About Marvin Rhoads

Marvin Rhoads · ‎10-22-2019

They could be left over from a previous configuration where they had an associated tunnel-group. If no current tunnel-group specifies them they are likely extraneous and can be removed. (You cannot remove the default group policy, even if it's not currently used.)

Marvin Rhoads · ‎10-17-2019

@Karsten Iwen Thanks for this - I just came across your answer. FYI I was able to accomplish pretty much the same thing on an FMC-managed FTD device via Devices > Platform Settings > SSL as follows: FTD TLS Platform Settings Applying the above settings on an FTD device (mine was running FTD 6.4.0.5) will result in an "A-" Qualys scan score. Cisco's decision not to support secure renegotiation limits us to that: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCud62637 https://community.cisco.com/t5/firewalls/cisco-asa-5512-9-8-2-support-for-secure-renegotiation/td-p/3754076

Marvin Rhoads · ‎10-16-2019

Moving this thread to Security > VPN and AnyConnect. @Reha Kucukosmanoglu Firepower Threat Defense (FTD) appliances can use Anyconnect licenses (since version 6.2.2 of FMC) but they need to be provisioned as Smart licenses. You then register your FMC to the Smart software licensing portal and it can assign your AnyConnect Smart licenses to your managed devices. If your Anyconnect licenses were provisioned as PAKs, you can request associated Smart licenses be provisioned to your account. Here's how: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html#anc56

Marvin Rhoads · ‎10-16-2019

I'm not positive about what the chassis backup includes. I don't think it gets logical device platform settings. Basically, older versions of FTD don't have a sound backup strategy. That's why Cisco is enhancing those features going forward.

Marvin Rhoads · ‎10-15-2019

Things such as device interfaces, routing etc. aren't included in the FMC backups (pre-6.3).

Marvin Rhoads · ‎10-14-2019

Several things can trigger failover. Among them is failure to receive the heartbeat from the peer unit. That would happen whether it is a single cable connecting the units or multiple switches across two sites. I've implemented scenarios like the one you describe and it works just fine.

Marvin Rhoads · ‎10-14-2019

Moved to Security > VPN for broader visibility. Yes this is possible and quite common. Just be sure to take into account any NAT that you may have configured and be sure to exempt the traffic from it.

Marvin Rhoads · ‎10-13-2019

Your ASDM logging is set to "warning" (level 4). When you have the log keyword on an ACL entry (as you show in your example) the default level assigned is "informational" (level 6). https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/configuration/firewall/asa-913-firewall-config/access-acls.html#ID-2069-00000206

Marvin Rhoads · ‎10-12-2019

Use the "keepout" command under webvpn. You can optionally present a message to users. https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/jk.html#pgfId-1630054

Marvin Rhoads · ‎10-12-2019

The most likely cause is physical layer between the two devices failed - either a bad cable or intermediate switch.

Marvin Rhoads · ‎10-12-2019

You cannot do nested Anyconnect connections. You could have a second profile on the primary VPN connection that only allows access to the protected environment and has the necessary restrictions built into it the same as the internal one. So when users authorized to access the restricted environment need to connect remotely they use that profile exclusively.

Marvin Rhoads · ‎10-11-2019

You posted this under "Security Events". Please post as a discussion thread under Firepower.

Marvin Rhoads · ‎10-10-2019

Did you check on the support contract as I mentioned in my 8-10-2019 post earlier in this thread? Your download entitlement normally is created as a result of that. It's a responsibility of the reseller to do so. If they cannot then providing your sales order number to Cisco might be a way to get it added.

Marvin Rhoads · ‎10-08-2019

Is it an HA pair or a single ASA? If it's an HA pair you must copy the profile.xml file onto both units. Otherwise when a failover event occurs the second unit will not have the profile file and the reference to it will be deleted from the configuration.

Marvin Rhoads · ‎10-07-2019

The exact configuration stanza (if present) would be: policy-map global_policy class sfr sfr fail-open

Marvin Rhoads · 10-23-2019

Can you share your Access Control Policy rules?

Marvin Rhoads · 10-22-2019

1. No. 2. You could use the captive portal but I've not done so. https://www.cisco.com/c/en/us/td/do...

Marvin Rhoads · 10-22-2019

I have not tested the results but you can configure both ISE and User Agent identity sources for a g...

Marvin Rhoads · 10-22-2019

The Firepower 1000 series has an embedded x86 CPU with some minimal acceleration but not a dedicated...

Marvin Rhoads · 10-22-2019

For the ISE-authenticated users you should add ISE as an Identity source for your FMC. It does requi...

Marvin Rhoads · 10-22-2019

Yes you can have users and groups as elements in your ACPs with only Realm integration. However unti...

Marvin Rhoads · 10-22-2019

They could be left over from a previous configuration where they had an associated tunnel-group. If ...

Marvin Rhoads · 10-22-2019

That makes sense to me @IanRobinson71613 . Cisco acquired Sourcefire in late 2013 and the Firepower ...

Marvin Rhoads · 10-22-2019

It will use the object "DefaultWebServerCertificate". You can replace the self-signed version of tha...

Marvin Rhoads · 10-21-2019

Only on the 9300 series can one run multiple logical devices (if you have multiple Security Modules)...

Marvin Rhoads · 10-19-2019

User reporting isn't really FMC's strong suit. It's always been lacking compared to something like t...

Marvin Rhoads · 10-19-2019

The User Agent can be on any Windows machine that has the appropriate access to the domain controlle...

Marvin Rhoads · 10-19-2019

Yes. Please see the following section in the configuration guide to setup your DNS server (s) and pr...

Marvin Rhoads · 10-18-2019

Are you able to resolve public DNS addresses from your FMC cli? Are you using a proxy server for Int...

Marvin Rhoads · 10-18-2019

I don't have one in front of me to verify on, but according to the documentation you can configure t...

Date Registered	‎06-28-2001 03:55 PM
Date Last Visited	‎10-22-2019 09:30 PM
Total Messages Posted	16,551
Total Helpful Votes Received	15893

Re: GROUP POLICY FOR DEFAULT TUNNEL-GRO...

Re: Anyconnect Perfect Forward Secrecy

Re: Confusing Licensing Problem

Re: Backing up config, FTD and vFMC.

Re: Backing up config, FTD and vFMC.

Re: ASA Failover pair connected through...

Re: traverse between multiple diffreent...

Re: Why ASA log view is empty

Re: How to Remove the Web Option from W...

Re: Failover

Re: We need to run two Anyconnect VPNs ...

Re: problem with decrement-ttl tracer...

Re: Licensing

Re: Connection profile gets deleted

Re: How Cisco ASA Firewall handle the t...

Re: User based URL Access

Re: User based URL Access

Re: Cisco ISE logs via AD User-Agent

Re: Firepower 1000 Series Hardware Accelerated Decryption

Re: Cisco ISE logs via AD User-Agent

Re: User based URL Access

Re: GROUP POLICY FOR DEFAULT TUNNEL-GROUP

Re: ASDM was unable to load the firewall's configuration.

Re: Firepower 1010: Management Web Server Certificate

Re: Adding more logical Devices from Chasis Manager

Re: URL - User Report

Re: User based URL Access

Re: Smart Licenses on Cisco firepower management center

Re: Smart Licenses on Cisco firepower management center

Re: FPR2/4/9k FTD webUI idle timeout