Do the Cisco Firepower Threat Defense (FTD) appliance (21xx, 41xx, or ASAs with FTD code) provide URL rewrite support? Customer has an application that responds to HTTPS requests using an internal URL/FQDN. The firewall would need to be able to translate it for outgoing traffic to an external FQDN.   ... View more

Existing Cisco UC customer is looking at Cisco Emergency Responder (CER), and they have some concerns over its ability to identify the location of wireless endpoints. This is healthcare, and doctors/nurses are highly mobile, carrying their 7925G phones everywhere, and the unfortunate current design is that all SSID of concern is tied to a single VLAN, no matter where the users roam. So, same VLAN/subnet, same ELIN, no change or real/accurate location being reported to CER. (We're discussing options in re-designing their wireless deployment, but such a re-design will not be a solution in the short-term.) Ideally, there would be some way of identifying the AP that the wireless endpoint is currently associated to, and have CER update based on this. If there's a way of possibly using MSE as a supplemental solution to provide the same capability, that would also be acceptable. They've been looking at www.spok.com, and claim that this 911 solution has such an ability, which I haven't yet been able to confirm. If there's a way of providing this kind of functionality within CER, that'd be ideal. Thank you ... View more

Where would one purchase extra rechargeable batteries for the 8831 wireless mics? Here is the info on the battery itself:   E502248 470mAh, 1.74wH P/N 4500044-00" ... View more

We're involved in a DC infrastructure upgrade for a customer with several HP blade chassis, which all have Cisco 3020 switches. In trying to figure out the new Nexus 5K/2K (FEX) design to upgrade them to Gigabit server access, they're questioning what the right replacement is for these TOR 3020s.  Specifically: Do the B22 FEX modules replace the 3020’s one for one, or are they advanced and provide the 4 ethernet connections for each blade with just one module? Any advice or design ref/guidance for this question would be helpful, and thank you.   ... View more

I'm trying to determine if a WebEx TP bridge (MeetMe) can be leveraged for internally-registered Cisco endpoints.   The customer already has a couple SX20 endpoints with WebEx TelePresence Premium endpoint subscriptions, as well as a 12-port MeetMe bridge. They are now looking to roll out video for their remaining sites, and are interested in the new SX10 Quick Sets (1/3 the cost of the SX20s), which are not supported by WebEx TP.  They are a Cisco UC shop, though, so the SX10s (and SX20s) could register directly to Communications Manager. The main question is whether an endpoint registered to CM can connect to a WebEx TP MeetMe bridge when needing to join a multi-party video conference. (Let's say the endpoints do NOT have WebEx TP Premium subscriptions, and the customer is only maintaining one or more MeetMe bridges.) Specifically, can SX endpoints registered to CM (or VCS) type in the MeetMe bridge video (EX: customerx .bridge @ webex.com ), and thus use the cloud bridge (so, local registration but using the WebEx TP cloud for non P2P conferences)? Assuming the above works, would on-prem VCS-Control and VCS-Expressway be required to enable this outbound connection, or would hitting up the MeetMe bridge not really make use of (require) firewall traversal technology?  Firewall traversal would, of course, be required when an outside party is needing to connect to an internal bridge/conference, is this infrastructure necessary if dialing out to a cloud bridge? Thank you ... View more

This thread regards ISE operation (and options) where a policy node becomes unavailable - so, in the case of either a single standalone ISE appliance (no HA), or more often a PSN becoming unavailable due to a WAN failure to a remote branch. The intended design for the deployment in question would involve using downloadable ACLs (dACLs) to provide differentiated access, specifically: - A default ACL would be configured on 802.1x switchports would allow "limited" access (possibly Internet-only, but TBD). - Successful 802.1x authentication would require 1) validation of a corporate certificate on the endpoint, and 2) successful AD login. This would provision a dACL providing full access. ISE provides the option to configure Inaccessible Authentication Bypass to support RADIUS unavailability when 802.1x is configured on switch ports, but I'm needing to confirm how this works when using dACLs instead of VLANs for differentiated access. Specifically, if IAB is configured so that 802.1x ports (maybe all of them if all ports at the branch need to be functional) get placed into a "critical VLAN", will this override the default ACL on the port, which would no longer be applicable to the new VLAN anyway? Simply put - we need to configure the deployment so that all endpoints fail open and have full access in the event of ISE/RADIUS becoming unavailable. (There'll be no local RADIUS and/or AD server in the event of WAN failure.) This will need to work although the 802.1x authentication/authorization will be using dACLs to determine access. Thank you ... View more

We have a global customer with clusters in North and South American, Europe and Asia connected via inter-cluster trunks, and all running CUCM/CUC 8.5.  I'm looking for any documentation dealing with upgrading multi-cluster environments - compatibility concerns between them, any caveats/items to look out for, etc.  The Install/Upgrade guides only deal with single clusters, at least that I've found. Thank you. ... View more