About Jernej Vodopivec

Jernej Vodopivec · ‎11-04-2018

Thanks, I've already checked release notes. Problem is we're already running 10.5.3.

Jernej Vodopivec · ‎11-03-2018

Hi, there is no upgrade path from 10.5.3 to 11.5 in release notes. Does anyone have information when (if) upgrade from 10.5.3. to 11.5 will be supported?

Jernej Vodopivec · ‎12-03-2017

Sorry, I get it now: it redirects all emails detected as a spam to this address. When action is set to Quarantine and when the message is released from quarantine it's redirected to the configured email address :)

Jernej Vodopivec · ‎12-03-2017

Libin, I noticed "Send to an Alternate Envelope Recipient (optional):" is not working when configured at policy level and "Apply This Action to Message:" is set to "Quarantine". It only works when "Apply This Action to Message:" is set to "Deliver". Is this a bug or is this by design?

Jernej Vodopivec · ‎12-02-2017

Have you configured Send and Receive connectors on both Exchange's correctly? Have you configured RAT, SMTP routes etc. on ESA correctly? Try to manually send email: a) from Exchange X to ESA: https://technet.microsoft.com/en-us/library/bb123686(v=exchg.160).aspx (step 3) - if ESA refuses the email copy-paste the text output b) from ESA to Exchange Y: run same procedure.. if Exchange Y refuses the email, copy paste the output

Jernej Vodopivec · ‎12-02-2017

Yes, it's possible. You have to define "Send to an Alternate Envelope Recipient (optional)" on incoming mail policy, "antispam settings".

Jernej Vodopivec · ‎10-22-2017

Hi, we ran into very strange situation yesterday: clients were unable to get DHCP configuration from DHCP servers. Wireshark analysis on client machine shows that only "discover" packets are sent (to ff:ff:ff:ff:ff:ff) and clients don't receive "offer" packet from DHCP server. Wireshark analysis on DHCP server shows that "discover" packets are received and "offer" packets are sent back to the client (to ff:ff:ff:ff:ff:ff as expected). The topology: - clients are connected to local 3650 access switches (stack) - catalyst 3650 are connected via port channel to Nexus 9300 (vPC); - Nexus 9300 (local) are connected to other Nexus 9300 (remote) via vPC (on the remote location) - Nexus 9300 (remote) are connected to Catalyst 3650 stack switches (remote) - DHCP server (windows server 2016) is connected to catalyst 3650 Next strange issue we observed was clients receive response from DHCP server after approx. 0,5h connected to network. Successful workaround was disconnecting Nexus switches and connecting Catalyst switches directly via portchannel. Nexus 9300 is running with latest recommended software: 7.0(3)I5(2). Anyone experienced similar issue?

Jernej Vodopivec · ‎08-12-2017

Hi Boyan, are you using non-QUERTY keyboard? "_" is "?" on QUERTZ keyboard. When you were doing initial configuration you typed "?" instead of "_". Keyboard was set to QUERY layout. And now when you're trying to login via web you're using your primary keyboard layout.

Jernej Vodopivec · ‎08-12-2017

I forgot: I'm pretty sure you won't be able to rehost license (essentials/premium). SKU's were different for each ASA model. You'd need to purchase new anyconnect license if you use old anyconnect licenses. But you can still ask licensing team to rehost license - maybe they'll be in a good mood and would rehost license despite different platform. :)

Jernej Vodopivec · ‎08-12-2017

Kombe, are you referring to anyconnect licenses? If you do refer to anyconnect licenses and you've purchased it recently - version 4 (Plus or Apex) then: - 250 overall users are entitled to use anyconnect service; the limit of 250 users refers to all users who'll use anyconnect at any time on any day - not simultaneous users - licenses cover users and not devices like old anyconnect license does - so you can activate any number of ASAs that would offer anyconnect service to your users; go to www.cisco.com/go/license and get activation key for ASA5525-X If you haven't migrated from old anyconnect licenses (essentials/premium) you'll have to contact licensing team as Aditya suggested. Licensing team will help you rehost licenses.

Jernej Vodopivec · ‎08-08-2017

You're welcome :) Thanks for rating!

Jernej Vodopivec · ‎08-07-2017

Hi, it's 65535 source ports for single IP address. ASA will use client's source port number if it's available. If the client's source port has already been used ASA will assign first free source port from the relevant pool: 1-511, 512 to 1023, and 1024 to 65535.

Jernej Vodopivec · ‎08-07-2017

Hi, it seems you're running out of ports for single IP address using by PAT. Do you have free public IP addresses you can use for PAT? If you have free public IP addresses configure PAT pool and reconfigure NAT rule: nat (CMTS,OUTSIDE) source dynamic 10.51.0.0 pat-pool NEW-NAT-POOL

Jernej Vodopivec · ‎08-02-2017

Hi, if client will be connecting to IP address instead of FQDN this will be untrusted connection. Client couldn't be sure he/she is connecting to trusted server. Nevertheless if you're not blocking connections to untrusted servers in anyconnect client it would work. So connecting to FQDN would be the right way.

Jernej Vodopivec · ‎12-22-2016

Hi Robert, 1. You create: a) one certificate with CN that matches one of the boxes MX record (doesn't matter which one). But you need to add alternate subject name (SAN) for MX record of the second box in the same CSR. b) use wildcard certificate where CN would match both MX records c) two separate CSRs/certificates for each box separately 2. a) you use one certificate for both appliances b) you use one certificate for both appliances c) you create two CSRs and install two different certificates - one on each appliance

Date Registered	‎08-12-2010 05:30 PM
Date Last Visited	‎11-13-2018 04:00 PM
Total Messages Posted	328
Total Helpful Votes Received	138

Re: Upgrade WSA from 10.5.3 to 11.5

Upgrade WSA from 10.5.3 to 11.5

Re: ESA quarantine forward mail

Re: ESA quarantine forward mail

Re: Test Virtual Email Security with Tw...

Re: ESA quarantine forward mail

Dropping/filtering broadcast packets

Hi Boyan, are you using non

I forgot: I'm pretty sure you

Kombe, are you referring to

You're welcome :)

Hi, it's 65535 source ports

Hi, it seems you're running

Hi, if client will be

Hi Robert,