Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jlucero2424
09-12-2018
Stats
Member since
12-04-2013
18
Posts
0
Helpful
0
Solutions
01-23-2014
01:58 AM
Hi Jouni, I cannot get the screenshot as i upgraded it 8.4. what i mean about service port for examp port 80, on 8.2 asdm they have predefined default service ports"HTTP", DNS, FTP, SSH, Netbios and so on, this all disappear from the service ports on 8.4 asdm 7.1
... View more
01-23-2014
12:39 AM
it looks that i create from the authorization is not working it falls on the default rule at the bottom which has deny rule.
... View more
01-23-2014
12:25 AM
Hi Jouni, Thanks for the reply, usually from adsm when we are configuring rules and adding the service ports there are predefined service ports. when i updgrade to 8.4 and asdm 7.1 the predefined service port. gone is there any way we can bring it back or is it there just hiding.
... View more
01-23-2014
12:18 AM
Hi Nix, I have set up the acs 5.4 and rsa server success full and able to authenticate however when it comes to authorization command from the device it says authorization failed
... View more
01-22-2014
10:09 PM
Hi guys, when i upgrade ASA 5510 from 8.2 to 8.4 predefined TCP/UDP ports are missing can you advise where can we get it.
... View more
Labels:
01-20-2014
11:20 AM
Hi Collin, Thanks for the reply, the two switch are not configured on VSS or stack, are you talking about creating port-channeling on the ASA? Also for the redundant interface configuration on the asa it looks that one of the interface is forwarding traffic and the other one is standby, so I gues it wont work with the set up., The set up is some of the servers are connected on the CSW1 and the other on CSW2, lan subnet is also on the core switches they areonly seperated by vlan.
... View more
01-20-2014
08:52 AM
Hi Guys, In regards configuring redundant Interface, correct me if i'm wrong from what i understand if I bond two interface(e.g e0/0+e0/1) this will create one logical interface, so regarding the physical Interface does this means that one of them are active and the other one is standby? If have two core switch and CSW1 is connected to e0/0 of the Firewall and the CSW2 is connected to e0/1,does the traffic comming from core switch 2 towards to the firewall will be drop as the interface e0/1 is on standby? Reason I'm Asking this is we have a existing design and we like to put a FW on it. servers which residing on a dmz is conneced on the csw1 and csw 2(no dmz switch), the Lan subnet is also on the CSW1, one CE router from WAN(outside) were planning to put assa between the core switches and the CErouter, so from ASA we configure redundancy interface towrads the two core switches 1 and 2 which e0/0+e0/1. then we configure subinterfaces on the redundant port and vlan to seperate zone. Have simple physical diagram below for better understanding (outside) Router---Firewall | | | | e0/0 e0/1 | | | | CSW1 CSW2 | | (DMZ)Vlan Servers/Vlan-LAN(Inisde) I just like you guys to comment on it and if there is other way design approach we only have one firewall, also not sure how efficient is configuring Interface redudant on asa. Please advise. Thanks in advance.
... View more
- Tags:
- asa
Labels:
01-19-2014
11:39 PM
Hi Amjad, Thanks for the prompt response. its all clear now, we will just ad the new servers from the config and when it is operational and ready for deployment, will remove the old acs server configured from the device.
... View more
01-19-2014
10:56 PM
Hi Amjad, Thanks for the resposnse appricate it, so you mean to say it is like a round robin depending on the running conifig of the device which is the first configure tacacs-server host? The two old acs server will be decommision as soon as the new acs are operational, so grouping it might not be best approach as we dont want to add another configuration on the device as were looking thousand of device. Thanks, Jaspher.
... View more
01-19-2014
08:45 PM
Hi Guys, We have Existing tacacs configuration form our devices and pointed the 2 ACS server. the acs server are manage with other vendor which the acs server is located at their site. Now were planning to manage the acs server. We Installed a new acs server from our location, we have thousand of devices, if we migrate to the new server can we just add the 2 acs server from the device? are the new acs server will able to comunicate from the device? how does a device select which primary or secondary acs server? please advise. Old config aaa new-model aaa authentication login vtymethod group tacacs+ local aaa authorization config-commands aaa authorization exec default group tacacs+ local if-authenticated aaa authorization commands 0 default group tacacs+ local if-authenticated aaa authorization commands 15 default group tacacs+ local if-authenticated aaa accounting send stop-record authentication failure aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting connection default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ ip tacacs source-interface Loopback0 tacacs-server host 10.x.x.x tacacs-server host 10.x.x.x New config aaa new-model aaa authentication login vtymethod group tacacs+ local aaa authorization config-commands aaa authorization exec default group tacacs+ local if-authenticated aaa authorization commands 0 default group tacacs+ local if-authenticated aaa authorization commands 15 default group tacacs+ local if-authenticated aaa accounting send stop-record authentication failure aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting connection default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ ip tacacs source-interface Loopback0 tacacs-server host 10.x.x.x tacacs-server host 10.x.x.x tacacs-server host 100.x.x.x <-- new tacacs-server host 100.x.x.x <-- new
... View more
Labels:
01-15-2014
11:55 PM
Hi Waisudin, Appreciate your response on this. For the initial set up as a login for ssh on cisco device. But we have vpn, in the future were planing to integrate also with acs. For now will just set up as device access. What I'm try to achive is to have level of access to the device for a certain users,I would also want to group each users for their department. in this setup it will be easier for me to identify logs and audit on monitoring and who are accessing the devices.
... View more
01-15-2014
10:39 PM
Hi Waisudin, thanks for the response appreciate it, my users should be local only and devices will be enroled on acs will be cisco device which will use tacacs. If it is not too much to ask do you have guide documents configuring acs 5.4 for device authenthicaion, authorization and accounting. I'm just newbie on acs. thanks in advance.
... View more
01-15-2014
10:20 PM
hi team, I just like to ask about initial setup for acs 5.4 on appliance SNS 3415, the acs i'm planning to build will be standalone and not join to domain, on the initial set up name-server, primary and secondar dns is asking to configure, since it is not joining to the domain, is it necessary to configure it? or should i leave it blank? the acs also will be map to RSA server fro two factor authentication. Need you advise thanks in advance.
... View more
Labels:
12-17-2013
08:23 PM
Hi Guys, I have setup a VPN RA on my asa however when I use my PDA or mobile via 3g or 4g connection over the Internet to connect on my vpn gateway, I'm not able to connect. I'm Having this error from the debug on my ASA fw "IKE TM V6 FSM error History" not sure what this is. But when I try on other service provider with 3g or 4g it works, so might be an issue with the ISP. However I want to understand why I get this error? is it an issue about NAT-T from my service provider using my pda or mobile? . below are the logs and config on the ASA 5510 Config interface Ethernet0/0 nameif outside security-level 0 ip address 111.109.34.209 255.255.255.240 interface Ethernet0/1 nameif inside security-level 100 ip address 10.98.216.58 255.255.255.224 object network vpnclient-network subnet 172.21.200.16 255.255.255.240 description VPN Client IP Address Range access-list Split_Tunnel_List standard permit 10.98.216.0 255.255.255.0 nat (inside,outside) source static any any destination static vpnclient-network vpnclient-network no-proxy-arp route-lookup route outside 0.0.0.0 0.0.0.0 111.109.34.210 1 route inside 10.98.216.0 255.255.255.0 10.98.216.33 1 route inside 172.21.200.0 255.255.248.0 10.98.216.33 1 aaa-server Radius protocol radius aaa-server Radius (inside) host 10.98.216.69 key ***** aaa-server Radius (inside) host 10.98.216.197 key ***** crypto dynamic-map REMOTE-ACCESS-DYNMAP 10 set ikev1 transform-set ESP-3DES-SHA crypto dynamic-map REMOTE-ACCESS-DYNMAP 10 set reverse-route crypto map REMOTE-ACCESS-MAP 10 ipsec-isakmp dynamic REMOTE-ACCESS-DYNMAP crypto map REMOTE-ACCESS-MAP interface outside crypto ikev1 enable outside crypto ikev1 policy 10 authentication pre-share encryption des hash md5 group 2 lifetime 1000 crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-des esp-md5-hmac group-policy REMOTE_ACCESS_GROUP internal group-policy REMOTE_ACCESS_GROUP attributes dns-server value 10.98.216.52 10.98.216.192 vpn-tunnel-protocol ikev1 l2tp-ipsec split-tunnel-policy tunnelspecified split-tunnel-network-list value Split_Tunnel_List default-domain value mylab.local tunnel-group REMOTE_ACCESS_GROUP type remote-access tunnel-group REMOTE_ACCESS_GROUP general-attributes address-pool vpnclient authentication-server-group Radius default-group-policy REMOTE_ACCESS_GROUP password-management tunnel-group REMOTE_ACCESS_GROUP ipsec-attributes ikev1 pre-shared-key ***** DEBUG LOGS debug cry ikev1 127 debug cry ips 127 Dec 17 18:49:52 [IKEv1]IP = 180.255.248.82, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 867 Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing SA payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing ke payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing ISA_KE payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing nonce payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing ID payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, Received xauth V6 VID Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, Received DPD VID Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, Received Fragmentation VID Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, Received NAT-Traversal ver 02 VID Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, processing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]IP = 180.255.248.82, Received Cisco Unity client VID Dec 17 18:49:52 [IKEv1]IP = 180.255.248.82, Connection landed on tunnel_group REMOTE_ACCESS_GROUP Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, processing IKE SA payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, IKE SA Proposal # 1, Transform # 13 acceptable Matches global IKE entry # 1 Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing ISAKMP SA payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing ke payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing nonce payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, Generating keys for Responder... Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing ID payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing hash payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, Computing hash for ISAKMP Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing Cisco Unity VID payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing xauth V6 VID payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing dpd vid payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing NAT-Traversal VID ver 02 payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing NAT-Discovery payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, computing NAT Discovery hash Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing NAT-Discovery payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, computing NAT Discovery hash Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing Fragmentation VID + extended capabilities payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, Send Altiga/Cisco VPN3000/Cisco ASA GW VID Dec 17 18:49:52 [IKEv1]IP = 180.255.248.82, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + HASH (8) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 428 Dec 17 18:49:52 [IKEv1]IP = 180.255.248.82, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + HASH (8) + NOTIFY (11) + NAT-D (130) + NAT-D (130) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 156 Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, processing hash payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, Computing hash for ISAKMP Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, processing notify payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, processing NAT-Discovery payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, computing NAT Discovery hash Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, processing NAT-Discovery payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, computing NAT Discovery hash Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, processing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, Processing IOS/PIX Vendor ID payload (version: 1.0.0, capabilities: 00000408) Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, processing VID payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, Received Cisco Unity client VID Dec 17 18:49:52 [IKEv1]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, Automatic NAT Detection Status: Remote end IS behind a NAT device This end is NOT behind a NAT device Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing blank hash payload Dec 17 18:49:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing qm hash payload Dec 17 18:49:52 [IKEv1]IP = 180.255.248.82, IKE_DECODE SENDING Message (msgid=10c80f5) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 112 Dec 17 18:51:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, IKE TM V6 FSM error history (struct &0xa9394ee8) <state>, <event>: TM_DONE, EV_ERROR-->TM_WAIT_REPLY, EV_TIMEOUT-->TM_WAIT_REPLY, NullEvent-->TM_SND_REQ, EV_SND_MSG-->TM_SND_REQ, EV_START_TMR-->TM_SND_REQ, EV_RESEND_MSG-->TM_WAIT_REPLY, EV_TIMEOUT-->TM_WAIT_REPLY, NullEvent Dec 17 18:51:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, IKE AM Responder FSM error history (struct &0xae237540) <state>, <event>: AM_DONE, EV_ERROR-->AM_TM_INIT_XAUTH_V6H, EV_TM_FAIL-->AM_TM_INIT_XAUTH_V6H, NullEvent-->AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA-->AM_TM_INIT_XAUTH_V6H, NullEvent-->AM_TM_INIT_XAUTH_V6H, EV_START_TM-->AM_TM_INIT_XAUTH, EV_START_TM-->AM_PROC_MSG3, EV_TEST_TM_H6 Dec 17 18:51:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, IKE SA AM:ed91976f terminating: flags 0x0105c001, refcnt 0, tuncnt 0 Dec 17 18:51:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, sending delete/delete with reason message Dec 17 18:51:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing blank hash payload Dec 17 18:51:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing IKE delete payload Dec 17 18:51:52 [IKEv1 DEBUG]Group = REMOTE_ACCESS_GROUP, IP = 180.255.248.82, constructing qm hash payload Dec 17 18:51:52 [IKEv1]IP = 180.255.248.82, IKE_DECODE SENDING Message (msgid=245811a3) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 76 Dec 17 18:54:53 [IKEv1]IP = 180.255.248.92, Received encrypted packet with no matching SA, dropping
... View more
Labels:
12-05-2013
09:24 PM
hi Jcarvaja, Thanks for a prompt reply. So in that case I'll monitor first traffic connections before configuring the the limit-resource. thanks, champ.
... View more
Created by
jlucero2424
in Firewalls
01-23-2014
01-23-2014
Hi Jouni,I cannot get the screenshot as i upgraded it 8.4. what i mean
about service port for examp ...
01-23-2014
it looks that i create from the authorization is not working it falls on
the default rule at the bot...
Created by
jlucero2424
in Firewalls
01-23-2014
01-23-2014
Hi Jouni,Thanks for the reply, usually from adsm when we are configuring
rules and adding the servic...
01-23-2014
Hi Nix, I have set up the acs 5.4 and rsa server success full and able
to authenticate however when ...
Created by
jlucero2424
in Firewalls
01-22-2014
01-22-2014
Hi guys,when i upgrade ASA 5510 from 8.2 to 8.4 predefined TCP/UDP ports
are missing can you advise ...
01-20-2014
Hi Collin,Thanks for the reply, the two switch are not configured on VSS
or stack, are you talking a...
01-20-2014
Hi Guys,In regards configuring redundant Interface, correct me if i'm
wrong from what i understand i...
01-19-2014
Hi Amjad,Thanks for the prompt response. its all clear now, we will just
ad the new servers from the...
01-19-2014
Hi Amjad,Thanks for the resposnse appricate it, so you mean to say it is
like a round robin dependin...
01-19-2014
Hi Guys,We have Existing tacacs configuration form our devices and
pointed the 2 ACS server. the acs...
01-15-2014
Hi Waisudin,Appreciate your response on this.For the initial set up as a
login for ssh on cisco devi...
01-15-2014
Hi Waisudin,thanks for the response appreciate it, my users should be
local only and devices will be...
01-15-2014
hi team,I just like to ask about initial setup for acs 5.4 on appliance
SNS 3415, the acs i'm planni...
12-17-2013
Hi Guys,I have setup a VPN RA on my asa however when I use my PDA or
mobile via 3g or 4g connection ...
Public Statistics
| Date Registered | 12-04-2013 10:44 PM |
| Date Last Visited | 09-12-2018 10:53 AM |
| Total Messages Posted | 18 |
