Hi,   We currently use Anyconnect SSL VPN with AAA+Certificate to authenticate the majority of our internal users. The AAA is backed off to AD (LDAP) and we map users to groups (and hence apply ACLs) based on LDAP group membership.   We have a temporary requirement for some users to connect with username/password and no certificate (potentially backed off to a separate LDAP server), but is it possible for the ASA to detect whether a client presents a certificate ot not and select the right group?   A "certificate-group-map Match-Corporate 10 Anyconnect-Client" configured under webvpn uses the "Anyconnect-Client" tunnel-group on the presence of a certificate described in "Match-Corporate".   I am wondering if this could be done by a 'hidden' group-url connection from AnyConnect, which would drop the user in to a different tunnel-group, when specifying say "<asa-ip-address>/backupvpn" in the AnyConnect connection dialogue?   Cheers, Matt ... View more

Hi,   We are using Cisco AnyConnect on ASA (9.6). Users are authenticated with LDAP, and group membership determines which group-policy is assigned (through an LDAP attribute map), and the user is assigned an IP address from a local pool (specified user the group-policy).   Now, we wish to assign client IPs from a DHCP server, but an issue is we want to use a different DHCP server based on the group-policy assigned to the user. The DHCP server appears to be specified in the tunnel-group (we have a generic one for all users), and all the group-policy does is provide a hint as to which scope to use on the DHCP server (dhcp-network-scope).   Is there any way to specify differnet DHCP servers for different user-groups? What I don't know is if multiple DHCP servers are specified in the tunnel-group configuration, will they be queried in turn (as a potential workaround)?   Cheers, Matt ... View more

Hi, I have an installation whereby I cannot connect using AnyConnect 4.5.01044 (on Windows 10) when a Yubico Yubikey is present. This is because the certificate required is on the machine, not the Yubikey (which is presenting a Smart Card certificate store). Is there any way (through policy or AC profiles) to force AnyConnect to ignore the (empty) certificate store on the Yubikey?   Cheers, Matt ... View more

Hi, I am trying to establish an adjacency between a Juniper MX switch and a NX-OS 7700 device running NX-OS 6.2 It's a fairly basic configuation, on the Nexus side: version 6.2(12) feature isis router isis LAB   net 49.0001.0100.7907.9004.00   is-type level-2   address-family ipv6 unicast interface Ethernet1/2/4   ipv6 router isis LAB   no isis hello-padding   isis circuit-type level-2 The adjacency comes up but stays in the INIT state, and I see the following in the NX-OS logs: 2017 May 15 17:11:20.929843 isis: LAB [29880] Receive L2 LAN IIH over Ethernet1/2/4 from XXXX.2711.7000 (f4b5.2f71.dfc4) len 59 prio 7 2017 May 15 17:11:20.929912 isis: LAB [29880] Fail to find IPv4 address TLV mt 0 2017 May 15 17:11:20.929991 isis: LAB [29880] Fail to find iih nbr tlv 2017 May 15 17:11:20.930022 isis: LAB [29880]  Neighbor TLV missing in hello from XXXX.2711.7000 , hence adjacency in INIT state 2017 May 15 17:11:20.930044 isis: LAB [29880] Obtained Restart TLV RR=0, RA=0, SA=0 2017 May 15 17:11:20.930067 isis: LAB [29880]  Remaining Time 0 for SID 0000.0000.0000 The IS-IS IIH looks right on the Juniper side: 17:22:21.246503 Out IS-IS, length 59         L2 Lan IIH, hlen: 27, v: 1, pdu-v: 1, sys-id-len: 6 (0), max-area: 3 (0)           source-id: XXXX.2711.7000,  holding time: 27s, Flags: [Level 2 only]           lan-id:    XXXX.2711.7000.00, Priority: 64, PDU length: 59             Protocols supported TLV #129, length: 1               NLPID(s): IPv6 (0x8e)             IPv6 Interface address(es) TLV #232, length: 16               IPv6 interface address: fe80::f6b5:2fff:fe71:dfc4             Area address(es) TLV #1, length: 4               Area address (length: 3): 49.0001             Restart Signaling TLV #211, length: 3               Flags [none], Remaining holding time 0s What might be causing the adjancecy to stick in the INIT state? Cheers, Matt ... View more

Hi, I have a Catalyst C4500-X running IOS-XE 3.6.2E (15.2(2)E2), and have disabled "Smart Install" as per the recent PSIRT. When checking that port 4786/tcp is closed, I see that another port is listening: switch-1#sh tcp brief all | i LISTEN 5CCB4B38  0.0.0.0.6154               *.*                         LISTEN Does anyone know what this service is (and whether it can be disabled), as I can't find it listed anywhere? (The command "show control-plane host open-ports" is not available on this platform/code). Cheers, Matt ... View more

Hi, I have a situation where two Nexus 7k boxes are running iBGP and contain a significant number of host routes which are present due to a migration from one platform to another, as well as to provide IP mobility to the downstream segments. These devices now need to be integrated into upstream full-mesh routers. The intention is to configure the Nexus devices as rr-clients (the full-mesh routers being the route reflectors). There are two upstream full-mesh routers, and each Nexus 7k will have a link to each, and the rr-client configuration will follow the physical topology. If the iBGP session between the Nexus devices is removed, then these host routes need to be carried up to full-mesh routers (which means they will be propagated to all full-mesh speakers). Ideally, I would like to advertise the only aggregates towards the RRs, but keep the host routes between the two Nexus devices which could be done by maintaining the iBGP session between the rr-clients. Is this recommended, or is there a better way? Cheers, Matt ... View more

Hi,   I have the following configuration on IOS XRv (5.3.0):   control-plane  management-plane   out-of-band    vrf MGMT    interface MgmtEth0/0/CPU0/0     allow SSH     allow Telnet    !   !  ! ! interface MgmtEth0/0/CPU0/0  cdp  vrf MGMT  ipv4 address 10.6.6.202 255.255.255.0 ! interface GigabitEthernet0/0/0/0  ipv4 address 10.6.6.203 255.255.255.0   With this configuration, I thought that MPP would only allow management (SSH/telnet) connections on MgmtEth0/0/CPU0/0. However, I can still ssh to the virtual XR instance on the 10.6.6.203 IP address in the global VRF. Is this by design or is it a feature? RP/0/0/CPU0:gw-xr1#sh lpts pifib brief | i (any,22) Sun Mar 15 19:42:40.477 GMT  IPv4       default  TCP    any          0/0/CPU0     any,22 any  IPv4       *        TCP    Mg0/0/CPU0/0 0/0/CPU0     any,22 any  IPv6       default  TCP    any          0/0/CPU0     any,22 any  IPv6       *        TCP    Mg0/0/CPU0/0 0/0/CPU0     any,22 any   Cheers, Matt       ... View more