Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About johnlloyd_13
09-14-2019
Stats
Member since
12-02-2007
3182
Posts
1031
Helpful
243
Solutions
09-11-2019
08:35 PM
hi, there's already a default NAT and access control rules configured in FTD for initial traffic to flow. you'll also need to further tweak the device via FDM. see helpful link: http://ccnpsecuritywannabe.blogspot.com/2019/09/configuring-ftd-623-via-firepower.html
... View more
09-06-2019
07:13 AM
hi reza, thanks for the cool link/tool! will try to insert a spare GLC-TE SFP on the N5K and see if it's detected. have a nice weekend ahead!
... View more
09-06-2019
06:56 AM
hi, just a quick question, is GLC-TE copper SFP compatible with cisco nexus 5K (N5K-C5672UP)? i only see GLC-T in the switch data sheet: https://www.cisco.com/c/en/us/products/collateral/switches/nexus-5000-series-switches/datasheet-c78-730760.html
... View more
Labels:
08-29-2019
06:24 PM
hi, you can check if your ASA 5506 has smartnet via this cisco link: https://cway.cisco.com/sncheck/ cisco TAC can guide with your FW configuration and in troubleshooting.
... View more
Created by
johnlloyd_13
in Firewalls
in Firewalls
08-20-2019
07:09 PM
08-20-2019
07:09 PM
hi, i need to lock down SIP ports on an ASA FW towards our internal SIP/voice GW: external SIP 208.x.x <> ASA FW <> 66.x.x.x internal voice GW per my google, SIP is TCP/UDP port 5060 but i can see some had 5061. there's also the dynamic/ephemeral port range 30,000 - 50,000+ and RTP range 16,000 - 32,000+ but on my FW show conn, i can see UDP port 5060 only and few low dynamic ports, i.e. 18890, 19718, 20250: i would like to know what ports/range i needed to allow? asa# sh conn 160 in use, 4408 most used UDP outside 208.x.x.10:0 inside 66.x.x.7:5060, idle 0:09:21, bytes 0, flags ti UDP outside 208.x.x.12:36076 inside 66.x.x.7:27938, idle 0:00:00, bytes 1634684, flags m UDP outside 208.x.x.12:0 inside 66.x.x.6:18891, idle 0:01:32, bytes 0, flags mi UDP outside 208.x.x.12:0 inside 66.x.x.6:18890, idle 0:01:48, bytes 0, flags mi UDP outside 208.x.x.x:0 inside 66.x.x.6:5060, idle 0:03:58, bytes 0, flags ti UDP outside 208.x.x.x:36544 inside 66.x.x.6:19718, idle 0:00:00, bytes 795520, flags - UDP outside 208.x.x.x:0 inside 66.51.33.6:5060, idle 0:20:06, bytes 0, flags ti UDP outside 208.x.x.x:34708 inside 66.51.33.6:20250, idle 0:00:00, bytes 3876560, flags m i plan to configure ACL as below. appreciate if someone can confirm. TIA! object-group network SIP-EXT description ### EXTERNAL SIP GW ### network-object host 208.x.x.10 network-object host 208.x.x.12 object-group network SIP-INT description ### INTERNAL VOICE GW ### network-object host 66.x.x.6 network-object host 66.x.x.7 object-group service SIP-PROTOCOLS service-object udp destination eq 5060 service-object tcp destination eq 5060 service-object udp destination range 32768 61000 access-list SIP-OUTSIDE_ACL extended permit object-group SIP-PROTOCOLS object-group SIP-EXT object-group SIP-INT
... View more
Labels:
Created by
johnlloyd_13
in Firewalls
in Firewalls
08-15-2019
10:28 PM
08-15-2019
10:28 PM
hi, could you post both the crypto IKE phase 1 and 2 policies from both ASA (mask sensitive info/IPs)? also post a show crypto isakmp sa output from both ASA as well.
... View more
Created by
johnlloyd_13
in Firewalls
in Firewalls
08-08-2019
06:11 PM
08-08-2019
06:11 PM
then you'll need a smartnet coverage on your FW in order to download OS.
... View more
08-08-2019
06:08 PM
hi, can you check for errors on the failover cable with a show interface g0/x? most of our active-standby FW deployment have direct failover cable between them. this will save switch ports and avoid design complexity and troubleshooting. we have very few deployments via L2 switch or patch panels if the two FWs are in different racks..
... View more
Created by
johnlloyd_13
in Firewalls
in Firewalls
08-07-2019
06:33 AM
08-07-2019
06:33 AM
hi, you'll need a smartnet coverage on your 5525-x and a CCO login in order to download ASA images.
... View more
08-07-2019
06:29 AM
hi, can you post a show failover state and show failover history output from the primary/active FW?
... View more
Created by
johnlloyd_13
in Firewalls
in Firewalls
07-31-2019
01:10 AM
07-31-2019
01:10 AM
hi, this is an expected behavior since there's no standby IP explicitly configured on the standby FW 'outside' and 'inside' interfaces. the standby FW will only get an IP from the primary/active after a fail over. once standby FW becomes active, it should be able to ping the internet.
... View more
Created by
johnlloyd_13
in Firewalls
in Firewalls
07-31-2019
01:03 AM
07-31-2019
01:03 AM
hi, were there any recent change or BW upgrade? issue a show debug if there's debugging left and negate with undebug all.
... View more
Created by
johnlloyd_13
in Firewalls
in Firewalls
07-31-2019
12:58 AM
07-31-2019
12:58 AM
hi, it depends on the IT requirement. is the site keeping the dual ISP/PPoE lines? is the mikrotik router still under warranty? note the 5506x can also support PPoE.
... View more
07-24-2019
01:08 AM
hi marvin, i tried access the FP performance estimator online tool (https://ngfwpe.cisco.com/) but got a policy error/access denied. i got a valid CCO. is this something you request to TAC?
... View more
Created by
johnlloyd_13
in VPN and AnyConnect
in VPN and AnyConnect
07-23-2019
08:31 PM
07-23-2019
08:31 PM
nevermind, i figured it out. i just installed the individual MSI component: anyconnect-win-4.7.04056-core-vpn-predeploy-k9 it's weird it doesn't let me run the 'setup' application and select which modules to install.
... View more
09-11-2019
hi,there's already a default NAT and access control rules configured in
FTD for initial traffic to f...
Created by
johnlloyd_13
in FirePOWER
09-11-2019
09-11-2019
hi,You can Blacklist a Destination IP address (Responder IP) by doing a
right-click on the specific ...
09-06-2019
hi reza,thanks for the cool link/tool!will try to insert a spare GLC-TE
SFP on the N5K and see if it...
09-06-2019
hi,just a quick question, is GLC-TE copper SFP compatible with cisco
nexus 5K (N5K-C5672UP)?i only s...
09-03-2019
you can leverage the FMC 'network discovery' and/or configure access
rule to allow all traffic and e...
09-03-2019
hi,you'll need to redirect traffic to the ASA FP module, add/register
device to FMC, apply NGFW lice...
08-29-2019
hi,you can check if your ASA 5506 has smartnet via this cisco
link:https://cway.cisco.com/sncheck/ci...
08-29-2019
hi,there's no SNMP setting/option in FDM under device or system
setting.you can do it via its flexco...
08-21-2019
hi,it seems like you console into a nexus switch. notice the device
hostname is 'switch' and has a '...
08-20-2019
hi,i need to lock down SIP ports on an ASA FW towards our internal
SIP/voice GW:external SIP 208.x.x...
08-15-2019
hi,could you post both the crypto IKE phase 1 and 2 policies from both
ASA (mask sensitive info/IPs)...
Created by
johnlloyd_13
in FirePOWER
08-15-2019
08-15-2019
hi,is this for a dedicated appliance or virtual FMC?just click on any
platform (say, FMC 1500) > sel...
08-08-2019
hi,can you check for errors on the failover cable with a show interface
g0/x?most of our active-stan...
Public Statistics
| Date Registered | 12-02-2007 03:31 AM |
| Date Last Visited | 09-14-2019 07:18 PM |
| Total Messages Posted | 3,182 |
| Total Helpful Votes Received | 1031 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 50 | |
| 195 | |
| 15 | |
| 121 | |
| 5 |
.jpg "VIP Expert"){kind=icon}
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 25 | |
| 5 | |
| 5 | |
| 5 | |
| 10 |
Awards
Community Spotlight Award
Mobile App Contributor January 2012
