Dear,   in case that you want protect your endpoints against ransomware Cisco can offer you AMP + Umbrella. These could help you to avoid new attack at your endpoints but for sure it's not enough. You need to consider many aspects: firewall, mail control, endpoints..   ... View more

Dear,   did you find the solution at this problem? I'm having your identical problem and I have also opened a TAC but I'm still without a valid solutions. I can add that the problem is present also with FT disabled. ... View more

Nope, you should print all web page.   You can do it if you use ISE for managing the guest instead of WLC.     ... View more

Dear,   you can try to use the following command:   tacacs-server timeout <seconds>   ... View more

Dear,   is your scope to block smartphone to connect on different SSID? In this case you can try to use a MDM software. Otherwise you can configure a SSID with 802.1X authentication and use company credentials for login. ... View more

I would suggest you to buy SSD with FirePower on board and IPS license. In this case you can configure SNORT rules on it and if you deploy FirePower Management Center you have many visibility on report and statistics. ... View more

Dear,   yes, you must configure an ACL on guest interface. Basically you can deny all network that are defined in RFC 1918 and permit all the rest. Obviously you should assign an external DNS server to guest clients.   Hope to be helpfully    ... View more

Yes, it's correct man. No shutdown on VLAN creation is not needed. ... View more

Dear,   I hope that you have already finished your project, however I suppose that your idea to configure NAT rule on ISR 4451 was the only solution for your problem. I'm not sure about vrf interface configuration, I think that source NAT would be enough. ... View more

Below the link:   https://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.pdf ... View more

Dear,   is your scope to turn off all AP in a specific time?  In case you can do a script on Prime for doing that, you could power off switch's interfaces or access point's radios.     ... View more

Dear,   you have a problem in your DHCP configuration, your default-router is 192.168.2.1 and not 111.111.111.14  .   Is your scope only NAT your network for surfing over internet or to publish an internal server? ... View more

Have you configured IP SLA on your layer 3 switch?   You have three routers, but I'm not understanding which role has R2 in your topology. It has three interfaces, one towards SW and others two towards  R1 and R3.  So it's a point of failure in your topology but it's not very clear which is its function. However if R1, R2, R3 are sharing the same subnet towards the switch, so they are connected on the same vlan on switch you can configure HSRP on routers.   ... View more