About David White

David White · ‎07-21-2016

Hi hroi, Smart Call-home is not tied to licensing. If Smart Call-home is not functioning (or not able to talk to Cisco) it will have zero impact on the operations of the firewall itself. Sincerely, David.

David White · ‎09-15-2015

Show Name: The Cisco Security Ninja Program Contributors: David White Jr., Magnus Mortensen, Chris Romeo Posting Date: September 22, 2015 Description: The podcast crew invites back a special return guest - Mr. Chris Romeo - to share with the world Cisco's Security Ninja program. Which is an educational arm of Cisco Secure Development Lifecycle (CSDL). The intent of this episode is to educate listeners about Cisco's internal Ninja program and to also help our listeners start their own Security education program within their company. Listen Now (MP3 27.9 MB; 29:04 mins) Subscribe to the Podcast in iTunes by clicking the image below: About the Cisco TAC Security Podcast The Cisco TAC Security Podcast Series is created by Cisco TAC engineers. Each show provides an in-depth technical discussion of Cisco product security features, with emphasis on troubleshooting. Complete show listing and show information Show Notes Example Slides Example slide deck showing how the Ninja modules are structured Content from a White Belt Module

David White · ‎05-28-2014

Hi Sam, Ok, I had an idea... and just tested this myself. You can specify the port by following the mail server's IP with a colon and then the port number. Example: call-home mail-server 192.168.1.4:587 The ASA accepts this (even though it isn't documented) and treats it as the destination port to use. Hope it helps! David.

David White · ‎05-28-2014

Why yes there is! :-) Have a look here: https://supportforums.cisco.com/document/57466/asa-smart-call-home-common-uses-and-periodic-monitoring However, the ASA does not provide the ability to specify the SMTP server's port number. Do you have another device you can use to port address translate the destination traffic? Or an internal mail server you can use? Sincerely, David.

David White · ‎04-17-2014

Hi Adil, Sure, sounds great. Email us directly: securityshow [at] cisco.com so we can work out the details! Sincerely, David.

David White · ‎03-06-2014

Hi Roel, This specific issue was fixed in 8.4(3), and confirmed by many customers. Therefore, if you are experiencing a similar issue, I would suggest opening a TAC case so we can investigate further and get it resolved. Thanks in advance! David.

David White · ‎03-05-2014

Hi Constantinos, Based on your description, I am not sure your symptoms match that of this bug. But your version is succeptible to it. That said, this forum is for discussing particular bugs. For help with your issue you can either post in the proper technology forum or open a TAC case for additional analysis. However, more details would be needed about the failure condition, and what is done to recover. Sincerely, David.

David White · ‎02-19-2014

Great, glad to hear everything is working for you now. Sincerely, David.

David White · ‎02-19-2014

Hi Boian, Can you confirm that the server is accessible externally? Since you said a partner was able to access it? Note: You cannot access the server by it's NATed/PATed IP from the inside. Sincerely, David.

David White · ‎02-19-2014

Hi Boian, You will never be able to connect to the NATed/PATed (ie: Public IP) from the Inside network of the ASA. This is just how the ASA is designed. If your client is located off the internal interface, then you need to connect to the Real IP of the server. If you want to test your configuration, you must test from a device located on the Outside interface. For the syslogs, if an interface ACL was blocking the packet (even the implicit deny at the bottom), you would see syslog messages 106023 or 106100. Syslog 710003 has a different meaning/purpose. It is specific to access attempts to services hosted by the ASA - which essentially tells me your NAT rule is not working. Sincerely, David.

David White · ‎02-19-2014

Hi Rainer, If you practice good security policies (SSH / ASDM with AAA), then only authorized users will have access to your PIX. Any security issues related to Cisco's products are publicly disclosed at: www.cisco.com/go/psirt I personally do not see the value of placing another security device in front of the PIX, mearly to attempt to protect the PIX. Sincerely, David.

David White · ‎02-19-2014

Hi Boian, Please note that I CAN SOLVE YOUR PROBLEM, but only if you supply the information I request. If the syslog includes the text, "TCP access denied by ACL", then I must assume that this is syslog 710003, in which case you are not hitting the interface ACL, but instead an implicit ACL which is applied to traffic destined "to-us" for services the ASA hosts. But, this shouldn't be happening, as a static PAT statement will override locally hosted services. Can you check the output of "show nat"? Sincerely, David.

David White · ‎02-19-2014

Can you capture the syslogs (at level 6) when you attempt to access the web server from the outside? That should help clear things up. You can also try running packet-tracer sourced from the outside client, destined to the outside interface IP on tcp/80 to see what it shows. Sincerely, David.

David White · ‎02-19-2014

That is correct. There is no inheritence of policy based commands from the physical interface to sub-interfaces. Sincerely, David.

David White · ‎02-19-2014

Hi Boian, Ok, you have a few problems - but all with the same root issue. When you overload on an Interface IP, you need to leverage the keyword "interface" in both the static and ACL statements. For example, if you want to allow users to connect to the outside interface on TCP/80 and have that PATed to an internal web server on port 80, you must use the syntax: static (inside,outside) tcp interface www 192.168.2.2 www netmask 255.255.255.255 Additionally, when you permit the traffic inbound to the outside interface, you need to leverage the 'interface' keyword: access-list OUTSIDE_IN extended permit tcp any interface outside eq www Sincerely, David.

Date Registered	‎10-26-2001 02:00 PM
Date Last Visited	‎08-31-2018 12:01 AM
Total Messages Posted	285
Total Helpful Votes Received	270

Hi hroi,

TAC Security Podcast Episode #47- The C...

Hi Sam, Ok, I had an idea...

Why yes there is! :-)Have a

Hi Adil, Sure, sounds great.

CSCtr16184 - To-the-box traffic fails f...

CSCuh56175 - SRTP to RTP Interworking o...

Cannot port forward 80 443 (ASA 5510 V8...

Cannot port forward 80 443 (ASA 5510 V8...

Cannot port forward 80 443 (ASA 5510 V8...

Bridged F/W in front of PIX?

Cannot port forward 80 443 (ASA 5510 V8...

Cannot port forward 80 443 (ASA 5510 V8...

if we enable IP audit feature in physic...

Cannot port forward 80 443 (ASA 5510 V8...