Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About misa.jovanovic
Stats
Member since
07-16-2013
16
Posts
5
Helpful
0
Solutions
Created by
misa.jovanovic
in Firewalls
in Firewalls
09-01-2019
10:09 AM
09-01-2019
10:09 AM
Hi, I don't remember I ever read anywhere that actual keying material can be retrieved, as this is done dynamically, using DH algorithm. Only output that I could think of that could have even close material as such would be output of the debug, as that one contains most detailed information about what is happening during tunnel establishment. Here is an example of such configuration, debug commands and output: ASA IKEv2 Debugs for Site-to-Site VPN with PSKs However, in this post it is clearly stated: It also computes a skeyid value, from which all keys can be derived for this IKE_SA. All but the headers of all the messages that follow are encrypted and authenticated. The keys used for the encryption and integrity protection are derived from SKEYID and are known as: a. SK_e (encryption). b. SK_a (authentication). c. SK_d is derived and used for derivation of further keying material for CHILD_SAs. A separate SK_e and SK_a is computed for each direction. So I would say that what you are trying to achieve is not possible with Cisco ASA. From the links that you've provided, I can see that it is not possible with Juniper SRX either. Best regards
... View more
Created by
misa.jovanovic
in Firewalls
in Firewalls
09-01-2019
04:08 AM
09-01-2019
04:08 AM
Hi, If you are referring to PSK configured on ASA, which is by standard "show run" command displayed as ****, you can see actual configured PSK by using command "more system:running-config". This way, you could see your other keys, hidden in "show run" command (e.g. your AAA server PSK, or SNMP server community). Additionally, you can narrow your search a bit by specific peer using "more system:running-config | begin IP_address". An example if used show would be: LAB-ASA# show run | b 192.168.185.49 tunnel-group 192.168.185.49 type ipsec-l2l tunnel-group 192.168.185.49 ipsec-attributes ikev1 pre-shared-key ***** or by using comand more: LAB-ASA# more system:running-config | b 192.168.185.49 tunnel-group 192.168.185.49 type ipsec-l2l tunnel-group 192.168.185.49 ipsec-attributes ikev1 pre-shared-key rEu!4q.W@ojR!zpHT#u.6b I hope this helps. Best regards
... View more
Created by
misa.jovanovic
in VPN and AnyConnect
in VPN and AnyConnect
08-31-2019
11:58 AM
08-31-2019
11:58 AM
I don't think it is the RAM either, as in that case, ASA probably wouldn't even boot. I mentioned RMA ( Return Material Authorization ), a process in which faulty HW is replaced by Cisco, if under service. However, based on the provided outputs, it looks that crypto engine is ok - it is sending the packets, just not receiving anything to process. Also, based on one of your debug outputs: Aug 31 00:50:57 [IKEv1 DEBUG]: IP = 154.73.104.100, processing IKE SA payload Aug 31 00:50:57 [IKEv1]: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 5 Cfg'd: Group 2 Aug 31 00:50:57 [IKEv1]: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 5 Cfg'd: Group 2 Aug 31 00:50:57 [IKEv1 DEBUG]: IP = 154.73.104.100, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 2 it does seem that you are receiving some traffic back from the peer 154.73.104.100. As advised by RJI, please make a packet capture on outside interface of traffic destined to 154.73.104.100. That would confirm that logs don't lie, and that indeed there is some packet exchange between these peers. Regarding other VPN peer that appears in logs, one with IP 41.79.47.28, you are missing configuration for PSK, something like: tunnel-group 41.79.47.28 type ipsec-l2l tunnel-group 41.79.47.28 ipsec-attributes pre-shared-key your_psk If this tunnel was working before, than we can conclude, with great certainty, that your configuration was not saved, which manifested after power outage . Best regards
... View more
Created by
misa.jovanovic
in VPN and AnyConnect
in VPN and AnyConnect
08-31-2019
05:14 AM
08-31-2019
05:14 AM
Hi Lebon, First of all, you should never post unaltered configuration to public forums, that contains usernames, passwords, PSKs and/or public IPs. You could check status of crypto accelerator with "sh crypto accelerator statistics", to see stats there. As you already said, you had multiple power outages, and no configuration was changed, so those outages which could lead to HW failure, so I would advise to go for TAC case, and possible RMA. Best regards
... View more
Created by
misa.jovanovic
in Firewalls
in Firewalls
08-31-2019
04:53 AM
08-31-2019
04:53 AM
Hi umeshunited, In terms of functionality, and how ASA is using this information - nothing. Both commands will override hardware MAC address, and use this given one. If I remember correctly, as of certain version of ASA code (I'm not sure exactly which one, maybe 9.5), if "failover mac" is used, you'll get a warning that this command will soon be deprecated, and that you should move to interface MAC command. Either way, I would recommend using one or another option (I personally use one under interface, for some time now), as it is quite handy in case your primary unit fails, it can make your life bit easier ;) Best regards
... View more
Created by
misa.jovanovic
in Policy and Access
in Policy and Access
02-09-2019
10:03 AM
02-09-2019
10:03 AM
I already watched both sessions, but, unfortunately, neither of these sessions covers design perspective of ISE-AD integration in more complex environments. One that I described, is definitely more complex scenario, but hardly unique, so I'm kinda disappointed that there is no official material dealing with this topic. I can only conclude (and couple of Cisco engineers I was in touch regarding this topic agree with me) that this topic is poorly documented.
The issue we are facing is not caused by peak traffic, as it repeats every day. I must stress out, that with ACS we had no such issue. Reason behind this lies in a fact that ACS had capability of joining each node to its own domain, and inside policies you are always referencing it as AD1, regardless of what is behind.
What we are doing now, after so many sessions with TAC, is to create 4 joint points, one for each subdomain, and then to use PSN ID to direct requests to appropriate domains. This effectively means that we'll multiply policy sets with 4, which I very much dislike. However, we did PoC with one subdomain, and I must say it gives promising results for now (latency dropped from over 2s to less that 400ms, which is very good, but we'll work towards further reducing this).
Once we finish with migration and have some good results, I'll write one more post to describe how my policy looks now.
... View more
Created by
misa.jovanovic
in Policy and Access
in Policy and Access
12-04-2018
01:20 AM
12-04-2018
01:20 AM
Hi,
We are in process of migration ACS v5.8 to ISE v2.4 for a large international customer. My customer has a fully distributed deployment, operating on 3 regions/continents (EMEA, APAC, AM). ISE is used for 802.1x and VPN authentication, with AD integration.
In terms of ISE, we have:
2x PAN nodes, located in EMEA region (main data center)
2x MnT nodes, located in EMEA
6x PSN nodes, with 2 of them located in EMEA, APAC and AM
In terms of AD, Microsoft multi-domain forest is in use, with two-way trust between all used domains. There are basically 4 domains:
mydoman.com - root domain
emea.mydomain.com - EMEA subdomain
apac.mydomain.com - APAC subdomain
am.mydomain.com - AM subdomain
AD servers are located in each region for each subdomain, and servers are at the same time DCs (Domain Controller), GCs (Global Catalog) and DNS servers:
For EMEA region, we have:
4x DC=GC for emea.mydomain.com
2x DC=GC for apac.mydomain.com
2x DC=GC for am.mydomain.com
2x DC=GC for mydomain.com
For APAC region, we have:
2x DC=GC for apac.mydomain.com
For AM region, we have:
2x DC=GC for am.mydomain.com
1x DC=GC for mydomain.com
We are using recommended Microsoft Sites and Services for all locations. All PSN nodes are in correct Sites, and there is no latency between e.g. AM PSN nodes and AM DCs (they are on same L3 device).
After successful configuration migration, we have joined PAN, MnT and PSN nodes to emea.mydomain.com (as it is main data center). As there is two-way trust, we can successfully pool AD groups from all subdomains, and we can authenticate users cross-domain. Thanks to this approach, we can use single JP (Join Point) as a reference in our policies. Everything works ideally, however...
From time to time, especially in peak hours for given region, we are receiving "High authentication latency" alarms. As the threshold for this alarm is 10s, I'm a bit worried about this one. We do have high-speed WAN links between regions, but it still might happen that there is a peak in utilization. Also, based on architecture, as we are using Sites and Services, I would expect minimum cross-domain communication from ISE standpoint (I'm aware that there must be some - e.g. EMEA user is roaming to AM, and authenticating to AM PSNs).
I did packet capture, and I can confirm that I can see that AM PSN is talking to AM DC, for captured RADIUS authentication. There is some communication from AM PSN back to EMEA DC, but this should be expected as it is joined to emea.mydomain.com. I can see high latency for multiple ISE services and scenarios, e.g.:
when certificate authentication is being used, with AD group authorization (for 802.1x scenario)
when AD authentication is being used, with AD group authorization (for BYOD and VPN scenario)
when AM workstation is authenticating to AM PSN (for 802.1x scenario)
when AM user is authenticating to AM PSN (VPN and BYOD scenario)
when EMEA user or workstation is authenticating to AM PSN (roaming users)
All of the alarms are raised for APAC and AM region, but never for EMEA, which makes me challenge design on AD integration part. Also, alarms are not raised for all authentications, nor entire time, so there is no obvious regularity.
I already went through tons of documentation and Live sessions, but there is actually no document describing how should a system be designed/deployed with multi-domain forest, in terms of which nodes to join to which domain/subdomain, how to build policies based on that approach, etc.
Could you please shed some light on this matter? Any experiences and recommendations with deployments like these?
Thanks
... View more
Labels:
Created by
misa.jovanovic
in Routing
in Routing
09-16-2013
05:58 AM
09-16-2013
05:58 AM
I've just remembered that i have DMVPN implemented, and that on Tunnel interface which source is FastEthernet on which i do shapping. On my Tunnel interface, i have MTU set to 1400 (although output of the show int tunnel shows that mtu is 1514), and MTU on FastEthernet interface is 1500. Now i'm confused?!?! Writing this makes me wonder, why do we even discuss about L2/L3 shapping? If Cisco isn't explicitly telling you to take care about this, why do we trying to figure out how to configure this? We've found some documents that covers older and specific device. Is it possible that you don't need to care about this, that it is left to hardware to handle this? Otherwise, Cisco should mention something when they are talking about traffic shapping. I'm thinking, when your provider gives you 1 or 2 or 5 Mb/s, he doesn't says is it L2 or L3 Mb/s or is it wire speed. They simply tells you that it is speed allocated to you. From that point of view, do i really need to take care of L2/L3 shapping? My data packets are bigger and they will be e.g. 1532 bytes, but my VoIP packets are smallerand they will be 520 bytes. My speed says that i can send 1 Mb (1024*1024 bytes) of traffic per seccond. If my packet is bigger, it will send less packets and other way arround. It's impossible to cover every scenario with every packet size, isn't it? Do you understand what i'm trying to say?
... View more
Created by
misa.jovanovic
in Routing
in Routing
09-14-2013
12:25 PM
09-14-2013
12:25 PM
I am satisfied with VoIP performance. we have no problem with jitter, latency or any other parameter, so i won't be changing anything regarding this. However, i'm not happy about shapping. My link is shaped ad 75% of it's capacity. I'm still not convinced that this is how it should be done. Same CCIE guy originally shapped it at 1024k, but my colleagues reduced this at 768k, with no so clear explanation about headers overhead. Reading one of your previous posts, i beleive they ment same thing as you when you were talking abou 5-15% less. Since Cisco isn't be very clear about L2/L3 shapping on newer devices (if 2801 is that ), i guess that only way to check this is to try it myself, and to check number of dropped packets on interfaces. But, since this is my production environment, i'll have to think this through before i do it.
... View more
Created by
misa.jovanovic
in Routing
in Routing
09-13-2013
07:20 AM
09-13-2013
07:20 AM
I've found this document (http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/12sl2os.html) which describes L2 happing configuration, but it says that is implemented on a specific module card. I'm not sure how other Cisco devices implements this functionality. As for the number of classes, they have its purpose because of different priorities. Althoug i'm not that much into QoS, this configuration was implemented by CCIE guy, so i believe that he knew what he was doing I'm not sure that i fully understood configuration of tx-ring-limit. I've searched Cisco site, but all i've found was related to ATM. Could you please provide me some links about this? Regarding VoIP, we are using it in our network, but we don't nave any problems with it. This remark was related to packet latency?
... View more
Created by
misa.jovanovic
in Routing
in Routing
09-12-2013
06:24 AM
09-12-2013
06:24 AM
Hi JosephDoherty, Thanks for replying. I have found your post https://supportforums.cisco.com/thread/2147463 where you've explained that shapping value should be 5 to 15% less than actual link speed, because of the L2 header. I'm also using nested policy and VoIP (bellow are the configuration and IOS version). Router models are 2801 and 2811. How can i check how does the shapper works for theese models? I've tried Cisco documentation, but without luck. How do you accuratelly determines will it be 5, 10 or 15% less? System image file is "flash:c2800nm-advipservicesk9-mz.124-25a.bin" policy-map My_Policy class VOICE priority 256 class VOICE-CONTROL bandwidth remaining percent 9 police 512000 class VIDEO bandwidth remaining percent 16 police 256000 class My_Class_01 bandwidth remaining percent 9 police 512000 class My_Class_02 bandwidth remaining percent 42 police 512000 class My_Class_02 bandwidth remaining percent 16 police 512000 class class-default bandwidth remaining percent 8 random-detect police 512000 ! policy-map Shape-1024K class class-default shape average 768000 service-policy My_Policy
... View more
Created by
misa.jovanovic
in Routing
in Routing
09-12-2013
02:38 AM
09-12-2013
02:38 AM
Hi pdriver, Thaks for your response. I do realize that congestion mechanism will take place only whe there is congestion. However, my routers FastEthernet interface is connected to my providers interface. ISP is allowing me only 1Mb/s and, since speed of my interface is 100 Mb/s, i have to use shapping to avoid packet drops. I have read abouot shaping and policing, but my dilemma is diferent. My question was would i use value of 768k or 1024k for 1M link? shape average 768000 or shape average 1024000? I would said that you will use value of 1024k to shape trafiic in this case, because my CIR is 1024k.
... View more
Created by
misa.jovanovic
in Routing
in Routing
09-12-2013
12:59 AM
09-12-2013
12:59 AM
Hi all, If i have 1M WAN link, what would be the value for traffic shaping: 1024000 or less? Bellow is an example of configuration on one of the routers in my company, and shapping value is set at 768000 with explanation that it always must be less because of the packet headers. For me, this doesn have much sense, because headers will go through that interface anyway. I believe that this value should be set to link speed (1M), not 768k. Thans in advance policy-map Shape-1024K class class-default shape average 768000 interface FastEthernet0/1 service-policy output Shape-1024K
... View more
Labels:
Created by
misa.jovanovic
in Firewalls
09-01-2019
09-01-2019
Hi,I don't remember I ever read anywhere that actual keying material can
be retrieved, as this is do...
Created by
misa.jovanovic
in Firewalls
09-01-2019
09-01-2019
Hi,If you are referring to PSK configured on ASA, which is by standard
"show run" command displayed ...
Created by
misa.jovanovic
in VPN and AnyConnect
08-31-2019
08-31-2019
I don't think it is the RAM either, as in that case, ASA probably
wouldn't even boot.I mentioned RMA...
Created by
misa.jovanovic
in VPN and AnyConnect
08-31-2019
08-31-2019
Hi Lebon, First of all, you should never post unaltered configuration to
public forums, that contain...
08-31-2019
Hi umeshunited, In terms of functionality, and how ASA is using this
information - nothing. Both com...
Created by
misa.jovanovic
in Identity Services Engine (ISE)
05-12-2019
05-12-2019
Thanks.It would be great if someone from Cisco could reply when can this
be expected, as I see it as...
Created by
misa.jovanovic
in Identity Services Engine (ISE)
05-10-2019
05-10-2019
Hi Arne, Is it possible to configure field "From:" for password expiry
notifications?I know it is po...
Created by
misa.jovanovic
in Policy and Access
02-09-2019
02-09-2019
I already watched both sessions, but, unfortunately, neither of these
sessions covers design perspec...
Created by
misa.jovanovic
in Policy and Access
12-04-2018
12-04-2018
Hi, We are in process of migration ACS v5.8 to ISE v2.4 for a large
international customer. My custo...
09-16-2013
I've just remembered that i have DMVPN implemented, and that on Tunnel
interface which source is Fas...
09-14-2013
I am satisfied with VoIP performance. we have no problem with jitter,
latency or any other parameter...
09-13-2013
I've found this document
(http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/12sl2os.html)
whic...
09-12-2013
Hi JosephDoherty,Thanks for replying. I have found your post
https://supportforums.cisco.com/thread/...
09-12-2013
Hi pdriver,Thaks for your response. I do realize that congestion
mechanism will take place only whe ...
Public Statistics
| Date Registered | 07-16-2013 05:39 AM |
| Date Last Visited | 10-15-2019 10:52 AM |
| Total Messages Posted | 16 |
| Total Helpful Votes Received | 5 |
