Hi All,   I need some help with configuring VPN.  The current VPN configuration works fine without any issues, however, we would like to route all traffic from SITE A to HQ via Site to Site VPN (including Internet traffic).  MY proposed configuration would be as below, please advise if this will be sufficient for me to route all traffic via the VPN tunnel or am I missing out something.    HQ: ==== Config t access-list ACL_TEST extended permit ip any object TEST_LAN     NAT: ===== object network TEST_LAN nat (outside,outside) dynamic interface    // This will access to Internet//   REMOTE: =======   Config t object-group network TEST_Network  network-object 172.20.67.0 255.255.255.128 network-object 172.20.68.0 255.255.255.0 network-object 172.20.67.248 255.255.255.248   object-group network HQ_Network network-object 0.0.0.0 0.0.0.0 ( I am not sure if this will work)   ACL for VPN traffic: ================ access-list VPN_TRAFFIC extended permit ip object TEST_Network  any   NAT: === nat (inside,outside) 1 source static TEST_Network  TEST_Network  destination HQ_Network HQ_Network   Please assist and thanks in advance for your assistance.    Regards,   Kanes.R   ... View more

Hi All,   I need your help, we have enabled TACACS+ on Cisco ASA version 9.6.1, however access is not working.  Upon further t-shoot I found that the authentication is successful but it is still failing over to the LOCAL database. I am not sure if it is due to the version or bug. I am using the exact same configs on several other ASAs but this is the first one with version 9.6.1. There is a SFR module on this unit but it should not cause any issue with firewall management.    Please assist if I am missing out on something:   configuration: //just enabled TACACS on SSH// aaa authentication http console LOCAL aaa authentication enable console LOCAL aaa authentication ssh console AuthInbound LOCAL aaa authorization command LOCAL aaa authorization exec LOCAL   aaa-server AuthInbound protocol tacacs+ aaa-server AuthInbound (Inside) host xxx.x.x.xx timeout 30 key *****   Debugs Logs:   Feb 13 2018 17:29:33: %ASA-6-113004: AAA user authentication Successful : server =  X.X.X.X : user = a***@*** Feb 13 2018 17:29:33: %ASA-4-409023: Attempting AAA Fallback method LOCAL for Authentication request for user a***@**c : Auth-server group LOCAL unreachable Feb 13 2018 17:29:33: %ASA-6-113005: AAA user authorization Rejected : reason = User was not found : server = 0.0.0.0 : user = a***@**c : user IP = X.X.X.X Feb 13 2018 17:29:33: %ASA-6-611102: User authentication failed: IP address:  X.X.X.X , Uname: ***** Feb 13 2018 17:29:33: %ASA-6-611102: User authentication failed: IP address:  X.X.X.X , Uname: ***** Feb 13 2018 17:29:33: %ASA-6-605004: Login denied from  X.X.X.X /46406 to Inside:192.168.12.3/ssh for user "*****" Feb 13 2018 17:29:33: %ASA-6-315011: SSH session from  X.X.X.X  on interface Inside for user "*****" disconnected by SSH server, reason: "Rejected by server" (0x0d) Thanks and Regards,   Kanes.R ... View more

Hi Team,   I need assistance as I am having issue accessing the CSPC (v2.7) portal via GUI.  The error I am getting is as following:   Your IP Address has been temporarily blocked as we are detecting malicious activity. Please try later.   Please also note that my root account is locked out at the moment and I am unable to login via CLI to the root account.  ... View more

Hi All, I am trying to understand on why the standby ASA does not have the OSPF traffic on its session table? When I do a show conn, the active firewall has the OSPF connection listed but not the standby ASA.  Is this an expected behavior.  Regards, Kanes.R ... View more

Hi Team, Good Day.  If I were to disable the captive bypass portal on the 3850, do i need to reboot the device for the command to take affect? I have performed the config on the 5500 series WLC and i had to reboot it for the command to take affect?  Would it be the same? Please assist.  Regards, Kanes.R ... View more