Goal To provide a solution to quickly setup a pop-up site that supports WiFi and provides instant internet access using LTE as a transport. Supported Platforms ISR 1K series routers with LTE and WiFi capability. Supported Router Models and Required Licenses   PID License Requirements Image Required C1121X-8PLTEPWY*​ with P-LTEAP18-GL** SL-1K-8P-SEC-SV, FL-1K-8P-HSEC-SV, FL-VPERF-8P200-SV 16.12 C1109-4PLTE2PW***​ with 2x P-LTEA​ SL-1100-4P-SEC, FL-VPERF-4P-100 16.12 C1117-4PW​ FL-1100-4P-HSEC, SL-1100-4P-SEC 17.4 (Nov) C1111-4PW FL-1100-4P-HSEC, SL-1100-4P-SEC 17.4 (Nov) C1111-8PW​ SL-1100-8P-SEC, FL-1100-8P-HSEC 17.4 (Nov) * Wi-Fi domain WY; Y = A, E, B, Z ** P-LTEAP18-GL available Europe & US only. For global CAT6 LTE options please visit ISR1K Datasheet​ *** Wi-Fi domain W* = A, B, D, E, Q, R, Z  Documentation ISR 1K datasheet: https://www.cisco.com/c/en/us/products/collateral/routers/1000-series-integrated-services-routers-isr/datasheet-c78-739512.html ISR LTE configuration guide: https://www.cisco.com/c/en/us/td/docs/routers/access/interfaces/NIM/software/configuration/guide/4GLTENIM_SW.html ISR ME configuration guide: https://www.cisco.com/c/en/us/td/docs/routers/access/1100/software/configuration/xe-16-6/cisco_1100_series_swcfg_xe_16_6_x/cisco_1100_series_swcfg_chapter_01010.html Prerequisites ISR using CAT18 LTE PIM must be running IOS-XE version 16.12.1 or above. ISR using built in LTE must be running IOS-XE version 16.6.1 or above   ISR -  https://software.cisco.com/download/home/286315006/type/282046477/release CAT18 LTE PIM -  https://software.cisco.com/download/home/286288566   Usecases Use Case #1 For small office, small retail stores, pop-up offices where workers need to quickly establish connectivity to the internet and at the same time connect back to their data center to gather/store information, these light-weight, desktop routers are easy to setup and capable of providing instant connectivity over LTE.        Use Case #2 In this scenario, a user can directly access the internet using a wireless device (ex. smartphone, tablet, laptop, etc.) or a wired computer via the cellular interface of the ISR1K router     Step-By-Step Configuration Guides SIM Installation and Verification Insert the SIM card in slot 0 of CAT18 LTE PIM or directly into the integrated SIM slot on the C1111/1109 routers.  To verify correct functionality of SIM, run the following show cellular commands: Router#show cellular 0/2/0 hardware //check for Carrier information Modem Firmware Version = 32.00.114 Host Firmware Version = 32.00.004_2 Device Model ID = LM960A18 International Mobile Subscriber Identity (IMSI) = 310260154954279 International Mobile Equipment Identity (IMEI) = 358347100003170 Integrated Circuit Card ID (ICCID) = 8901260151749542798 Mobile Subscriber Integrated Services Digital Network-Number (MSISDN) = 18574157134 Modem Status = Modem Online Current Modem Temperature = 30 deg C PRI version = 1023, Carrier = Generic OEM PRI version = 32101006 Check signal strength (RSSI) and Radio Access Technology (RAT). The RSSI is based on various factors (i.e., range from cellular tower, usage density in location, etc.) and can range from -30dBm (Excellent quality) to -90dBm (Unusable). Check to see if the RAT matches the data plan purchased from your cellular carrier. Router#show cellular 0/2/0 radio Radio power mode = Online LTE Rx Channel Number(PCC) = 926 LTE Tx Channel Number(PCC) = 18926 LTE Band = 66 LTE Bandwidth = 5 MHz Current RSSI = -82 dBm Current RSRP = -112 dBm Current RSRQ = -16 dB Current SNR = -1.5 dB Physical Cell Id = 55 Number of nearby cells = 2 Idx PCI (Physical Cell Id) -------------------------------- 1 55 2 57 Radio Access Technology(RAT) Preference = AUTO Radio Access Technology(RAT) Selected = LTE   Site-to-Site VPN  (with routable public IP) PSK Tunnel Configuration The procedure in this section describes how to use a pre-shared key (PSK) in order to configure the tunnels in this network environment. Left-Router 1. Configure the Internet Key Exchange version 2 (IKEv2) keyring: crypto ikev2 keyring mykeys peer Right-Router address 172.36.1.1 pre-shared-key Cisco123 2. Configure IKEv2 proposal and policy crypto ikev2 proposal S2S_Proposal encryption aes-cbc-256 integrity sha256 group 15 crypto ikev2 policy S2S-Policy proposal S2S_Proposal 3.Reconfigure the IKEv2 profile in order to: match on the IKE ID set the authentication methods for local and remote reference the keyring listed in the previous step crypto ikev2 profile S2S_IKEv2_PROFILE match identity remote address 172.36.1.1 255.255.255.255 authentication remote pre-share authentication local pre-share keyring local mykeys dpd 60 2 on-demand 4. Configure IPsec Transform Set crypto ipsec transform-set S2S_Set esp-aes 256 esp-sha256-hmac mode tunnel 5. Reconfigure the IPsec profile in order to reference the default IKEv2 profile: crypto ipsec profile S2S_IPSEC_Profile set transform-set S2S_Set set ikev2-profile S2S_IKEv2_PROFILE ! interface Tunnel0 ip address 10.1.1.1 255.255.255.0 tunnel source <cellular slot/sub-slot/port> tunnel destination 172.36.1.1 tunnel protection ipsec profile S2S_IPSEC_Profile ! 6.   Configure the LAN and WAN interfaces: interface <cellular slot/sub-slot/port> description WAN ip address dhcp ip nat outside ! interface GigabitEthernet0/0/0 description LAN ip address 192.168.1.1 255.255.255.0 ip nat inside vlan 2 name Wireless ! interface Wlan-GigabitEthernet0/1/8 description AP switchport mode access switchport access vlan 2 no shut ! interface Vlan 2 description Wireless ip address 192.168.2.1 255.255.255.0 ip nat inside ! ip route 172.16.0.0 255.240.0.0 10.1.1.2 name DC_Subnets ip route 0.0.0.0 0.0.0.0 <cellular slot/sub-slot/port> dhcp ip access-list extended NAT deny ip 192.168.1.0 0.0.0.255 172.16.0.0 0.15.255.255 deny ip 192.168.2.0 0.0.0.255 172.16.0.0 0.15.255.255 permit ip any any ip nat inside source list NAT interface GigabitEthernet0/0/2 overload Right-Router Repeat the steps from the Left-Router configuration, but with these necessary changes: crypto ikev2 keyring mykeys peer Left-Router address 172.33.1.1 pre-shared-key Cisco123 ! crypto ikev2 proposal S2S_Proposal encryption aes-cbc-256 integrity sha256 group 15 crypto ikev2 policy S2S-Policy proposal S2S_Proposal ! crypto ikev2 profile S2S_IKEv2_PROFILE match identity remote address 172.33.1.1 255.255.255.255 authentication remote pre-share authentication local pre-share keyring local mykeys dpd 60 2 on-demand ! interface Tunnel0 ip address 10.1.1.1 255.255.255.0 tunnel source GigabitEthernet0/0/0 tunnel destination 172.33.1.1 tunnel protection ipsec profile S2S_IPSEC_Profile ! interface GigabitEthernet0/0/0 description WAN ip address 172.36.1.1 255.255.255.252 ! interface GigabitEthernet0/0/1 description LAN ip address 172.16.0.1 255.240.0.0 ! ip route 0.0.0.0 0.0.0.0 172.33.1.2 name route_to_internet ip route 192.168.1.0 255.255.255.0 10.1.1.1 name branch_wired_subnet ip route 192.168.2.0 255.255.255.0 10.1.1.1 name branch_wireless_subnet Verification Enter the following command on the Left-Router to verify connections Router#show crypto ikev2 sa IPv4 Crypto IKEv2 SA Tunnel-id Local Remote fvrf/ivrf Status 1 172.33.1.1/500 172.36.1.1/500 none/none READY Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:15, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/10830 sec IPv6 Crypto IKEv2 SA Router#show crypto ipsec sa interface: Tunnel0 Crypto map tag: Tunnel0-head-0, local addr 172.33.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (172.33.1.1/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (172.36.1.1/255.255.255.255/47/0) current_peer 172.36.1.1 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15 #pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15#pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 172.33.1.1, remote crypto endpt.: 172.36.1.1 plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0.10 current outbound spi: 0xAAC9EE2A(2865360426) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x6F946636(1871996470) transform: esp-256-aes esp-sha256-hmac , in use settings ={Tunnel, } conn id: 2051, flow_id: ESG:51, sibling_flags FFFFFFFF80000048, crypto map: Tunnel0-head-0 sa timing: remaining key lifetime (k/sec): (4608000/2485) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xAAC9EE2A(2865360426) transform: esp-256-aes esp-sha256-hmac , in use settings ={Tunnel, } conn id: 2052, flow_id: ESG:52, sibling_flags FFFFFFFF80000048, crypto map: Tunnel0-head-0 sa timing: remaining key lifetime (k/sec): (4608000/2485) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas: Dynamic Multipoint VPN  (with private IP from Service Provider)   Example Hub 1 Configuration for DMVPN In the following example, which configures the hub router for multipoint GRE and IPsec integration, no explicit configuration lines are needed for each spoke; that is, the hub is configured with a global IPsec policy template that all spoke routers can talk to. In this example, EIGRP is configured to run over the private physical interface and the tunnel interface. 1.  Configure IKE Policy crypto isakmp policy 1 encryption aes 256 authentication pre-share group 15 crypto isakmp key cisco47 address 0.0.0.0 2. Configure IPsec Transform Set crypto ipsec transform-set trans2 esp-aes 256 esp-sha256-hmac mode transport 3.  Configure an IPsec Profile crypto ipsec profile vpnprof set transform-set trans2 ! 4.  Configure the Tunnel Interface for DMVPN interface Tunnel0 bandwidth 1000 ip address 10.1.1.2 255.255.255.0 ip mtu 1400 ip nhrp authentication donttell ip nhrp map multicast dynamic ip nhrp network-id 99 ip nhrp holdtime 300 no ip split-horizon eigrp 1 no ip next-hop-self eigrp 1 ip tcp adjust-mss 1360 delay 1000 tunnel source Gigabitethernet0/0/0 tunnel mode gre multipoint tunnel key 100000 tunnel protection ipsec profile vpnprof 5. Configure the Physical Interfaces interface Gigabitethernet0/0/0 ip address 172.36.1.1 255.255.255.0 ! interface Gigabitethernet0/0/1 ip address 172.16.0.1 255.240.0.0 ! 6. Configure the Dynamic Protocol router eigrp 1 network 172.16.0.0 0.15.255.255 network 10.1.1.0 0.0.0.255 For information about defining and configuring ISAKMP profiles, see the “ Certificate to ISAKMP Profile Mapping ” module in the Cisco IOS XE Security Configuration Guide: Secure Connectivity . Example Hub 2 Configuration for DMVPN Repeat the steps from Hub1 configuration, but with these necessary changes:   crypto isakmp policy 1 encryption aes 256 authentication pre-share group 15 crypto isakmp key cisco47 address 0.0.0.0 ! crypto ipsec transform-set trans2 esp-aes 256 esp-sha256-hmac mode transport ! crypto ipsec profile vpnprof set transform-set trans2 ! interface Tunnel1 bandwidth 1000 ip address 10.1.2.2 255.255.255.0 ip mtu 1400 ip nhrp authentication donttell ip nhrp map multicast dynamic ip nhrp network-id 100 ip nhrp holdtime 300 no ip split-horizon eigrp 1 no ip next-hop-self eigrp 1 ip tcp adjust-mss 1360 delay 1000 tunnel source Gigabitethernet0/0/0 tunnel mode gre multipoint tunnel key 100001 tunnel protection ipsec profile vpnprof ! interface Gigabitethernet0/0/0 ip address 172.37.1.1 255.255.255.0 ! interface Gigabitethernet0/0/1 ip address 172.16.0.2 255.240.0.0 ! router eigrp 1 network 172.16.0.0 0.15.255.255 network 10.1.2.0 0.0.0.255 Example Spoke Configuration for DMVPN In the following example, all spokes are configured the same except for tunnel and local interface address, thereby reducing necessary configurations for the user: crypto isakmp policy 1 encryption aes 256 authentication pre-share group 15 crypto isakmp key cisco47 address 0.0.0.0 ! crypto ipsec transform-set trans2 esp-aes 256 esp-sha256-hmac mode transport ! crypto ipsec profile vpnprof set transform-set trans2 ! crypto ipsec profile vpnprof1 set transform-set trans2 ! interface Tunnel0 bandwidth 1000 ip address 10.1.1.1 255.255.255.0 ip mtu 1400 ip nhrp authentication donttell ip nhrp map 10.1.1.2 172.36.1.1 ip nhrp map multicast 172.36.1.1 ip nhrp network-id 99 ip nhrp holdtime 300 ip nhrp nhs 10.1.1.2 ip tcp adjust-mss 1360 delay 1000 tunnel source <Cellular Slot/sub-slot/port> tunnel mode gre multipoint tunnel key 100000 tunnel protection ipsec profile vpnprof ! interface Tunnel1 bandwidth 1000 ip address 10.1.2.1 255.255.255.0 ip mtu 1400 ip nhrp authentication donttell ip nhrp map 10.1.2.2 172.37.1.1 ip nhrp map multicast 172.37.1.1 ip nhrp network-id 100 ip nhrp holdtime 300 ip nhrp nhs 10.1.2.2 ip tcp adjust-mss 1360 delay 1000 tunnel source <Cellular Slot/sub-slot/port> tunnel mode gre multipoint tunnel key 100001 tunnel protection ipsec profile vpnprof1 ! router eigrp 1 network 192.168.1.0 0.0.0.255 network 192.168.2.0 0.0.0.255 network 10.1.1.0 0.0.0.255 network 10.1.2.0 0.0.0.255 Configure the physical interfaces to perform Network Address Translation in order to access the internet  interface <Cellular Slot/sub-slot/port> description WAN ip address dhcp hostname Spoke1 ip nat outside ! interface GigabitEthernet0/0/1 description Wired LAN ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface vlan 2 description Wireless LAN ip address 192.168.2.1 255.255.255.0 ip nat inside ! interface Wlan-GigabitEthernet0/1/8 switchport access vlan 2 switchport mode access ! ip access-list extended NAT deny ip 192.168.1.0 0.0.0.255 172.16.0.0 0.15.255.255 deny ip 192.168.2.0 0.0.0.255 172.16.0.0 0.15.255.255 permit ip any any ip nat inside source list NAT interface GigabitEthernet0/0/2 overload ! Verification Enter the following command on the Spoke to verify connections Router#show ip eigrp neighbors EIGRP-IPv4 Neighbors for AS(1) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 1 10.1.2.2 Tu1 14 00:29:36 1 132 0 34 0 10.1.1.2 Tu0 13 00:29:45 1 1398 0 77 Router#show ip route eigrp | include D D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA o - ODR, P - periodic downloaded static route, l - LISP D 172.17.0.0 [90/25984000] via 10.1.1.2, 00:01:58, Tunnel0 D 172.18.0.0 [90/2944000] via 10.1.2.2, 00:31:28, Tunnel1 Router#ping 172.17.0.1 source 192.168.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.17.0.1, timeout is 2 seconds: Packet sent with a source address of 192.168.1.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms Router#ping 172.17.0.1 source 192.168.2.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.17.0.1, timeout is 2 seconds: Packet sent with a source address of 192.168.2.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms Router#ping 172.18.0.1 source 192.168.2.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.18.0.1, timeout is 2 seconds: Packet sent with a source address of 192.168.2.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms Router#ping 172.18.0.1 source 192.168.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.18.0.1, timeout is 2 seconds: Packet sent with a source address of 192.168.1.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms Router#show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 172.36.1.1 172.33.1.1 QM_IDLE 1071 ACTIVE 172.37.1.1 172.33.1.1 QM_IDLE 1068 ACTIVE Router#show crypto sa interface: Tunnel0 Crypto map tag: Tunnel0-head-0, local addr 172.33.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (172.33.1.1/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (172.37.1.1/255.255.255.255/47/0) current_peer 172.37.1.1 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 1036, #pkts encrypt: 1036, #pkts digest: 1036 #pkts decaps: 1053, #pkts decrypt: 1053, #pkts verify: 1053 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 172.33.1.1, remote crypto endpt.: 172.37.1.1 plaintext mtu 1458, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0.10 current outbound spi: 0x7895BF85(2023079813) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x32F70777(855050103) transform: esp-256-aes esp-sha256-hmac , in use settings ={Transport, } conn id: 2053, flow_id: ESG:53, sibling_flags FFFFFFFF80004008, crypto map: Tunnel1000-head-0 sa timing: remaining key lifetime (k/sec): (4607964/2449) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x7895BF85(2023079813) transform: esp-256-aes esp-sha256-hmac , in use settings ={Transport, } conn id: 2054, flow_id: ESG:54, sibling_flags FFFFFFFF80004008, crypto map: Tunnel1000-head-0 sa timing: remaining key lifetime (k/sec): (4607979/2449) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: outbound pcp sas: interface: Tunnel1 Crypto map tag: Tunnel1-head-0, local addr 172.33.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (172.33.1.1/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (172.36.1.1/255.255.255.255/47/0) current_peer 172.36.1.1 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 552, #pkts encrypt: 552, #pkts digest: 552 #pkts decaps: 557, #pkts decrypt: 557, #pkts verify: 557 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 172.33.1.1, remote crypto endpt.: 172.36.1.1 plaintext mtu 1458, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0.10 current outbound spi: 0x75D7D3A2(1977078690) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x881AC24(142715940) transform: esp-256-aes esp-sha256-hmac , in use settings ={Transport, } conn id: 2049, flow_id: ESG:49, sibling_flags FFFFFFFF80004008, crypto map: Tunnel1001-head-0 sa timing: remaining key lifetime (k/sec): (4607932/1270) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x75D7D3A2(1977078690) transform: esp-256-aes esp-sha256-hmac , in use settings ={Transport, } conn id: 2050, flow_id: ESG:50, sibling_flags FFFFFFFF80004008, crypto map: Tunnel1001-head-0 sa timing: remaining key lifetime (k/sec): (4607961/1270) IV size: 16 bytes replay detection support: Y Status: ACTIVE(ACTIVE) outbound ah sas: WiFi Configuration Identify the Wireless AP slot on the router, by using a show platform command  Router#sh platform Chassis type: C1121X-8PLTEPWB Slot Type State Insert time (ago) --------- ------------------- --------------------- ----------------- 0 C1121X-8PLTEPWB ok 00:27:23 0/0 C1121X-2x1GE ok 00:25:01 0/1 C1121X-ES-8 ok 00:25:01 0/2 P-LTEAP18-GL ok 00:25:01 0/3 ISR-AP1101AC-B ok 00:25:01 R0 C1121X-8PLTEPWB ok, active 00:27:23 F0 C1121X-8PLTEPWB ok, active 00:27:23 P0 PWR-12V ok 00:26:48 Slot CPLD Version Firmware Version --------- ------------------- --------------------------------------- 0 18103101 16.12(1r) R0 18103101 16.12(1r) F0 18103101 16.12(1r) Open a session to your module using the  hw-module session  command in privileged EXEC mode on the router : Router#hw-module session 0/3 Establishing session connect to subslot 0/3 To exit, type ^a^q picocom v2.2 port is : /dev/ttyS3 flowcontrol : none baudrate is : 9600 parity is : none databits are : 8 stopbits are : 1 escape is : C-a local echo is : no noinit is : no noreset is : no nolock is : yes send_cmd is : sz -vv receive_cmd is : rz -vv -E imap is : omap is : emap is : crcrlf,delbs, logfile is : none Type [C-a] [C-h] to see available commands Terminal ready When prompted to terminate the auto-install process (the CLI Initial Configuration Wizard), wait for 30 seconds. The CLI Initial Configuration Wizard begins after 30 seconds. Enter the Administrative Username and Administrative password to be assigned to this controller : Enter Administrative User Name (24 characters max): admin Enter Administrative Password (3 to 127 characters): ******** Re-enter Administrative Password : ******** Enter the System Name, which is the name that you want to assign to the controller : System Name [Cisco-4001.7ac0.8ba0] (24 characters max): Cisco-4001.7ac0.8ba0 Enter the code for the country in which the Mobility Express network is located. In case you are not aware of your country code, you can enter "help" and then type the appropriate country code : Enter Country Code list (enter 'help' for a list of countries) [US]: help Enter the country code list (e.g. US,CA,MX) max=30. Supported Country Codes: AE, AL, AR, AT, AU, BA, BB, BE, BG, BH, BM, BN, BO, BR, BY, CA, CH, CL, CM, CN, CO, CR, CY, CZ, DE, DK, DO, DZ, EC, EE, EG, EL, ES, FI, FJ, FR, GB, GH, GI, GR, HK, HR, HU, ID, IE, IL, IO, IN, IQ, IS, IT, J4, JM, JO, KE, KN, KW, KZ, LB, LI, LK, LT, LU, LV, LY, MA, MC, ME, MK, MN, MO, MT, MX, MY, NG, NL, NO, NZ, OM, PA, PE, PH, PK, PL, PR, PT, PY, QA, RO, RS, RU, SA, SE, SG, SI, SK, TH, TI, TN, TR, TW, UA, US, UY, VE, VN, ZA Enter Country Code list (enter 'help' for a list of countries) [US]: IN If you want the controller to receive its time setting from an external Network Time Protocol (NTP) server when it powers up, enter YES to configure an NTP server. For this lab purpose, we would be skipping this step. When you select "No", then it would ask the user to manually enter the date and time. This step can also be skipped : Configure a NTP server now? [YES][no]: no Configure the system time now? [YES][no]: no Note! Default NTP servers will be used Enter the IP address of the management interface. The management interface is the default interface for in-band management of the controller and connectivity to enterprise services. Also enter the IP address and subnet mask of the management interface and the default gateway router address : Management Interface IP Address Configuration [STATIC][dhcp]: STATIC Management Interface IP Address: 192.168.50.254 Management Interface Netmask: 255.255.255.0 Management Interface Default Router: 192.168.50.1 Now it will ask if you want to configure the DHCP scope to manage the address allocation for the clients connecting to the SSID (Yet to be configured). Please provide the relevant details such as pool, mask, Domain Name, DNS : Create Management DHCP Scope? [yes][NO]: yes DHCP Network : 192.168.50.0 DHCP Netmask : 255.255.255.0 Router IP: 192.168.50.1 Start DHCP IP address: 192.168.50.11 Stop DHCP IP address: 192.168.50.253 DomainName : cisco.com DNS Server : [OPENDNS][user DNS] Now it asks to configure the Employee Network ID (SSID) for the wireless controller and its security/authentication type and respective paraphrase : Employee Network Name (SSID)?: cisco_true_labs Employee Network Security? [PSK][enterprise]: PSK Employee PSK Passphrase (8-63 characters)?: ******** Re-enter Employee PSK Passphrase: ********* To enable RF Parameter Optimization, enter YES. Enter the  Client Density. You can enter   TYPICAL,   Low, or   High, as per your requirement. Then it will confirm the changes made so far, and would reset the controller with the configured settings : Enable RF Parameter Optimization? [YES][no]: YES Client Density [TYPICAL][Low][High]: Low Configuration correct? If yes, system will save it and reset. [yes][NO]: yes Configuration saved! Resetting system with new configuration... After this step, wait till the controller comes back up and the AP is given the management address and the AP comes online. You can verify if the AP is online using the "show ap summary" command from the controller mode : (Cisco Controller) >show ap sum Number of APs.................................... 1 Global AP User Name.............................. admin Global AP Dot1x User Name........................ Not Configured Global AP Dot1x EAP Method....................... EAP-FAST * prefix indicates Cisco Internal AP AP Name Slots AP Model Ethernet MAC IP Address Clients ----------------- ----- --------------- -------------- ---------- ----------- *AP4001.7AC0.8BA0 2 ISR-AP1101AC-D 40:01:7a:c0:8b:a0 192.168.50.97 1 Verification Now, you should be able to see this SSID being advertised by the AP, and using any mobile device try to login to the SSID.                 Then, you can verify the client which had joined the AP using "show dhcp lease" from the controller mode : (Cisco Controller) >show dhcp lease Total Leases: 2 Host Name MAC IP Lease Time Remaining ABCDEs-iPhone aa:bb:cc:dd:ee:ff 192.168.50.198 23 hours 57 minutes 10 seconds AP4001-7AC0-8BA0 40:01:7a:c0:8b:a0 192.168.50.97 23 hours 52 minutes 39 seconds You can validate if the SSID is active using "show wlan summary" from the controller mode : (Cisco Controller) >show wlan summary Number of WLANs..................... 1 WLAN ID WLAN Profile Name / SSID Status Interface Name ------- ------------------------------------- -------- -------------------- 1 cisco_true_labs / cisco_true_labs Enabled management ... View more

  Contributed by Kureli Sankar and Rudresh Veerappaji Documentation This configuration example is meant to be interpreted with the aid of the official documentation from the configuration guide located here: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Security/Security-Book/security-solution.html (Latest 16.12/19.2) https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.4/05Security/Configuring_the_18.4_Security_Virtual_Image_for_IPS%2F%2FIDS_and_URL_Filtering   Prerequisites and disclaimers This deployment guide assumes that the controllers and the edges have been successfully deployed and are operational. For firewall ports that need to be open for device on-boarding please refer this link: https://sdwan-docs.cisco.com/Product_Documentation/Getting_Started/Viptela_Overlay_Network_Bringup/01Bringup_Sequence_of_Events/Firewall_Ports_for_Viptela_Deployments Upload the image for virtual service if you intent to test IPS/IPS and/or URL-F Click Maintenance >> Software Repository then choose the "Virtual Images" tab and upload the App Hosting tar file to the software repository. Security policy does not support CLI device template.  Please attach security policy only to feature device template. ISR platforms need to have minimum 8 GB DRAM and 8 GB of FLASH if IPS/URL-F functions are required.  If configuring DNS/web-layer Security, log into your Umbrella Portal and copy the API token so we can configure the DNS security section on vManage. Under Deployments >> Network Devices >> Choose the API token on the far right corner and copy the long string of numbers to clip board. This token needs to be populated (pasted from clip board) under the vManage settings like shown below under "Umbrella API Token":   Download Software images Release Notes for both 16.11.1 and 19.2: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/xe-16-12/ios-xe-sd-wan-re-notes-16-12.html Release Notes for both 16.11.1 and 19.1: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/xe-16-11/sd-wan-rel-notes-19-1.html Release Notes for 16.10.1 and 18.4: https://sdwan-docs.cisco.com/Product_Documentation/Getting_Started/Release_Notes/010Release_Notes_for_IOS_XE_SD-WAN_Release_16.10_and_SD-WAN_Release_18.4 16.10.1 Software Download Link for ISR 1K/4K and ASR: ISR 1K: https://software.cisco.com/download/home/286321996/type/286321980/release/16.10.1 ISR 4K: https://software.cisco.com/download/home/286321991/type/286321980/release/16.10.1 ASR1K: https://software.cisco.com/download/home/286321999/type/286321980/release/16.10.1 18.4 vManage New Deployment Download Link: https://software.cisco.com/download/home/286320995/type/286321039/release/18.4.0 18.4 vManage upgrade image download Link: https://software.cisco.com/download/home/286320995/type/286321394/release/18.4.0 19.2 vManage New Deployment Download Link: https://software.cisco.com/download/home/286320995/type/286321039/release/19.2.0 19.2 vManage upgrade image download Link: https://software.cisco.com/download/home/286320995/type/286321394/release/19.2.0 Configuring Security Template Click under Configuration >> Security and click "Add Security Policy" and pick one of the features that you like to implement or if you need more than one choose the "custom" option and proceed. Application Firewall Policy Click on "Add Firewall Policy" choose "Create New" and proceed.   Give the policy a name and description as shown below and start creating sequence rule. If you need to configure permission for DIA (Direct Internet Access) for example only allow http, https, dns follow the screen shots for below: To allow http, click add sequence rule, click on the protocol tab and in the search field type http and choose it. Click on the "Actions" tab and choose "Inspect".  This will allow the response traffic to come through automatically. Repeat this for https Instead of adding two sequences for http and https you can combine both in one sequence by choosing the following: Choose "Destination Port" and type "80 443" and then click the protocol tab and type "6" for tcp.   For dns if you choose application protocol, the tool will pick both tcp and udp protocols for port 53. To only pick udp, choose the destination port 53 and then type protocol 17.  Once you get all the rules configured, click on the very top "Apply Zone-Pairs", click "New Zone List" give it a name such as "INSIDE" and specify the VPN "1".    Repeat this for OUTSIDE and VPN 0. Note: Self-Zone is supported from 16.12/19.2 release   This completes the Firewall policy.   Intrusion Prevention Moving on to IPS, click on "Add Intrusion Prevention policy".  Give the policy a name and proceed with choosing a Signature Set, Inspection Mode.  Optionally one could under configure a Signature Whitelist by importing or creating a new file on the local computer and set the "Alerts Log Level".  Once done make sure to apply the policy to all or only selected Target VPNs. IPS signature update On the vManage screen, click on "Administration" and go to "Settings" and "IPS signature Update" and provide CCO credentials (could be any CCO account or the companies CCO account) for vManage to download the subscription signature set and update the WAN edges.  Router#sh utd engine standard status Engine version : 1.0.8_SV2.9.13.0_XE16.12 Profile : Cloud-Low System memory : Usage : 22.00 % Status : Green Number of engines : 1 Engine Running Health Reason =========================================== Engine(#1): Yes Green None ======================================================= Overall system status: Green Signature update status: ========================= Current signature package version: 29130.51.s =========> .s indicates subscription Last update status: Successful Last successful update time: Wed Dec 11 19:53:19 2019 UTC Last failed update time: None Last failed update reason: None Next update scheduled at: None Current status: Idle URL-Filtering Prerequisite: For this feature to work we need NAT configured for the WAN interface.  The security App Hosting container uses the virtual port group 0 to reach out to the internet and talk to Webroot/Brightcloud in order to download the URL-Filtering database if the device has 16 MB of DRAM or do a cloud lookup for the URLs to get the category information if the device only has 8 GB of DRAM.  Either way the WAN interface needs to be NAT enabled (even if an upstream device provides NAT for this WAN edge router). This is because the virtual port group uses the subnet 192.168.1.0/30 subnet and if you do not PAT this to the WAN interface, you need to provide routes on the upstream device for response packets to get back to this WAN edge router for 192.168.1.0/30 network.   Click "Add URL Filtering Policy" and choose "create new". Give it a policy name and proceed with choosing the categories using the down arrow.   Choose whether to block or allow (with block, all categories are allowed but those blocked and vise versa) Choose the categories from the search option Choose the Web Reputation Under Advanced choose create a new URL list for White or Black List.  Eg. whitelisted URLs bypass all URL filtering policy. Blacklisted URL's are immediately dropped without further processing the URL filtering policy. Under the Block Page Content the "Default Content Header" cannot be changed  (we will hide/remove this from the UI for FCS). Under "Content Body" you can type a message or add the help desk number that the users could call if needed.    Fill the rest of the items and make sure to apply the policy to all or only selected target VPNs. Advanced Malware Protection (AMP/TG) Click next from the previous screen, and configure AMP/TG feature from "Add Advanced Malware Protection Policy" and choose "Create New". Give it a policy name and proceed. Choose an AMP Cloud region that is closest to your device location, and set Alerts log level from the options available.   Toggle the "File Analysis" option at the bottom of the screen to enable Threat Grid (TG) feature. Enter the Threat Grid API key under "Custom Options"->"Threat Grid API Key"   From here you can select the closet Threat grid cloud region to your device location, and also select the file types that you would like to send to TG for sandboxing and analysis. DNS/web-layer Security   Start configuring DNS/web-layer security feature "Add DNS security Policy" and choose "create new" give it a policy name and proceed. Since we have already keyed in the Umbrella Token ID under settings, Umbrella Registration Status shows "green" configured. Now create an optional domain bypass list for DNS requests (for internal company only websites) that do not need to be re-directed to Umbrella.  DNScrypt is enabled by default which will encrypt the DNS packets with the EDNS headers of client IP etc. and be sent to the umbrella cloud.   Make sure to apply the policy to all or only selected target VPNs. Make sure to apply the policy to all or only selected VPNs. Then, go next and review the policy summary page Policy Summary     Make sure to uncheck the box that says 'Allow Internet Traffic to VPN 0 if VPN 0 is not in a zone'.  Checking this will allow all traffic without being inspected by the firewall. You can enable High Speed logging to send all Enterprise firewall logs in the form of Netflow v9 records to a Netflow Collector. Also you can enable External Syslog server for UTD services namely IPS, URL Filtering and AMP/TG in the policy summary page. Save the policy. Attach the security policy to the device template Before attaching the security policy to the device template, since the IPS and URL-F features are container based, we need to upload the image for App Hosting. If you haven't done this already, now is the time to do this. Click Maintenance >> Software Repository then choose the "Virtual Images" tab and upload the App Hosting tar file to the repository. Next, go to the Configuration >> Templates choose the template that is attached to the device then click on the far left ... and choose edit. Now, scroll all the way down choose the security policy that we just configured and also choose the UTD "Factory Default_UTD_Template" if you are deploying IPS or URL-F. Now, attach the device(s) to the template as shown below. This process takes a few minutes (up to 10 minutes) so, please be patient and watch the progress by clicking on the "Tasks". Overall Dashboard Go to "Dashboard" -> "Security" for the Security specific Global/Overall Dashboard Enterprise Firewall Toggle between Inspected VS Dropped, click on 1h, 3h, 6h and click at any point on the trend for further drilling down. IPS Toggle between "By Severity" or "By Count" to further drill-down by signature name on the bottom that will show more details about the 5-tuples responsible for triggering the signature. URL Filtering Toggle between "Blocked" VS "Allowed" and click on certain color band to get more details about the number of sessions processed by all the devices in the enterprise for the particular category. Advanced Malware Protection (AMP/TG)   Toggle between "File Reputation" for AMP and "File Analysis" for Threat Grid, and click on any point in the graph to get additional details such as the devices where the malicious files were seen and number of times they were seen. Device-Specific Dashboard Click under Monitor >> Network and choose the device in question and choose one feature at a time under "Security Monitoring" Choose all different options and drill downs.  This dashboard has "Umbrella DNS re-direct" as well. Real Time Data Under the device specific dashboard, you can get some real time stats on the security features. For example if you click under Monitor >> Network >> Choose the device >> Real Time (very bottom on the left pane).      You can type "Policy Zone" and get FW statics real time as shown below:                 You can type "UTD" and get IPS statics real time as shown below: You can type "Umbrella" and get Umbrella (DNS/web-layer security) statics real time outputs as shown below: Further reading Refer to the release notes, configuration guides and troubleshooting guide for further information on SD-WAN Security https://www.cisco.com/c/en/us/support/routers/xe-sd-wan-routers/products-release-notes-list.html https://www.cisco.com/c/en/us/support/routers/sd-wan/products-installation-and-configuration-guides-list.html https://community.cisco.com/t5/networking-documents/sd-wan-security-troubleshooting-guide/ta-p/3735301 ... View more

Router Upgrade Unable to upgrade image - stuck in rommon System Bootstrap, Version 16.7(3r), RELEASE SOFTWARE Copyright (c) 1994-2017 by cisco Systems, Inc. Current image running: *Upgrade in progress* Boot ROM0 Last reset cause: BootRomUpgrade ISR4331/K9 platform with 16777216 Kbytes of main memory rommon 1 > Upgrade the image to IOS-XE CCO image 16.10.1 which will automatically upgrade the rommon. If upgrading to 16.10.1 IOS-XE SD-WAN image then rommon upgrade has to be done manually. Watch the video here: https://youtu.be/qugfIlEmSEM Template Error Unable to attach template with security [5-Jan-2019 7:34:40 UTC] Configuring device with feature template: Single_Site_Dual_Homed_CSR1000v_Device_Template_Sec_Policy_For_Compliance [5-Jan-2019 7:34:40 UTC] Generating configuration from template [5-Jan-2019 7:34:47 UTC] Checking and creating device in vManage [5-Jan-2019 7:34:53 UTC] Device is online [5-Jan-2019 7:34:53 UTC] Updating device configuration in vManage [5-Jan-2019 7:34:59 UTC] Pushing configuration to device [5-Jan-2019 7:36:27 UTC] Pre config validation failed. Device is not configured to accept new configuration. Error while doing pre config validation of type utd for CSR-6FEA589A-A60F-4445-87A8-1F65F9B5CFC2-100.100.30.1. Error Reason: Failed to get cpu share, memory and disk specs Solution: It appears that the router previously had app-hosting configured and now you are trying to attach a template which would require app-hosting again.  It is not able to get the CPU and memory it needs (‘cos it already is running and has acquired CPU and memory). Use CLI stop and uninstall container using the following commands and make sure there is no service running when you issue "show app-hosting list" SD-WAN-Router#app-hosting stop appid utd SD-WAN-Router#app-hosting uninstall appid utd then attach the template again. Make sure the matching app-hosting image file is loaded to the software repository prior to attaching the template. Unable to attach template While attaching template even before configuring security policies, it fails. Error on line 22: invalid value for: address in /vmanage-cfs:templates/vmanage-cfs:template [vmanage-cfs:template-name='vip_internal_temp_device_CSR-c3d127e1-a15c-4d5d-b687-741670093000'] /vmanage-cfs:vpn/vmanage-cfs:vpn-instance[vmanage-cfs:vpn-id='1']/vmanage-cfs:interface[vmanage-cfs: if-name='GigabitEthernet1']/vmanage-cfs:ip/vmanage-cfs:address: "192.168.30.1" is an invalid value. Looks like the IP address that is configured does not include a mask.  Try configuring IP address with 192.168.30.1/24 and it should work. Controllers Issues  vManage Cert shows error This is not an issue as vManage web cert is always self-signed Linking smart account in vManage results in credential error             Failed to connect to server Issuing "show sdwan cert serial" shows error below: Router#show sdwan certificate serial Failed to connect to server  "Failed to connect to server" message, this is due to the PNP process running, which blocks access to the viptela service running on the ISR.  You can run "pnpa service discovery stop" and then it will let you run the show command. Try the "show crypto pki certificates CISCO_IDEVID_SUDI" command.  Using the SUDI serial number, PID, and serial number add the device to the PNP portal following the guide outlined in the video (https://www.youtube.com/watch?v=qugfIlEmSEM) Export the Provisioning File from Plug and Play connect under Controller Profiles. Control Connections drop with NAT enabled for DIA When NAT is configured on cEdge interface to access internet traffic, the control connections drop after few minutes and configurations rolleback. NAT configurations appear to create NAT translations for control connections as well. ip nat inside source list nat-dia-vpn-hop-access-list interface GigabitEthernet0/0/0 overload ip nat translation tcp-timeout 60 ip nat translation udp-timeout 1 interface GigabitEthernet0/0/0 description Internet Circuit no shutdown arp timeout 1200 ip address dhcp client-id GigabitEthernet0/0/0 ip dhcp client default-router distance 1 ip mtu 1500 ip nat outside mtu 1500 negotiation auto service-policy output shape_GigabitEthernet0/0/0 exit Make sure vManage is at least on 18.3.1 as there is config push issue in previous code with cEdge. Remove NAT and verify if Control connection comes up. If control connection comes up without NAT then push the NAT configurations again. Using the feature template or CLI, make sure that default route to VPN0 under the service VPN is added. If the configuration push is successful and device did not roll back verify all control connections show sdwan control local-properties show sdwan control connections show ip nat translations Device may still show control connection to vManage getting NAT translations and is down. The control connection to vSmart and vBond are up. TCP Dump on ISR shows connection is getting RST from either vManage or Modem in the path. Capture on vManage confirms that vManage is resting the connection The cEdge is selecting a random high number port for the control connection formation to vManage. This, in itself, isn’t necessarily a problem as the connection can still form with vManage using that port for communication. The second, and main problem, is that we confirmed with packet captures on the cEdge that it was NATing the initial SYN towards vManage but the ACK and future packets were not. Since this traffic is sourced by the CPU on the cEdge, it shouldn’t be NATed. Check if there is a NAT ACL that is matching on WAN IP and forcing the translation for even control CPU generated connections. show ip access-list dynamic Solution: The bug involves an issue where control packets may be treated as datapath traffic. Because of that, some of the traffic gets NATed unexpected, which in this case is the TCP SYN when we try to build the control connection. The ACK is properly treated as control and is not NATed and this is the reason we see differences in the source port on the vManage capture before it resets the connection. To workaround this, we need to convert vManage to use DTLS for now. This bug will be fixed in the GA release but wasn’t picked up in time for the EFT build. This needs to be done for all controllers, not just vManage. vBond already uses DTLS. There is no preference. With DTLS udp connections will be torn down quicker than TCP connections on any intermediate NAT box. To change the control connection in CLI go to Security->Control-> Protocl and select DTLS vManage doesn’t show images in the repository This is a known issue where vManage is not able to show the images in repository. This fix is committed for next release. Error when trying to apply the security policy   security policy will not work if the virtual app file is not copied to the software repository and the factory default template is not picked for UTD. This is mandatory step for IPS and UTD features before attaching the template Also verify the VPNs are correctly listed in the CLI policy. If VPN2 is used in the security policy, but that is not defined on the device template, then security policy will fail. Firewall Config push may fail with ZBFW and IPS policy Try to configure the template without preview. May get below error If the ZBFW policy and IPS policy name is the same, the config push may fail. To fix the issue, have unique names. This behavior will be fixed in upcoming releases. Firewall dashboard does not populate data Double check and make sure the firewall is building sessions. Connect to the router via CLI and issue the following command and make sure session are being built and they show up in "SIS_OPEN" state. Raleigh-CSR#sh policy-map type inspect zone-pair sessions   Zone-pair: ZP_INSIDE_OUTSIDE_FIREWALL-TEST   Service-policy inspect : FIREWALL-TEST     Class-map: FIREWALL-TEST-seq-1-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-1-acl_       Inspect         Established Sessions          Session ID 0x0005454C (192.168.10.10:33284)=>(52.11.201.245:443) https SIS_OPEN           Created 00:07:05, Last heard 00:07:05           Bytes sent (initiator:responder) [1164:3826]       Service-policy inspect avc : My-drop-app-list-pm_         Class-map: My-drop-app-list-cm0_ (match-any)             0 packets, 0 bytes           30 second offered rate 0000 bps, drop rate 0000 bps           Match: protocol attribute application-family peer-to-peer             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol attribute application-family webmail             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk-chat             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol youtube             0 packets, 0 bytes             30 second rate 0 bps           Deny         Class-map: class-default (match-any)             4847090 packets, 3040398370 bytes           30 second offered rate 160000 bps, drop rate 0000 bps           Match: any           Allow     Class-map: FIREWALL-TEST-seq-11-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-11-acl_       Pass         15 packets, 1470 bytes     Class-map: FIREWALL-TEST-seq-21-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-21-acl_       Inspect         Established Sessions          Session ID 0x00054724 (192.168.10.10:53865)=>(208.67.222.222:53) dns SIS_OPEN           Created 00:00:09, Last heard 00:00:04           Bytes sent (initiator:responder) [154:0]                  Half-open Sessions          Session ID 0x00054726 (192.168.10.10:35795)=>(208.67.220.220:53) dns SIS_OPENING           Created 00:00:01, Last heard 00:00:01           Bytes sent (initiator:responder) [81:0]     Class-map: FIREWALL-TEST-seq-31-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s31-l4-cm_         Match: protocol https           0 packets, 0 bytes       Inspect     Class-map: FIREWALL-TEST-seq-41-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s41-l4-cm_         Match: protocol http           0 packets, 0 bytes       Inspect     Class-map: class-default (match-any)         Match: any       Drop         672 packets, 60480 bytes IPS How to verify IPS is functioning? Make sure to issue the command "show utd engine standard status" and make sure the engine status is Green. Also make sure that the signature package file name below "29111.8.s" has a ".s" indicating it is subscriber signature set and not have ".c" to indicate community signature set that comes default with the virtual app-hosting image. Raleigh-CSR#sh policy-map type inspect zone-pair sessions   Zone-pair: ZP_INSIDE_OUTSIDE_FIREWALL-TEST   Service-policy inspect : FIREWALL-TEST     Class-map: FIREWALL-TEST-seq-1-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-1-acl_       Inspect         Established Sessions          Session ID 0x0005454C (192.168.10.10:33284)=>(52.11.201.245:443) https SIS_OPEN           Created 00:07:05, Last heard 00:07:05           Bytes sent (initiator:responder) [1164:3826]       Service-policy inspect avc : My-drop-app-list-pm_         Class-map: My-drop-app-list-cm0_ (match-any)             0 packets, 0 bytes           30 second offered rate 0000 bps, drop rate 0000 bps           Match: protocol attribute application-family peer-to-peer             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol attribute application-family webmail             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol gtalk-chat             0 packets, 0 bytes             30 second rate 0 bps           Match: protocol youtube             0 packets, 0 bytes             30 second rate 0 bps           Deny         Class-map: class-default (match-any)             4847090 packets, 3040398370 bytes           30 second offered rate 160000 bps, drop rate 0000 bps           Match: any           Allow     Class-map: FIREWALL-TEST-seq-11-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-11-acl_       Pass         15 packets, 1470 bytes     Class-map: FIREWALL-TEST-seq-21-cm_ (match-all)         Match: access-group name FIREWALL-TEST-seq-21-acl_       Inspect         Established Sessions          Session ID 0x00054724 (192.168.10.10:53865)=>(208.67.222.222:53) dns SIS_OPEN           Created 00:00:09, Last heard 00:00:04           Bytes sent (initiator:responder) [154:0]             Half-open Sessions          Session ID 0x00054726 (192.168.10.10:35795)=>(208.67.220.220:53) dns SIS_OPENING           Created 00:00:01, Last heard 00:00:01           Bytes sent (initiator:responder) [81:0]     Class-map: FIREWALL-TEST-seq-31-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s31-l4-cm_         Match: protocol https           0 packets, 0 bytes       Inspect     Class-map: FIREWALL-TEST-seq-41-cm_ (match-all)         Match: class-map match-any FIREWALL-TEST-s41-l4-cm_         Match: protocol http           0 packets, 0 bytes       Inspect     Class-map: class-default (match-any)         Match: any       Drop         672 packets, 60480 bytes Dashboard does not populate any data for IPS Both overall dashboard as well as device specific dashboards do not show IPS events even though there is some traffic that would trigger signatures are seen by the router. 1. Make sure subscriber signature set is running.  The default that comes is the free community signature set with only about 600 signaures. Use the IPS signature update (under settings) and provide CEC credentials and get the subscriber signature set.     2. Issue the following command and make sure subscriber signature package has been downloaded. Either by going to Monitor >> Network >> Choose Router >> Intrusion Prevention   OR 3. Via CLI connect to the router and issue the following command and make sure the subscriber signature package has been downloaded. Cary-CSR#sh utd engine standard threat-inspection signature update status Current signature package version: 29111.35.s Current signature package name: UTD-STD-SIGNATURE-29111-35-S.pkg ========> S indicates subscriber sig Previous signature package version: 29111.34.s --------------------------------------- Last update status: Successful --------------------------------------- Last successful update time: Fri Jan 4 03:30:16 2019 UTC Last successful update method: Manual Last successful update server: None Last successful update speed: 3917236 bytes in 20 secs --------------------------------------- Last failed update time: None Last failed update method: None Last failed update server: None Last failed update reason: None --------------------------------------- Last attempted update time: Fri Jan 4 03:30:16 2019 UTC Last attempted update method: Manual Last attempted update server: None --------------------------------------- Total num of updates successful: 5 Num of attempts successful: 5 Num of attempts failed: 0 Total num of attempts: 5 --------------------------------------- Next update scheduled at: None --------------------------------------- Current status: Idle URL-F Error when updating the device template with the Security Policy Confirm virtual image for IPS and URL-F were uploaded On the protocol/destination port, in this case we need to give the protocol number, mainly it will be TCP Or UDP. If no protocol is defined then both TCP & UDP are used. Performance Issues with URL-F and IPS Policy is applied to VPN1 and seeing worst performance when DIA is disabled and sent traffic through DC. case1) With DIA and Url filter and IPS turned ON, everything works normal. case2) When we disable DIA and keeping the URL filter and IPS turned ON, we do see the response is pretty slow. case3) When we disable DIA, URL and IPS all of them turned OFF, everything works as normal and the requests from client behind the router are relatively fast. -  It does take upto 10 mins for the IPS to work normally after applying the policy. This is expected from container perspective, DT team also confirmed this behavior. After 10mins we do see things working normal. DNS/web-layer Security DNS Request not resolving In case we have 2 default routes on underlay and one is not having internet reachability (assume it is MPLS) and DNS resolution doesn't work due to ECMP. Need to implement static routes for RFC1918 subnets pointing to MPLS next-hop and default route to internet next-hop. Umbrella Registration failing   ISR4331-1#sh sdwan umbrella device-registration umbrella-ios-oper-data umbrella-dev-reg-data 1 status UNKNOWN tag vpn1 device-id "" description "Domain lookup failed for 'api.opendns.com',retrying"   Check if DNS is working, ping Google we get the following: ISR4331-1#ping www.google.com % Unrecognized host or address, or protocol not running. The device needs to be configured with a DNS service and domain look-up enabled from vManage. Under the VPN0 template, add DNS Server. Verify the running configurations sh sdwan running-config | | name-server ip name-server 8.8.8.8 We have two interfaces, an INET and MPLS. Traffic utilizing the MPLS next hop is using a source IP of the INET interface and traffic utilizing the INET next hop is using a source IP of the MPLS interface The FIB shows the correct interface mapping, but traffic flows appear to ignore the source IPs. G0/0/0 is INET and gi0/0/1 is MPLS ISR4331-1#sh ip cef Prefix Next Hop Interface 0.0.0.0/0 10.1.5.1 GigabitEthernet0/0/0 10.2.5.1 GigabitEthernet0/0/1 0.0.0.0/8 drop 0.0.0.0/32 receive 10.1.5.0/28 attached GigabitEthernet0/0/0 10.1.5.0/32 receive GigabitEthernet0/0/0 10.1.5.1/32 attached GigabitEthernet0/0/0 10.1.5.3/32 receive GigabitEthernet0/0/0 10.1.5.15/32 receive GigabitEthernet0/0/0 10.2.5.0/28 attached GigabitEthernet0/0/1 10.2.5.0/32 receive GigabitEthernet0/0/1 10.2.5.1/32 attached GigabitEthernet0/0/1 10.2.5.2/32 receive GigabitEthernet0/0/1 10.2.5.15/32 receive GigabitEthernet0/0/1 127.0.0.0/8 drop 192.0.2.0/30 attached VirtualPortGroup1 192.0.2.0/32 receive VirtualPortGroup1 192.0.2.1/32 receive VirtualPortGroup1 192.0.2.2/32 attached VirtualPortGroup1 192.0.2.3/32 receive VirtualPortGroup1 224.0.0.0/4 drop 224.0.0.0/24 receive 240.0.0.0/4 drop 255.255.255.255/32 receive The DNS/Traffic is taking the route of MPLS because of ECMP. Need to implement static routes for RFC1918 subnets pointing to MPLS next-hop and default route to internet next-hop. Verify Umbrella registration now ISR4331-1#sh sdwan umbrella device-registration umbrella-ios-oper-data umbrella-dev-reg-data 1 status UNKNOWN tag vpn1 device-id "" description "Socket connection failed for'api.opendns.com',retrying" Verify DNS is resolving ping opendns.com from the transport VPN Match the Umbrella token from Umbrella and the one that is configured in vManage. Verify that “allow-services all” is configured under the interface facing the internet. Now verify Umbrella registration with “sh umbrella config” - should show the device registered and with a valid org ID. The Security push fails after Umbrella is detached from the policy 11-Oct-2018 21:34:15 UTC] Configuring device with feature template: 4331-Branch-v1-GreatWALL [11-Oct-2018 21:34:15 UTC] Generating configuration from template [11-Oct-2018 21:34:24 UTC] Checking and creating device in vManage [11-Oct-2018 21:34:32 UTC] Device is online [11-Oct-2018 21:34:32 UTC] Updating device configuration in vManage [11-Oct-2018 21:34:44 UTC] Pushing configuration to device [11-Oct-2018 21:34:55 UTC] Failed to process device request. Error response : rpc-reply error: <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="10"> <rpc-error> <error-type>application</error-type> <error-tag>invalid-value</error-tag> <error-severity>error</error-severity> <error-message unknown:lang="en">inconsistent value: Device refused one or more commands</error-message> <error-info> <severity xmlns="http://cisco.com/yang/cisco-ia">error_cli</severity> <detail xmlns="http://cisco.com/yang/cisco-ia"> <bad-cli> <bad-command>utd engine standard multi-tenancy</bad-command> <error-location>0</error-location> <parser-response>%Config update in progress; please wait and retry</parser-response> </bad-cli> <bad-cli> <bad-command> no web-filter block page profile block-GreatWall_URL</bad-command> <error-location>5</error-location> <parser-response/> </bad-cli> </detail> </error-info> </rpc-error> </rpc-reply> Umbrella can be detached by going to Config > Security > go to one of the tabs (say firewall) click the ... and select "detach" Wait for UTD Engine status to turn green and push the policy again monitor -> network -> device -> realtime -> "UTD Engine Status" To fix the issue a) sufficient time was given to avoid error "config update in progress" b) Security Policy was detached from Device template and modified and reattached.           ... View more

Ent. Firewall App Aware 1. Does App Aware FW use OpenAppID or NBAR? ANS: AppFW uses NBAR/SD-AVC for application detection.   2. Will TLS1.3 impact FW and App Aware policies? ANS: TLS1.3 will impact App Aware policy. SD-AVC can help to some extent to identify certain applications.   3. Where/how is logging being handled? ANS: Logging today is through Syslog server and vManage notifcation.   Intrusion Prevention 1. When will vEdge devices have IDS/IPS and URL-F? ANS: They will not.   2. Do you manage the IPS with FMC or how is that IPS managed or is that managed by Cisco? ANS: vManage is used to manage SD-WAN security.    3. Will the ips capability support custom signatures and nested policies? ANS: No custom signature or nested policies for Dec release. We will plan it for future releases.   URL-Filtering 1. Is the url filtering for http and tls or just http? ANS: Since we do not support SSL decryption, for tls (< 1.3) certificates are examined for domain name and filtering is based on domain name.   2. Does it support time-based URL rules? ANS: No.   3. When configuring a URL Filtering Policy, what does "Web Reputation" do exactly? ANS: Each URL has a reputation score associated with it. The reputation score range is from 0-100, and it is categorized as: high-risk (reputation score (0-20), suspicious (0-40), moderate-risk (0-60), low-risk(0-80), and trustworthy(0-100). Based on the reputation score of a URL and the configuration, a URL is either blocked or allowed. If the user defines a reputation threshold, all the URLs, with a reputation score lower than the user-defined threshold will be blocked.   DNS/web-layer Security 1. Are you redirecting the traffic through Umbrella like a proxy or just redirecting the query?  Almost all of my customers do not want to tunnel through traffic through Cisco Umbrella. ANS: Like a proxy, not tunnel.   2. For Umbrella security, once the network device is sending DNS traffic can you apply policies to that site based on the internal subnet? ANS: You need to map them to VPNs and apply DNS/web-layer security to VPNs.   3. Umbrella scrutinizes EVERY dns query? ANS: There is an option to skip certain domains using "Local Domain Bypass"             ... View more

  Documentation OpenDNS Documentation: https://docs.opendns.com/product/hardware/cisco-umbrella-isr4k/ Cisco Documentation: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_utd/configuration/xe-16/sec-data-umbrella-branch-xe-16-book.html Prerequisite and code download links Code Download Link: https://software.cisco.com/download/type.html?mdfid=284389362&catid=null ISR-4K must be running Polaris (16.3) image or above Security K9 license enabled on the router Goal To configure OpenDNS connector on the ISR such that it redirects all the DNS traffic except local domain traffic to the OpenDNS DNS resolvers. Limitations/Restrictions OpenDNS will not have any effect on the following if configured. Meaning traffic will not be filtered based on OpenDNS policies configured on the portal. Loading a page using IP address Using a proxy on the browser Topology How OpenDNS works All DNS traffic is intercepted by the ISR; if it is a local domain query, then the DNS packet will not be changed and forwarded to OpenDNS DNS resolvers, otherwise the ISR will add ENDS records to the query and forward it to OpenDNS cloud. Based on the policies configured on the OpenDNS portal if the HTTP client is trying to browse to a page that is blocked or malicious, then OpenDNS sends their blocked page IP address as DNS response. HTTP client will send HTTP request to OpenDNS cloud IP address and OpenDNS provides the reason for blocking the content in the HTTP response. Step by Step Configuration Upgrade the router image to Polaris (16.3) or higher image   ISR-4321-OpenDNS #copy tftp: flash: Address or name of remote host [10.10.20.2]? Source filename [ isr4300-universalk9.16.03.06.SPA.bin ]? Destination filename [ isr4300-universalk9.16.03.06.SPA.bin ]? Accessing tftp://10.10.20.ftp://10.10.20.2/ isr4300-universalk9.16.03.06.SPA.bin / isr4300-universalk9.16.03.06.SPA.bin .bin Loading isr4300-universalk9.16.03.06.SPA.bin from 10.10.20.2 (via GigabitEthernet0/0/1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 509907627 bytes] 509907627 bytes copied in 414.230 secs (1230977 bytes/sec)   Upgrade rommom Once you upgrade to 16.3 or higher we also need to upgrade the rommon. Pls. follow the steps below. Download the  isr4200_4300_rommon_167_3r_SPA.pkg image from here: Cisco 4321 Integrated Services Router - Cisco and upload it to flash. Then upgrade using the "upgrade" command. ISR-4321-OpenDNS # copy tftp flash: Address or name of remote host []? 10.10.20.2 Source filename []?  isr4200_4300_rommon_167_3r_SPA.pkg Destination filename [ isr4200_4300_rommon_167_3r_SPA.pkg ]? Accessing t ftp://10.10.20.2/ isr4200_4300_rommon_167_3r_SPA.pkg ... Loading isr4200_4300_rommon_167_3r_SPA.pkg from 10.10.20.2 (via GigabitEthernet0/0/1): !!!!!!!!!!! [OK - 2646988 bytes]   CWS-Tunnel-RTR# upgrade rom-monitor filename bootflash: isr4200_4300_rommon_167_3r_SPA.pkg R0 Chassis model ISR4321/K9 has a single rom-monitor. Upgrade rom-monitor Target copying rom-monitor image file selected : 0 Booted : 0 Reset Reason: 0 Info: Upgrading entire flash from the rommon package 4259840+0 records in 4259840+0 records out 262144+0 records in 262144+0 records out 655360+0 records in 655360+0 records out 4194304+0 records in 4194304+0 records out File  is a FIPS ROMMON image FIPS-140-3 Load Test on  has PASSED. Authenticity of the image has been verified. Switching to ROM 1 8192+0 records in 8192+0 records out Upgrade image MD5 signature is b702a0a59a46a20a4924f9b17b8f0887 4259840+0 records in 4259840+0 records out 4194304+0 records in 4194304+0 records out 4194304+0 records in 4194304+0 records out 262144+0 records in 262144+0 records out Upgrade image MD5 signature verification is b702a0a59a46a20a4924f9b17b8f0887 Switching back to ROM 0 ROMMON upgrade complete. To make the new ROMMON permanent, you must restart the RP. Once the upgrade is done reload the router.  Make sure to issue "show platform" and verify the rommon upgrade was successful. The firmware version should show 16.7(3r). Import CA certificate to the trust pool Communication for device registration to the OpenDNS server is via HTTPs. This requires a root certificate to be installed on the router. ISR-4321-OpenDNS(config)#crypto pki trustpool import terminal % Enter PEM-formatted CA certificate. MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83 nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f /ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0 /RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6 Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1 oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl 5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA 8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC 2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0 j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz % End with a blank line or "quit" on a line by itself. quit % PEM files import succeeded. Get the token to register the device Log into the OpenDNS portal https://login.opendns.com/?return_to=https://dashboard2.opendns.com/https://login.opendns.com/?return_to=https://dashboard2.opendns.com/ Then follow the screen shot to get the "Token" or if this is brand new setup generate a fresh "Token".   Configure local domains (optional) DNS queries destined to local domain will remain untouched and will not be redirected to OpenDNS cloud. parameter-map type regex dns_bypass pattern www.cisco.com pattern .*eisg.cisco.* Configure the token Configure the token that you got from the OpenDNS portal and add the optional local domain configured in the above step. ISR-4321-OpenDNS(config)#parameter-map type opendns global ISR-4321-OpenDNS(config-profile)#token 0F322FEC26991C2B562D3C7FF844E0001C70E7 ISR-4321-OpenDNS(config-profile)#local-domain dns_bypass Enable OpenDNS out Enable OpenDNS out on the interface facing the internet ISR-4321-OpenDNS(config-if)#int g0/0/0 ISR-4321-OpenDNS(config-if)#opendns out  ===> command has been changed to "umbrella out" Enable OpenDNS in Enable OpenDNS in on all the interfaces that are interested in redirecting DNS traffic to the OpenDNS cloud.  Each interface should include a "tag" so you can configure policies based on the "tag" on the OpenDNS portal. In this case we have used the "tag" as "inside-network" ISR-4321-OpenDNS(config-if)#int g0/0/1 ISR-4321-OpenDNS(config-if)#opendns in inside-network ===> command has been changed to "umbrella in" Final Relevant Config parameter-map type regex dns_bypass pattern www.cisco.com pattern .*eisg.cisco.* ! parameter-map type opendns global token 0F32C32FEC26991C2B562D3C7FF844E0001C70E7 local-domain dns_bypass ! interface GigabitEthernet0/0/0 ip address dhcp ip nat outside umbrella out  ! interface GigabitEthernet0/0/1 ip address 10.10.20.1 255.255.255.0 ip nat inside umbrella in inside-network Show commands show opendns dnscrypt show opendns config show opendns deviceid Debugs debug opendns device-registration The below debugs clearly indicate there is a problem with the certificate. *Apr  6 02:58:28.938: OPENDNS-DEV-REG:opendns_dev_reg_process_start *Apr  6 02:58:28.938: OPENDNS-DEV-REG:Found channel *Apr  6 02:58:28.938: OPENDNS-DEV-REG:dev reg to be sent for interface :GigabitEthernet0/0/1 status :REQ QUEUED *Apr  6 02:58:28.938: OPENDNS-DEV-REG: Dev reg interface details interface name: GigabitEthernet0/0/1 tag: inside-network, status :1 *Apr  6 02:58:28.938: OPENDNS-DEV-REG:Found channel *Apr  6 02:58:28.940: OPENDNS-DEV-REG:DNS match found for api.opendns.com is 67.215.92.210 *Apr  6 02:58:28.940: OPENDNS-DEV-REG:channel connect : resolved OOB server ip:67.215.92.210 *Apr  6 02:58:28.940: OPENDNS-DEV-REG:channel: IDB name GigabitEthernet0/0/1: *Apr  6 02:58:28.940: OPENDNS-DEV-REG: channel: Connecting to 67.215.92.210(443) from src 0.0.0.0: socket 6: status -1: errno 265 channel status0 *Apr  6 02:58:28.940: OPENDNS-DEV-REG: channel: Error in socket_connect: status -1: sock_fd 6 *Apr  6 02:58:28.940: OPENDNS-DEV-REG:Cleaning up the channel *Apr  6 02:58:28.940: OPENDNS-DEV-REG: Could not connect device reg channel *Apr  6 02:58:28.940: OPENDNS-DEV-REG:cleanup and reconnect *Apr  6 02:58:28.940: OPENDNS-DEV-REG:Cleaning up the channel Please import the certificate and make sure the cert the is still there. If not import it to trustpool again. ISR-4321-OpenDNS#sh cry pki trustpool ISR-4321-OpenDNS#sh cry pki trustpool CA Certificate   Status: Available   Certificate Serial Number (hex): 01FDA3EB6ECA75C888438B724BCFBC91   Certificate Usage: Signature   Issuer:     cn=DigiCert Global Root CA     ou=www.digicert.com     o=DigiCert Inc     c=US   Subject:     cn=DigiCert SHA2 Secure Server CA     o=DigiCert Inc     c=US   CRL Distribution Points:     http://crl3.digicert.com/DigiCertGlobalRootCA.crl     http://crl4.digicert.com/DigiCertGlobalRootCA.crl   Validity Date:     start date: 12:00:00 UTC Mar 8 2013     end   date: 12:00:00 UTC Mar 8 2023   Associated Trustpoints: Trustpool   Trustpool: Downloaded debug opendns config debug opendns split-dns Troubleshooting https://community.cisco.com/t5/security-documents/cisco-umbrella-opendns-troubleshooting/ta-p/3165759 ... View more

Configuration https://community.cisco.com/t5/security-documents/snort-ips-on-isr-isrv-and-csr-step-by-step-configuration/ta-p/3369186 Troubleshooting Unable to get signature update from cisco.com  1. Make sure the router can get name resolution. Configure the router with a proper DNS name server. ISR4451#utd threat-inspection signature update server cisco username xxxxx password yyyyy % This operation may cause the UTD service to restart which will briefly interrupt services. Proceed with signature update? [confirm] ISR4451#show utd engine standard threat-inspection signature update status Current signature package version: 29.0.c Current signature package name: default Previous signature package version: None --------------------------------------- Last update status: Failed --------------------------------------- Last successful update time: None Last successful update method: None Last successful update server: None Last successful update speed: None --------------------------------------- Last failed update time: Wed Feb 14 09:01:16 2018 PST Last failed update method: Manual Last failed update server: cisco Last failed update reason: ('Connection aborted.', gaierror(-2, 'Name or service not known')) --------------------------------------- Last attempted update time: Wed Feb 14 09:01:16 2018 PST Last attempted update method: Manual Last attempted update server: cisco --------------------------------------- Total num of updates successful: 0 Num of attempts successful: 0 Num of attempts failed: 1 Total num of attempts: 1 --------------------------------------- Next update scheduled at: None --------------------------------------- Current status: Idle The error highlighted in red above usually means DNS is failing to resolve cloudsso2.cisco.com sourced from the VirtualPortGroup0 interface. Once a proper DNS name server and the router is able to resolve cloudsso2.cisco.com to 173.37.144.211 source from virtual portgroup 0 interface, make sure to issue the following command to make sure the router can establish an https connection with the IP address   ISR4451#telnet 173.37.144.211 443 /source-interface virt0    Trying 173.37.144.211, 443 ... Open Once this step is done signature update should happen without any problem as shown below: ISR4451#show utd engine standard threat-inspection signature update status Current signature package version: 2983.44.s Current signature package name: UTD-STD-SIGNATURE-2983-44-S.pkg Previous signature package version: 29.0.c --------------------------------------- Last update status: Successful --------------------------------------- Last successful update time: Wed Feb 14 09:38:32 2018 PST Last successful update method: Manual Last successful update server: cisco Last successful update speed: 3212512 bytes in 19 secs --------------------------------------- Last failed update time: Wed Feb 14 09:01:16 2018 PST Last failed update method: Manual Last failed update server: cisco Last failed update reason: ('Connection aborted.', gaierror(-2, 'Name or service not known')) --------------------------------------- Last attempted update time: Wed Feb 14 09:38:32 2018 PST Last attempted update method: Manual Last attempted update server: cisco --------------------------------------- Total num of updates successful: 1 Num of attempts successful: 1 Num of attempts failed: 1 Total num of attempts: 2 --------------------------------------- Next update scheduled at: None --------------------------------------- Current status: Idle Unable to view the virtual service Check memory available ISR4451#show virtual-service  ^ % Invalid input detected at '^' marker. Check memory available ISR4451#virtual-service install name myips package flash:iosxe-utd.16.07.01.1.0.1_ SV2983_XE_16_7.ova  ISR4451#show log  Feb 9 18:54:45.096 PST: %VMAN-2-VIRT_INST_DISK: R0/0: vman: Virtual Service[UTD]: :Disk reservation::Failed to reserve disk storage for virtual service::Disk storage request (3210 MB) exceeds remaining disk space (3090 MB) on storage media UTD_HEALTH_CHANGE: Service node changed state Down => Red (1) Feb 22 12:00:49.283: %IOSXE-1-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:000 TS:00000000761565218623 %UTD-1-UTD_HEALTH_CHANGE: Service node changed state Down => Red (1) Feb 22 12:01:10.871: %IOSXE_UTD-4-MT_CONTAINER_MESSAGE_TIMEOUT: UTD message sent to the container has timed out Feb 22 12:01:42.871: %IOSXE_UTD-4-MT_CONTAINER_MESSAGE_TIMEOUT: UTD message sent to the container has timed out Snort black holes traffic Incorrect IP address configured on the guest (container) side Packets go to the container but nothing comes back: Encaps shows huge count but decaps shows nothing coming back out to the data plane. CSR#show platform hardware qfp active feature utd stats . . Diversion Statistics: Redirect 137023 Encaps 137023 Decaps 6 Reinject 6 Check the configuration for misconfiguration. Problem is because the container side IP address is a broadcast IP address. interface VirtualPortGroup0 ip address 172.30.50.121 255.255.255.252 ip nat inside zone-member security zone-Inside ! interface VirtualPortGroup1 ip address 192.0.2.2 255.255.255.252 ! utd engine standard logging syslog threat-inspection threat detection policy connectivity logging level debug utd engine standard all-interfaces ! virtual-service utd vnic gateway VirtualPortGroup0 guest ip address 172.30.50.122 vnic gateway VirtualPortGroup1 guest ip address 192.0.2.3 =======> misconfigured with bcast address activate IP address is being used some where else in the network The IP address used on VPG1 on the router side and the guest side was already being used else where in the network and it was routed to null.  All the packets that were diverted to the UTD engine didn't make it to the UTD engine at all.  There by black holing traffic. A ping sourced from VPG1 destined to vnic gateway VirtualPortGroup1 IP address failed.   Refer to this defect: CSCvi11665 When does engine status show as yellow? There is hysteresis in the checking algorithm. When the memory usage is going up, it won't become yellow until crossing 95%. When the usage is going down, the health won't come back to green until crossing 90%.     ... View more