My most sincere congratulations. Welcome Peter to the Hall of Fame.  ... View more

First off, ping (icmp echo request and reply) is not a good way to test firewall connectivity since it is a stateless protocol.   Second, the ping failure can be due to a couple of things. Your original config had:   access-list inside_access_in extended permit ip any any log debugging access-list outside_access_in extended permit icmp any any log debugging access-list outside_access_in extended permit ip any any   So there is only ip (not icmp) on the insice_access_in ACL. Either add an entry to allow icmp or remove that ACL altogether since it really doesn't do anything (except inadvertently block non-IP traffic).    You should also add "inspect icmp" to your default class-map. ... View more

You can always take any written exam by just scheduling it with an authorized testing center.   If you want to recertify though, that will only happen when you pass the four exams for CCNP Security as well as the prerequisite one for CCNA Security (and CCNA R&S if that is also expired). ... View more

The certificates depend on what type you are using.   If you have an externally generated CSR (e.g. you have a copy of the private key used in the request) and CA-issued certificate, then you can import the certificate and private key on to the new ASA.   If your AnyConnect licenses are 4.x type (Plus or Apex PAKs issued) then the PAKs can be used across multiple ASAs to create activation keys since the licenses are per unique user, not per device. ... View more

If you put your RA-dedicated ASA inside on the FTD device then you can use Geoblocking in your ACP rule. ... View more

I would simply manually convert each relevant section. There are only two active interfaces - outside and inside, a couple of static NATs and a dynamic interface NAT.   The source config looks like it might be a lab. I say that because it has an acl outside_in to allow ip any any. If that's the case then it's a good learning experience. ... View more

What is the ASDM version?   Do you have Java installed? What version of Java? ... View more

ISE seems to indicate that the Authorization result is looking for an undefined shell profile.   Does the detail report from ISE Live logs shed any more light? ... View more

Multi-instance container scale limitations are documented here:   https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/fxos241/cli-guide/b_CLI_ConfigGuide_FXOS_241/logical_devices.html#id_77542   Only FTD is supported, not ASA logical devices. The maximum is 14 with Firepower 9300 and SM-44. ... View more

You could very likely be affected by a hardware issue:   https://www.cisco.com/c/en/us/support/docs/field-notices/642/fn64228.html   Check your status lights as described in the Field Notice above. If that's the case, a support ticket to get an RMA unit would be the route to go. ... View more

To get a more comparable solution using ISR series routes, you would have to add something like Firepower Threat defense for ISR:   https://www.cisco.com/c/en/us/products/collateral/security/router-security/datasheet-c78-735410.html   For that you need to add the UCS module. So the cost of the module plus license may make the difference between using a second appliance (ASA running FTD or such) less.   The protection capabilities between the two options are comparable. However you are getting into a MUCH less deployed option with FTD for ISR. You are also then tying your security to your router and possibly closing off other options. for instance, what if you wanted to adopt the SD-WAN for ISR solution (i.e. the Viptela technology)? Is that compatible with also running the other security services?   Also, if you are considering just relying on IOS Zone-Based Firewall (ZBFW) I would not recommend that option. You'd be using 10+ year old technology to attempt to protect against modern threats.     ... View more

This is an internal Cisco IT problem; so the public support community is not the right place to inquire.   Please open a helpdesk ticket with Cisco IT. ... View more