About auranprost

auranprost · ‎05-03-2014

Hello Rare, Good to have you on board for studying, I wish you best of luck with it. I am not familiar with packet-tracer being available here but I downloaded it from the netacad (netacad.com), I am not familiar with it being available in the support forums. What I can recommend you is that you can also use GNS3 to simulate everything or WebIOU as well. IDK if I can post any link for the GNS or WEBIOU downloads here so you maybe is gonna have to find it. BR, Bruno Silva.

auranprost · ‎05-03-2014

Everything depends my friend. Usually depending on the windows version and board version sometimes you have to go to network preferences and delete the SSID from the preferences so it can authenticate and associate again, you can run this process by going to the control panel. If it`s linux it may be a driver issue, what means that something may be wrong with it. If it`s an apple device you can easily edit network preferences to delete and re-create the SSID association as well as to edit the preferences for that specific SSID. The ideal here would be you post what is happening with logging and prints so we can understand the situation better. BR, Bruno Silva.

auranprost · ‎04-25-2014

Hi Sam, It`s no problem at all, I am also having certificate issues but concerns another area of expertise involving SCEP auto-enrollment. For some reason I think the problems are almost the same because when I authenticate using the new certificate it seems to be impossible to match the certificate properly and then it enrolls to a new certificate, it`s really giving me a hard time on solving it and I can`t find a way to match it. As per the certificate you are telling I am pretty sure it`s something related to the enrollment. When you enroll to this type of thing, you need to enroll in 3 different trust points for 3 different areas, the internal certificate, the SSL validation and the Code signer. The first is for the ASA itself, the second for the SSL vpn and the last for java applications such as any connect and ASDM. I am simulating, as soon as I get a proper conclusion I`ll let you know.

auranprost · ‎04-24-2014

Hi Sam, I am labbing this so I can conclude what`s missing but I believe you are not enrolling correctly with the asa with the CA. Also, for Java applications such as any connect and the asdm you have to use a code certificate what means something is missing anyways. So far my any connect presents me with the correct trusted certificate. I`ll let u know when I am finished. BR, Bruno Silva.

auranprost · ‎04-23-2014

Hi Sam, From what I am used to you should never use the standard templates to anything, what means that you should create a new template for this. Nevertheless, let me point your troubleshooting so far: 1 - Created the trust point; 2 - Enrolled to all certificated, user, ipsec and webserver 3 - Edited and changed KU and EKU fields (even though they should only be changed when you match the certificate field inside the XML file on the any connect before version 3) 4 - Enrolled to multiple trustpoints manually; Now, let me go through your enrollment process on ASA: 1 - create the certificate on the asa (crypto key generate rsa) 2 - Created the trust point with your CA server (crypto ca trust point) 3 - Enrolled to the certificate 4 - Generated the certificate and installed it on the ASA (using the web server default template) 5 - Configured the any connect ikev2 parameters to use the certificate that was installed during the last process. Is all of this correct?

auranprost · ‎04-23-2014

Hi Sam, Looking at your DART logging it looks like the certificate is not the proper certificate for what you are using. That`s quite awkward. Are you using SCEP for this?

auranprost · ‎04-23-2014

Hi Sam, How many certificate trust points you have on the asa?

auranprost · ‎04-22-2014

Hi Sam, When you check the Anyconnect configurations, does it show the correct certificate being used?

auranprost · ‎04-22-2014

Hi Sam, It does not look like a EKU ou anything else. For me it looks like your machine does not know the root CA. Did you install the root CA certificate on the machine that you`re testing? Are you using SCEP for the certificate enrollment on the machine or are you using manual certificate enrollment? For this specific message to be gone you need to make your machine recognize your root CA as one of the trusted root CAs in the machine, which means you have to download and install the root CA certificate on the machine as well as the machine certificate or user certificate itself. If you can, and I highly recommend you doing this, you can download the anyconnect Diagnostics and reporting tool (DART) to troubleshoot the certificate validation. If you make it and if you can put the package here so we can look at it together would be very nice to troubleshoot the certificate issue with you. BR, Bruno Silva.

auranprost · ‎02-18-2014

Hi all, I came across a very odd situation where I was asked to configure double factor authentication for anyconnect using certificates and ldap authentication. During my implementation I was asked to configure both, windows certificate services with NDES and the ASA Anyconnect and I found it very troublesome because the windows instalation had to be made on a distributed environment where the main CA was a windows 2k8 and the NDES certificate service was installed on a 2K12 machine. During my experience I could not find any document teaching exactly how to configure both, windows and ASA so this document is intended to share my experience with you guys so anyone can be able to configure it very easily. First let`s take a look at our topology: Explaining what was shown: 1 - ASA 5525-X with failover 1 - Windows server 2008 with DNS, Active directory and Certificate Services 1 - Windows 2012 with NDES (Network Device Enrollment Serices) 1 - Iphone 5 with anyconnect 1 - Macbook with osx Lion

auranprost · ‎01-10-2012

Hi, According to what I remember, everytime you try to filter a route with a prefix list on the ASA you should just match a standard ACL. In this case that you`re trying to filter the following command: asa(config)# match ip address [acl-id] Will be configured with an standar ACL which matches the routes with a destination that matches the ACL. You can check the whole explanation here: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_maps.html BR, Bruno Silva.

auranprost · 05-03-2014

Hello Rare,Good to have you on board for studying, I wish you best of luck with it. I am not familia...

auranprost · 05-03-2014

Everything depends my friend. Usually depending on the windows version and board version sometimes y...

auranprost · 04-25-2014

Hi Sam,It`s no problem at all, I am also having certificate issues but concerns another area of expe...

auranprost · 04-24-2014

Hi Sam,I am labbing this so I can conclude what`s missing but I believe you are not enrolling correc...

auranprost · 04-23-2014

Hi Sam,From what I am used to you should never use the standard templates to anything, what means th...

auranprost · 04-23-2014

Hi Sam,Looking at your DART logging it looks like the certificate is not the proper certificate for ...

auranprost · 04-23-2014

Hi Sam,How many certificate trust points you have on the asa?

auranprost · 04-22-2014

Hi Sam,When you check the Anyconnect configurations, does it show the correct certificate being used...

auranprost · 04-22-2014

Hi Sam,It does not look like a EKU ou anything else. For me it looks like your machine does not know...

auranprost · 02-18-2014

Hi all,I came across a very odd situation where I was asked to configure double factor authenticatio...

auranprost · 01-10-2012

Hi,According to what I remember, everytime you try to filter a route with a prefix list on the ASA y...

Date Registered	‎12-25-2007 01:11 AM
Date Last Visited	‎08-18-2017 04:03 AM
Total Messages Posted	10
Total Helpful Votes Received	10

Hello Rare,Good to have you

Everything depends my friend.

Hi Sam,It`s no problem at all

Hi Sam,I am labbing this so I

Hi Sam,From what I am used to

Hi Sam,Looking at your DART

Hi Sam,How many certificate

Hi Sam,When you check the

Hi Sam,It does not look like

Anyconnect VPN with ikev2 and SCEP Auto...

OSPF - Redistribute static on ASA