Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About MARK BAKER
07-19-2019
Stats
Member since
10-13-2003
419
Posts
197
Helpful
5
Solutions
Created by
MARK BAKER
in VPN and AnyConnect
in VPN and AnyConnect
03-05-2019
04:40 PM
03-05-2019
04:40 PM
I have ASA 9.7 and above doing SAML directly to Azure and have the ASA configured to point to our ISE server for authorization only. I am able to login with SAML / MFA and assign the user to a group-policy based on their AD group assignment. I would assume you can point to an NPS server for authorization only as well. The authentication port is required to do authorization only.
aaa-server ISESAML protocol radius authorize-only aaa-server ISESAML (management) host 1.1.1.1 key ***** authentication-port 1812 accounting-port 1813 aaa-server ISESAML (management) host 10.1.1.2 key ***** authentication-port 1812 accounting-port 1813
... View more
03-05-2019
11:58 AM
Thank you for this info. It was the missing piece for getting this to work. I saw many statements to use ISE for authorization only, but this is the first I have seen on how to configure it. I was trying to set authorization only on ISE itself before finding this.
FYI... I used this with SAML authentication to Azure instead of certificate, but it worked the same. I was able to use ISE with AD backend to assign group-policy based on user AD group assignment.
... View more
Created by
MARK BAKER
in Cisco Bug Discussions
in Cisco Bug Discussions
02-05-2019
11:24 AM
02-05-2019
11:24 AM
I received an engineering release from TAC with the fix for this bug and was told that the issue will be fixed in official image 15.6(2)SP6 to be released tentatively by the end of March 2019. I have not yet deployed the engineering release, so can't verify that it has fixed the issue.
... View more
Created by
MARK BAKER
in Cisco Bug Discussions
in Cisco Bug Discussions
01-31-2019
09:11 AM
01-31-2019
09:11 AM
TAC suspects this bug as the cause of the issue I am currently experiencing. I have seen it in 15.3.? through 156-2.SP5. Currently running 152-4.S7 without issue.
... View more
10-19-2018
12:39 PM
I checked the interface MTU, IP MTU, and MPLS MTU on a 6807 port and found that they were all the same as configured under the interface mtu setting. It was 9174 in this case. I configured the 9500 system mtu to 9198 and the IP and MPLS MTU to 9174. I configured just 'ip mtu' first, but this didn't change the MPLS MTU. I used the command 'mpls mtu' to make it match the IP MTU.
6807 = MTU 9174, IP MTU 9174, MPLS MTU 9174
9500 = MTU 9198, IP MTU 9174, MPLS MTU 9174
I do have interfaces running MTU 9216 that I'll have to configure for 9198 or lower.
I connected the 9500 to an asr 920 and set the interface MTU on the 920 to 9174. The 9500 is set as it is above. I was able to ping up to but not over 9174 bytes. I also set the 9500 ip/mpls mtu to 1500 and left the 920 at mtu 9174. I could pint up to but not over 1500 bytes. EIGRP route MTU used the IP MTU setting of the interface as well.
By default all three of these match on the 6807:
show int te1/0/1= see global/interface MTU
show ip int te1/0/1 = ip MTU
show mpls int te1/0/1 detail = MPLS MTU
... View more
10-19-2018
11:17 AM
I am in the same boat here. Issues I have seen with mismatched MTU is with EIGRP that can use the full MTU of the interface. I have seen where EIGRP neighbors flap when the MTUs don't match. I am going to be looking into the interface commands 'ip mtu' and 'mpls mtu' to see if I can match the MTU of attached routers. The 9500s are going to be used as core routers and not running BGP. If they were being used as PE routers, I could see issues with MTU mismatch between L2 tunnel endpoints.
... View more
11-06-2017
02:42 PM
Has anyone set up a network using Nexus 7702 with the Nexus configured for QinQ on an interface and then transported via VPLS to another site with the same configuration? I have this configured now, but it seems that the VPLS network is stripping both the inner and outer tags of the QinQ tunnel. On the other side, the untagged packet is being sent out the correct QinQ interface, but it isn't in the right VLAN (untagged).
... View more
Labels:
07-18-2017
10:51 AM
Mohd,
Note : In redirect-list, the access list should only contain network addresses. Port-specific entries are not supported.
That is from:
http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116046-config-wccp-asa-00.html#anc6
I'm not sure if it is still not supported, but it was not supported at the time I configured it on an ASA. In any case, the ports are not required in the redirect ACL.
Thanks, Mark
... View more
07-18-2017
09:51 AM
@Mohd,
You can specify the port number in the redirect ACL, but it is not required. IronPort service configuration specifies the ports that need to be redirected. If you say 80/443 in the IronPort service, the WCCP router will only redirect 80/443 even with IP (not TCP/UDP) specified in the access-list. I am doing it currently on 6807 and ASR routers. I did the same previously on an ASA, as documentation at the time recommended not configuring the port number.
Thanks, Mark
... View more
05-03-2017
10:29 AM
Hi Serdar,
Documentation says that WCCP is supported in single and multi-context modes. This means that you would be able to configure it on a per context basis.
... View more
Created by
MARK BAKER
in Unified Computing System Discussions
in Unified Computing System Discussions
04-27-2017
10:10 AM
04-27-2017
10:10 AM
Yes this is the scenario we were discussing. Below is additional information from Robert.
You will need to run the N5K in "switch" mode (rather than npv mode) which will enable the FC services such as name server, zoning etc, which will function as your FC switching device.
... View more
Created by
MARK BAKER
in Other Data Center Subjects
in Other Data Center Subjects
04-06-2017
12:04 AM
04-06-2017
12:04 AM
ASA clustering is done on the system context when in multi mode. RA VPN is not supported on any of the contexts on the firewall when clustering. This is my understanding of it. We are clustering in multi mode and clustering is done on the system context. I check back from time to time to see if RA VPN support has been added, but haven't seen that it is yet.
... View more
Created by
MARK BAKER
in Other Data Center Subjects
in Other Data Center Subjects
03-03-2017
11:34 AM
03-03-2017
11:34 AM
Sorry, found this right after I posted. I assume this is the same for the F2e.
F3 Series modules in an OTV VDC should not have the VLAN mode configured as Fabricpath.
... View more
03-03-2017
11:33 AM
Andrew,
I know your post is old, but I am having trouble finding the answer to this question for F2e modules now that they are supported as internal interfaces on OTV. Did you ever find the answer to your question?
Thank you, Mark
... View more
02-24-2017
11:37 AM
I've been looking into PfR for optimizing inbound traffic from the internet. The two forms of adjusting the inbound traffic is BGP AS-PATH prepending and AS-PATH Community. We have a mix of ISPs that support one or the other. For the ones that support only the AS-PATH community, I'm not sure how this works under PfR. I read that out of policy will add a community up to six times to try to bring the interface back into compliance. This can't be the same community 6 times can it? Every example I see shows a single community to adjust the AS-PATH advertisement from an ISP. How do you change to community to request different levels of prepending through PfR? Our ISP has a different community depending on how many times you want to prepend your advertisement. Does PfR accept a list of communities to support this?
ISP communities:
444:1 (prepend 1)
444:2 (prepend 2)
444:3 (prepend 3)
444:4 (prepend 4)
pfr master border 10.4.5.6 key-chain pfr interface Ethernet0/1 external downgrade bgp community aa:nn (community number in aa:nn format) dinterface Ethernet0/0 internal
... View more
Labels:
06-14-2019
Update for others... You do use the PAN certificate for Admin role
whether it's CA assigned or self-...
06-06-2019
tmatzeu12,Did you ever get an answer to your certificate question when
using a CA assigned cert for ...
Created by
MARK BAKER
in VPN and AnyConnect
03-05-2019
03-05-2019
I have ASA 9.7 and above doing SAML directly to Azure and have the ASA
configured to point to our IS...
03-05-2019
Thank you for this info. It was the missing piece for getting this to
work. I saw many statements to...
02-05-2019
I received an engineering release from TAC with the fix for this bug and
was told that the issue wil...
01-31-2019
TAC suspects this bug as the cause of the issue I am currently
experiencing. I have seen it in 15.3....
10-19-2018
I checked the interface MTU, IP MTU, and MPLS MTU on a 6807 port and
found that they were all the sa...
10-19-2018
I am in the same boat here. Issues I have seen with mismatched MTU is
with EIGRP that can use the fu...
11-06-2017
Has anyone set up a network using Nexus 7702 with the Nexus configured
for QinQ on an interface and ...
07-18-2017
Mohd, Note: In redirect-list, the access list should only contain
network addresses. Port-specific e...
07-18-2017
@Mohd, You can specify the port number in the redirect ACL, but it is
not required. IronPort service...
05-03-2017
Hi Serdar, Documentation says that WCCP is supported in single and
multi-context modes. This means t...
Created by
MARK BAKER
in Unified Computing System Discussions
04-27-2017
04-27-2017
Yes this is the scenario we were discussing. Below is additional
information from Robert. You will n...
04-06-2017
ASA clustering is done on the system context when in multi mode. RA VPN
is not supported on any of t...
Public Statistics
| Date Registered | 10-13-2003 08:51 PM |
| Date Last Visited | 07-19-2019 11:11 AM |
| Total Messages Posted | 419 |
| Total Helpful Votes Received | 197 |
Helpful Votes Given To
.jpg "Hall of Fame Expert"){kind=icon}
.jpg "VIP Engager"){kind=icon}
Helpful Votes From
