Once an IPS Policy is created with FirePower Recommendations  , next day if there are any updates from Cisco for "FirePower Recommendations" does not it get applied to the Policy automatically ? or we need to update the "FirePower Recommendations" with  "Update Recommendations" option from the already created IPS Policy ?   Also what it does for " Recurring Rule Update Imports " at FMC >> System >> Updates Section ? Is it equivalent to .vrt  file  ? ... View more

Hello All,    I am trying to configure an UCS-E Box with ASAv installed on it at VMWare side. If you see the Diagram it will be more easier considering what I am thinking to execute.    ISR router model is UCS-E140S-M2/K9 with in built switch installed on it. My plan is at the Switch Module users will connect with gateway whose L3 is configured as an Inside Interface of ASA ( installed at  UCS_E Vmware ). Having said that traffic from switch module for a User machine connected at switch module need to go to ASA Inside Interface and through ASA Outside Interface Traffic will go to Internet or Other Side of the VPN.    Used G0/0/0 as WAN connection of the router and then used VNIC0 / UCSE1/0/0 treating as the WAN side of the ASA.      interface Loopback10  ip address 10.1.1.1 255.255.255.0     interface ucse1/0/0  ip unnumbered Loopback10  negotiation auto  switchport mode trunk  no mop enabled  no mop sysid   and then used VNIC1 / UCSE1/0/1 with BDI500 treating as the connection of ESXI VNIC 1 which is eventually the Inside Interface of ASA.    ! interface BDI500  ip address 192.168.1.1 255.255.255.0   interface ucse1/0/1  no ip address  no negotiation auto  switchport mode trunk  no mop enabled  no mop sysid  spanning-tree cost 10  service instance 500 ethernet   encapsulation dot1q 500   rewrite egress tag push dot1q 500   bridge-domain 500   But when I try to use one switch port while assigning an ip of 192.168.1.0/24 with GW 1.1 at Laptop I am not able to Ping to 192.168.1.1 even though BDI Interface shows UP from router.    interface GigabitEthernet0/1/0  switchport access vlan 500  switchport mode access   Router#sh arp Protocol  Address          Age (min)  Hardware Addr   Type   Interface Internet  10.1.1.2               13   a0e0.afe0.8ce5  ARPA   ucse1/0/0 Internet  100.100.100.1           -   00aa.6ef6.2760  ARPA   GigabitEthernet0/0/0 Internet  192.168.1.1             -   00aa.6ef6.27e3  ARPA   BDI500   Any thoughts what configuration I am doing wrong ? ... View more

Hello All,    I require some guide line here. I need to configure a UCS-E Series ( UCS-E140S-M2/K9 ). There will be an ASAv VM at UCS- Series behind which I need to isolate the Inside Resources. So there will be 1 Outside and multiple Inside Subnet need to confiugred at ASAv. So I need to bring this subnets through the UCS Router to UCS-E Series Blade. Now I am in confusion with how to make the Internal Connection with Router to UCS Blade ( ESXI Host ) for multiple  subnet to configure in ESXI. I used Routers G0/0/0 and UCS1/0/0 for CIMC IP Configuration.   Then My only left port is UCS1/0/1 to make internal connection between Router and UCS. But how to do that to make an Internal Connection with Router and UCS-E while making sure I can configure multiple subnet in UCS-E Side ? ... View more

Hello   I was configuring the CIMC IP. Below is the config I did for CIMC Access , method using the E-Series Server's Internal NIC GE1 and routers UCSE 1/0/1 Interface.   Physical Connectivity I did is connected a Cable to Routers GE0 Interface with a PC where I assigned a same block IP ( 10.7.29.210 ). From PC ( 10.7.29.210 ). I can Ping G00/0/0 but not the CIMC IP ( 10.7.29.202 ). Also from Router I can Ping G0/0/0 IP but not CIMC IP. I also added "sh ip interface brief" , “ sh platform” command output in case it helps.  Can you advise what is wrong I am doing here ?   interface GigabitEthernet0/0/0 ip address 10.7.29.201 255.255.255.0 negotiation auto interface ucse1/0/1 ip unnumbered GigabitEthernet0/0/0 no negotiation auto switchport mode trunk   ucse subslot 1/0 imc access-port shared-lom console imc ip address 10.7.29.202 255.255.255.0 default-gateway 10.7.29.201 ip route 10.7.29.202 255.255.255.255 ucse1/0/1   Command Output   Roter#sh ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0/0 10.7.29.201 YES NVRAM up up GigabitEthernet0/0/1 unassigned YES NVRAM administratively down down GigabitEthernet0/0/2 unassigned YES NVRAM administratively down down GigabitEthernet0/1/0 unassigned YES unset down down GigabitEthernet0/1/1 unassigned YES unset down down GigabitEthernet0/1/2 unassigned YES unset down down GigabitEthernet0/1/3 unassigned YES unset down down GigabitEthernet0/1/4 unassigned YES unset down down GigabitEthernet0/1/5 unassigned YES unset down down GigabitEthernet0/1/6 unassigned YES unset down down GigabitEthernet0/1/7 unassigned YES unset down down ucse1/0/0 unassigned YES NVRAM administratively down down ucse1/0/1 10.7.29.201 YES unset up up GigabitEthernet0 unassigned YES NVRAM administratively down down Vlan1 unassigned YES NVRAM administratively down down Router#ping 10.7.29.201 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.7.29.201, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms   Router#ping 10.7.29.202 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.7.29.202, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) ... View more

    Hello All,    I am a newbie to Cisoc UCS E-Series Server ( with ISR 4331 ). I was configuring the CIMC IP. Below is the config I did for CIMC Access using the E-Series Server's Internal NIC GE1 and routers UCSE 1/0/1 Interface.    Physicaly Connectivity I did is connected a Cable to Routers GE0 Inteafce with a PC where I assigned a same block IP ( 10.7.29.210 ). From PC I can Ping G00/0/0 but not the CIMC IP ( 10.7.29.202 ). Also from Router I can Ping G0/0/0 IP but not CIMC IP. I also added "sh ip interface brief" command output in case it helps.   Can you advise what could be the issue  ? ================================================== interface GigabitEthernet0/0/0 ip address 10.7.29.201 255.255.255.0 negotiation auto   interface ucse1/0/1 ip unnumbered GigabitEthernet0/0/0 no negotiation auto switchport mode trunk   ucse subslot 1/0 imc access-port shared-lom console imc ip address 10.7.29.202 255.255.255.0 default-gateway 10.7.29.201   ip route 10.7.29.202 255.255.255.255 ucse1/0/1   ============================================================= Command Output   Roter#sh ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0/0 10.7.29.201 YES NVRAM up up GigabitEthernet0/0/1 unassigned YES NVRAM administratively down down GigabitEthernet0/0/2 unassigned YES NVRAM administratively down down GigabitEthernet0/1/0 unassigned YES unset down down GigabitEthernet0/1/1 unassigned YES unset down down GigabitEthernet0/1/2 unassigned YES unset down down GigabitEthernet0/1/3 unassigned YES unset down down GigabitEthernet0/1/4 unassigned YES unset down down GigabitEthernet0/1/5 unassigned YES unset down down GigabitEthernet0/1/6 unassigned YES unset down down GigabitEthernet0/1/7 unassigned YES unset down down ucse1/0/0 unassigned YES NVRAM administratively down down ucse1/0/1 10.7.29.201 YES unset up up GigabitEthernet0 unassigned YES NVRAM administratively down down Vlan1 unassigned YES NVRAM administratively down down Router#ping 10.7.29.201 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.7.29.201, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms   Router#ping 10.7.29.202 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.7.29.202, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) Router#   Router#show platform Chassis type: ISR4331/K9 Slot Type State Insert time (ago) --------- ------------------- --------------------- ----------------- 0 ISR4331/K9 ok 00:26:50 0/0 ISR4331-3x1GE ok 00:25:42 0/1 NIM-ES2-8 ok 00:25:42 1 ISR4331/K9 ok 00:26:50 1/0 UCS-E140S-M2/K9 ok 00:25:42 R0 ISR4331/K9 ok, active 00:26:50 F0 ISR4331/K9 ok, active 00:26:50 P0 PWR-4330-AC ok 00:26:27 P2 ACS-4330-FANASSY ok 00:26:27     ... View more

Hello All,   Is there any way that I can Limit  administrative access to specific FTDs/ASAs through FMC for a specific user  ?  Lets say I have 10 Sensors in the FMC but I want to give access to only 1 specific Sensor to a user to administer.   Subrun ... View more

Hello All,   I am having issue to bring UP one VPN tunnel. Following are my observations.   -----VPN Tunnel is not coming UP. I see no TX & RX from ASDM and no sa for " sh crypto ipsac sa peer "   --- And there is no TX , RX when I see the VPN Status from ASDM  ----- If I do the packet-tracer it shows VNP Drop   HOST# packet-tracer input inside tcp 10.7.61.79 12345 10.50.1.23 tcp 10.7.61.79 12345 10.50.1.23 5450 Phase: 1 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 142.XX.XX.XX using egress ifc Outside Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (Inside,Outside) source static DM_INLINE_NETWORK_16 DM_INLINE_NETWORK_16 destination static PI-Server PI-Server no-proxy-arp route-lookup Additional Information: NAT divert to egress interface Outside Untranslate 10.50.1.23/5450 to 10.50.1.23/5450 Phase: 3 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: Additional Information:   Phase: 4 Type: CONN-SETTINGS Subtype: Result: ALLOW Config: class-map class-default match any policy-map global_policy description HTTP_Exempt_from_Inspection class class-default set connection decrement-ttl service-policy global_policy global Additional Information: Phase: 5 Type: NAT Subtype: Result: ALLOW Config: nat (Inside,Outside) source static DM_INLINE_NETWORK_16 DM_INLINE_NETWORK_16 destination static PI-Server PI-Server no-proxy-arp route-lookup Additional Information: Static translate 10.7.61.79/12345 to 10.7.61.79/12345 Phase: 6 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information: Phase: 7 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Phase: 8 Type: FOVER Subtype: standby-update Result: ALLOW Config: Additional Information: Phase: 9 Type: FLOW-EXPORT Subtype: Result: ALLOW Config: Additional Information: Phase: 10 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Result: input-interface: Inside input-status: up input-line-status: up output-interface: Outside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule HOST# exit   ----When Looked at VPN Firewall see that return packet is SYN TimeOut. Screenshot attached. File name :: ASDM_Realtime_1   ---- But remote team checked but they are not receiving any packet. File name :: Remote_End ... View more

Hello All,    I configured a VPN tunnel , VPN Tunnel is UP and I see Encap & Decap Value in ipsec sa command.   When I do a packet tracer sourcing from inside interlace ( from where Interested traffic is initiating ) to Remote Destination it is allowed while hitting the correct acl , correct nAT exempt rule.    But Client is saying Client is not able to hit to remote server application  ?   What are other areas I can check  ? How can I do a    --- asp drop  to confirm that ASA is not dropping the traffic ? --- How to confirm I am receiving return traffic from Remote Interested traffic  ?   Note :: Both Interested traffic is not behind nat    ... View more

Hello All,   I need a suggestion for ASA FIrePower Firewall specifically user based rules.    I need to configure User Based Firewall rules in an ASA FirePower , so that I can use User Groups that will be allowed as SOURCE to access a specific destination which is at Inside Interface of ASA FirePower Firewall.    ASA FirePower is added to the FMC and FMC is already configured with LDAP hence user to ip mapping information is in FMC. So as ASA FirePower is added to the FMC and FMC is integrated with LDAP ,  I can use that Information from FMC to configure User Based Firewall Rules for ASA FirePower right  ?   In which Interface I should apply the user based rules if I need to allow any source as User need to access to Destinations at Inside Interface  ? ... View more

Hello,  I need to replace one Cisco Wireless access point. I had one Cisco AP AIR-AP1252G-A-K9 is dead now. Right now I am checking to see if I can install Cisco AIR-CAP2602E-A-K9 Access Point. I need to have bridge option available for the new access point. How can I confirm if one access point supports bridging ?   Subrun ... View more