About Marvin Rhoads

Marvin Rhoads · ‎11-15-2018

ASA 5506 with Firepower has been a bit of a stretch on the device's capabilities. It works but it's no speed demon. 40-50 Mbps is at the edge of it's upper limit if you're pushing all traffic to the Firepower module for inspection. If you look at the release notes for ASA 9.10(1) you will note that Cisco will no longer support Firepower on the 4 GB models such as ASA 5506-X as of that new release. Unfortunately you cannot upgrade the RAM on these devices.

Marvin Rhoads · ‎11-15-2018

The bug details indicate that is cosmetic only and does not affect traffic. You might want to open a TAC case to look into your settings in detail.

Marvin Rhoads · ‎11-15-2018

@AndreasKvist when you add a node to an ISE deployment you choose which persona(s) it runs. Device Administration is a service that is optionally enabled on a node running Policy Service (PSN). When enabled, that node is the one where you will direct your network devices (switches, routes, WLCs, firewalls etc.) for TACACS+ services. It is a completely separate function from Admin persona role (Primary PAN or Secondary PAN).

Marvin Rhoads · ‎11-14-2018

You probably don't want multiple context mode. If you should decide that you do, despite advice otherwise, be VERY careful when converting. As soon as you change from single ti multiple context mode the existing configuration will be completely lost. You will need to recreate it on one of the new contexts so make sure you understand it completely and have an offline backup.

Marvin Rhoads · ‎11-14-2018

If you are running an ASA image on your Firepower 2130 it will not have any of the Firepower NGIPS features. It will run only as a "classic" ASA (no service module) with the difference being that you have the Firepower Chassis Manager (FCM) to do initial setup and manage the physical chassis, deploy the ASA image (logical device) and assign interfaces to the ASA. No Firepower Control license, IPS subscription, URL filtering license or Malware license can be used as those features are not available. You just setup the ASA as usual once you've deployed in via FCM.

Marvin Rhoads · ‎11-14-2018

Is the Firepower 2130 running ASA image or FTD image?

Marvin Rhoads · ‎11-14-2018

It can and does check the source port. However, due to the nature of how tcp and udp generally works, source ports are ephemeral (semi-random port number >1023 as @Mohammed al Baqari mentioned) so we very seldom have an ACL or other rule that restricts source port numbers. Generally when using packet-tracer I just use 1234 as my source port unless I have a specific reason to use a specific port (very very rarely in real life).

Marvin Rhoads · ‎11-14-2018

Check your interface settings and access control policies. Something is not right. I just installed a Firepower 2110 HA pair running FTD for a customer and measured Speedtest results of 980-990 Mbps on a 1 Gbps connection.

Marvin Rhoads · ‎11-13-2018

That looks ok. Can you ssh to any other device? What is the device you are attempting to access? Can you provide the output of "show version" from it?

Marvin Rhoads · ‎11-13-2018

You can configure it on many interfaces. You will most likely be constrained with routing the return traffic properly more so than anything else.

Marvin Rhoads · ‎11-13-2018

The "crypto key generate..." command will never be in the running-config as it is a runtime command used only to generate a new key. However you should have at least one RSA key present. You can confirm it with the following command: show crypto key mypubkey rsa

Marvin Rhoads · ‎11-13-2018

True. I just submitted document feedback on the release notes. In my experience the documentation teams take this feedback to heart - I have had several errata corrected via that avenue. Just click the Feedback link on the top right of most documentation and you can fill out a short form with your comments. Here's what I sent just now: "I realize the product is end of sales, but table 2 should be updated to note that the currently offered hardware appliances are the ones with UEFI secure boot firmware and ISE image pre-installed. Those are NOT compatible with ACS."

Marvin Rhoads · ‎11-13-2018

In that case just stand up a new VM. Even if they don't have an ESXi infrastructure, they could use the free ESXi server on an inexpensive server and be done with it.

Marvin Rhoads · ‎11-13-2018

The SNS-3595 can only run ACS if it has the older non-secure-boot (UEFI) firmware. Is there a reason why they don't just upgrade to ISE since ACS is post-end-of-sales?

Marvin Rhoads · ‎11-12-2018

Without an active Anyconnect license, users will not be able to to connect via remote access SSL VPN. Note however that mosts ASAs have two non-time-limited AnyConnect Premium (an older style roughly equivalent to Apex minus Mobile and AEA features) licenses included already.

Date Registered	‎06-28-2001 03:55 PM
Date Last Visited	‎11-15-2018 01:59 AM
Total Messages Posted	15,017
Total Helpful Votes Received	13148

Re: Is our ASA5506X underpowered for Fi...

Re: Anyconnect Anyconnect

Re: ISE 2.4 Licensing - Quick Access

Re: active/active in Single Context Mod...

Re: Anyconnect Anyconnect

Re: Anyconnect Anyconnect

Re: Packet Tracer command

Re: Anyconnect Anyconnect

Re: transport input telnet ssh help

Re: Anyconnect Anyconnect

Re: transport input telnet ssh help

Re: SNS-3595-K9 and ACS

Re: SNS-3595-K9 and ACS

Re: SNS-3595-K9 and ACS

Re: ASA AnyConnect Evaluation License E...