-OpenDNS(config-if)#int g0/0/1 ISR-4321-OpenDNS(config-if)#opendns in inside-network ===> command has been changed to "umbrella in" Final Relevant Config parameter-map type regex dns_bypass pattern www.cisco.com pattern .*eisg.cisco.* ! parameter-map type opendns global token 0F32C32FEC26991C2B562D3C7FF844E0001C70E7 local-domain dns_bypass ! interface GigabitEthernet0/0/0 ip address dhcp ip nat outside umbrella out  ! interface GigabitEthernet0/0/1 ip address 10.10.20.1 255.255.255.0 ip nat inside umbrella in inside-network Show commands show opendns dnscrypt show opendns config show opendns deviceid Debugs debug opendns device-registration The below debugs clearly indicate there is a problem with the certificate. *Apr  6 02:58:28.938: OPENDNS-DEV-REG:opendns_dev_reg_process_start *Apr  6 02:58:28.938: OPENDNS-DEV-REG:Found channel *Apr  6 02:58:28.938: OPENDNS-DEV-REG:dev reg to be sent for interface :GigabitEthernet0/0/1 status :REQ QUEUED *Apr  6 02:58:28.938: OPENDNS-DEV-REG: Dev reg interface details interface name: GigabitEthernet0/0/1 tag: inside-network, status :1 *Apr  6 02:58:28.938: OPENDNS-DEV-REG:Found channel *Apr  6 02:58:28.940: OPENDNS-DEV-REG:DNS match found for api.opendns.com is 67.215.92.210 *Apr  6 02:58:28.940: OPENDNS-DEV-REG:channel connect : resolved OOB server ip:67.215.92.210 *Apr  6 02:58:28.940: OPENDNS-DEV-REG:channel: IDB name GigabitEthernet0/0/1: *Apr  6 02:58:28.940: OPENDNS-DEV-REG: channel: Connecting to 67.215.92.210(443) from src 0.0.0.0: socket 6: status -1: errno 265 channel status0 *Apr  6 02:58:28.940: OPENDNS-DEV-REG: channel: Error in socket_connect: status -1: sock_fd 6 *Apr  6 02:58:28.940: OPENDNS-DEV-REG:Cleaning up the channel *Apr  6 02:58:28.940: OPENDNS-DEV-REG: Could not connect device reg channel *Apr  6 02:58:28.940: OPENDNS-DEV-REG:cleanup and reconnect *Apr  6 02:58:28.940: OPENDNS-DEV-REG:Cleaning up the channel Please import the certificate and make sure the cert the is still there. If not import it to trustpool again. ISR-4321-OpenDNS#sh cry pki trustpool ISR-4321-OpenDNS#sh cry pki trustpool CA Certificate   Status: Available   Certificate Serial Number (hex): 01FDA3EB6ECA75C888438B724BCFBC91   Certificate Usage: Signature   Issuer:     cn=DigiCert Global Root CA     ou=www.digicert.com     o=DigiCert Inc     c=US   Subject:     cn=DigiCert SHA2 Secure Server CA     o=DigiCert Inc     c=US   CRL Distribution Points:     http://crl3.digicert.com/DigiCertGlobalRootCA.crl     http://crl4.digicert.com/DigiCertGlobalRootCA.crl   Validity Date:     start date: 12:00:00 UTC Mar 8 2013     end   date: 12:00:00 UTC Mar 8 2023   Associated Trustpoints: Trustpool   Trustpool: Downloaded debug opendns config debug opendns split-dns Troubleshooting https://community.cisco.com/t5/security-documents/cisco-umbrella-opendns-troubleshooting/ta-p/3165759 ... View more

Configuration https://community.cisco.com/t5/security-documents/snort-ips-on-isr-isrv-and-csr-step-by-step-configuration/ta-p/3369186 Troubleshooting Unable to get signature update from cisco.com  1. Make sure the router can get name resolution. Configure the router with a proper DNS name server. ISR4451#utd threat-inspection signature update server cisco username xxxxx password yyyyy % This operation may cause the UTD service to restart which will briefly interrupt services. Proceed with signature update? [confirm] ISR4451#show utd engine standard threat-inspection signature update status Current signature package version: 29.0.c Current signature package name: default Previous signature package version: None --------------------------------------- Last update status: Failed --------------------------------------- Last successful update time: None Last successful update method: None Last successful update server: None Last successful update speed: None --------------------------------------- Last failed update time: Wed Feb 14 09:01:16 2018 PST Last failed update method: Manual Last failed update server: cisco Last failed update reason: ('Connection aborted.', gaierror(-2, 'Name or service not known')) --------------------------------------- Last attempted update time: Wed Feb 14 09:01:16 2018 PST Last attempted update method: Manual Last attempted update server: cisco --------------------------------------- Total num of updates successful: 0 Num of attempts successful: 0 Num of attempts failed: 1 Total num of attempts: 1 --------------------------------------- Next update scheduled at: None --------------------------------------- Current status: Idle The error highlighted in red above usually means DNS is failing to resolve cloudsso2.cisco.com sourced from the VirtualPortGroup0 interface. Once a proper DNS name server and the router is able to resolve cloudsso2.cisco.com to 173.37.144.211 source from virtual portgroup 0 interface, make sure to issue the following command to make sure the router can establish an https connection with the IP address   ISR4451#telnet 173.37.144.211 443 /source-interface virt0    Trying 173.37.144.211, 443 ... Open Once this step is done signature update should happen without any problem as shown below: ISR4451#show utd engine standard threat-inspection signature update status Current signature package version: 2983.44.s Current signature package name: UTD-STD-SIGNATURE-2983-44-S.pkg Previous signature package version: 29.0.c --------------------------------------- Last update status: Successful --------------------------------------- Last successful update time: Wed Feb 14 09:38:32 2018 PST Last successful update method: Manual Last successful update server: cisco Last successful update speed: 3212512 bytes in 19 secs --------------------------------------- Last failed update time: Wed Feb 14 09:01:16 2018 PST Last failed update method: Manual Last failed update server: cisco Last failed update reason: ('Connection aborted.', gaierror(-2, 'Name or service not known')) --------------------------------------- Last attempted update time: Wed Feb 14 09:38:32 2018 PST Last attempted update method: Manual Last attempted update server: cisco --------------------------------------- Total num of updates successful: 1 Num of attempts successful: 1 Num of attempts failed: 1 Total num of attempts: 2 --------------------------------------- Next update scheduled at: None --------------------------------------- Current status: Idle Unable to view the virtual service Check memory available ISR4451#show virtual-service  ^ % Invalid input detected at '^' marker. Check memory available ISR4451#virtual-service install name myips package flash:iosxe-utd.16.07.01.1.0.1_ SV2983_XE_16_7.ova  ISR4451#show log  Feb 9 18:54:45.096 PST: %VMAN-2-VIRT_INST_DISK: R0/0: vman: Virtual Service[UTD]: :Disk reservation::Failed to reserve disk storage for virtual service::Disk storage request (3210 MB) exceeds remaining disk space (3090 MB) on storage media UTD_HEALTH_CHANGE: Service node changed state Down => Red (1) Feb 22 12:00:49.283: %IOSXE-1-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:000 TS:00000000761565218623 %UTD-1-UTD_HEALTH_CHANGE: Service node changed state Down => Red (1) Feb 22 12:01:10.871: %IOSXE_UTD-4-MT_CONTAINER_MESSAGE_TIMEOUT: UTD message sent to the container has timed out Feb 22 12:01:42.871: %IOSXE_UTD-4-MT_CONTAINER_MESSAGE_TIMEOUT: UTD message sent to the container has timed out Snort black holes traffic Packets go to the container but nothing comes back: Encaps shows huge count but decaps shows nothing coming back out to the data plane. CSR#show platform hardware qfp active feature utd stats . . Diversion Statistics: Redirect 137023 Encaps 137023 Decaps 6 Reinject 6 Check the configuration for misconfiguration. Problem is because the container side IP address is a broadcast IP address. interface VirtualPortGroup0 ip address 172.30.50.121 255.255.255.252 ip nat inside zone-member security zone-Inside ! interface VirtualPortGroup1 ip address 192.0.2.2 255.255.255.252 ! utd engine standard logging syslog threat-inspection threat detection policy connectivity logging level debug utd engine standard all-interfaces ! virtual-service utd vnic gateway VirtualPortGroup0 guest ip address 172.30.50.122 vnic gateway VirtualPortGroup1 guest ip address 192.0.2.3 =======> misconfigured with bcast address activate Refer to this defect: CSCvi11665 When does engine status show as yellow? There is hysteresis in the checking algorithm. When the memory usage is going up, it won't become yellow until crossing 95%. When the usage is going down, the health won't come back to green until crossing 90%.     ... View more