Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About craig bache
Stats
Member since
06-01-2005
85
Posts
5
Helpful
4
Solutions
Created by
craig bache
in Network Access Control
in Network Access Control
02-05-2015
01:07 PM
02-05-2015
01:07 PM
Hi All I am hoping someone could help with the following, I have a ACS 5.6 patch 2 running on a VM. When adding new AAA clients the ACS is seeing latency and in the AD debug logs we are seeing: acs adclient[8921]: WARN <fd:56 MS-RPC user authentication > daemon.ipcserver writeMsg failed: Broken pipe -- disconnecting client. acs adclient[8921]: INFO <main> util.threadpool 30 threads busy. If this happens often, increase max thread count I have been trying to find out if the thread count would maybe get stuck as this is a connection to the AD server, or maybe the AD server is not responding so the ACS opens a new thread causing it to run out (hit the max) This is AAA clients are being migrated from ACS 4.2 which connects to the same AD with no issues. Any help much appreciated ....... Regards Craig
... View more
Labels:
07-22-2014
12:49 AM
Hi Kanwal Thanks for the response, I take it this will be a predictable cookie as the value is static. Regards Craig
... View more
07-21-2014
11:43 AM
HI Kanwal Thank you for the response, I take it this command was introduced in A4. I have checked the configuration guide on the latest software for the ACE20 and I have not been able to see this setting. Regards Craig
... View more
07-21-2014
11:05 AM
Hi All I am hoping someone can help with the following on the Cisco ACE, this is the ACE20. A scan of our environment has revealed a vulnerability in the application hosted on ACE Load Balancer due to ACE inserting a predictable cookie for sticky http sessions. The cookie type used is cookie insert browser-expire, I believe this is expected as the cookie value is derived from a combination from the serverfarm name, rserver name, and rserver port. Is there anyway to changed this so the cookie is not predictable.... Thanks Craig
... View more
Labels:
02-25-2014
08:44 AM
Hi All I am having an issue with the Scansafe proxies and these showing as unreachable but most of the time reachable, I don't change anything. 9.1(2) Primary: Proxy411.scansafe.net (80.254.147.163) (UNREACHABLE) for last 3 hours 24 mins, tried to connect 193817 times Backup: Proxy137.scansafe.net (80.254.152.99) (UNREACHABLE) for last 3 hours 21 mins, tried to connect 224595 times ASA# debug scansafe 255 debug scansafe enabled at level 255 ASA# Checking the scansafe L7 whitelist and redirect rules Could not get the user details! Could not get the username from the flow! Redirecting packets Scansafe cloud is down; switching to allow as default action! Any help much appreciate.. Regards Craig
... View more
Labels:
02-21-2014
10:53 AM
Hi Jon/ Marvin Thank you for the response. I will change the configuration to match Regards Craig
... View more
02-21-2014
10:24 AM
Hi All Hopefully some one can help? I have a setup of wireless clients that are not able to connect to the internet. I can see packets on both the Wireless-DMZ and outside interfaces, but I can see from the logging the following. Feb 21 2014 18:06:03: %ASA-7-609001: Built local-host WIRELESS-DMZ:192.168.87.210 Feb 21 2014 18:06:03: %ASA-6-305011: Built dynamic UDP translation from WIRELESS-DMZ:192.168.87.210/56197 to OUTSIDE:x.x.x.x/53547 Feb 21 2014 18:06:03: %ASA-6-302015: Built outbound UDP connection 21496269 for OUTSIDE:8.8.4.4/53 (8.8.4.4/53) to WIRELESS-DMZ:192.168.87.210/56197 (x.x.x.x/53547) Feb 21 2014 18:06:03: %ASA-6-110003: Routing failed to locate next hop for UDP from OUTSIDE:8.8.4.4/53 to WIRELESS-DMZ:192.168.87.210/56197 Feb 21 2014 18:06:03: %ASA-6-302016: Teardown UDP connection 21496269 for OUTSIDE:8.8.4.4/53 to WIRELESS-DMZ:192.168.87.210/56197 duration 0:00:00 bytes 210 NHSE-SW-ASA01/act# Feb 21 2014 18:06:03: %ASA-7-609001: Built local-host WIRELESS-DMZ:192.168.87.210 Feb 21 2014 18:06:03: %ASA-6-305011: Built dynamic UDP translation from WIRELESS-DMZ:192.168.87.210/56197 to OUTSIDE:x.x.x.x/53547 Feb 21 2014 18:06:03: %ASA-6-302015: Built outbound UDP connection 21496269 for OUTSIDE:8.8.4.4/53 (8.8.4.4/53) to WIRELESS-DMZ:192.168.87.210/56197 (x.x.x.x/53547) Feb 21 2014 18:06:03: %ASA-6-110003: Routing failed to locate next hop for UDP from OUTSIDE:8.8.4.4/53 to WIRELESS-DMZ:192.168.87.210/56197 Feb 21 2014 18:06:03: %ASA-6-302016: Teardown UDP connection 21496269 for OUTSIDE:8.8.4.4/53 to WIRELESS-DMZ:192.168.87.210/56197 duration 0:00:00 bytes 210 NAT CONFIG SE-SW-ASA01/act# sh run nat nat (WIRELESS-DMZ) 1 192.168.0.0 255.255.0.0 sh run global global (OUTSIDE) 1 x.x.x.x Interface gig 0/2 has 2 sub interfaces, SW-ASA01/act# sh run int Ethernet0/2.666 ! interface Ethernet0/2.666 vlan 666 nameif WIRELESS-DMZ security-level 50 ip address 192.168.84.1 255.255.254.0 Connected ROUTE SW-ASA01/act# sh route wiRELESS-DMZ C 192.168.84.0 255.255.254.0 is directly connected, WIRELESS-DMZ ARP TABLE SW-ASA01/act# sh arp WIRELESS-DMZ 192.168.87.199 a0ed.cda1.8725 3 WIRELESS-DMZ 192.168.87.210 b09f.bab3.d860 7 WIRELESS-DMZ 192.168.87.219 b09f.bac8.fa8f 579 WIRELESS-DMZ 192.168.87.202 a888.0856.b5d3 3197 WIRELESS-DMZ 192.168.87.146 6c88.140c.552c 3486 WIRELESS-DMZ 192.168.87.145 0c30.218a.5fd4 3492 WIRELESS-DMZ 192.168.87.218 b09f.bac8.6ddd 3585 WIRELESS-DMZ 192.168.87.212 8cfa.ba4a.4b1e 3632 WIRELESS-DMZ 192.168.87.217 4874.6e54.ceb4 3641 WIRELESS-DMZ 192.168.87.209 6c88.140c.5a80 3787 WIRELESS-DMZ 192.168.87.213 6c88.1409.6f64 4210 WIRELESS-DMZ 192.168.87.141 843a.4bae.74d8 5470 WIRELESS-DMZ 192.168.87.195 6c88.140c.5a38 6292 WIRELESS-DMZ 192.168.87.206 444c.0cda.b1e1 7206 WIRELESS-DMZ 192.168.87.182 cc78.5fb6.79a9 7347 WIRELESS-DMZ 192.168.87.181 0c30.2193.a477 7385 WIRELESS-DMZ 192.168.87.198 a0ed.cd9d.395a 9394 WIRELESS-DMZ 192.168.87.192 6c88.1409.ec90 9447 WIRELESS-DMZ 192.168.87.211 ec35.86d0.af7d 12006 ERROR MESSAGE 1: 17:48:19.786671 8.8.4.4.53 > 192.168.87.210.56759: udp 179 Drop-reason: (no-adjacency) No valid adjacency 2: 17:48:20.787251 8.8.4.4.53 > 192.168.87.210.56759: udp 179 3: 17:48:23.800800 8.8.8.8.53 > 192.168.87.210.56759: udp 179 Drop-reason: (no-adjacency) No valid adjacency 4: 17:48:24.802921 8.8.8.8.53 > 192.168.87.210.56759: udp 179 Drop-reason: (no-adjacency) No valid adjacency 5: 17:48:27.804523 8.8.4.4.53 > 192.168.87.210.56759: udp 179 Drop-reason: (no-adjacency) No valid adjacency 6: 17:48:36.823336 8.8.4.4.53 > 192.168.87.210.56759: udp 179 7: 17:49:03.885131 8.8.8.8.53 > 192.168.87.210.56759: udp 179 Drop-reason: (no-adjacency) No valid adjacency 7 packets shown SWITCH CONFIG SW-CORESW01#sh run int gig 1/0/1 interface GigabitEthernet1/0/1 description SW-ASA01-P GI0/1 : INSIDE FIREWALL switchport access vlan 999 switchport trunk encapsulation dot1q switchport trunk native vlan 901 switchport trunk allowed vlan 144,666,1016 switchport mode trunk SWITCH MAC ADDRESS SW-CORESW01#sh mac address-table | in d48c.b5c2.7246 666 d48c.b5c2.7246 DYNAMIC Gi1/0/1 1016 d48c.b5c2.7246 DYNAMIC Gi1/0/1 SW-CORESW01#sh run int gig 1/0/1 VLAN 666 SW-CORESW01#sh vlan id 666 VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 666 WIRELESS-GUEST active Fa1/0/47, Gi1/0/1, Fa2/0/47, Gi2/0/1, Fa3/0/47 VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 666 enet 100666 1500 - - - - - 0 0 Regards Craig
... View more
Labels:
09-11-2013
12:39 AM
Hi Cesar Thanks for the response, this is what is strange that is in the configuration. But when the unit is checked in Solarwinds under the "node details" the system name is not the context ID its the Admin ID. Is there anything under the SNMP I need to change. Thanks Craig
... View more
09-09-2013
03:17 AM
Hi All Currently we have the context name set up correctly but it inherits the admin's context sysname in our monitoring system. Is there a way to set up a host name for the context with out the admin context or is there any other way to do this? So when viewing the SNMP messages we can see the ADMIN name at the beginning of the SNMP message. Regards Craig
... View more
Labels:
08-22-2013
02:43 PM
HI All I hope someone is able to help with the following: We currently use ISE to authenticate domain users connecting to our corporate wifi. ISE checks Windows AD for the wireless policy. The issue is that once a machine connects to the wifi, it allows any user to connect regardless of whether that user is allowed access in a later policy. We would like to configure authorization so that it uses Computer and User authorization, ie only if the computer and users are in AD, can the user successfully authenticate. The problem with this config is that I can log onto a Corp laptop as a local user, and still get access to the Corporate Wifi. The reason being that the connection hits the first rule which allows computer access, and doesn't check that the user authentication. I'd therefore like to configure ISE so that it checks for computer and user authentication together, so that both parts need to be met before access is allowed. Regards Craig
... View more
Labels:
Created by
craig bache
in Application Networking
in Application Networking
05-31-2013
05:53 AM
05-31-2013
05:53 AM
Hi Jorge Thank you for the response, with regrads to the A4 and the ACE-20 I was just pointing out this is not an option due to the hardware not supporting the software. Many thanks Craig
... View more
Created by
craig bache
in Application Networking
in Application Networking
05-27-2013
02:49 AM
05-27-2013
02:49 AM
Hi All I am hoping someone is able to assist with the following: I am trying to assign multiple certificates to a single VIP via an Auth-group, the current limitation is 4 certificates in a Auth-group in A3(3.5) and support for 10 certificates within a Auth-group seems to be in a released in (A4(1.0) but we are running an ACE-20. In terms of configuration we had to avoid using wildcard or giving out the same client SSL cert for different customers. The web service we host has multiple 3rd parties connecting to it to manage it for support etc. The 3rd parties can't be given the same client SSL cert for security reasons therefore we tried using the Auth-group and bundling a few together. We are also constrained in creating multiple SSL services for the following reasons: - Webservice URL is restricted and licensed with 1 DNS entry - URL is web based so it would be difficult for us to set different DNS > IP addresses (each 3rd party hits a different SSL proxy but would use the same backend server farm) There seems to be discrepancy in the command documentation on A5(1.0): Support for 10 certificates in an auth-group A2(3.0): http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA5_1_0/command/reference/authngrp.html#wp1032855 Support for 10 certificates in an auth-group A4(1.0): http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA5_1_0/command/reference/config.html#wpxref63102 Regards Craig
... View more
Labels:
05-19-2013
12:19 AM
Hi All We received two vulnerability alerts for different web sites behind Cisco ACE: 1) Vulnerability - SSL / TLS Renegotiation DoS Description: The remote service encrypts traffic using TLS / SSL and permits clients to renegotiate connections. The computational requirements for renegotiating a connection are asymmetrical between the client and the server, with the server performing several times more work. Since the remote host does not appear to limit the number of renegotiations for a single TLS / SSL connection, this permits a client to open several simultaneous connections and repeatedly renegotiate them, possibly leading to a denial of service condition. Recommendation: Contact the vendor for specific patch information. 2) Vulnerability - SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability Description: A vulnerability exists in SSL 3.0 and TLS 1.0 that could allow information disclosure if an attacker intercepts encrypted traffic served from an affected system. TLS 1.1, TLS 1.2, and all cipher suites that do not use CBC mode are not affected. Could you please help how they could be fixed? ACE software A4(2.3) Regards Craig
... View more
Labels:
04-12-2013
08:17 AM
Hi Afoz Thank you for the response, was that it will not cause any issue. Many thanks Craig
... View more
04-12-2013
07:53 AM
Thanks for the response's, Afoz restarting the Configmanager server does this have any service impact? Regards Craig
... View more
02-05-2015
Hi AllI am hoping someone could help with the following, I have a ACS
5.6 patch 2 running on a VM. W...
07-22-2014
Hi KanwalThanks for the response, I take it this will be a predictable
cookie as the value is static...
07-21-2014
HI KanwalThank you for the response, I take it this command was
introduced in A4. I have checked the...
07-21-2014
Hi AllI am hoping someone can help with the following on the Cisco ACE,
this is the ACE20.A scan of ...
02-25-2014
Hi AllI am having an issue with the Scansafe proxies and these showing
as unreachable but most of th...
02-21-2014
Hi Jon/ MarvinThank you for the response. I will change the
configuration to matchRegards Craig
02-21-2014
Hi AllHopefully some one can help? I have a setup of wireless clients
that are not able to connect t...
09-11-2013
Hi CesarThanks for the response, this is what is strange that is in the
configuration.But when the u...
09-09-2013
Hi AllCurrently we have the context name set up correctly but it
inherits the admin's context sysnam...
08-22-2013
HI AllI hope someone is able to help with the following:We currently use
ISE to authenticate domain ...
05-31-2013
Hi JorgeThank you for the response, with regrads to the A4 and the
ACE-20 I was just pointing out th...
05-27-2013
Hi AllI am hoping someone is able to assist with the following: I am
trying to assign multiple certi...
05-19-2013
Hi AllWe received two vulnerability alerts for different web sites
behind Cisco ACE: 1) Vulnerabilit...
04-12-2013
Hi AfozThank you for the response, was that it will not cause any
issue.Many thanks Craig
Public Statistics
| Date Registered | 06-01-2005 03:41 AM |
| Date Last Visited | 10-17-2017 07:48 AM |
| Total Messages Posted | 85 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 15 | |
| 5 | |
| 5 | |
| 5 |
.jpg "Hall of Fame Community Legend"){kind=icon}
