Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Richard Bradfield
Richard Bradfield
Frequent Contributor
I have been working with Cisco gear since 1993, I was CCIE2947, but for the last ten years till my retirement in April 2015, i worked for a food company as a Senior Communications Engineer. Although now retired I like to keep the grey matter ticking over by helping people on the support forum.
Recent Badges
Stats
Member since
10-19-2005
1084
Posts
315
Helpful
61
Solutions
03-01-2020
11:58 PM
the tunnel came up when I did a crypto map outside_map 15 set nat-t-disable but still not passing traffic
... View more
03-01-2020
10:46 PM
Below is the debug I am getting on the ASA, I find Meraki support not very helpful Passes phase 1 but get a disconnect from the Meraki when doing phase 2 anybody help IKEv2-PLAT-2: (804): Site to Site connection detected IKEv2-PLAT-2: (804): P1 ID = 255 IKEv2-PLAT-2: (804): Completed authentication for connection IKEv2-PLAT-2: (804): connection auth hdl set to 1674 IKEv2-PLAT-2: (804): AAA conn attribute retrieval successfully queued for register session request. IKEv2-PLAT-2: (804): idle timeout set to: 30 IKEv2-PLAT-2: (804): session timeout set to: 0 IKEv2-PLAT-2: (804): group policy set to L2L-Ipsec IKEv2-PLAT-2: (804): class attr set IKEv2-PLAT-2: (804): tunnel protocol set to: 0x44 IKEv2-PLAT-2: (804): IPv4 filter ID not configured for connection IKEv2-PLAT-2: (804): group lock set to: none IKEv2-PLAT-2: (804): IPv6 filter ID not configured for connection IKEv2-PLAT-2: (804): connection attribues set valid to TRUE IKEv2-PLAT-2: (804): Successfully retrieved conn attrs IKEv2-PLAT-2: (804): Session registration after conn attr retrieval PASSED, No error IKEv2-PLAT-2: (804): connection auth hdl set to -1 IKEv2-PLAT-2: (804): Encrypt success status returned via ipc 1 IKEv2-PLAT-3: (804): SENT PKT [INFORMATIONAL] [103.xx.xx.xx]:500->[148.xx.xx.xx]:500 InitSPI=0x6b8abf186fdf7ba1 RespSPI=0xd0b47244cebc96ea MID=00000002 IKEv2 Recv RAW packet dump 6b 8a bf 18 6f df 7b a1 d0 b4 72 44 ce bc 96 ea | k...o.{...rD.... 2e 20 25 20 00 00 00 02 00 00 00 4c 00 00 00 30 | . % .......L...0 9c c0 a9 da c8 3c d2 d2 79 9e 27 d8 77 1a a5 76 | .....<..y.'.w..v cf e8 72 3a 3f 66 a1 f5 1c d4 a0 10 2a 37 24 76 | ..r:?f......*7$v e8 11 67 9a 07 70 8e 7e cc 29 fd 2b | ..g..p.~.).+ IKEv2-PLAT-2: (804): Decrypt success status returned via ipc 1 IKEv2-PLAT-2: (804): IKEv2 session deregistered from session manager. Reason: 8 IKEv2-PLAT-2: (804): session manager killed ikev2 tunnel. Reason: Internal Error IKEv2-PLAT-2: (804): PSH cleanup
... View more
Created by
Richard Bradfield
in Network Security
in Network Security
10-06-2019
04:23 AM
10-06-2019
04:23 AM
Mohammed, Thanks for the response, I will check this out
... View more
Created by
Richard Bradfield
in Network Security
in Network Security
10-06-2019
01:05 AM
10-06-2019
01:05 AM
There have been problems with Ransom ware sites, we have list of site IP address that cause problems, so that is easy to add to a black list group but some locations are only known by their FQDN from certain Domain servers so we blocked that Domain server as well as the FQDN for the server. so we note that when the ASA tries to get the IP address, it talks to our internal DNS,which in turn tries Google, and Telstra which in turn come back with failure for that FQDN but then it tries the blocked DNS server contunualy because it never gets a response, and the ASA keeps asking It is doing its job ok the bad sites are blocked. So my question is there a better way so the ASA does not keep trying?
... View more
Labels:
05-14-2019
03:50 PM
We tried the Tunnel-group and Group-policy name the same but still get the same problem. remember when we allow the user to select profile at login page it is ok it is only when we dont allow this. Note we use ISE 2.3 and the contractor who looks after it has tested on another ASA and is ok. please find below the relevant ASA config tunnel-group innotech type remote-access tunnel-group innotech general-attributes address-pool innotech_vpn authentication-server-group ISE authentication-server-group (inside) ISE default-group-policy innotech tunnel-group innotech webvpn-attributes group-alias innotech enable group-policy innotech internal group-policy innotech attributes wins-server none vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value split_innotech default-domain value healthecare.net webvpn anyconnect ssl keepalive 300 anyconnect dpd-interval client 120 anyconnect dpd-interval gateway 120 group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes banner none wins-server none dns-server none dhcp-network-scope none vpn-access-hours none vpn-simultaneous-logins 3 vpn-idle-timeout 30 vpn-idle-timeout alert-interval 1 vpn-session-timeout none vpn-session-timeout alert-interval 1 vpn-filter none vpn-tunnel-protocol ikev1 ssl-client ip-comp disable group-lock none pfs disable split-tunnel-policy tunnelall ipv6-split-tunnel-policy tunnelall split-tunnel-network-list none default-domain value healthecare.net split-dns none split-tunnel-all-dns disable client-bypass-protocol disable gateway-fqdn none msie-proxy server none msie-proxy method no-modify msie-proxy except-list none msie-proxy local-bypass disable msie-proxy pac-url none msie-proxy lockdown enable address-pools none ipv6-address-pools none smartcard-removal-disconnect enable security-group-tag none periodic-authentication certificate none webvpn homepage none anyconnect ssl dtls enable anyconnect mtu 1406 anyconnect firewall-rule client-interface private none anyconnect firewall-rule client-interface public none anyconnect keep-installer installed anyconnect ssl keepalive 20 anyconnect ssl rekey time none anyconnect ssl rekey method none anyconnect dpd-interval client 30 anyconnect dpd-interval gateway 30 anyconnect ssl compression none anyconnect dtls compression none anyconnect modules none anyconnect profiles none anyconnect ssl df-bit-ignore disable anyconnect routing-filtering-ignore disable tunnel-group DefaultWEBVPNGroup type remote-access tunnel-group DefaultWEBVPNGroup general-attributes no address-pool no ipv6-address-pool authentication-server-group ISE secondary-authentication-server-group none no accounting-server-group default-group-policy DfltGrpPolicy no dhcp-server no nat-assigned-to-public-ip no password-management no authorization-required username-from-certificate CN OU secondary-username-from-certificate CN OU authentication-attr-from-server primary authenticated-session-username primary tunnel-group DefaultWEBVPNGroup webvpn-attributes authentication aaa no radius-reject-message no pre-fill-username ssl-client no secondary-pre-fill-username ssl-client
... View more
05-14-2019
03:28 PM
Hi RJI, That is the problem we have it is etup as you say. but it still says no assigned address when trying to connect Does the 'Tunnel-group' and the 'Group-policy' name have to be the same? in the examples I have seen they are. that is the next thing to try at the moment the names are different.
... View more
05-14-2019
06:07 AM
Thanks for your response When you say groups are you referring to an ASA tunnel-group or are you referring to AD groups? << ASA groups All users connect on the Default tunnel-group and are you then attempting to send a different tunnel-group to the user session via authorization, is that correct? <<<< Yes
... View more
05-14-2019
12:52 AM
BB We are not using DHCP, but local pools on the ASA. and the example in the link you supplied uses local pools
... View more
05-13-2019
11:52 PM
WE have been using AnyConnect for 3rd party access to our network for some time, using local auth on the ASA, and IP addressing coming from local pools, and split tunnel ACL to control access, so when 3rd party connect they get the drop down box to select the correct group. We moved the authentication to the AD server via ISE, now ISE works ok authenticates and downloads the DACL for the correct group The next step is to remove the " tunnel-group-list enable" from webvpn We followed the video and configured the ASA as below group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 ikev2 ssl-clientless l2tp-ipsec ssl-client exit tunnel-group DefaultWEBVPNGroup general-attributes authentication-server-group ISE But now we get the message when trying to connect that there was no Ip address, and disconnects. I understand the way it should work is once the anyconnect authentication reaches the ISE, the user is linked to a specific group, which then tells the ASA to use that group for IP addressing etc. anybody help with this Security efault
... View more
Labels:
Created by
Richard Bradfield
in Network Management
in Network Management
10-22-2018
11:22 PM
10-22-2018
11:22 PM
Ok I’ll give it a go
... View more
Created by
Richard Bradfield
in Network Management
in Network Management
10-22-2018
04:43 PM
10-22-2018
04:43 PM
In my syslog I see all the normal warning, errors and critical messages
, but I dont see the following HSRP messages
Oct 22 17:24:39.326 AEDST: %HSRP-5-STATECHANGE: Vlan200 Grp 101 state Active -> Speak Oct 22 17:24:39.326 AEDST: %HSRP-5-STATECHANGE: Vlan201 Grp 204 state Active -> Speak Oct 22 17:24:39.582 AEDST: %HSRP-5-STATECHANGE: Vlan301 Grp 201 state Active -> Speak Oct 22 17:24:40.110 AEDST: %HSRP-5-STATECHANGE: Vlan100 Grp 100 state Active -> Speak Oct 22 17:24:40.350 AEDST: %HSRP-5-STATECHANGE: Vlan300 Grp 200 state Active -> Speak Oct 22 17:24:40.814 AEDST: %HSRP-5-STATECHANGE: Vlan320 Grp 202 state Active -> Speak Oct 22 17:24:40.894 AEDST: %HSRP-5-STATECHANGE: Vlan2 Grp 2 state Active -> Speak Oct 22 17:24:49.534 AEDST: %HSRP-5-STATECHANGE: Vlan201 Grp 204 state Speak -> Standby Oct 22 17:24:49.966 AEDST: %HSRP-5-STATECHANGE: Vlan301 Grp 201 state Speak -> Standby Oct 22 17:24:50.190 AEDST: %HSRP-5-STATECHANGE: Vlan200 Grp 101 state Speak -> Standby Oct 22 17:24:51.742 AEDST: %HSRP-5-STATECHANGE: Vlan320 Grp 202 state Speak -> Standby Oct 22 17:24:51.822 AEDST: %HSRP-5-STATECHANGE: Vlan300 Grp 200 state Speak -> Standby
I should see these messages as the syslog server is connected via a VPN and the source interface is a loopback which is not associated with the HSRP interfaces and is always up.
logging config as below
logging history informational logging trap debugging logging source-interface Loopback10 logging snmp-trap emergencies logging snmp-trap alerts logging snmp-trap critical logging snmp-trap errors logging snmp-trap warnings logging snmp-trap informational logging host 10.1..xx.xx
... View more
Labels:
Created by
Richard Bradfield
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-24-2018
05:20 PM
09-24-2018
05:20 PM
Y
OK I was looking at logic the other way round, this is how it works
with a Boolean “AND” function requires that each object in the list be in an up state for the tracked object
to be up. A tracked list with a Boolean “OR” function needs only one object in the list to be in the up state for the tracked object to be up.
... View more
Created by
Richard Bradfield
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-24-2018
02:57 PM
09-24-2018
02:57 PM
How does the boolean "and" "or" work
to me it seems logical that in your example if 1 or 2 went down then it would trigger as you used "or" and if you used "and" then both 1 and 2 would be needed to trigger it.
... View more
03-01-2020
the tunnel came up when I did acrypto map outside_map 15 set
nat-t-disablebut still not passing traf...
03-01-2020
Below is the debug I am getting on the ASA, I find Meraki support not
very helpfulPasses phase 1 but...
Created by
Richard Bradfield
in Network Security
10-06-2019
10-06-2019
Mohammed,Thanks for the response, I will check this out
Created by
Richard Bradfield
in Network Security
10-06-2019
10-06-2019
There have been problems with Ransom ware sites,we have list of site IP
address that cause problems,...
05-14-2019
We tried the Tunnel-group and Group-policy name the same but still get
the same problem.remember whe...
05-14-2019
Hi RJI,That is the problem we have it is etup as you say. but it still
says no assigned address when...
05-14-2019
Thanks for your response When you say groups are you referring to an ASA
tunnel-group or are you ref...
05-14-2019
BBWe are not using DHCP, but local pools on the ASA.and the example in
the link you supplied uses lo...
05-13-2019
WE have been using AnyConnect for 3rd party access to our network for
some time, using local auth on...
Created by
Richard Bradfield
in Network Management
10-22-2018
10-22-2018
In my syslog I see all the normal warning, errors and critical messages
, but I dont see the followi...
09-24-2018
Y OK I was looking at logic the other way round, this is how it works
with a Boolean “AND” function ...
Public Statistics
| Date Registered | 10-19-2005 07:29 PM |
| Date Last Visited | 03-04-2020 12:17 AM |
| Total Messages Posted | 1,084 |
| Total Helpful Votes Received | 315 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
