Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About zalkurdi
Stats
Member since
11-08-2013
18
Posts
9
Helpful
2
Solutions
Created by
zalkurdi
in Policy and Access
in Policy and Access
09-01-2017
01:12 PM
09-01-2017
01:12 PM
Glad to hear it. Enjoy.
... View more
09-01-2017
01:02 PM
Hello Douglas, It may be that the Management services is not running or unresponsive after the upgrade. If you run the command "show application status acs" command, what is the output? Also, use the "show disk" command to check the disk utilization status. If you see the management service not running, try to restart the services on the node or reboot the box. If you are still facing issues, then you might need TAC assistane to go through the logs or access the root. Hope this helps. Regards, Zaid Kurdi
... View more
Created by
zalkurdi
in Policy and Access
in Policy and Access
09-01-2017
12:55 PM
09-01-2017
12:55 PM
Hello Ben, So from what you are saying, if you open a browser and go to http://8.8.8.8, you are not redirected to the portal, correct? Once you authenticate the user, what do you see in the authentication report on the ISE? Are you sure that ISE is pushing the redirect ACL and URL? If so, you can go to the WLC client page, open the MAC address of the client and check whether the URL and ACL are visibile there. The state of the client should be You need to make sure that the ACL is permitting traffic to the ISE nodes, DNS and DHCP but denying all HTTP traffic. This lets the WLC know that HTTP traffic should be redirected. If all this is confirmed, try to run a packet capture on the PC to see if it is receiving the redirect URL from the WLC. Hope this helps. Regards, Zaid Kurdi
... View more
Created by
zalkurdi
in Policy and Access
in Policy and Access
08-30-2017
06:59 PM
08-30-2017
06:59 PM
Hello Jacob, At the moment, the only way to profile an endpoint as an Apple iOS device or as an Android device is to utilize the user agent in the HTTP packet or the host name attribute in the DHCP packet. If you open the pre-built profiling policy, you will see that those are the conditions to match those profiles. Radius alone does not have the necessary information to profile the device on such a deep level. In your case, if you do not use any portals, you will have to wait for the DHCP packet to reach ISE to make the decision. ISE can not profile the device on the fly during the actual authentication, it needs time to gather information and make a decision about the kind of endpoint. In your case, you can create a general Authz rule to allow limited access for an unknown endpoint. Once ISE receives the DHCP packets and profiles the device, it can send a CoA to reauthenticate the device and match the rule you already have. Hope this helps. Cheers, Zaid Kurdi
... View more
12-29-2013
11:33 PM
Hello, Now if you want to statically map the public IP of the router to the IP of the ASA, that would work. However, this will make all traffic to that IP, not just VPN, go to the ASA. My suggestion was to allow only VPN traffic through. This is totally up to you.
... View more
12-28-2013
05:57 AM
Hello, A little clarification: Q. Why is NAT-T needed? A. In phase 2 and the last messages of phase1, the packets being sent between peers are encrypted ESP packets (IP-proto-50). So when an encrypted packet goes through a device running PAT, it will be dropped since it doesnt use port numbers. In these cases, NAT-T is used to send UDP 4500 packets instead of ESP packets. So, if you are behind a NAT device, you need to enable NAT-T. As for the NATing on the router, you need to add 2 static NAT statements to allow UDP 500 and UDP 4500 packets. ip nat inside source static udp X.X.X.X 500 interface FastEthernet0/0 500 ip nat inside source static udp X.X.X.X 4500 interface FastEthernet0/0 4500 This is called Port Forwading and will pass any VPN traffic to the ASA. If you implement static NATing without ports, all traffic going to the public ip of the router will go to the ASA. If you want to disable NAT-T, you can have the router become the termination point of the VPN instead of the ASA. HTH Zaid Al-Kurdi
... View more
12-27-2013
03:37 PM
Hello, NAT including PAT is used in many networks where IPsec is also used, but there are a number of incompatibilities that prevent IPsec packets from successfully traversing NAT devices. NAT traversal enables ESP packets to pass through one or more NAT devices. The "sysopt connection permit-vpn" command allows incomming VPN traffic to bypass any ACL on the outside interface. This is done so that you dont have to add any ACL to allow VPN traffic. If you would like to know more, go to the Cisco ASA Command Reference.
... View more
12-24-2013
09:46 AM
Hello, Make sure that this command is present on the ASA: " Crypto key generate rsa modulus 1024" Also, make sure that the traffic is reaching the ASA. You mentioned that you have the DMZ interface connected to a router. Maybe the router is routing the trafffic somewhere else. To make sure, you can run some packet captures on the DMZ interface by using the following commands: "cap capin interface DMZ match ip host 10.250.100.140 host 10.250.0.5" Then try to access the ASA from the PC using the browser and then use the command "show cap capin". This will show if the packets are infact reaching the ASA.
... View more
12-23-2013
11:13 AM
Hello, As to your question, you cant have more than 1 crypto map on the interface. However, you can use the same crypto map for multiple policies. You can change the my-map to vpnmap. This way both are enabled on the same interface, with one having a higher priority than the other. So if a packet is coming from the inside interface, the first crypto ACL will be checked and then the next and so on. The first match it finds is chosen for the IPsec negotioation.
... View more
12-22-2013
08:46 AM
In my previous post, I mentioned how you can change the configuration in the link to meet your needs. I don't believe there are any disadvantages. Its just another way to set up L2L.
... View more
12-22-2013
01:06 AM
Hello, Just to be clear, the POWER LED is blinking green, it is not solid green? What do you see on the STATUS LED? Do you get any console output? This might be a hardware failure and might need replacment. The link below shows the meaning of each LED indicator. http://www.cisco.com/en/US/docs/security/asa/hw/maintenance/guide/overview.html
... View more
12-22-2013
12:56 AM
Hello, That can be due to many reasons. If you would attach your configuration maybe we can see what the issue is. But make sure that you configured NAT properly and you dont have any ACLs blocking your packets. Make sure your default route is set. Also use the commands below to see where the drop is happening. "Packet-tr input inside tcp 1234 4.2.2.2 80 detail" "Packet-tr input outside tcp 4.2.2.2 80 1234 detail"
... View more
12-21-2013
11:06 AM
Hello, The link below has everything you need. http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080950890.shtml
... View more
12-21-2013
10:59 AM
Hello, The link below will help you for any NAT scenario you want. https://supportforums.cisco.com/docs/DOC-9129
... View more
12-21-2013
03:12 AM
Hello, If I understood you correctly, you want VPN clients to access an extra network behind the Firewall or router. Correct? If that is the case, on the firewall or router, you need to add a standard access list with the source IP being the internal networks that you want to access through the tunnel from the clients. Then you need to go under the group policy and create a split tunnel list using the ACL you created before. Like so: ciscoasa(config)#group-policy attributes
ciscoasa(config-group-policy)# Specify the split tunnel policy. In this case the policy is tunnelspecified. ciscoasa(config-group-policy)#split-tunnel-policy tunnelspecified Specify the split tunnel access list. In this case, the list is Split_Tunnel_List . ciscoasa(config-group-policy)#split-tunnel-network-list value Split_Tunnel_List This way you tell the VPN client, in order to access those networks, use the VPN tunnel. Hope this helps.
... View more
09-01-2017
Hello Douglas, It may be that the Management services is not running or
unresponsive after the upgra...
09-01-2017
Hello Ben, So from what you are saying, if you open a browser and go to
http://8.8.8.8, you are not ...
Created by
zalkurdi
in Policy and Access
08-30-2017
08-30-2017
Hello Jacob, At the moment, the only way to profile an endpoint as an
Apple iOS device or as an Andr...
12-29-2013
Hello,Now if you want to statically map the public IP of the router to
the IP of the ASA, that would...
12-28-2013
Hello,A little clarification:Q. Why is NAT-T needed?A. In phase 2 and
the last messages of phase1, t...
12-27-2013
Hello,NAT including PAT is used in many networks where IPsec is also
used, but there are a number of...
12-24-2013
Hello,Make sure that this command is present on the ASA:"Crypto key
generate rsa modulus 1024"Also, ...
12-23-2013
Hello,As to your question, you cant have more than 1 crypto map on the
interface.However, you can us...
12-22-2013
In my previous post, I mentioned how you can change the configuration in
the link to meet your needs...
12-22-2013
Hello,Just to be clear, the POWER LED is blinking green, it is not solid
green?What do you see on th...
12-22-2013
Hello,That can be due to many reasons. If you would attach your
configuration maybe we can see what ...
12-21-2013
Hello,The link below has everything you
need.http://www.cisco.com/en/US/products/ps6120/products_con...
12-21-2013
Hello,The link below will help you for any NAT scenario you
want.https://supportforums.cisco.com/doc...
Public Statistics
| Date Registered | 11-08-2013 02:44 AM |
| Date Last Visited | 09-25-2019 12:21 AM |
| Total Messages Posted | 18 |
| Total Helpful Votes Received | 9 |
