Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About David White
08-31-2018
David White
Member since
10-26-2001
Cisco Employee
07-21-2016
10:30 AM
Hi hroi,
Smart Call-home is not tied to licensing. If Smart Call-home is not functioning (or not able to talk to Cisco) it will have zero impact on the operations of the firewall itself.
Sincerely,
David.
... View more
Created by
David White
in Security Documents
in Security Documents
09-15-2015
11:22 AM
09-15-2015
11:22 AM
Show Name: The Cisco Security Ninja Program
Contributors: David White Jr., Magnus Mortensen, Chris Romeo
Posting Date: September 22, 2015
Description: The podcast crew invites back a special return guest - Mr. Chris Romeo - to share with the world Cisco's Security Ninja program. Which is an educational arm of Cisco Secure Development Lifecycle (CSDL). The intent of this episode is to educate listeners about Cisco's internal Ninja program and to also help our listeners start their own Security education program within their company.
Listen Now (MP3 27.9 MB; 29:04 mins)
Subscribe to the Podcast in iTunes by clicking the image below:
About the Cisco TAC Security Podcast
The Cisco TAC Security Podcast Series is created by Cisco TAC engineers. Each show provides an in-depth technical discussion of Cisco product security features, with emphasis on troubleshooting.
Complete show listing and show information
Show Notes
Example Slides
Example slide deck showing how the Ninja modules are structured
Content from a White Belt Module
... View more
Labels:
05-28-2014
12:37 PM
Hi Sam, Ok, I had an idea... and just tested this myself. You can specify the port by following the mail server's IP with a colon and then the port number. Example: call-home mail-server 192.168.1.4:587 The ASA accepts this (even though it isn't documented) and treats it as the destination port to use. Hope it helps! David.
... View more
05-28-2014
11:25 AM
Why yes there is! :-) Have a look here: https://supportforums.cisco.com/document/57466/asa-smart-call-home-common-uses-and-periodic-monitoring However, the ASA does not provide the ability to specify the SMTP server's port number. Do you have another device you can use to port address translate the destination traffic? Or an internal mail server you can use? Sincerely, David.
... View more
04-17-2014
01:46 PM
Hi Adil, Sure, sounds great. Email us directly: securityshow [at] cisco.com so we can work out the details! Sincerely, David.
... View more
Created by
David White
in Cisco Bug Discussions
in Cisco Bug Discussions
03-06-2014
06:02 AM
03-06-2014
06:02 AM
Hi Roel, This specific issue was fixed in 8.4(3), and confirmed by many customers. Therefore, if you are experiencing a similar issue, I would suggest opening a TAC case so we can investigate further and get it resolved. Thanks in advance! David.
... View more
Created by
David White
in Cisco Bug Discussions
in Cisco Bug Discussions
03-05-2014
06:44 AM
03-05-2014
06:44 AM
Hi Constantinos, Based on your description, I am not sure your symptoms match that of this bug. But your version is succeptible to it. That said, this forum is for discussing particular bugs. For help with your issue you can either post in the proper technology forum or open a TAC case for additional analysis. However, more details would be needed about the failure condition, and what is done to recover. Sincerely, David.
... View more
02-19-2014
11:33 AM
Great, glad to hear everything is working for you now. Sincerely, David.
... View more
02-19-2014
10:13 AM
Hi Boian, Can you confirm that the server is accessible externally? Since you said a partner was able to access it? Note: You cannot access the server by it's NATed/PATed IP from the inside. Sincerely, David.
... View more
02-19-2014
08:52 AM
Hi Boian, You will never be able to connect to the NATed/PATed (ie: Public IP) from the Inside network of the ASA. This is just how the ASA is designed. If your client is located off the internal interface, then you need to connect to the Real IP of the server. If you want to test your configuration, you must test from a device located on the Outside interface. For the syslogs, if an interface ACL was blocking the packet (even the implicit deny at the bottom), you would see syslog messages 106023 or 106100. Syslog 710003 has a different meaning/purpose. It is specific to access attempts to services hosted by the ASA - which essentially tells me your NAT rule is not working. Sincerely, David.
... View more
02-19-2014
08:44 AM
Hi Rainer, If you practice good security policies (SSH / ASDM with AAA), then only authorized users will have access to your PIX. Any security issues related to Cisco's products are publicly disclosed at: www.cisco.com/go/psirt I personally do not see the value of placing another security device in front of the PIX, mearly to attempt to protect the PIX. Sincerely, David.
... View more
02-19-2014
08:34 AM
Hi Boian, Please note that I CAN SOLVE YOUR PROBLEM, but only if you supply the information I request. If the syslog includes the text, "TCP access denied by ACL", then I must assume that this is syslog 710003, in which case you are not hitting the interface ACL, but instead an implicit ACL which is applied to traffic destined "to-us" for services the ASA hosts. But, this shouldn't be happening, as a static PAT statement will override locally hosted services. Can you check the output of "show nat"? Sincerely, David.
... View more
02-19-2014
07:56 AM
Can you capture the syslogs (at level 6) when you attempt to access the web server from the outside? That should help clear things up. You can also try running packet-tracer sourced from the outside client, destined to the outside interface IP on tcp/80 to see what it shows. Sincerely, David.
... View more
02-19-2014
06:31 AM
That is correct. There is no inheritence of policy based commands from the physical interface to sub-interfaces. Sincerely, David.
... View more
02-19-2014
06:29 AM
Hi Boian, Ok, you have a few problems - but all with the same root issue. When you overload on an Interface IP, you need to leverage the keyword "interface" in both the static and ACL statements. For example, if you want to allow users to connect to the outside interface on TCP/80 and have that PATed to an internal web server on port 80, you must use the syntax: static (inside,outside) tcp interface www 192.168.2.2 www netmask 255.255.255.255 Additionally, when you permit the traffic inbound to the outside interface, you need to leverage the 'interface' keyword: access-list OUTSIDE_IN extended permit tcp any interface outside eq www Sincerely, David.
... View more
07-21-2016 10:30 AM
Hi hroi, Smart Call-home is not tied to licensing. If Smart Call-home is
not functioning (or not abl...
Created by
David White
in Security Documents
09-15-2015 11:22 AM
09-15-2015 11:22 AM
Show Name: The Cisco Security Ninja Program Contributors: David White
Jr., Magnus Mortensen, Chris R...
05-28-2014 12:37 PM
Hi Sam, Ok, I had an idea... and just tested this myself. You can
specify the port by following the ...
05-28-2014 11:25 AM
Why yes there is! :-)Have a look
here:https://supportforums.cisco.com/document/57466/asa-smart-call-...
04-17-2014 01:46 PM
Hi Adil, Sure, sounds great. Email us directly: securityshow [at]
cisco.com so we can work out the d...
Created by
David White
in Cisco Bug Discussions
03-06-2014 06:02 AM
03-06-2014 06:02 AM
Hi Roel,This specific issue was fixed in 8.4(3), and confirmed by many
customers.Therefore, if you a...
Created by
David White
in Cisco Bug Discussions
03-05-2014 06:44 AM
03-05-2014 06:44 AM
Hi Constantinos,Based on your description, I am not sure your symptoms
match that of this bug. But y...
02-19-2014 10:13 AM
Hi Boian,Can you confirm that the server is accessible externally? Since
you said a partner was able...
02-19-2014 08:52 AM
Hi Boian,You will never be able to connect to the NATed/PATed (ie:
Public IP) from the Inside networ...
02-19-2014 08:44 AM
Hi Rainer,If you practice good security policies (SSH / ASDM with AAA),
then only authorized users w...
02-19-2014 08:34 AM
Hi Boian,Please note that I CAN SOLVE YOUR PROBLEM, but only if you
supply the information I request...
02-19-2014 07:56 AM
Can you capture the syslogs (at level 6) when you attempt to access the
web server from the outside?...
Created by
David White
in Firewalls
02-19-2014 06:31 AM
02-19-2014 06:31 AM
That is correct. There is no inheritence of policy based commands from
the physical interface to sub...
Public Statistics
| Date Registered | 10-26-2001 02:00 PM |
| Date Last Visited | 08-31-2018 12:01 AM |
| Total Messages Posted | 285 |
| Total Helpful Votes Received | 275 |
Helpful Votes Given To
.jpg "Hall of Fame Cisco Employee"){kind=icon}
Helpful Votes From
