Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Karsten Iwen
Karsten Iwen
.jpg){kind=icon}
VIP Mentor
I started my work in the IT at about 1995/1996 as a freelance Trainer and consultant with a focus on networking, Novell NetWare and Microsoft Backoffice. In 2001 I started teaching Cisco classes at Global Knowledge in Germany. Since 2003 I'm again Freelancer with a strong focus on security technologies and infrastructure.
And yes, you can hire me for your security-projects and security-workshops. ;-)
I started my work in the IT at about 1995/1996 as a freelance Trainer and consultant with a focus on networking, Novell NetWare and Microsoft Backoffice. In 2001 I started teaching Cisco classes at Global Knowledge in Germany. Since 2003 I'm again Freelancer with a strong focus on security technologies and infrastructure.
And yes, you can hire me for your securi
Awards
Recent Badges
Stats
Member since
12-21-2006
5859
Posts
4184
Helpful
1194
Solutions
09-18-2019
04:56 AM
I think the easiest option is still missing from the recommendations:
Just configure a Port-ACL and attach it to the switchport pointing to that device.
It could look like the following:
ip access-list extended UNTRUSTED-DEVICE
deny tcp any any eq 22
! or if only SSH to the local switch-IP 10.10.10.10 ! should be denied:
deny tcp any host 10.10.10.10 eq 22
permit ip any any
!
interface gig 0/23
ip access-group UNTRUSTED-DEVICE in
... View more
09-18-2019
04:37 AM
In ASDM you go to Certificate Management and add a new trustpoint. There you upload the PFX, specify the PFX-password and the certificate gets imported. The standby ASA will directly receive this new certificate from the active one.
... View more
09-13-2019
09:38 AM
For this scenario it doesn't matter if you have one ASA or two in HA. In most cases I would just ignore this "problem" when both switches are directly colocated and have a direct link (typically a channel) between each other. It's just one switched hop more than the optimal path. Or you have to build your distribution as a VSS/VPC or stack. There you can use EtherChannels to both devices.
... View more
09-13-2019
09:12 AM
here is a starting point:
https://community.cisco.com/t5/networking-documents/how-to-upgrade-or-downgrade-the-ios-on-an-isr-or-similar-router/ta-p/3111919
... View more
09-13-2019
08:52 AM
You can configure a redundant interface on the ASA and add one member-interface connecting to SW1 and one member-interface connecting to SW2. The redundant interface also can have sub interfaces for all your needed VLANs. But as ASA and the Switch don't share any information which switch is HSRP-active, you could have a non-optimal traffic flow.
... View more
09-13-2019
07:48 AM
No, put it on a tftp-server (like tftp64) and just copy it from the router-cli to the routers flash and make it active.
... View more
Created by
Karsten Iwen
in Firewalls
Karsten Iwen
in Firewalls
09-13-2019
06:24 AM
09-13-2019
06:24 AM
It just means that you can't point your clients to that device to resolve names. Most likely you have a DNS-server inside of your HQ and you can point your clients to that one. With that all clients can resolve your internal resources. Or you could install DNS-servers in each branch. But that could be overkill for 10 employees.
... View more
Created by
Karsten Iwen
in Firewalls
Karsten Iwen
in Firewalls
09-13-2019
05:19 AM
09-13-2019
05:19 AM
If you really need to have DNS-services, there is only the IOS router in the cisco portfolio.
If you can live without, my preferences would be:
Cisco Meraki MX on HQ and the branches. These are most easily to setup and the VPN will work instantly.
Cisco ASAs on all sites with manually configured route-based VPN. This will give you also a good firewall for the branches.
IOS routers on all sites. Maximum flexibility but the firewall implementation is most complex compared to the other solutions.
Personally I don't like Firepower Thread Defense as you always need two IPs reachable from your headquarter. One for the Data-Plane and one for management. That can get quite tricky to setup and is a more advanced topic.
... View more
Created by
Karsten Iwen
in Firewalls
Karsten Iwen
in Firewalls
09-13-2019
05:11 AM
09-13-2019
05:11 AM
You only need 10 seconds to handle this device the right way: Just dump it.
The CSC is end-of-life for such a long time, it will not benefit your network-security and is also not useful for any learning-purpose. It just uses energy and heats the room. Nothing more!
... View more
Created by
Karsten Iwen
in Firewalls
Karsten Iwen
in Firewalls
09-13-2019
04:34 AM
09-13-2019
04:34 AM
This is not uncommon when there are misconfigurations in the network. It could be a wrong IP-config on a PC or a wrong NAT inside the network. Or even a user willingly spoofing other addresses.
... View more
Created by
Karsten Iwen
in VPN and AnyConnect
Karsten Iwen
in VPN and AnyConnect
09-13-2019
04:32 AM
09-13-2019
04:32 AM
Yes, that will work. The setup is quite straight-forward:
You have multiple trust points that contain the different certificates
Your tunnel-groups are configured as usual with different group-urls
You configure the used FQDNs to use different trust points.
tunnel-group VPN-GROUP1 webvpn-attributes
group-url https://vpn.example.com enable
...
tunnel-group VPN-GROUP2 webvpn-attributes
group-url https://vpn.example.net enable
...
ssl trust-point VPN-NET domain vpn.example.net
ssl trust-point VPN-COM domain vpn.example.com
... View more
09-12-2019
10:59 PM
I've never used NPE before. But my understanding was that you have to load the corresponding npe-image to the router. Have you done that?
... View more
Created by
Karsten Iwen
in Wireless and Mobility
Karsten Iwen
in Wireless and Mobility
09-11-2019
01:30 PM
09-11-2019
01:30 PM
When you say the internet-speed is 10 MBit/s, are you also saying that this problem only occurs when communicating to the internet? Or is it the same when accessing internal resources. If the problem is only with internet, also look at your firewall if there are restrictions. If the problem is also internal, have you checked the ports where the APs are connected?
... View more
Created by
Karsten Iwen
in VPN and AnyConnect
Karsten Iwen
in VPN and AnyConnect
09-11-2019
07:45 AM
09-11-2019
07:45 AM
One typical config-problem that can cause situations like these, is when the crypto ACLs on both ends do not mirror. Please check this first. And if you migrate to route based VPNs (virtual tunnel interfaces, VTIs), this config-problem can not happen.
... View more
09-18-2019
I think the easiest option is still missing from the recommendations:
Just configure a Port-ACL and ...
09-18-2019
In ASDM you go to Certificate Management and add a new trustpoint. There
you upload the PFX, specify...
09-13-2019
For this scenario it doesn't matter if you have one ASA or two in HA. In
most cases I would just ign...
09-13-2019
here is a starting point:
https://community.cisco.com/t5/networking-documents/how-to-upgrade-or-down...
09-13-2019
You can configure a redundant interface on the ASA and add one
member-interface connecting to SW1 an...
09-13-2019
No, put it on a tftp-server (like tftp64) and just copy it from the
router-cli to the routers flash ...
Created by
Karsten Iwen
in Firewalls
09-13-2019
09-13-2019
It just means that you can't point your clients to that device to
resolve names. Most likely you hav...
Created by
Karsten Iwen
in Firewalls
09-13-2019
09-13-2019
If you really need to have DNS-services, there is only the IOS router in
the cisco portfolio. If you...
09-13-2019
You only need 10 seconds to handle this device the right way: Just dump
it. The CSC is end-of-life f...
Created by
Karsten Iwen
in Firewalls
09-13-2019
09-13-2019
This is not uncommon when there are misconfigurations in the network. It
could be a wrong IP-config ...
Created by
Karsten Iwen
in VPN and AnyConnect
09-13-2019
09-13-2019
Yes, that will work. The setup is quite straight-forward: You have
multiple trust points that contai...
09-12-2019
I've never used NPE before. But my understanding was that you have to
load the corresponding npe-ima...
09-11-2019
When you say the internet-speed is 10 MBit/s, are you also saying that
this problem only occurs when...
Public Statistics
| Date Registered | 12-21-2006 02:52 PM |
| Date Last Visited | 09-18-2019 04:32 AM |
| Total Messages Posted | 5,859 |
| Total Helpful Votes Received | 4184 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 70 | |
| 5 |
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 10 |
Awards
Cisco Designated VIPs
2018 Firewalling VPN
Cisco Designated VIPs
2017 Firewalling VPN
Cisco Designated VIPs
2016 Firewalling VPN
Cisco Designated VIPs
2015 Security
Cisco Designated VIPs
2014 Security
Cisco Designated VIPs
2013 Security
Cisco Designated VIPs
2019 Firewalls, VPN
Community Spotlight Award
Mobile App Contributor August 2012
