Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Richard Bradfield
05-22-2019
Richard Bradfield
Frequent Contributor
I have been working with Cisco gear since 1993, I was CCIE2947, but for the last ten years till my retirement in April 2015, i worked for a food company as a Senior Communications Engineer. Although now retired I like to keep the grey matter ticking over by helping people on the support forum.
Recent Badges
Stats
Member since
10-19-2005
1079
Posts
300
Helpful
60
Solutions
Created by
Richard Bradfield
in VPN and AnyConnect
in VPN and AnyConnect
05-15-2019
03:12 PM
05-15-2019
03:12 PM
RJI , thanks for all your help. that fixed it!!
... View more
Created by
Richard Bradfield
in VPN and AnyConnect
in VPN and AnyConnect
05-14-2019
03:50 PM
05-14-2019
03:50 PM
We tried the Tunnel-group and Group-policy name the same but still get the same problem. remember when we allow the user to select profile at login page it is ok it is only when we dont allow this. Note we use ISE 2.3 and the contractor who looks after it has tested on another ASA and is ok. please find below the relevant ASA config tunnel-group innotech type remote-access tunnel-group innotech general-attributes address-pool innotech_vpn authentication-server-group ISE authentication-server-group (inside) ISE default-group-policy innotech tunnel-group innotech webvpn-attributes group-alias innotech enable group-policy innotech internal group-policy innotech attributes wins-server none vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value split_innotech default-domain value healthecare.net webvpn anyconnect ssl keepalive 300 anyconnect dpd-interval client 120 anyconnect dpd-interval gateway 120 group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes banner none wins-server none dns-server none dhcp-network-scope none vpn-access-hours none vpn-simultaneous-logins 3 vpn-idle-timeout 30 vpn-idle-timeout alert-interval 1 vpn-session-timeout none vpn-session-timeout alert-interval 1 vpn-filter none vpn-tunnel-protocol ikev1 ssl-client ip-comp disable group-lock none pfs disable split-tunnel-policy tunnelall ipv6-split-tunnel-policy tunnelall split-tunnel-network-list none default-domain value healthecare.net split-dns none split-tunnel-all-dns disable client-bypass-protocol disable gateway-fqdn none msie-proxy server none msie-proxy method no-modify msie-proxy except-list none msie-proxy local-bypass disable msie-proxy pac-url none msie-proxy lockdown enable address-pools none ipv6-address-pools none smartcard-removal-disconnect enable security-group-tag none periodic-authentication certificate none webvpn homepage none anyconnect ssl dtls enable anyconnect mtu 1406 anyconnect firewall-rule client-interface private none anyconnect firewall-rule client-interface public none anyconnect keep-installer installed anyconnect ssl keepalive 20 anyconnect ssl rekey time none anyconnect ssl rekey method none anyconnect dpd-interval client 30 anyconnect dpd-interval gateway 30 anyconnect ssl compression none anyconnect dtls compression none anyconnect modules none anyconnect profiles none anyconnect ssl df-bit-ignore disable anyconnect routing-filtering-ignore disable tunnel-group DefaultWEBVPNGroup type remote-access tunnel-group DefaultWEBVPNGroup general-attributes no address-pool no ipv6-address-pool authentication-server-group ISE secondary-authentication-server-group none no accounting-server-group default-group-policy DfltGrpPolicy no dhcp-server no nat-assigned-to-public-ip no password-management no authorization-required username-from-certificate CN OU secondary-username-from-certificate CN OU authentication-attr-from-server primary authenticated-session-username primary tunnel-group DefaultWEBVPNGroup webvpn-attributes authentication aaa no radius-reject-message no pre-fill-username ssl-client no secondary-pre-fill-username ssl-client
... View more
Created by
Richard Bradfield
in VPN and AnyConnect
in VPN and AnyConnect
05-14-2019
03:28 PM
05-14-2019
03:28 PM
Hi RJI, That is the problem we have it is etup as you say. but it still says no assigned address when trying to connect Does the 'Tunnel-group' and the 'Group-policy' name have to be the same? in the examples I have seen they are. that is the next thing to try at the moment the names are different.
... View more
Created by
Richard Bradfield
in VPN and AnyConnect
in VPN and AnyConnect
05-14-2019
06:07 AM
05-14-2019
06:07 AM
Thanks for your response When you say groups are you referring to an ASA tunnel-group or are you referring to AD groups? << ASA groups All users connect on the Default tunnel-group and are you then attempting to send a different tunnel-group to the user session via authorization, is that correct? <<<< Yes
... View more
Created by
Richard Bradfield
in VPN and AnyConnect
in VPN and AnyConnect
05-14-2019
12:52 AM
05-14-2019
12:52 AM
BB We are not using DHCP, but local pools on the ASA. and the example in the link you supplied uses local pools
... View more
Created by
Richard Bradfield
in VPN and AnyConnect
in VPN and AnyConnect
05-13-2019
11:52 PM
05-13-2019
11:52 PM
WE have been using AnyConnect for 3rd party access to our network for some time, using local auth on the ASA, and IP addressing coming from local pools, and split tunnel ACL to control access, so when 3rd party connect they get the drop down box to select the correct group. We moved the authentication to the AD server via ISE, now ISE works ok authenticates and downloads the DACL for the correct group The next step is to remove the " tunnel-group-list enable" from webvpn We followed the video and configured the ASA as below group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 ikev2 ssl-clientless l2tp-ipsec ssl-client exit tunnel-group DefaultWEBVPNGroup general-attributes authentication-server-group ISE But now we get the message when trying to connect that there was no Ip address, and disconnects. I understand the way it should work is once the anyconnect authentication reaches the ISE, the user is linked to a specific group, which then tells the ASA to use that group for IP addressing etc. anybody help with this Security efault
... View more
Labels:
Created by
Richard Bradfield
in Network Management
in Network Management
10-22-2018
11:22 PM
10-22-2018
11:22 PM
Ok I’ll give it a go
... View more
Created by
Richard Bradfield
in Network Management
in Network Management
10-22-2018
04:43 PM
10-22-2018
04:43 PM
In my syslog I see all the normal warning, errors and critical messages
, but I dont see the following HSRP messages
Oct 22 17:24:39.326 AEDST: %HSRP-5-STATECHANGE: Vlan200 Grp 101 state Active -> Speak Oct 22 17:24:39.326 AEDST: %HSRP-5-STATECHANGE: Vlan201 Grp 204 state Active -> Speak Oct 22 17:24:39.582 AEDST: %HSRP-5-STATECHANGE: Vlan301 Grp 201 state Active -> Speak Oct 22 17:24:40.110 AEDST: %HSRP-5-STATECHANGE: Vlan100 Grp 100 state Active -> Speak Oct 22 17:24:40.350 AEDST: %HSRP-5-STATECHANGE: Vlan300 Grp 200 state Active -> Speak Oct 22 17:24:40.814 AEDST: %HSRP-5-STATECHANGE: Vlan320 Grp 202 state Active -> Speak Oct 22 17:24:40.894 AEDST: %HSRP-5-STATECHANGE: Vlan2 Grp 2 state Active -> Speak Oct 22 17:24:49.534 AEDST: %HSRP-5-STATECHANGE: Vlan201 Grp 204 state Speak -> Standby Oct 22 17:24:49.966 AEDST: %HSRP-5-STATECHANGE: Vlan301 Grp 201 state Speak -> Standby Oct 22 17:24:50.190 AEDST: %HSRP-5-STATECHANGE: Vlan200 Grp 101 state Speak -> Standby Oct 22 17:24:51.742 AEDST: %HSRP-5-STATECHANGE: Vlan320 Grp 202 state Speak -> Standby Oct 22 17:24:51.822 AEDST: %HSRP-5-STATECHANGE: Vlan300 Grp 200 state Speak -> Standby
I should see these messages as the syslog server is connected via a VPN and the source interface is a loopback which is not associated with the HSRP interfaces and is always up.
logging config as below
logging history informational logging trap debugging logging source-interface Loopback10 logging snmp-trap emergencies logging snmp-trap alerts logging snmp-trap critical logging snmp-trap errors logging snmp-trap warnings logging snmp-trap informational logging host 10.1..xx.xx
... View more
Labels:
Created by
Richard Bradfield
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-24-2018
05:20 PM
09-24-2018
05:20 PM
Y
OK I was looking at logic the other way round, this is how it works
with a Boolean “AND” function requires that each object in the list be in an up state for the tracked object
to be up. A tracked list with a Boolean “OR” function needs only one object in the list to be in the up state for the tracked object to be up.
... View more
Created by
Richard Bradfield
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-24-2018
02:57 PM
09-24-2018
02:57 PM
How does the boolean "and" "or" work
to me it seems logical that in your example if 1 or 2 went down then it would trigger as you used "or" and if you used "and" then both 1 and 2 would be needed to trigger it.
... View more
Created by
Richard Bradfield
in Routing
in Routing
05-29-2018
01:27 AM
05-29-2018
01:27 AM
trouble is, it is very intermittent perhaps goes a few weeks without a problem. I am thinking of removing the dialer down-with-vinterface on this router as not an alternate route anyway.we'll see how it goes thanks for your input
... View more
Created by
Richard Bradfield
in Routing
in Routing
05-29-2018
01:05 AM
05-29-2018
01:05 AM
also 15.6.3 M4 is MD that is why I am upgrading to that one.
... View more
Created by
Richard Bradfield
in Routing
in Routing
05-29-2018
12:40 AM
05-29-2018
12:40 AM
we are running 156-3.M1 will be 156-3.M4 at next reload
... View more
Created by
Richard Bradfield
in Routing
in Routing
05-28-2018
07:05 PM
05-28-2018
07:05 PM
I have seen this problem a number of times on our Cisco 897 routers.
if the ATM interface flaps the virtual interface comes back up but the Dialer interface stays down.
It seems the only way to recover is to reload the router.
below is relevant config and output fro sh int di 1 when down
anybody else seen this problem?
interface ATM0 no ip address no atm ilmi-keepalive ! interface ATM0.1 point-to-point pvc 8/35 encapsulation aal5mux ppp dialer dialer pool-member 1 !
interface Dialer1 ip address negotiated ip access-group Internet-ACL in ip nat outside ip virtual-reassembly in encapsulation ppp ip tcp adjust-mss 1452 dialer pool 1 dialer idle-timeout 0 dialer down-with-vInterface dialer-group 1 ppp authentication chap callin ppp chap hostname xxxx.xxx ppp chap password yyyyyy
below is sh int di 1
Dialer1 is down, line protocol is down Hardware is Unknown Internet address is xx.xx.xx.xx/32 MTU 1500 bytes, BW 56 Kbit/sec, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation PPP, LCP Closed, loopback not set Keepalive set (10 sec) DTR is pulsed for 1 seconds on reset Interface is bound to Vi2 Last input never, output never, output hang never Last clearing of "show interface" counters 07:24:21 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 300842 packets input, 210743258 bytes 305884 packets output, 64407064 bytes Bound to: Virtual-Access2 is up, line protocol is up Hardware is Virtual Access interface MTU 1500 bytes, BW 747 Kbit/sec, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation PPP, LCP Open Stopped: CDPCP Open: IPCP PPPoATM vaccess, cloned from Dialer1 Vaccess status 0x44 Bound to ATM0.1 VCD: 1, VPI: 8, VCI: 35, loopback not set Keepalive set (10 sec) DTR is pulsed for 5 seconds on reset Interface is bound to Di1 (Encapsulation PPP) Last input 00:00:03, output never, output hang never Last clearing of "show interface" counters 07:22:33 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 304391 packets input, 210956216 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 305936 packets output, 64408106 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions
... View more
Labels:
02-10-2018
04:10 AM
the delay should be longer than the timeout so you know the ping has failed.You can adjust the timeout *(config-ip-sla-echo)#timeout ? <0-604800000> Timeout in milliseconds* So say you ping every 5 seconds and adjust the timeout to 3 seconds then lets say a ping fails and we set the tracking delay to 9 seconds, so that ensures that 2 consecutive pings have failed before you say it is down, and it will come up after the delay in the up time after a successful ping.
... View more
Created by
Richard Bradfield
in VPN and AnyConnect
05-15-2019
05-15-2019
RJI ,thanks for all your help.that fixed it!!
Created by
Richard Bradfield
in VPN and AnyConnect
05-14-2019
05-14-2019
We tried the Tunnel-group and Group-policy name the same but still get
the same problem.remember whe...
Created by
Richard Bradfield
in VPN and AnyConnect
05-14-2019
05-14-2019
Hi RJI,That is the problem we have it is etup as you say. but it still
says no assigned address when...
Created by
Richard Bradfield
in VPN and AnyConnect
05-14-2019
05-14-2019
Thanks for your response When you say groups are you referring to an ASA
tunnel-group or are you ref...
Created by
Richard Bradfield
in VPN and AnyConnect
05-14-2019
05-14-2019
BBWe are not using DHCP, but local pools on the ASA.and the example in
the link you supplied uses lo...
Created by
Richard Bradfield
in VPN and AnyConnect
05-13-2019
05-13-2019
WE have been using AnyConnect for 3rd party access to our network for
some time, using local auth on...
Created by
Richard Bradfield
in Network Management
10-22-2018
10-22-2018
In my syslog I see all the normal warning, errors and critical messages
, but I dont see the followi...
09-24-2018
Y OK I was looking at logic the other way round, this is how it works
with a Boolean “AND” function ...
09-24-2018
How does the boolean "and" "or" work to me it seems logical that in your
example if 1 or 2 went down...
Created by
Richard Bradfield
in Routing
05-29-2018
05-29-2018
trouble is, it is very intermittent perhaps goes a few weeks without
aproblem.I am thinking of remov...
Created by
Richard Bradfield
in Routing
05-29-2018
05-29-2018
also 15.6.3 M4 is MD that is why I am upgrading to that one.
Created by
Richard Bradfield
in Routing
05-29-2018
05-29-2018
we are running 156-3.M1 will be 156-3.M4 at next reload
Created by
Richard Bradfield
in Routing
05-28-2018
05-28-2018
I have seen this problem a number of times on our Cisco 897 routers. if
the ATM interface flaps the ...
Public Statistics
| Date Registered | 10-19-2005 07:29 PM |
| Date Last Visited | 05-22-2019 12:07 AM |
| Total Messages Posted | 1,079 |
| Total Helpful Votes Received | 300 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 3 |
.jpg "VIP Advocate"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
