Dear ani_raj91 I suggest to start a new thread, instead of replying to a question that aparently does not contain an answer to yours. ... View more

did you try re-syncing the maps to mse assignment ? ... View more

  your wifipool is using network 192.168.172.16 255.255.255.240 which is from 192.168.172. 16  until  192.168.172.31 y ou've got 16 addresses, from which .16 and .31 are network and broadcast and .17-.18 are excluded -> 14 left how many active devices do you have in this pool?    also your exclude statements look a little odd....  ip dhcp excluded-address 192.168.172.1 192.168.172.18 ip dhcp excluded-address 192.168.172.0 192.168.172.17 ip-address The excluded IP address, or first IP address in an excluded address range. last-ip-address (Optional) The last IP address in the excluded address range. as it is an exclusion range so I see overlap  .0-.17 with .1-.18 you may correct this for clarity ... View more

check more details of your topology. It could simply be that the FW is not physically between the ISP and your network,  but logically just like the "router on a stick" it can be a "firewall on a stick"   e.g. the ISP is connected to the switch, this connection is forwarded by a vlan to a subinterface on the FW as  outside link same for inside vlan(s)   ... View more

e document i referenced mentions: Note:  By default the TOE supports the following ciphersuites for the TLS client and is not configurable: (same list as erlier post) -> in 3.2 you cannot disable the CBC cyphers, they stay enabled! So you can only pay attention that the client uses the GCM cypher to prevent attackers to intercept and "recover the plaintext" the CBC options remain available, but you must not use them just like having both telnet and ssh enabled, but only use ssh! ... View more

I guess the provider has given you subnet  192.210.14.76/30 for communication between his network and your firewall. So an ip-address in this subnet is necessary for your ASA outside interface. this subnet itself has no access from/to internet, but is necessary to communicate to the provider network. (access is THROUGH this network, but not FROM this network)   your provides sees this subnet 192.210.14.144/29 behind your ASA and routes it to the ASA with address in 192.210.14.76/30 network you use the 192.210.14.144/29 adresses as outside NAT adresses on your ASA.   your ASA needs to be "normally" configured for an inside, DMZ, etc. your firepower module needs an ip-address for management access, read firepower configuraton guide   ... View more

look at this document Cisco Prime Infrastructure 3.2  Common Criteria Configuration Guide   4.3 Restrict Web GUI Ciphers The TOE evaluated configuration allows only ECDHE and DHE ciphers to be available from the Web GUI.  To enable only ECDHE and DHE ciphers, the administrator must run this command: admin# ncs run tls-server-ciphers tls-ecdhe tls-dhe The ciphers will be restricted to this list below: o TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 o TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 o TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA o TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA   o TLS_DHE_RSA_WITH_AES_256_CBC_SHA o TLS_DHE_RSA_WITH_AES_128_CBC_SHA o TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 o TLS_DHE_RSA_WITH_AES_128_CBC_SHA256   so you need the top cyphers setting? ... View more

Sebastian brings up a good point! look at this table   please check the switch is configured to use vtp version 3 and is in transparent mode ... View more

I know it's not the main issue, (which is how to get management acces to the module) But I'm answering on your question:      how do i set a 2951 router to 57600 baud using config registers, ive tried.......     ... View more

You don't understand! the procedure to get into rommon mod to configure the baudrate starts the same as the password recovery procedure   once you have got into rommon mode you do not do the password recovery steps, but steps to change the baudrate as in my post from  ‎07-02-2019 04:20 PM ... View more

Step-by-Step Procedure Perform these steps in order to recover your password: Either switch off or shut down the router. Remove the compact flash that is on the rear of the router.  For more information, refer to Back Panel Slots and Connectors on the Cisco 2921 and 2951 Routers. Switch on the router. Once the router is on Rommon mode, reinsert the compact flash. ... View more

native vlan 1198 and allowed vlans 1,900,1198 native vlans is untagged packets, allowed vlan is tagged packets I'm not sure, but in my eyes  I see some inconsistency here - > I suggest to remove 1198 from the allowed vlans list and try again ... View more

found this procedure to change baudrate in rommon    Once in ROMmon, change the console baud rate from 9600 bps to 115200 bps to speed up the download time. Use the confreg command and complete the instructions presented on the screen.   rommon 1 >confreg Configuration Summary enabled are: break/abort has effect console baud: 9600 boot: the ROM Monitor   do you wish to change the configuration? y/n [n]: y enable "diagnostic mode"? y/n [n]: enable "use net in IP bcast address"? y/n [n]: enable "load rom after netboot fails"? y/n [n]: enable "use all zero broadcast"? y/n [n]: disable "break/abort has effect"? y/n [n]: enable "ignore system config info"? y/n [n]: change console baud rate? y/n [n]: y enter rate: 0 = 9600, 1 = 4800, 2 = 1200, 3 = 2400 4 = 19200, 5 = 38400, 6 = 57600, 7 = 115200 [0]: 7 change the boot characteristics? y/n [n]:            Configuration Summary enabled are: break/abort has effect console baud: 115200 boot: the ROM Monitor   do you wish to change the configuration? y/n [n]:            You must reset or power cycle for new config to take effect.   rommon 2 > ... View more