I am currently working on a POC to achieve Authentication and Authorisation for remote access VPN on ASA firewalls whereby RSA server and AD user account is used for authentication, and the LDAP - Security Group (SG) member check is used for authorisation.   Can someone please advise if the above solution is possible to achieve ? If yes, please direct to the right documentation for this.   Thanks in advance. ... View more

I tried to find alot for the answer of this question online, but nothing has helped much.   I am aware that the SFR module shares the MGMT interface with the ASA and its only used for Management level communication to the FMC. But what interface on the SFR module is used to receive traffic from ASA ? Apologies, if this question sounds very silly. ... View more

We had sold 2 IPS subscription licenses to our client for their two Cisco ASA Firepower modules.   In return from Cisco, we received one software claim certificate containing the 1 PAK key. From its description, it is a Cisco ASA5515 Control License.   I was told by Cisco Licensing team that once the PAK key is entered on the license registration portal, it would generate 2 licenses for 2 Cisco 5515-X firepower modules.   However, our client has come back saying that they only received 1 control license. Currently, I have opened a case with TAC but they are still looking into it.   Can someone please advise what am I missing ? ... View more

We have two 5545-X ASAs in active/standby mode that currently run sfr module 5.4.0.8.   Our plan is to upgrade our FMC from 5.4.1.7 to 6.2.0.5 through proper upgrade process. However, for our ASAs, we are planning to re-image them straight to 6.2.0 and patch 6.2.0.5.   My main question here is, can I install firepower module on standby first and then install on active firewall without having to do a failover ? ... View more

We are currently working on an issue where, as the title suggests, after failover of active FW from primary to secondary, there was no traffic passing through the secondary(active) FW. Due to this, the active FW was immediately failedback to primary. After a while, the field engineer performed, "write standby" on the primary FW. However, another failover attempt couldn't performed to troubleshoot as the network is very critical in nature. While trying to find the root cause of this issue, we made the following observations, Its ASA 5580 with version,  9.1(7.15), which has this bug,   CSCvd78303, due to which the ASA may stop passing traffic after 213 days of uptime. However, it was confirmed that the asa was anyhow restarted, hence, this may not be the issue. After looking in more detail about "write standby"command, I realised, it should normally be avoided and if needed, only upon advise of Cisco TAC. After doing "show failover history", the time duration between the moment when failover was done on primary to secondary and when secondary actually became active was approx. 20mins. Not sure, if this is normal. "show failover history" also showed, "configuration mismatch between the primary and secondary. Another major point was, there were no .cfg files present on the secondary ASA. We had no ASA logs after the outage to determine, what exactly happened to the traffic, there is a non-cisco IPS behind the ASAs, but it was also confirmed no traffic passed through the secondary asa.    TAC also has been engaged to look into this case, but we have had no concrete response as to why this must have happened and how it can be resolved.   I strongly feel, pts 4 & 5 could be a major cause here, as it would be quite obvious that secondary becomes active and it finds no config files in its flash, how would it even operate? But, as I am not an ASA expert, I can't be sure.    We are also thinking to manually copy the .cfg files from primary to secondary and attempt another failover to see if it works.   Hence, can someone please advise what could be the probable cause of this issue and how it can be resolved ?         ... View more