Picking at an old topic here. We have a PRTG installation for monitoring, but It can't handle all IPSec via SNMP.   How do you monitor IPSec connections on ASA, and alert on them? Tools, scripts, anything...   Best regards,   Michael ... View more

Just a quick question regarding Umbrella Application blocking, is to how its works? We did some testing with VPN clients, and when we enforced anonymizer block via Umbrella, the VPN disconnected within a minute.   /Michael ... View more

Hi I recently started to receive this auth prompt in asdm for comodo ocsp url? I changed the anyconnect certificate about 2 weeks ago, and this is the third time I've gotten the prompt. Any help?   Br, Michael ... View more

A developer raised a ticket that he were unable to update packages from files.pythonhosted.org and several other related sites.   Doing some troubleshooting, the user were able to connect to the site, from outside the corp network. We checked ASA for denies, FirePower for blocks and Umbrella for blocked DNS entries. Umbrella did not have a block for https://files.pythonhosted.org, and we were able to browse for the site. But packages did still fail.   Output from the update tool threw an error about "..unable to validate certificate..", so I checked that the client were able to connect to all AIA's in the certificate chain. Some AIA pointers failed, but the entire chain were vaild. But just to make sure I reconfigured the DNS to Google, and the update tool worked!   Back to Umbrella, no blocks for files.pythonhosted.org, but added the sites and the others to the global allow list and then it all worked.   The only thing that struck me, was that files.pythonhosted.org's certificate were issued by Umbrella!   Did I miss some configuration in Umbrella?  ... View more

Hi   I have a case were a user has reported poor performance over remote access VPN, using AnyConnect. The users has a 300/300 fiber provide at home, plenty of bandwidth and low latency. During file transfers over VPN the performance have degraded 2/3, to around ~90 mbps, which the users thinks is fairly unreasonable!   Things that I have considered:   1) Fragmentation - tunnel MTU is 1406, ping test maxes-out at 1379, leaving 1378 the optimal value. Validated with wireshark, using ip.flag.mf == 1, came out empty   2) Latency - about 10 - 15ms, so ruling out bandwidth delay product   3) Look at firewall specs - ASA 5525X has 300 mbps 3DES/AES throughput. how should this number be interpreted???   4) Firepower - how much performance is lost due to firepower operations?   5) Users - Current connected users is 43, most seen 82. How is resources allocated between them, thinking that this must affected crypto performance?    Br, Michael ... View more

Hi guys,   We are using Aastra IP phones, that does't support LLDP og CDP. The phones connect to a user subnet for FTP download for the config. After the config is installed, the phone puts voice traffic in VLAN 40.   How can I make a MAB policy that, allows the phone onto the user VLAN for config, and afterwards ISE makes a CoA, and puts the phone onto VLAN 40. If I put the phone directly in VLAN 40 via the AuthZ policy, it doesn't get an IP address, since the traffic should be tagged to VLAN 40.   My 802.1x deployment is stuck, until I find a workaround!   Br, Michael   ... View more