turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Craig Hyps
09-19-2018
Craig Hyps
Member since
05-07-2003
Advocate
Created by
Craig Hyps
in Security Documents
in Security Documents
09-10-2018
08:41 AM
09-10-2018
08:41 AM
For those looking for an update on the CLIENT_DATA versus CLIENT_ACCEPTED debate, I am sad to report that I have not been able to make progress with F5 on this point after numerous attempts to collaborate and reach an authoritative consensus to benefit of our mutual customers. My current recommendation is to stick with CLIENT_DATA until such time F5 can provide a detailed recommendation for updating the iRule to work with alternative statements such as CLIENT_ACCEPTED.
Best regards, Craig
... View more
Created by
Craig Hyps
in Security Documents
in Security Documents
08-27-2018
11:03 AM
08-27-2018
11:03 AM
Unfortunately that is a limitation of current ISE version. There is no option to import logical profiles via file or API today. Therefore, the entries must be added manually today. Recommend have a separate tab/window open to compare list while selecting with CTRL key.
These profiles are not part of Feed update. There is a limit to max profiles (2000) and so these are intended fro user by customers interested in specific list of IoT vertical. There were a couple profiles (parent profiles) at root level which were updated to maintain consistent "scoring" across profiles. Anything flagged as Administrator Created or Modified will not be updated by Feed service, although deleting a profile will cause it to auto-revert to default Feed values if one existed. You can re-import profiles, but realize that any change to profiles--deletion/updates/adds--can impact current classifications and access policy in a production deployment. Treat such imports like patch upgrades to avoid unexpected disruption in service. Also recommend verify all profile updates--including Feed--offline before applying to production deployment.
... View more
Created by
Craig Hyps
in Security Documents
in Security Documents
08-16-2018
06:10 AM
08-16-2018
06:10 AM
See https://community.cisco.com/t5/security-documents/cisco-snmp-coa-nad-profile-zip/ta-p/3637330
... View more
08-10-2018
04:44 AM
Just seeing this post for first time and likely resolved, but to bring closure for anyone else asking same...
DHCP Snooping is a switch security feature that adds benefits independent of ISE and helps to ensure trust in the DHCP client and server communications. It is also foundational to other switch security features. Specific to ISE, DHCP Snooping is cited as a prerequisite for the Device Sensor feature which allows switch/controller to capture local DHCP traffic, parse key option attributes, and publish those to ISE as av-pairs in RADIUS Accounting Update packets. Device Sensor can do the same for other types of locally learned endpoint data such as CDP/LLDP, HTTP User Agents, mDNS, H323, SIP, etc.
Specific to dACLs, the switch needs to learn the IP address for the client to instantiate source IP address substitution in the per-user ACL. This IP binding to MAC can be learned via IP Device Tracking or DHCP Snooping.
... View more
Created by
Craig Hyps
in Security Documents
in Security Documents
07-17-2018
09:40 AM
07-17-2018
09:40 AM
IOS RADIUS LB is a valid option which I have covered for years in BRKSEC-3699. A key concern over this method is lack of determinism in the RADIUS target. It also does not handle some of the more sophisticated use cases such as web, profiling, and T+ load balancing, or helping to ensure endpoint data is pinned to a specific PSN which can result in major impact in replication data. Also, I cite operational cost as one of the huge factors in deciding on whether to leverage central LB. When specific RADIUS server IPs are listed in NAD config, then any Move/Add/Change must be orchestrated and pushed to every NAD rather than centrally with minimal disruption. I am not sure what issues you experienced with F5 config but happy that you are happy with your new setup.
... View more
Created by
Craig Hyps
in Security Documents
in Security Documents
06-29-2018
04:22 AM
06-29-2018
04:22 AM
Thanks abs-comms for the feedback. Since providing an updated iRule per feedback received directly and indirectly from F5 on this point, a number of customers have since claimed issues with CLIENT_ACCEPTED and also reported that F5 support told them to revert to CLIENT_DATA to resolve. This has obviously resulted in much confusion. Before ping-ponging my response here, I have been working to meet with F5 to resolve this issue and gain agreement on recommended config. I am happy to report that I recently met with F5 representative at Cisco Live and succeeded in getting commitment for future meeting to review (should occur in next 2-3 weeks). I will certainly update post and iRules, if needed, based on results of these discussions.
... View more
Created by
Craig Hyps
in Security Documents
in Security Documents
04-08-2018
09:44 PM
04-08-2018
09:44 PM
Please Read First Before importing to a production ISE deployment, be sure you have read and understand the following conditions and caveats: Before importing the profile library to a production ISE deployment, it is highly recommended that you first complete the following tasks: Backup the ISE configuration database under Administration > System > Backup& Restore, or via CLI. Optionally, export all current ISE profiles under Policy > Profiling > Profiling Policies > Export > Select All. Restore current ISE configuration to a lab system and test the import of new profile library. Note resulting profile policy changes to current endpoints which may impact policy assignment in the production deployment. This library contains approximately 9 new/updated profiles. This library is based on Profiler Version 3 compatible updates which ensures that only ISE deployments running ISE 2.1 and above can import the library. This is due to the use of probes introduced in ISE 2.1 including the NMAP and AD probes. Logical Profile creation: ISE does not currently support import or API update of logical profiles. Therefore, it is necessary to manually assign the new profiles to a new or existing logical profile. Each of the profiles do have descriptions which can aid in deciding how to logically group the profiles. Each profile can be a member of more than one logical profile. Logical profiles allow groups of devices to be distinguished in Context Visibility and facilitate the creation of policy rules based on logical groupings versus individual profiles. This profile library uses the existing Workstation > Microsoft-Workstation profile hierarchy. There is a minor enhancement to the Windows8-Workstation profile. As such, Feed Service updates will not make changes to this profile. If wish to revert to original profile, this can be done by deleting the current version of profile and original Cisco-Provided profile will return in its place. Installation To install the Windows Embedded-IoT profile library: Download the Cisco ISE Windows Embedded-IoT Profile library ZIP file Unzip the ZIP file on your local computer to get the XML file. In ISE, navigate to Work Centers > Profiler > Profiling Policies Click Import ( ) Click Browse... Choose the Windows Embedded-IoT XML file Click on Submit. Wait ~1 minute or less for the Windows Embedded-IoT endpoint profiles to be imported! Once the endpoint profiles are imported, you may view the list of Windows Embedded-IoT devices by choosing Quick Filter and entering "Windows" under the Profiler Policy Name and "Administrator Created" or "Administrator Modified" under the System Type header. The filters should display the following new or modified profiles: Windows-Vista-IoT Windows-Vista-Workstation Windows10-IoT Windows7-IoT Windows8-IoT Widnows8-Workstation (Modified) Windows81-IoT Windows81-Workstation WindowsXP-IoT
... View more
Labels:
Created by
Craig Hyps
in Security Documents
in Security Documents
04-08-2018
08:59 PM
04-08-2018
08:59 PM
Please Read First Before importing to a production ISE deployment, be sure you have read and understand the following conditions and caveats: This library contains approximately 11 new profiles. This library is based on Profiler Version 4 compatible updates which ensures that only ISE deployments running ISE 2.4 and above can import the library. This is due to the fact that profiles are based on the new pxGrid Probe introduced in ISE 2.4. Logical Profile creation: ISE does not currently support import or API update of logical profiles. Therefore, it is necessary to manually assign the new profiles to a new or existing logical profile. Each of the profiles do have descriptions which can aid in deciding how to logically group the profiles. Each profile can be a member of more than one logical profile. Logical profiles allow groups of devices to be distinguished in Context Visibility and facilitate the creation of policy rules based on logical groupings versus individual profiles. Installation To install, the IND endpoint profile library: Download the Cisco ISE IND IoT Profile library ZIP file Unzip the ZIP file on your local computer to get the XML file. In ISE, navigate to Work Centers > Profiler > Profiling Policies Click Import ( ) Click Browse... Choose the IND XML file Click on Submit. Wait ~1 minute or less for the IND endpoint profiles to be imported! Once the endpoint profiles are imported, you may view the list of IND devices by choosing Quick Filter and entering "IoT-" under the Profiling Policy Name header. There will be two main categories: IoT-DeviceType - Corresponds to unique IND Device Types Drive Ethernet/IP Node HMI IO PLC Supervisor Switch IoT-Protocol-Device - Corresponds to the unique IoT/OT Protocol used by the device BACnet CIP Modbus PROFINET
... View more
Labels:
Created by
Craig Hyps
in Security Documents
in Security Documents
04-08-2018
08:39 PM
04-08-2018
08:39 PM
Caution - Please Read First This library contains a large number of endpoint profile policies. Before importing to a production ISE deployment, be sure you have read and understand the following conditions and caveats: Before importing the profile library to a production ISE deployment, it is highly recommended that you first complete the following tasks: Backup the ISE configuration database under Administration > System > Backup& Restore, or via CLI. Optionally, export all current ISE profiles under Policy > Profiling > Profiling Policies > Export > Select All. Restore current ISE configuration to a lab system and test the import of new profile library. Note resulting profile policy changes to current endpoints which may impact policy assignment in the production deployment. The maximum number of profiles that has been QA tested and officially supported for ISE 2.1 and above is 2000. Before importing the new library, check the current number of profiles under Policy > Profiling > Profiling Policies. This library contains approximately 700 new profiles. Increasing the profiler policy total beyond 2000 profiles (whether via Profiler Feed Service, manual import or custom profile creation) may result in resource capacity issues and service disruption. This library is based on Profiler Version 3 compatible updates which ensures that only ISE deployments running ISE 2.1 and above can import the library. This also ensures that each ISE appliance is minimally running 16GB RAM. To ensure sufficient memory is allocated to ISE services running on a virtual appliance, verify that your appliance platform is properly detected. There are a couple ways to verify proper the platform detected by ISE. From CLI... ise-node/admin# show tech | begin PlatformProperties From Admin UI (ISE 2.2 +)... Operations > Reports > Diagnostics > ISE Counters > [node] (Under ISE Profile column) Valid platform sizes include: UCS_SMALL UCS_LARGE SNS_3515 SNS_3595 SNS_3595 <super> (ISE 2.4 only) Any other platform (for example, EVAL, IBM_SMALL_MEDIUM, or IBM_LARGE) will result in insufficient (or less than expected) memory resource allocation for ISE services. Also, make sure that platform detected the platform for which you expect. For example, if deployed 35x5-equivalent VM appliance, make sure it is not displaying as a UCS appliance. Related defects (Note that many are duplicate or resolved via same patch version): ISE VM platform properties defects: CSCvd24296 ISE: Revise platform selection rules for ISE installed on VMs Fixed In: 2.3P0 CSCvh71644 VMware OVA templates for SNS-35xx are not detected correctly in platform.properties-active Fix: Updated OVAs will be posted to Cisco Software Center for 2.1, 2.2, 2.3, 2.4 Context Visibility Resource Issues CSCvf22318 Exception: All Shards Failed due to "java.lang.OutOfMemoryError" Fixed In: 2.1P6, 2.2P4, 2.3P1, 2.4P0 CSCvf42061 Unable to load Context Visibility all shards failed due to CircuitBreakingException Fixed In: 2.1P6, 2.2P4, 2.3P1, 2.4P0 CSCvh48558 ISE 2.2p5 Unable to load Context Visibility Fixed In: 2.2P8, 2.3 P3, 2.4P0 CSCvg54641 ISE 2.3p1/2.2p4 Unable to load context visibility - java heap size not modified for ibmSmallMedium Profiler Feed Service / High Profile Count Issues (Fixed In 2.4 P0) CSCvh13873 ISE PSN/PAN App server crashes after profiler feed update CSCvh14378 ISE nodes APP Initializing after Feed Service update - out of mem CSCvh17860 Profiler Feed Server Proactively taken offline for maintenance CSCvh20783 Feed Server undo on PAN does not roll back rules and checks Upgrade / Restore issues related to Mem Allocation CSCvh57345 Restore of 1.4/2.0/2.0.1 backup fails which taken after Feed update Fixed In: 2.2P8, 2.4P0 CSCvi38845 Upgrade fails after Feed update due to less heapspace Requires new Upgrade Bundles to be posted to Cisco Software Center After installing a large Profile library, be sure to take the following precautions prior to a major ISE version upgrade… Backup ISE Configuration database Test restore of the ISE configuration to a separate ISE server in a lab environment to verify upgrade process, or else restore to newer version. Review the related defects above related to upgrade/restore. If you plan to restore existing configuration to a newer version of ISE, be sure you have applied the current patch with the fix for CSCvh57345 on the new ISE PAN node before restore. If you plan to use the standard upgrade process, ensure you are using one of the newer upgrade bundles (dated April 2018 or later) which contains the fix for CSCvi38845. The above steps will ensure that you are not hitting a 2GB Heap memory limitation in upgrade/restore process. Logical Profile creation: ISE does not currently support import or API update of logical profiles. Therefore, it is necessary to manually assign the new profiles to a new or existing logical profile. Each of the profiles do have descriptions which can aid in deciding how to logically group the profiles. Each profile can be a member of more than one logical profile. Logical profiles allow groups of devices to be distinguished in Context Visibility and facilitate the creation of policy rules based on logical groupings versus individual profiles. When the number of top-level profiles exceeds 500, you will need to switch from Tree-View to List-View to navigate entries beyond the first 500. Installation To install, the Automation-Control profile library: Download the Cisco ISE Automation and Control Profile library ZIP file Unzip the ZIP file on your local computer to get the XML file. In ISE, navigate to Work Centers > Profiler > Profiling Policies Click Import ( ) Click Browse... Choose the Automation-Control XML file Click on Submit. Wait 1-5 minutes for the Automation-Control endpoint profiles to be imported! Once the endpoint profiles are imported, you may view the list of Automation and Control devices by choosing Quick Filter and entering one of the following keywords under the Description header: Automation (primary filter) Manufacturing Building Home Power Lighting Traffic Transport Elevator HVAC Fire Safety Access (Control) Audio-Video Finance Defense Embedded Industrial Device Name Categories 802automation-Device Manufacturing AAEON-Technology-Device Industrial Compute ABB-AB-Cewe-Control-Device Manufacturing/Power ABB-AG-Device Manufacturing/Power ABB-AS-Automation-Device Manufacturing ABB-Australia-Device Manufacturing/Building/Power ABB-Automation-Products-Device Manufacturing ABB-Bomem-Device Manufacturing ABB-Device Manufacturing/Building/Home/Power ABB-Genway-Xiamen-Electrical-Device Building/Audio-Video/Access Control ABB-Global-Industries-Device Power ABB-Industrial-Systems-Device Manufacturing ABB-Ltd-Device Manufacturing/Building/Power ABB-Oy-Device Manufacturing/Power ABB-Oy-Drives-Device Power ABB-Oy-Medium-Voltage-Device Power ABB-Power-Quality-Device Power ABB-Power-Systems-Generation-Device Power ABB-Power-Technologies-Device Power ABB-Power-Transmission-Distribution-Device Power ABB-SPA-SACE-Device Power ABB-Stotz-Kontakt-Device Manufacturing/Building/Power ABB-Switzerland-Device Power ABB-Switzerland-Power-Systems-Device Power ABB-Totalflow-Device Manufacturing Abb-Tropos-Device Industrial Wireless ABB-Xiamen-Low-Voltage-Device Power ABB-Xiamen-Transmission-Distribution-Device Power Access-Control-Systems-JSC-Device Building/Audio-Video/Access Control/Fire Safety-Healthcare-Nurse Call Accu-Sort-Systems-Device Packaging Accu-Time-Systems-Device Timekeeping Acroloop-Motion-Control-Device Manufacturing ACTi-Corporation-Device Audio-Video/Access Control Active-Control-Technology-Device Access Control adp-Gauselmann-Device Finance Advanced-Control-Systems-Doo-Device Power Advanced-Control-Systems-Inc-Device Power Advanced-Illumination-Device Lighting Advanced-Micro-Controls-Device Manufacturing Advanced-Motion-Controls-Device Manufacturing Advantage-Controls-Device Manufacturing/Water Advantech-Co-Device Manufacturing Advantech-Technologies-Device Manufacturing Advantech-Technology-Device Manufacturing Advatek-Lighting-Device Lighting Aiphone-Device Intercom-Nurse Call Alfa-Laval-Automation-Device Manufacturing Alstom-Device Manufacturing Alstom-Grid-Device Power Alstom-Hydro-France-Device Manufacturing/Power Alstom-Signalling-Device Manufacturing/Traffic-Transport Alstom-Strongwish-Device Manufacturing Alstom-Transport-Device Manufacturing/Traffic-Transport Altech-Controls-Device Building Amatis-Controls-Device Building Amazing-Controls-Device Building/Home AMSC-Device Power Andover-Controls-Device Building Anviz-Biometric-Tech-Device Access Control/Biometric APG-Cash-Drawer-Device Finance Applied-Automation-Device Manufacturing Applied-Materials-Device Manufacturing Arco-Electronic-Control-Device Access Control Arcom-Control-Systems-Device Manufacturing Arecont-Vision-Device Audio-Video/Access Control Armour-Home-Electronics-Device Home/Audio-Video Assa-Abloy-Cote-Picarde-Device Access Control Assa-Abloy-Device Access Control ATI-Industrial-Automation-Device Manufacturing AudioControl-Device Home/Audio-Video August-Home-Device Home/Access Control AUMA-Riester-Device Manufacturing Autec-Device Building/Access Control Automated-Logic-Device Building Automatic-Bar-Controls-Device Building/Restaurant Automation-Components-Device Building/HVAC Automation-Electronics-Device Manufacturing/Power Automation-Products-Group-Device Manufacturing automationNEXT-Device Power Autronica-Fire-And-Security-Device Building/Fire Safety AVAT-Automation-Device Power Aventura-Device Audio-Video/Access Control Avigilon-Device Audio-Video/Access Control AVTECH-Device Audio-Video/Access Control Axis-Communications-Device Audio-Video/Access Control Baldor-Electric-Device Manufacturing Balogh-Device Traffic-Transport/RFID Balogh-TAG-Device Manufacturing/Access Control/Traffic-Transport/RFID Barco-Control-Controls-Device Control Rooms Basler-Device Manufacturing/Audio-Video Basler-Electric-Device Manufacturing/Power Bay-Controls-Device Manufacturing BC-Illumination-Device Lighting Beckhoff-Automation-Device Manufacturing Beckmann-Device Traffic-Transport/Finance Beckmann-Egle-Device Finance Beijing-E3Control-Technology-Device Building/Lighting Beijing-General-Research-Institute-Device Mining Berghof-Automation-Device Manufacturing Berkeley-Process-Control-Device Manufacturing Bharat-Electronics-Device Manufacturing/Defense BioControl-Device Agriculture Biometric-Access-Company-Device Access Control/Biometric Bioscrypt-Device Access Control/Biometric Bitwise-Controls-Device Building/Home/Audio-Video Bonfiglioli-Vectron-Device Manufacturing Bosch-Access-Systems-Device Building/Access Control Bosch-Automotive-Device Manufacturing/Repair-Diagnostic Bosch-Rexroth-Device Manufacturing Bosch-Security-Systems-Device Building/Audio-Video/Access Control/Fire Safety Bosch-Security-Systems-Netherlands-Device Building/Home/Audio-Video/Access Control/Fire Safety Bosch-Security-Systems-USA-Device Building/Home/Audio-Video/Access Control/Fire Safety Bosch-Siemens-Home-Device IoT Bosch-Software-Innovations-Device Manufacturing BR-Controls-Nederland-Device Building Brilliant-Home-Technology-Device Home Brooks-Automation-Device Manufacturing Brooks-Automation-RFID-Device Retail-RFID-RTLS Building-Block-Video-Device Audio-Video/Access Control Burroughs-Payment-Systems-Device Finance CA-Traffic-Device Traffic-Transport CAREL-Device Building/HVAC- Refrigeration Carlo-Gavazzi-Controls-Device Manufacturing Carrier-Corporation-Device Building/HVAC-Refrigeration Cash-Systemes-Industrie-Device Finance CashGuard-Device Finance Cashmaster-Device Finance Castles-Technology-Device Finance Caterpillar-Device Manufacturing Caterpillar-Trimble-Control-Device Manufacturing CCV-Deutschland-Device Finance CentraLite-Systems-Device Building/Home Chubb-Electronic-Security-Systems-Device Building/Access Control Circontrol-Device Building/Traffic-Transport Clare-Controls-Device Home Colorado-vNet-Device Home Companytec-Automation-Control-Device Manufacturing Compressor-Controls-Corp-Device Manufacturing Computerized-Elevator-Contol-Device Manufacturing/Elevators Comtrol-Device Industrial Networking-Gateways Connected-Home-Device Home Contemporary-Control-Device Manufacturing Control-Applications-Device Manufacturing Control-Dynamics-Device Home/Audio-Video Control-Express-Finland-Device Manufacturing Control-iD-Device Access Control Control-Microsystems-Device Manufacturing Control-Module-Device Traffic-Transport/Monitoring Control-Module-Device Timekeeping Control-Products-Device Building Control-Resources-Corp-Device Manufacturing/Building Control-Robotics-Solutions-Device Manufacturing Control-Sistematizado-Device Manufacturing Control-Solutions-Device Manufacturing Control-Solutions-Inc-Device Manufacturing Control-Techniques-Device Manufacturing Control-Technology-Corp-Device Manufacturing Control-Technology-Inc-Device Manufacturing Control4-Device Home Controlled-Electronic-Device Access Control Controlled-Environments-Device Environmental Control ControlNet-Device Building ControlThings-Device IoT Security CONTROLtronic-Device Building Cool-Control-Device Building/HVAC Cooper-Industries-Device Power/Lighting/Fire Safety Copley-Controls-Corp-Device Manufacturing Creative-Lighting-Sound-Device Lighting Cree-Device Lighting Crestron-Electronics-Device Manufacturing/Building Crisp-Automation-Device Manufacturing CSI-Control-Systems-Device Manufacturing/Building CSIRO-Exploration-Mining-Device Mining Ctek-Device Manufacturing/Power/Access Control/Traffic-Transport/Agriculture-Water Cummins-Allison-Device Finance Curtiss-Wright-Avionics-Electronics-Device Manufacturing/Traffic-Transport/Aviation Curtiss-Wright-Embedded-Computing-Device Manufacturing/Traffic-Transport Custom-Control-Concepts-Device Traffic-Transport/Aviation Cylon-Controls-Device Building Daeyeon-Control-Instrument-Device Manufacturing Dai-ichi-Dentsu-Device Manufacturing Dalian-Seasky-Automation-Device Manufacturing/Traffic-Transport DanControl-Engineering-Device Power Darfon-Lighting-Device Lighting DASA-Robot-Device Manufacturing Dassault-Electronique-Device Manufacturing Data-Control-Equipment-Device Manufacturing Datasym-POS-Device Finance DeLaval-International-Device Agriculture Delta-Control-Device Manufacturing/Building Delta-Controls-Device Building Delta-Danish-Electronics-Device Manufacturing Delta-Electronics-Device Manufacturing Delta-Elektronika-Device Power DEOS-Control-Systems-Device Building Deutschmann-Automation-Device Manufacturing DigiBoard-Device Terminal Servers-Serial Gateways Digital-Control-Device Manufacturing Digital-Lighting-Systems-Device Building/Lighting Digital-Payment-Technologies-Device Traffic-Transport/Finance Digitronic-Device Manufacturing/Building Direct-Payment-Solutions-Device Finance DRS-Consolidated-Controls-Device Manufacturing DVTel-Device Audio-Video/Access Control Dynacolor-Device Audio-Video/Access Control E-Control-Systems-Device Manufacturing Eagle-Traffic-Control-Device Traffic-Transport Eaton-Automation-Device Manufacturing Eaton-Corporation-Device Manufacturing/Power Eaton-Device Manufacturing/Power Eaton-FHF-Device Manufacturing/Power Eaton-Industries-Device Manufacturing/Power Eaton-Pulizzi-Electrical-Device Manufacturing/Power Econolite-Control-Device Traffic-Transport EControls-Device Manufacturing Eddy-Smart-Home-Device Home/Water Edwards-Ltd-Device Building EKE-Building-Technology-Device Building ELAN-Systems-Device Building ELC-Lighting-Device Lighting/Entertainment Electric-Controller-Manufacturing-Device Manufacturing Electronic-Theatre-Controls-Device Home/Lighting/Entertainment Eliwell-Controls-Device Building/HVAC Elk-Products-Device Building/Home Elmo-Motion-Control-Device Manufacturing ELPRO-Technologies-Device Manufacturing/Monitoring Embedded-Automation-Device Home Emerson-Appliance-Device Manufacturing Emerson-Climate-Device Building Emerson-Climate-Retail-Device Building Emerson-Climate-Transportation-Device Building/Traffic-Transport Emerson-Device Manufacturing/Building Emerson-Energy-Systems-Device Building/Power Emerson-Network-Power-Avocent-Device Power Emerson-Network-Power-Device Power Emerson-Power-Water-Device Manufacturing Enovation-Controls-Device Manufacturing Equinox-Payments-Device Finance Estun-Automation-Device Manufacturing Eurotherm-Controls-Device Manufacturing Exceptional-Innovation-Device Home/Hospitality-Healthcare F-Robotics-Acquisitions-Device Home FAG-Industrial-Device Manufacturing Fagor-Automation-Device Manufacturing Fairmount-Automation-Device Manufacturing FANUC-Robotics-Device Manufacturing FATEK-Automation-Device Manufacturing Fisher-Controls-Device Manufacturing Flytech-Technology-Device Finance/Healthcare FS-Forth-Systeme-Device Embedded Networking FUJI-Automation-Device Manufacturing FUJI-Electric-Device Manufacturing/Power Galil-Motion-Control-Device Manufacturing GE-Consumer-Industrial-Device Building/Power/Lighting GE-Corp-Device Manufacturing GE-Digital-Energy-Device Power GE-Energy-Device Power GE-Fanuc-Automation-Device Manufacturing GE-Global-Research-Device Manufacturing GE-Water-Process-Device Manufacturing/Water Gemalto-ePayment-Device Finance General-Dynamics-Robotic-Systems-Device Manufacturing/Defense Genetec-Device Audio-Video/Access Control/Traffic-Transport/Retail Genie-Industries-Device Manufacturing/Lifts Genmark-Automation-Device Manufacturing GeoVision-Device Audio-Video/Access Control German-Light-Products-Device Lighting/Entertainment GKB-CCTV-Device Home/Audio-Video/Access Control/Fire Safety Global-Traffic-Technologies-Device Traffic-Transport Golden-River-Traffic-Device Traffic-Transport Goldline-Controls-Device Home Grandeye-Device Audio-Video/Access Control Grundfos-Holding-Device Manufacturing/Building Gunnebo-Cash-Automation-Device Access Control/Finance Haas-Automation-Device Manufacturing Hangzhou-Hikvision-Device Audio-Video/Access Control Hangzhou-Hollysys-Automation-Device Manufacturing/Power/Traffic-Transport Hanwha-Techwin-Device Manufacturing/Audio-Video Hanwha-Techwin-Security-Device Manufacturing/Audio-Video Hectronic-Device Traffic-Transport HESS-Cash-Systems-Device Finance HID-Corp-Device Access Control Highlight-Parking-Systems-Device Traffic-Transport Hills-Sound-Vision-Lighting-Device Building/Healthcare-RTLS-Nurse Call Hirschmann-Austria-Device Manufacturing/Power/Traffic-Transport Hirschmann-Automation-Control-Device Manufacturing/Industrial Networking Hirschmann-Automation-Device Manufacturing/Industrial Networking Hirschmann-Device Manufacturing/Building/Home Hirschmann-Multimedia-Device Building/Home Hitachi-High-Tech-Control-Device Manufacturing Hitachi-Industrial-Equipment-Device Manufacturing Hitachi-Industry-Control-Device Access Control Hitachi-Johnson-Controls-Device Building/HVAC-Refrigeration HMS-Industrial-Networks-Device Industrial Networking Homag-Device Manufacturing/Wood Home-Automation-Europe-Device Home Home-Control-Singapore-Device Home Home-Director-Device Home Home-Network-System-Device Home home2net-Device IoT Networking HomeLogic-Device Home Homenet-Communications-Device Audio-Video/Access Control Homerider-Systems-Device Building HomeScenario-Device Building/Home Honeywell-ACS-Device Manufacturing Honeywell-Analytics-Device Manufacturing/Industrial Safety Honeywell-Automation-Device Manufacturing/Building Honeywell-China-Device Manufacturing Honeywell-CMSS-Device Traffic-Transport Honeywell-Dating-Device Access Control Honeywell-ECC-Device Building Honeywell-Environmental-Device Building Honeywell-Fire-System-Device Manufacturing/Fire Safety Honeywell-Germany-Device Manufacturing/Building Honeywell-International-Device Manufacturing/Building Honeywell-Korea-Device Manufacturing/Building Honeywell-Life-Safety-Device Building/Fire Safety Honeywell-Safety-Products-Device Industrial Safety Honeywell-Security-Device Building/Access Control Honeywell-Video-Systems-Device Audio-Video/Access Control Honeywld-Technology-Device Home/Access Control/RTLS-Healthcare Horner-Electric-Device Manufacturing Hubbell-Building-Automation-Device Building/Lighting Hubbell-Device Building/Power/Lighting Hubbell-Power-Systems-Device Power Hurco-Automation-Device Manufacturing/Building/HVAC Hypercom-Device Finance i-Controls-Device Building/Home/Traffic-Transport IBASE-Technology-Device Industrial Compute-Digital Signage ICC-Device Manufacturing/Building ICM-Controls-Device Building/HVAC iControl-Device RTLS ICP-ePayment-Device Finance IDEC-Corp-Device Manufacturing/Building/Embedded Compute IDIS-Co-Device Audio-Video Impinj-Device RFID In-Home-Displays-Device Home/Power Industrea-Mining-Technology-Device Mining Industrial-Control-Device Manufacturing Industrial-Control-Systems-Device Traffic-Transport Inex-Technologies-Device Traffic-Transport Infinova-Device Audio-Video/Access Control Ingenico-POS-Payment-Device Finance Ingenico-Terminals-Device Finance Ingersoll-Rand-Device Manufacturing Intec-Automation-Device Manufacturing Integrated-Control-Corp-Device Restaurant Integrated-Control-Technology-Device Access Control Intelligent-Control-Systems-Device Manufacturing Intelligent-Distributed-Controls-Device Manufacturing/Building/Lighting/Healthcare-RTLS-Nurse Call International-Mining-Technologies-Device Mining Intrepid-Control-Systems-Device Traffic-Transport Invensys-Controls-Device Building/HVAC-Fire Safety Invisua-Lighting-Device Lighting ioIMAGE-Device Audio-Video/Access Control IQinVision-Device Audio-Video/Access Control iRZ-Automation-Device Manufacturing Japan-Cash-Machine-Device Finance JK-microsystems-Device Manufacturing/Building/Audio-Video Johnson-Controls-Device Building Kaba-Benzing-Device Access Control Kaba-Benzing-Device Timekeeping Kinco-Automation-Device Manufacturing Kingtek-CCTV-Alliance-Device Audio-Video/Access Control KMC-CONTROLS-Device Building Knapp-Logistik-Device Manufacturing/Warehouse Kone-Device Elevators-Escalators Kongsberg-Norcontrol-Device Access Control Kontron-Electronik-Device Manufacturing/Embedded-Industrial Compute Kronos-Device Timekeeping KUKA-Welding-Robots-Device Manufacturing LACROIX-Traffic-Device Lighting/Traffic-Transport Lagotek-Corp-Device Building/Home LARsys-Automation-Device Manufacturing Laser-Light-Engines-Device Lighting LED-Roadway-Lighting-Device Lighting/Traffic-Transport Leedarson-Lighting-Device Building/Home/Lighting LEGRAND-Device Building/Home Legrand-Home-Systems-Device Building/Home Leroy-Automation-Device Manufacturing Leviton-Manufacturing-Device Building/Home LightHaus-Logic-Device Finance Lighting-Science-Group-Device Lighting/Healthcare-Agriculture LightStar-Device Manufacturing Lipman-TransAction-Device Finance Lippert-Automation-Device Manufacturing Liquid-Robotics-Device Environmental Monitoring Listman-Home-Technologies-Device Home LiteTouch-Device Home/Lighting LNT-Automation-Device Building/Lighting Logic-Controls-Device Finance Logic-Product-Device Manufacturing Longdhua-Controls-Device Building Lorex-Technology-Device Audio-Video/Access Control LOYTEC-electronics-Device Building Luninex-Lighting-Control-Device Home/Audio-Video/Lighting Lupine-Lighting-Systems-Device Lighting Lutron-Electronics-Device Building/Home/Lighting MA-Lighting-Device Building Maas-International-Device Finance Magal-Senstar-Device Access Control/Healthcare Magnetic-Autocontrol-Device Access Control/Traffic-Transport March-Networks-Device Audio-Video/Access Control Masterclock-Device Timekeeping McCain-Traffic-Supply-Device Traffic-Transport MCS-Logic-Device Home/Audio-Video Mercury-Security-Device Access Control Merten-Device Building Meteocontrol-Device Power Metso-Automation-Device Manufacturing miControl-Device Manufacturing Micro-Control-Designs-Device Manufacturing Micro-Control-Systems-Inc-Device Building/HVAC-Refrigeration Micro-Control-Systems-Ltd-Device Building/Lighting/Environmental Control Micro-Robotics-Limited-Device Manufacturing Microrobot-Device Education Mine-Site-Technologies-Device Mining Mitsubishi-Electric-Device Manufacturing/Building/Power/Elevator Mitsubishi-Electric-Service-Device Manufacturing/Repair Mitsubishi-Electronics-Logistic-Device Traffic-Transport/Logistics Mitsubishi-Heavy-Industries-Device Manufacturing/Traffic-Transport Mitsubishi-Precision-Device Manufacturing/Traffic-Transport/Logistics-Parking-Simulation Mobotix-Device Audio-Video/Access Control Modbus-Client Manufacturing Modbus-Server Manufacturing Mode-Lighting-Device Building/Lighting Modular-Mining-Systems-Device Mining Molex-Canada-Device Manufacturing Molex-Device Manufacturing/Building/Healthcare Moog-Broad-Reach-Device Traffic-Transport Moog-Device Manufacturing Moog-Germany-Device Manufacturing Moog-USA-Device Manufacturing Motion-Control-Engineering-Device Elevators Motion-Control-Systems-Device Manufacturing Multivision-Intelligent-Surveillance-Device Audio-Video/Access Control Nanjing-SAC-Power-Device Power Nanjing-Shining-Electric-Device Power Navionics-Research-Device Manufacturing/Building NBS-Device Finance NBS-Payment-Solutions-Device Finance NCR-Device Finance NCTech-Device Audio-Video Nedap-Device Access Control/Lighting/RFID-Agriculture Nest-Labs-Device Home/Access Control/Fire Safety Netatmo-Device Home Netcontrol-Device Power Network-Controls-International-Device Finance Neuberger-Building-Automation-Device Building Neuron-Robotics-Device Education New-Light-LED-Device Lighting NEWPOS-Device Finance Nexans-Germany-Device Manufacturing/Building Nidec-Copal-Device Manufacturing Nidec-Device Manufacturing Nidec-Sanyo-Device Manufacturing Nixdorf-Computer-Device Finance Novus-Security-Device Audio-Video/Access Control Nuki-Home-Solutions-Device Home/Access Control NuLEDs-Device Home/Lighting Omnex-Control-Systems-Device Manufacturing Open-Source-Robotics-Foundation-Device Education Orient-Power-Home-Network-Device Home Otis-Elevator-Device Elevators-Escalators Panasonic-Electric-Works-Automation-Device Manufacturing Panasonic-Electric-Works-Device Manufacturing/Building Panasonic-Industrial-Device Manufacturing/Building Park-Assist-Device Traffic-Transport Parker-Hannifin-Compumotor-Device Manufacturing Parker-Hannifin-Device Manufacturing Parker-Hannifin-Electromechanical-Device Manufacturing Parker-Hannifin-Manufacturing-Germany-Device Manufacturing Parker-Hannifin-Manufacturing-UK-Device Manufacturing Parking-BOXX-Device Traffic-Transport/Finance PChome-Online-Device Finance Peek-Traffic-Device Traffic-Transport Peek-Traffic-Netherlands-Device Traffic-Transport Peek-Traffic-USA-Device Traffic-Transport Pelco-Device Audio-Video/Access Control Peperoni-Light-Device Lighting/Entertainment Phase-Motion-Control-Device Manufacturing Philips-CFT-Device Manufacturing Philips-Lighting-Device Building/Lighting Plast-Control-Device Manufacturing Pneu-Logic-Device Manufacturing Portwell-Device Embedded-Industrial Compute POSBANK-Device Finance POSDATA-Device Finance Posiflex-Device Finance Power-Automation-Device Power Precise-Automation-Device Manufacturing PROBA-Building-Automation-Device Building Process-Control-Corp-Device Manufacturing/Building Prolon-Control-Systems-Device Building/HVAC Q-Light-Device Traffic-Transport QSR-Automations-Device Restaurant Quatech-Device Industrial Networking-Gateways Quest-Controls-Device Building/Power Radiation-Safety-Device Manufacturing Rainforest-Automation-Device Power RBZ-Embedded-Logics-Device Manufacturing Real-Time-Automation-Device Manufacturing Realand-Bio-Co-Device Access Control/Biometric Recardo-Test-Automation-Device Manufacturing Red-Lion-Controls-Device Manufacturing Reliable-Controls-Device Building Remote-Technologies-Device Home Residential-Control-Systems-Device Building/Home ROBE-Show-Lighting-Device Home/Lighting/Entertainment Robert-Bosch-ATMO-Device Manufacturing Robert-Bosch-Automotive-Device Manufacturing Robert-Bosch-Device Manufacturing/Building/Home/Access Control Robert-Bosch-Smart-Home-Device Home Robot-Visual-Systems-Device Manufacturing/Traffic-Transport RoboTech-Device Manufacturing ROBOTIS-Device Home Robotous-Device Manufacturing Rockwell-Automation-Device Manufacturing Rosemont-Controls-Device Manufacturing Ross-Controls-Device Manufacturing ROTEC-Industry-Automation-Device Manufacturing RS-Automation-Device Building S2-Security-Corp-Device Audio-Video/Access Control Safetran-Traffic-Systems-Device Traffic-Transport Saia-Burgess-Controls-Device Manufacturing/Building Samsung-Techwin-Device Manufacturing/Audio-Video Sanritz-Automation-Device Manufacturing Satchwell-Control-Systems-Device Building Savant-Systems-Device Home Schilling-Robotics-Device Manufacturing Schindler-Elevator-Device Elevators-Escalators Schlumberger-Device Manufacturing/Oil-Gas Schlumberger-Kabushiki-Kaisha-Device Manufacturing/Fluid Analysis Schlumberger-Retail-Petroleum-Device Manufacturing/Oil-Gas Schlumberger-Well-Services-Device Manufacturing/Oil-Gas Schneider-Electric-Asia-Pacific-Device Building/Power Schneider-Electric-Australia-Device Manufacturing/Building/Power Schneider-Electric-Canada-Device Manufacturing/Building/Power Schneider-Electric-Device Manufacturing/Building/Power/Access Control/Fire Safety Schneider-Electric-Fire-Security-Device Access Control/Fire Safety Schneider-Electric-France-Device Manufacturing/Building/Power Schneider-Electric-Germany-Device Manufacturing/Building/Power Schneider-Electric-Motion-Device Manufacturing Schneider-Electric-Ultra-Terminal-Device Building SE-Controls-Device Building/Fire Safety Se-Kure-Controls-Device Audio-Video/Access Control Securite-Communications-Honeywell-Device Home/Access Control SEGGER-Microcontroller-Device Manufacturing SEL-Schweitzer-Device Manufacturing/Power Sensys-Traffic-Device Traffic-Transport Sentry-360-Security-Device Audio-Video/Access Control Sepro-Robotique-Device Manufacturing Servo-Robot-Device Manufacturing SGM-Technology-Device Home/Lighting/Entertainment Shanghai-iComhome-Device Home ShangHai-Sun-Up-Lighting-Device Lighting Shenzhen-Heguang-Device Manufacturing/Building Shenzhen-HT-Intelligent-Control-Device Home Shenzhen-Shidean-Legrand-Device Building/Home/Audio-Video/Access Control SHI-Control-Systems-Device Manufacturing Shibaura-Vending-Device Manufacturing/Finance ShopperTrak-Device Retail SiboTech-Automation-Device Manufacturing Siemens-Asia-Device Manufacturing/Building/Power Siemens-Austria-SIMEA-Device Manufacturing Siemens-Automation-Device Manufacturing/Building/Power Siemens-Automation-Drives-Device Manufacturing Siemens-Belgium-Device Manufacturing/Building/Power Siemens-Building-Device Building/DXR Controllers Siemens-Building-Technologies-Device Building Siemens-Convergence-Device Home/Access Control Siemens-Digital-Factory-Device Manufacturing Siemens-Energy-Automation-Device Power Siemens-Energy-Management-Device Manufacturing/Power Siemens-Home-Office-Device Home Siemens-ICM-Device Manufacturing Siemens-Industrial-Automation-China-Device Manufacturing Siemens-Industrial-Automation-Device Manufacturing Siemens-Industrial-Automation-EWA-Device Manufacturing Siemens-Industrial-Solutions-Device Manufacturing Siemens-Industry-Device Building Siemens-Low-Voltage-Device Building/Power Siemens-Numerical-Control-Device Manufacturing Siemens-Sector-Industry-Device Manufacturing Siemens-Switzerland-BT-HVP-Device Building/PXCM Supervisory Controllers-HVAC Siemens-Transportation-Device Manufacturing/Power/Traffic-Transport SightLogix-Device Audio-Video/Access Control Silex-Technology-America-Device IoT Gateways Siqura-Device Audio-Video/Access Control Sistemas-Avanzados-Control-Device Manufacturing SmarteBuilding-Device Power/Monitoring Smarthome-Device Home Soenen-Controls-Device Manufacturing Softlink-Automation-Device Manufacturing Solberg-Andersen-Device Manufacturing Somat-Corp-Device Data Acquisition Spectra-Technologies-Device Finance Spectronix-Device Manufacturing/Healthcare Spectrum-Control-Device Power Spectrum-Controls-Device Manufacturing SPG-Controls-Device Access Control/RTLS Spire-Payments-Device Finance Sprecher-Automation-Device Manufacturing Square-D-Device Building/Power SSI-Schaefer-Peem-Device Storage and Materials Handling Star-Micronics-Device Finance/Printers StarDot-Technologies-Device Audio-Video/Access Control Strand-Lighting-Device Building/Home/Lighting Sur-Gard-Security-Device Audio-Video/Access Control SWAC-Device Manufacturing Swarco-Device Lighting/Traffic-Transport Symbol-POS-Device Finance Synergy-Lighting-Controls-Device Building/Lighting Syscor-Controls-Automation-Device Manufacturing TagMaster-Device Traffic-Transport/RFID Takagi-Industrial-Device Manufacturing/Building/Power Tesco-Controls-Device Manufacturing TF-Payment-Service-Device Finance Thermo-Fisher-Scientific-Device Manufacturing Thomas-Betts-Device Building/Power/HVAC ThyssenKrupp-Elevator-Device Building/Elevators-Escalators Time-Management-Device Traffic-Transport/Vehicle Tracking Time-O-Matic-Device Digital Signage TimeKeeping-Systems-Device Timekeeping TopControl-Device Food Industry Toshiba-Mitsubishi-Electric-Industrial-Device Manufacturing/Power Touchless-Biometric-Systems-Device Access Control/Biometric TPA-Traffic-Parking-Automation-Device Traffic-Transport TrafficCast-Device Traffic-Transport Trane-Device Building/HVAC Trebing-Himstedt-Proze-Automation-Device Manufacturing Tridium-Device Building Triton-Electronics-Device Water Triton-Systems-ATM-Device Finance Truen-Device Audio-Video/Access Control TST-Biometrics-Device Access Control/Biometric TTC-Next-Gen-Home-Network-Device Building/Home TurControlSystme-Device Building TVT-Device Audio-Video/Access Control Tyco-Traffic-Transportation-Device Traffic-Transport uControl-Device Home/Access Control Ultra-Electronics-Command-Control-Device Defense UniControls-Device Traffic-Transport United-Western-Technologies-Device Manufacturing Universal-Control-Solution-Device Manufacturing Universal-Remote-Control-Device Building US-Traffic-Corp-Device Lighting/Traffic-Transport UTC-Climate-Control-Security-Device Building/Access Control/HVAC-Fire Safety UTC-Fire-Security-Device Building/Access Control/Fire Safety Uwe-Schneider-Device Manufacturing/Traffic-Transport Vanderbilt-International-Device Audio-Video/Access Control Vantage-Controls-Device Building Vectron-Systems-Device Finance VendNovation-Device Finance Verifone-Device Finance Verint-Loronix-Video-Device Audio-Video VG-Controls-Device Manufacturing Vialis-Device Traffic-Transport Vicon-Industries-Device Audio-Video/Access Control VideoIQ-Device Audio-Video visago-Systems-Controls-Device Building Visonic-Device Home/Access Control Vista-Control-Systems-Device Manufacturing Vista-Controls-Corp-Device Defense Vivotek-Device Audio-Video Wachendorff-Automation-Device Manufacturing Wayne-Dalton-Device Building/Home Weiss-Robotics-Device Manufacturing Westcontrol-Device Manufacturing Wincor-Nixdorf-Diebold-Device Finance Winpresa-Building-Automation-Device Building Wintech-Automation-Device Manufacturing WPS-Parking-Systems-Device Traffic-Transport Wuhan-FiberHome-Device Access Control XAC-Automation-Device Finance Xanboo-Device Home Xantech-Corp-Device Building/Home/Audio-Video Xin-Hua-Control-Engineering-Device Power Xipher-Technologies-Device Timekeeping Yacoub-Automation-Device Manufacturing/Traffic-Transport Yamatake-Honeywell-Device Manufacturing/Building Yarg-Biometrics-Device Access Control/Biometric YORK-Refrigeration-Device Manufacturing/Traffic-Transport/Refrigeration Zhejiang-Dahua-Device Audio-Video/Access Control Zhejiang-Shenghui-Lighting-Device Building/Lighting Zhejiang-Uniview-Device Audio-Video/Access Control Ziehl-Abegg-Device Manufacturing ZIEHL-industrie-electronik-Device Manufacturing
... View more
Labels:
Created by
Craig Hyps
in Security Documents
in Security Documents
02-23-2018
07:06 AM
02-23-2018
07:06 AM
Thanks Matt for the feedback. I reached out to the original F5 team that assisted with original guide validation as well as other F5 experts to resolve these topics. The original method was CLIENT_DATA and I was later told by an F5 engineer this is NOT recommended, so I obliged and changed it to CLIENT_ACCEPTED in the post here. I certainly want to get to the bottom of this so that we have single guidance, or at least understand caveats if more than one option is applicable per deployment circumstances. As mentioned, CLIENT_DATA waits for entire message to be assembled before making a forwarding decision and was reason why originally proposed. It may be misunderstanding from specific F5 rep that led to CLIENT_ACCEPTED recommendation, but I'll get this resolved and post update accordingly.
... View more
Created by
Craig Hyps
in Security Documents
in Security Documents
02-21-2018
08:08 AM
02-21-2018
08:08 AM
To answer the "why", part of the reason is called out at CLIENT_DATA - DevCentral Wiki. "For UDP, this event fires each time a datagram arrives from the client. (Large UDP datagrams may be subject to IP fragmentation at the source or in transit. The BIG-IP will reassemble fragmented datagrams before firing this event, as explained in f5 Solution Note f5 SOL17102.) NOTE ALSO: Per f5 Solution Note f5 SOL14563 it is better to process UDP datagrams in CLIENT_ACCEPTED than in this event." More info on CLIENT_ACCEPTED here: CLIENT_ACCEPTED - DevCentral Wiki I am providing best practice guidance. If system is working with CLIENT_DATA then you can continue to use that. If looking for more detailed differences in the use of each option, F5 should be able to shed light. We had many customers running successfully with original iRule, but a few SMEs requested shift, and this is first case where I have heard issues with this change.
... View more
Created by
Craig Hyps
in Security Documents
in Security Documents
02-21-2018
04:53 AM
02-21-2018
04:53 AM
We are testing a workaround that allows the use of Access-Reject. Will update once finalized. Correct. This notice was to confirm that the existing health monitor does NOT allow Access-Reject as a positive health indicator. As noted, there are measures to suppress "noise" associated with health monitor probes via Collection Filters and considerations for which account to use (internal/external) as well as access policy. For more details, please refer to Reference version of BRKSEC-3699 on ciscolive.com.
... View more
Public Statistics
| Date Registered | 05-07-2003 05:21 AM |
| Date Last Visited | 09-19-2018 08:15 PM |
| Total Messages Posted | 1,069 |
| Total Helpful Votes Received | 628 |
Helpful Votes From
