Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About ssambourg
06-24-2019
ssambourg
Member since
02-26-2009
Beginner
Created by
ssambourg
in Network Management
in Network Management
05-27-2019
06:48 AM
05-27-2019
06:48 AM
Yes I'll let you know.
... View more
Created by
ssambourg
in Network Management
in Network Management
05-26-2019
06:51 AM
05-26-2019
06:51 AM
Hello NO Device pack available for now on prime infra 3.6. From the matrix compability prime infra 3.6 support Catalyst 9500. I will open a TAC case and let you know.
... View more
Created by
ssambourg
in Network Management
in Network Management
05-23-2019
09:43 AM
05-23-2019
09:43 AM
Hello, I recently installed Cisco Prime Infrastructure 3.5 so as to manage catalyst 2k, 9200 and 9500 then upgrade to Prime Infrastructure 3.6 to support 9500 switches. It appears that Catalyst 2k and Catalyst 9200 are managed correctly and 9500 is shown as "Unsupported Cisco Device". The part number of the Catalyst 9500 is : C9500-48Y4C The 9500 ICMP and SNMP reachability are OK. From the Cisco Prime Infrastructure Device Supported document find here, it seems that this hardware is supported. https://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/prime/infrastructure/3-6/supported/devices/PI36-Supported-Device-List.xlsx Does anyone hit this behaviour ? I don't find any bug document about it.
... View more
Labels:
Re: User name change detected for the s...
in Cisco Bug Discussions
03-12-2019
11:57 AM
03-12-2019
11:57 AM
Hello,
Long time ago... We resolved this issue by limiting the withelisted domain authentication into External Identity Sources > Active Directory > Whitelisted domain from where relationship are established.
Hope that help.
... View more
Re: User name change detected for the s...
in Cisco Bug Discussions
04-11-2018
09:15 AM
04-11-2018
09:15 AM
Hello,
some updates ?
I have this issue with ISE 2.3 patch 3.
... View more
Created by
ssambourg
in Policy and Access
in Policy and Access
01-30-2018
10:29 AM
01-30-2018
10:29 AM
Attached the show status of docker app
... View more
Created by
ssambourg
in Policy and Access
in Policy and Access
01-30-2018
10:18 AM
01-30-2018
10:18 AM
Hi,
Unable to get thist daemon running after restarting ise app :
2018-01-29T19:16:20.171256+01:00 srv-ise-adm-01 logger: Cannot connect to the Docker daemon. Is the docker daemon running on this host?
... View more
Created by
ssambourg
in Policy and Access
in Policy and Access
01-29-2018
06:18 AM
01-29-2018
06:18 AM
Hello,
I recently upgrade ISE 1.1 to ISE 2.2 patch 4.
After about 1 month of production on the new version, My 1st PAN encounters this alarm :
> Docker Daemon not running
What's the exact job / utility of this daemon ?
I assume that restarting ISE application will solve that.
Sylvain
... View more
Labels:
01-29-2018
06:13 AM
Hello,
Trust the stream from AMP4E Clients to AMP EU CLoud URL resolved my issue.
At first URL was not trust... just allow and something in IPS Policy block.
HTH
... View more
Created by
ssambourg
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2018
06:07 AM
01-29-2018
06:07 AM
Hi,
With an incredible delay (sorry !)... the service provider filter IPSec.
Change to ASA-V with SSL VPN since IKEv2 SSL VPN was not supported on ISR4K.
HTH
... View more
Created by
ssambourg
in VPN and AnyConnect
in VPN and AnyConnect
09-15-2017
11:13 AM
09-15-2017
11:13 AM
I'm using IOS VPN. What's the better way for you to highlight VPN port blocking on 3G/4G ?
... View more
Created by
ssambourg
in VPN and AnyConnect
in VPN and AnyConnect
09-15-2017
09:20 AM
09-15-2017
09:20 AM
Hello, My AnyConnect VPN Connection can't pass the exchange authent phase 1 when I'm trying via 3G/4G. The connection on same device is OK via WiFi. I'm using Android 7.0 and AnyConnect 4.0.09039. I've capture some debug IKEv2 outputs following : 058991: Sep 15 17:32:09.226 CET: IKEv2:(SESSION ID = 226,SA ID = 1):Auth exchange failed 058992: Sep 15 17:32:09.227 CET: IKEv2-ERROR:(SESSION ID = 226,SA ID = 1):: Auth exchange failed 058993: Sep 15 17:32:09.227 CET: IKEv2:(SESSION ID = 226,SA ID = 1):Abort exchange 058994: Sep 15 17:32:09.227 CET: IKEv2:(SESSION ID = 226,SA ID = 1):Deleting SA 058995: Sep 15 17:32:09.227 CET: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Close PKI Session 058996: Sep 15 17:32:09.227 CET: IKEv2:(SA ID = 1):[PKI -> IKEv2] Closing of PKI Session PASSED 058997: Sep 15 17:33:19.190 CET: IKEv2-ERROR:(SESSION ID = 227,SA ID = 2):: Failed to receive the AUTH msg before the timer expired 058998: Sep 15 17:33:19.190 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Verification of peer's authentication data FAILED 058999: Sep 15 17:33:19.190 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Sending authentication failure notify 059000: Sep 15 17:33:19.191 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Building packet for encryption. Payload contents: NOTIFY(AUTHENTICATION_FAILED) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: Unknown - 0, spi size: 0, type: AUTHENTICATION_FAILED 058966: Sep 15 17:31:34.845 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Starting timer (90 sec) to wait for auth message 058967: Sep 15 17:31:36.860 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Retransmitting packet 058968: Sep 15 17:31:36.860 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Sending Packet [To 77.136.X.X:55359/From 46.218.X.X:4500/VRF i0:f0] Initiator SPI : 26E3506ABFD3C60D - Responder SPI : DBB53F6DC3BBD980 Message id: 1 IKEv2 IKE_AUTH Exchange RESPONSE 058969: Sep 15 17:31:36.860 CET: IKEv2-PAK:(SESSION ID = 227,SA ID = 2):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 1756 Payload contents: ENCR Next payload: VID, reserved: 0x0, length: 1728 I see packet retransmission error causing timeout : 058970: Sep 15 17:31:36.860 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Restarting timer for 90 seconds to wait for auth message 058971: Sep 15 17:31:36.863 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Packet is a retransmission 058972: Sep 15 17:31:36.864 CET: IKEv2-ERROR:: Packet is a retransmission 058973: Sep 15 17:31:40.851 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Retransmitting packet 058974: Sep 15 17:31:40.851 CET: IKEv2:(SESSION ID = 227,SA ID = 2):Sending Packet [To 77.136.X.X:55359/From 46.218.X.X:4500/VRF i0:f0] Initiator SPI : 26E3506ABFD3C60D - Responder SPI : DBB53F6DC3BBD980 Message id: 1 IKEv2 IKE_AUTH Exchange RESPONSE 058975: Sep 15 17:31:40.851 CET: IKEv2-PAK:(SESSION ID = 227,SA ID = 2):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 1756 Payload contents: ENCR Next payload: VID, reserved: 0x0, length: 1728 I try with : forced 2G/3G connection 4G connection 3 Mobile ISP and I've got the same results. I've also tested it on iOS and get the same behaviour. Someone already experience this issue ?
... View more
Labels:
08-24-2017
02:10 AM
Hello Jetsy, I've set up FQDN trust in my FTD device. I saw that the reverse DNS resolution of AMP IP addresses point to compute.amazonaws and the capture-traffic on FTD device during a SyncPolicy on AMP E Connector give output between my endpoint and compute.amazonaws. I think it was the mistake but it was a FTD configuration. Now working with this URL group as mentionned in the doc : amp.cisco.com amp.sourcefire.com api.sourcefire.com panacea.threatgrid.com Instead of allowing this URL group, I tried to open FireAMP & FireAMP-SSL app in FTD but that don't match my access rule with App condition (which would be better in case of URL changing / adding). Sylvain
... View more
08-23-2017
04:19 AM
Hello, I find on this doc https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html URL to open for AMP for Endpoint operations. After deploying my configuration my AMP connector is still disconnected and when I try to sync the policy I see these outputs in my capture-traffic : 11:17:07.149991 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 1500) ec2-46-137-99-242.eu-west-1.compute.amazonaws.com.https > crc1.dom-opac45.fr.1269: Flags [.], cksum 0xefe7 (correct), seq 4452:5912, ack 286, win 65535, length 1460 11:17:07.149994 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 374) ec2-46-137-99-242.eu-west-1.compute.amazonaws.com.https > crc1.dom-opac45.fr.1269: Flags [.], cksum 0x403d (correct), seq 5912:6246, ack 286, win 65535, length 334 11:17:07.150765 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 378) ec2-46-137-99-242.eu-west-1.compute.amazonaws.com.https > crc1.dom-opac45.fr.1269: Flags [.], cksum 0x535b (correct), seq 6246:6584, ack 286, win 65535, length 338 11:17:07.150774 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 49) ec2-46-137-99-242.eu-west-1.compute.amazonaws.com.https > crc1.dom-opac45.fr.1269: Flags [.], cksum 0x1aca (correct), seq 6584:6593, ack 286, win 65535, length 9 11:17:07.151181 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 40) crc1.dom-opac45.fr.1269 > ec2-46-137-99-242.eu-west-1.compute.amazonaws.com.https: Flags [R], cksum 0x37e7 (correct), seq 1297440847, win 65535, length 0 So it seems that AMP try to communicate directly with fqdn *compute.amazonaws.com.https ?
... View more
Labels:
Created by
ssambourg
in Network Management
a month ago
a month ago
Hello NO Device pack available for now on prime infra 3.6. From the
matrix compability prime infra 3...
Created by
ssambourg
in Network Management
05-23-2019 09:43 AM
05-23-2019 09:43 AM
Hello, I recently installed Cisco Prime Infrastructure 3.5 so as to
manage catalyst 2k, 9200 and 950...
Created by
ssambourg
in Cisco Bug Discussions
03-12-2019 11:57 AM
03-12-2019 11:57 AM
Hello, Long time ago... We resolved this issue by limiting the
withelisted domain authentication int...
12-13-2018 12:02 AM
Yes the routing table correctly show the ISP I targeted: > show route
Codes: L - local, C - connecte...
12-12-2018 02:34 AM
Hello Marvin, I don't have any NAT on this public IP. The socket seems
to be OK for my outside publi...
12-11-2018 12:55 AM
Hello, I am configuring a new RA VPN Policy on FTD 6.2.3 software based
on 2 x ASA 5500-X hardware. ...
Created by
ssambourg
in Cisco Bug Discussions
04-11-2018 09:15 AM
04-11-2018 09:15 AM
Hello, some updates ? I have this issue with ISE 2.3 patch 3.
Created by
ssambourg
in Policy and Access
01-30-2018 10:29 AM
01-30-2018 10:29 AM
Attached the show status of docker app
Created by
ssambourg
in Policy and Access
01-30-2018 10:18 AM
01-30-2018 10:18 AM
Hi, Unable to get thist daemon running after restarting ise app :
2018-01-29T19:16:20.171256+01:00 s...
Created by
ssambourg
in Policy and Access
01-29-2018 06:18 AM
01-29-2018 06:18 AM
Hello, I recently upgrade ISE 1.1 to ISE 2.2 patch 4. After about 1
month of production on the new v...
01-29-2018 06:13 AM
Hello, Trust the stream from AMP4E Clients to AMP EU CLoud URL resolved
my issue. At first URL was n...
Created by
ssambourg
in VPN and AnyConnect
01-29-2018 06:07 AM
01-29-2018 06:07 AM
Hi, With an incredible delay (sorry !)... the service provider filter
IPSec. Change to ASA-V with SS...
Public Statistics
| Date Registered | 02-26-2009 09:34 AM |
| Date Last Visited | 06-24-2019 06:34 AM |
| Total Messages Posted | 62 |
| Total Helpful Votes Received | 11 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Mentor"){kind=icon}
