Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Thomas Busch
07-15-2019
Thomas Busch
Member since
10-25-2013
Cisco Employee
Created by
Thomas Busch
in Advanced Threats
in Advanced Threats
05-26-2019
03:06 PM
05-26-2019
03:06 PM
At this current time, there is not a way to do a cloud-based uninstall. What you can do however and place the computer into a separate group which has a fairly restrictive policy (Application control for a common program, block common IPs, etc). While it won't guarantee a user will uninstall it increases the chances of it happening. You can also ensure to delete computer objects that have not checked in for over 30 days by filtering those machines out on the computer page and subsequently removing those that haven't checked in to ensure you don't have allocated licenses to old/unused machines.
... View more
Created by
Thomas Busch
in Advanced Threats
in Advanced Threats
11-14-2018
09:54 AM
11-14-2018
09:54 AM
A reinstall of the connectors using an installer from the other private cloud will be required to ensure all pieces (policy IDs, mutual certs) are synced and properly registered between the endpoints and the private cloud
... View more
09-17-2018
04:50 AM
Currently, any uploaded IOC would require a scan be run on the endpoint for the IOC to be triggered.
However, since you are only matching on specific MD5s you could potentially convert the IOC to match using an Advanced Custom Detection. The only caveat is that you would need to create this ACD logic yourself to ensure the correct results.
... View more
09-11-2018
04:09 PM
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc64688 is the current bug tracking this behavior. You may follow the bug to get updates to when the GUI will be able to support multiple user logins.
... View more
05-03-2017
05:55 AM
TDEVIDAL07,
Please look at the below, especially focusing on the Net.ReversePathFwdCheckPromisc section as this sounds like what you are hitting.
Complete these steps in order to resolve this issue and stop the loop of multicast packets that are sent in the VMware environment:
Enable promiscuous mode on the Virtual Switch (vSwitch).
Enable MAC Address changes.
Enable Forged transmits.
If multiple physical ports exist on the same vSwitch, then the Net. ReversePathFwdCheckPromisc option must be enabled in order to work around a vSwitch bug where the multicast traffic loops back to the host, which causes the CARP to not function with link states coalesced messages. (Refer to the next section for additional information).
Modify the Net.ReversePathFwdCheckPromisc Option
Complete these steps in order to modify the Net.ReversePathFwdCheckPromisc option:
Log into the VMware vSphere client.
Complete these steps for each VMware host:
Click host, and navigate to the Configuration tab.
Click Software Advanced Settings from the left pane.
Click Net and scroll down to the Net.ReversePathFwdCheckPromisc option.
Set the Net.ReversePathFwdCheckPromisc option to 1.
Click OK.
The interfaces that are in Promiscuous mode must now be set, or turned off and then back on. This is completed on a per-host basis.
Complete these steps in order to set the interfaces:
Navigate to the Hardware section and click Networking.
Complete these steps for each vSwitch and/or Virtual Machine (VM) port group:
Click Properties from the vSwitch.
By default, Promiscuous mode is set to Reject. In order to change this setting, click edit and navigate to the Security tab.
Select Accept from drop-down menu.
Click OK.
... View more
02-20-2017
09:04 AM
If you previously revert to 9.1.x and then upgrade to 10.x, you can revert back to 9.1
If you redeploy the virtual WSA, you would need to ensure that you use the 9.1.x version of the OVA and then upgrade to ensure you can "revert" if needed.
... View more
02-20-2017
06:30 AM
The 9.2.X code version is a special build that is used for the WSA hybrid solution and is automatically updated to ensure compatibility.
In order to upgrade to 10.X code, you will need to either revert to 9.1.x and then upgrade to 10.x or if using a virtual WSA, redeploy the WSA using the 10.X OVA file.
... View more
11-08-2016
11:19 AM
Marcus,
I have had many issues with trying to copy the license over Vmware workstation and my computer correctly.
Even though there is not a license installed you can still configure the ip address of the M1 interface using the ifconfig command. Once this is set and committed you can then ssh to the cli and copy/paste the contents of the license XML over. Once that is done, you can continue to setup the WSA.
... View more
11-01-2016
05:37 PM
Hi Simon,
I suspect that you are using AnyConnects' detect closest tower feature in order to allow AnyConnect WSM (Web Security Module) to send traffic to the tower that will provide the best performance based on factors such as network latency, and best path to name a few.
A common reason that this logic can happen would be due to the ISP link itself and the latency that is occurring in the path to one tower vs the other. If there is latency to the UK tower, but not to the France tower, AnyConnect will pick the France tower in order to provide the best service to you.
You can check for this behavior specifically by running a traceroute to the towers in question and comparing the latency. Additionally, running a DART bundle in verbose mode will produce a detailed output of the stats AnyConnect used at that instance to pick the best tower. Additionally, you can uncheck the "Detect Closest tower" option and manually select the tower to use.
CWS reporting (Wire) does not currently have the ability to report on the Tower ID or country code that the traffic was processed through.
... View more
10-21-2016
07:59 AM
Jacques,
The best way to think about setting your policies up is to think of them like an ACL. Therefore for your setup, you would need to structure the policy from most restrictive to non-restrictive.
Example:
-More specific rules
1) Policy to block AD group all the time
2) Policy to allow AD group all the time
3) Allow based on time
- Other general rules
... View more
08-24-2016
04:05 AM
Nelson,
This IP address is associated with the CWS (cloud web security service) for access207.
Each access tower is configured that there is an ingress IP (what you connect to) and an egress IP (what end websites see your traffic sourced from).
For example in your case, you would point your connector/redirection method to the IP address 108.171.130.134 to have your traffic reach the tower and we would then take the traffic and send it to the end server sourcing it from our egress IP.
Note that your traffic should only be pointed to redirect to the ingress IP (access<number>) not the egress IP
... View more
08-04-2016
05:17 PM
The AnyConnect Web Security module is designed to always be on to ensure that your clients are filtered through your configured policy.
There is a feature within AnyConnect called TND (trusted network detection) which allows you to disable the module when it can reach out to a trusted server (verified via a certificate hash) only accessible on your corporate network.
The logic can be work around however to do the opposite (stay enabled via the corporate network, disabled outside the corporate network) by instead using a certificate hash of any public HTTPS website and then ensure the configured website is blocked via the corporate network.
When the users are off the corporate network AnyConnect can pull the certificate hash and disable the module. While on the corporate network, the connection to the site will not establish (due to being blocked on edge firewall for example) and not pull the hash, allowing AnyConnect to still stay enabled and filtering.
... View more
08-25-2015
04:20 AM
I've submitted that URL as Entertainment. Please note it may take up to 24 hours for the classification to occur.
... View more
Created by
Thomas Busch
in Advanced Threats
05-26-2019 03:06 PM
05-26-2019 03:06 PM
At this current time, there is not a way to do a cloud-based uninstall.
What you can do however and ...
Created by
Thomas Busch
in Advanced Threats
11-14-2018 09:54 AM
11-14-2018 09:54 AM
A reinstall of the connectors using an installer from the other private
cloud will be required to en...
09-17-2018 04:50 AM
Currently, any uploaded IOC would require a scan be run on the endpoint
for the IOC to be triggered....
09-11-2018 04:09 PM
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc64688 is the current
bug tracking this behavior. ...
05-03-2017 05:55 AM
TDEVIDAL07, Please look at the below, especially focusing on the
Net.ReversePathFwdCheckPromisc sect...
02-20-2017 09:04 AM
If you previously revert to 9.1.x and then upgrade to 10.x, you can
revert back to 9.1 If you redepl...
02-20-2017 06:30 AM
The 9.2.X code version is a special build that is used for the WSA
hybrid solution and is automatica...
11-08-2016 11:19 AM
Marcus, I have had many issues with trying to copy the license over
Vmware workstation and my comput...
11-01-2016 05:37 PM
Hi Simon, I suspect that you are using AnyConnects' detect closest tower
feature in order to allow A...
10-21-2016 07:59 AM
Jacques, The best way to think about setting your policies up is to
think of them like an ACL. There...
08-24-2016 04:05 AM
Nelson, This IP address is associated with the CWS (cloud web security
service) for access207. Each ...
08-04-2016 05:17 PM
The AnyConnect Web Security module is designed to always be on to ensure
that your clients are filte...
Public Statistics
| Date Registered | 10-25-2013 10:29 AM |
| Date Last Visited | 07-15-2019 05:35 AM |
| Total Messages Posted | 13 |
| Total Helpful Votes Received | 10 |
