Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mulhollandm
Stats
Member since
12-23-2002
395
Posts
8
Helpful
0
Solutions
02-22-2017
07:01 AM
neno
many thanks for your help
I eventually spoke to tac and it turned out that the issue was with my authorisation policy
I was passing back the permit attribute rather than the group attribute
so again, thanks for your help and contribution, it was much appreciated
... View more
02-13-2017
02:39 PM
neon many thanks for your response, its much appreciated
I'm new to ise so I'm not sure how all the components work together
I don't have any authorisation policy configured, I simply have the user accounts configured and added into groups
is this what I'm maybe missing? thanks again
... View more
Created by
mulhollandm
in Policy and Access
in Policy and Access
02-13-2017
11:53 AM
02-13-2017
11:53 AM
folks
i have an ISE 2.0 vm and i'm authenticating users on an ssl vpn with the ise radius service
users, on ise, are put into separate identity groups and i'm trying to allocate ip addresses on my ssl vpn server based on identity group but i don't
see ise passing the group attribute back to the vpn server
does anyone know how i can do this?
thanks to anyone taking the time to reply
... View more
Labels:
02-07-2017
05:34 AM
marius apologies but i've only seen your query now i created the trustpoint as normal but used the enrolment terminal command i imported the the CA certificate using the crypto pki authenticate [TRUSTPOINT] name and pasted the certificate in from notepad i generated the csr with the crypto pki enroll [TRUSTPOINT] name command and then imported the certificate with the crypto pki import [TRUSTPOINT] name command after copying it from notepad you can view the certificates with the command show crypto ca certificates [TRUSTPOINT] name hope this helps and again, apologies
... View more
01-20-2017
01:21 PM
rahul thanks for your help and contribution, its greatly appreciated I'd seen these in my own searching but haven't gave them the attention the most likely deserve i'll have another look at them many thanks for your help
... View more
Created by
mulhollandm
in Policy and Access
in Policy and Access
01-19-2017
04:44 PM
01-19-2017
04:44 PM
folks i want to authentication ssl vpn users against my ise box i want to configure users, put them into groups and then allocate an ip address based on their group membership after successful authentication has anyone a configuration guide or a link to one for this type of setup I'd be grateful for any links or examples thanks to anyone taking the time to reply - much appreciated
... View more
Labels:
Created by
mulhollandm
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-25-2016
03:52 PM
10-25-2016
03:52 PM
folks
I have a pair of 5585x boxes with firepower and I have to set up the firepower ips
I only want ips so I'm looking a simple guide to understand how to configure and deploy a firepower ips policy
can someone point me in the right direction please?
thanks to anyone taking the time to respond
... View more
Labels:
09-14-2016
02:21 AM
folks I'm looking into setting up a backup interface for a remote site I have the current configuration is a 1941 (15.1(4)M3) with two interfaces, lan and wan I now need to create a failover path in case the wan link fails I'm considering using a VSDL ISP who will provide me with an Ethernet port on a modem and then use PPPoE to authenticate to the ISP and get an ip address etc
I intend to use an IP SLA to create the failover condition and route traffic out the dialer interface if the primary wan link fails
traffic over both links will also be encrypted over a l2l tunnel using IPsec profiles I've already set it up and tested in VIRL using standard Ethernet ports but haven't tested it yet with a dialer ip and PPPoE I know what I'm looking to do isn't new but I'm hoping anyone out there can point me to a recent config guide or share their issues with a similar setup thanks to anyone taking the time to read this or reply
... View more
Labels:
Created by
mulhollandm
in Policy and Access
in Policy and Access
08-23-2016
03:24 PM
08-23-2016
03:24 PM
folks
I'm trying to get authenticated on a juniper firewall (screenos) using tacacs on ise 2.1
I've got my cisco kit working ok but the juniper tells me auth has failed even though the tacacs logs tells me it has succeeded
I seem to remember that acs 4.x had to pass an attribute value back to the juniper but I can remember
has anyone had this issue and found a resolution?
many thanks to anyone taking the time to reply
... View more
Labels:
04-11-2016
03:07 AM
folks
I'm patching an ASA5585 10Gb sfp interface to a HP 10Gb sfp port
I have to use a hp 10Gb sfp transceiver on my ten gigabit port but its not coming up if I use a cisco1Gb sfp transceiver it all comes up so I'm assuming the ASA doesn't like the HP SFP as shown in the error message below DC-ASA/act(config-if)# bcm_esw_sfp_eeprom_checksum_validate(2919): SFP Vendor Specific ID Fields 96-123 corrupted, unit 0 phy_addr 73, rv -1 ERROR: SFP+ module TenGigabit0/6 EEPROM SFF Byte 96-123 checksum (0x2b008105). Calculated checksum=0xc787e0a0 my problem is that I can't find an equivalent service unsupported transceiver command for the asa 5585 can anyone help please? thanks
... View more
Labels:
03-23-2016
09:59 AM
andre
i've got it working again
there were several issues that caused me problems i created two new trustpoints and dropped the intermediate and root certificates into them I had left out the trustpoint from the crypto map, once I got these added it started working interestingly I was working from an example in the cisco asa all in one next gen firewall book and while it mentions adding in the identity and issuing certs it doesn't touch on the intermediate or root certs thanks for all your help and patience
... View more
03-23-2016
05:32 AM
folks thanks for all your replies, its greatly appreciated i currently have the identity certificate and enterprise associated with the same trustpoint are you telling me I need to have the intermediate and root certificates also loaded onto the ASA if so, do I need to create a new trustpoint for the root and a new one for the intermediate? I was sure I read that the ASA only needs the identity and issuing certificates, I've had a look but can't see any guides for installing certificate chains so I'd be grateful if you can point me in the right direction thanks again
... View more
03-22-2016
08:19 AM
folks
I'm hoping you can help me with a query
I'm setting up a site to site vpn between an ASA and a palo alto, I've set it up and tested ok using a PSK but I now need to migrate it to using certificates instead of the PSK
I have defined the trustpoint and bound my identity cert and the issuer cert (the identity cert is issued by an enterprise authority) to the trustpoint my problem is that when I test the vpn phase 1 fails and the asa complains that the peer's certificate is
CRYPTO_PKI(Cert Lookup) issuer="cn=x.x.x.x" serial number=xxxxxxxxxxx aaaaaaaa | w.....?%...... 00 00 2e | ...
CRYPTO_PKI: Invalid cert
a debug crypto ikev1 127 complains that there is a Certificate Validation Failed
both my and the peer's certificates have been issued by the enterprise authority though they have different common names , the crypto policy is set for rsa-sig authentication and the tunnel group is pointing to the trustpoint do I need to define a trustpoint and load the intermediate certificate too? (the intermediate issued the enterprise certificate) thanks to anyone taking the time to have a look
... View more
Labels:
03-06-2016
04:07 AM
marius
many thanks for your reply the show cluster info command doesn't show which interfaces are being monitored so i configured the health-check command manually for both inside and outside port channels when i pull the inside interface on asa 1 i can now see the inside port-channel goes down and line protocol goes down the outside port-channel goes down but line protocol stays up the external switch which terminates both asa outside interfaces show both asa interfaces as up and so I suspect is load balancing to the dead asa a ping from a router on the outside interface to the asa outside ip address then fails, as does a test ping from my inside to outside thanks again for your help
... View more
12-04-2019
folksi've been asked to look at the output of the command show interface
status | in bma157 on a nex...
02-22-2017
neno many thanks for your help I eventually spoke to tac and it turned
out that the issue was with m...
02-13-2017
neonmany thanks for your response, its much appreciated I'm new to ise
so I'm not sure how all the c...
Created by
mulhollandm
in Policy and Access
02-13-2017
02-13-2017
folks i have an ISE 2.0 vm and i'm authenticating users on an ssl vpn
with the ise radius service us...
02-07-2017
mariusapologies but i've only seen your query nowi created the
trustpoint as normal but used the enr...
01-20-2017
rahulthanks for your help and contribution, its greatly appreciatedI'd
seen these in my own searchin...
01-19-2017
folksi want to authentication ssl vpn users against my ise boxi want to
configure users, put them in...
Created by
mulhollandm
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-25-2016
10-25-2016
folks I have a pair of 5585x boxes with firepower and I have to set up
the firepower ips I only want...
09-14-2016
folksI'm looking into setting up a backup interface for a remote site I
havethe current configuratio...
08-23-2016
folks I'm trying to get authenticated on a juniper firewall (screenos)
using tacacs on ise 2.1 I've ...
04-11-2016
folks I'm patching an ASA5585 10Gb sfp interface to a HP 10Gb sfp port I
have to use a hp 10Gb sfp t...
03-23-2016
andre i've got it working again there were several issues that caused me
problemsi created two new t...
03-23-2016
folksthanks for all your replies, its greatly appreciatedi currently
have the identity certificate a...
Public Statistics
| Date Registered | 12-23-2002 06:24 AM |
| Date Last Visited | 12-11-2019 03:45 PM |
| Total Messages Posted | 395 |
| Total Helpful Votes Received | 8 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 14 | |
| 8 | |
| 4 | |
| 3 |
.jpg "Hall of Fame Expert"){kind=icon}
