Having an issue with vpn load balancing certificate on the vip

Hi all,
I am setting up vpn load balancing in a lab. I have two asa's running 8.6. I created a ucc cert from our internal CA that has the vip as the CN in the cert and the two ASA's themselves as subject alternative names. I used open ssl to create the request. In each asa I am using encryption between the ASA's to encrypt the psk's. Since this is a lab and I do not have the DNS servers at my disposal I've added the hostnames and addresses of each ASA to the config in the ASA's. The problem I have is that when I connect to the vip I get a cert error saying the cert doesn't match the name on the site. See below:
"The security certificate presented by this website was issued for a different website's address."
I have a hostfile on my lab pc connected directly to the outside of the ASA that can resolve the name of the vip but when I browse to the vip I get the cert error. If I click proceed anyway the asa redirects me and the page opens without error on one of the two ASA's.
Does any one know what the CN of the cert should be for vpn load balancing. I thought the CN would be the vip but sometinhg is not right.
Any help is appreciated.
Thanks.

Issue resolved. Switched the order of the trustpoints on the outside and vpn load balance.

Similar Messages

I am having font issues with font book. It validates the font, yet it is not availabe in my software programs (Adobe or Microsoft). What can I do to use these fonts?

I am having font issues with font book. It validates the font, yet it is not availabe in my software programs (Adobe or Microsoft). What can I do to use these fonts?
I actually created these fonts with fontagrapher in 1998 and have been using them regularly ever since and now they are not available in InDesign. I really need to use them.

I found a page on Adobe, Troubleshoot fonts | Mac OS X
On PostScript type 1 fonts you need to copy/move the fonts to the correct font folder because Font Book doesn't copy them into the folder. Select the fonts double-click the fonts and Find in the font Book app and validate.
The correct font folder depends how you are set up. I am by myself so my font folder was MyHarddrive/Library/Fonts. I was using Suitcas fusion and the fonts are located in a different folder.
Most of the fonts have worked. Go to
http://helpx.adobe.com/x-productkb/global/troubleshoot-fonts-mac-os-x.html
This should help. Good Luck.

Having An Issue With Site Loading In Firebox

Hello,
I'm having a small issue that I could use some help with. I'm not really sure what is going on, but I'm having an issue with one of the pages from my site not loading when trying to view the page in Firefox. But if I load this page in Safari or Chrome, it loads just fine.
Here's the page URL to take a look: 
Specific link removed from display by moderator ~J99 <sitename>.com/top-10/top...services/

Any idea on why this could be happening or how to fix it? I'm not sure if it's just my computer, or if others are having the same issue.
Thanks in advance,
Mike

Hello Mike,
I have no problem loading and seeing the page <site>.com/top-10/...monitoring-services . General advice would be to try clearing cache and site cookies on the machine you are using.
*see [[Firefox can't load websites but other browsers can]]
I imagine you will have easy access to other machines on which you can test with Firefox so hopefully you will be able to test and demonstrate that the page does normally load on Firefox.
Website design is outside the scope of this forum, but you probably have a professional team working on that.
I did note from <sitenname>.com/disclosure/
<blockquote>Disclosure In regards to the new FTC regulations, we are making this page to be compliant with 100% transparency regarding disclosure of incentive and paid reviews. Every page on this site has been created to generate revenue. This site generates income through banner advertisements and affiliate links on product reviews.</blockquote>

Cache refresh issue with PI Load Balanced HA setup.

Dear Experts,
Wei have installed a HA Load Balanced PI Production Server with the below specifications. Its a four node cluster. Two nodes for Application Cluster and another two nodes for Database Cluster.
Node1
Physical Hostname : axsappci
Virtual Hostname : axsapp00
Instances         : CI,SCS and ASCS.
Node2
Physical Hostname : axsappdi
Virtual Hostname   : axsapp00
Instances          : Dialog instance installed with physical hostname axsappdi
Node3
Physical Hostname : axsappd1
Virtual Hostname   : axsappdb
Instances : DB Instance.
Node4
Physical Hostname : axsappd2
Virtual Hostname   : axsappdb
Instances : Standby DB Instance (passive).
Web Dispatcher Hostname : h2h
Application Switchover : CI,SCS and ASCS to switchover to Node2 and dialog instance Node2 forcing to go down
Database Switchover : DB Instance switchover to Node2 if Node1 fails.
We have changed all the parameters according to note 951910 -> NW2004s High Availability Usage Type PI
I am facing an issue with the cache Notifications in the Integration Repository and Directory. The cache notifications are not happening properly particularly with the ABAP Cache.
I get the below error in my ID when i try to do the manual cache notification.
Unable to notify integration runtime (ABAP) of data changes
Unable to establish http connection "http://h2h:8002/sap/xi/cache?sap-
client=001"
Kindly assist.
Thanks and Regards
Raghu.

Hi Srikanth,
Thanks for the reply.
I have configured my web disptacher to use default HTTP and HTTPS ports i.e 80 and 443. According to note 951910 i have changed parameters in exchange profile to use these ports.
Regards
Raghu.

Is anyone having an issue with saving Adobe Photoshop files to the server?

Unable to save Photoshop files to the server. Has anyone faced the same problem?

Two options. Doing either one worked.
1st option
In Photoshop preferences under File Handling set Preview to Never.
This has been working for me all day. Maybe a couple of times I got something about not being able to save because of not having access to the file, but then the save as dialog comes up and hitting okay saves the file.
Wasn't a big deal.
2nd option
Create a file (it didn't exist) in the /etc folder named nsmb.conf file, with the contents below.
[default]
streams=no
Here's where I got the info.
http://forums.adobe.com/message/4590780#
Currently I'm doing option one, as it only turns off a feature in Photoshop and doesn't reconfigure anything in the OS.
It's probably just a byproduct of an OS being updated (lots of things happening) and Apple will remedy it in 10.8.1. At least this works for now.

User is having a issues with accured vacation account on payroll.

user is having a issues with accured vac account on payroll. the account will not balance and they need some help
can you please guide me how to solve this issue. Its a P1 issue and I need to solve this by EOD.

User gave me the below inputs:
My accrued vacation pay hourly account# 23650200 is out of balance. On 2/11/2010 I transmitted $8765.68 in vacation pay but this account shows $15197.72 a difference of $6432.04. I can see a debit for $6432.04 made by RMARWAH on the same date, 2/11/2010. We think this transaction is part of the problem but we are not for sure.

ASA 5520 VPN load balancing with Active/Standby failover on 2 devices only...

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin-top:0in;
mso-para-margin-right:0in;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0in;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
This topic has been beat to death, but I did not see a real answer. Here is configuration:
1) 2 x ASA 5520, running 8.2
2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
This sounds trivial, but I cannot find a clear answer (without testing this); and many people are confusing the issue. Here are some examples of confusion. These do not apply to my scenario.
Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
In any case, any experts out there that can answer question? TIA!

Wow, some good info posted here (both questions and some answers). I'm in a similar situation with a couple of vpn load-balanced pairs... my goal was to get active-standby failover up and running in each pair- then I ran into this thread and saw the first post about the unique IP addr pools (and obviously we can't have unique pools in an active-standby failover rig where the complete config is replicated). So it would seem that these two features are indeed mutually exclusive. Real nice initial post to call this out.
Now I'm wondering if the ASA could actually handle a single addr pool in an active-standby fo rig- *if* the code supported the exchange of addr pool status between the fo members (so they each would know what addrs have been farmed out from this single pool)? Can I get some feedback from folks on this? If this is viable, then I suppose we could submit a feature request to Cisco... not that this would necessarily be supported anytime soon, but it might be worth a try. And I'm also assuming we might need a vip on the inside int as well (not just on the outside), to properly flip the traffic on both sides if the failover occurs (note we're not currently doing this).
Finally, if a member fails in a std load-balanced vpn pair (w/o fo disabled), the remaining member must take over traffic hitting the vip addr (full time)... can someone tell me how this works? And when this pair is working normally (with both members up), do the two systems coordinate who owns the vip at any time to load-balance the traffic? Is this basically how their load-balancing scheme works?
Anyway, pretty cool thread... would really appreciate it if folks could give some feedback on some of the above.
Thanks much,
Mike

On some sites we get sec_error_unknown_issuer SSL error due to missing root certificate TC TrustCenter Class 2 L1 CA XI. Firefox is the only browser having this issue. Why is that certificate not preinstalled and shipped with Firefox?

On some sites we get sec_error_unknown_issuer SSL error due to missing root certificate TC TrustCenter Class 2 L1 CA XI. Firefox is the only browser having this issue. Why is that certificate not preinstalled and shipped with Firefox?
Check sales.sauer-danfoss.com for details with Firefox 7.
Thanks
Stefan

You are not sending the TC TrustCenter Class 2 L1 CA XI intermediate certificate
*http://sales.sauer-danfoss.com/
Web servers need to send all required intermediate certificates to build the chain to build-in root certificates.
You need to install that intermediate certificate on your server.
*http://www.trustcenter.de/en/infocenter/root_certificates.htm#3479
You can test the certificate chain via a site like this:
*http://www.networking4all.com/en/support/tools/site+check/

HT1925 I am having an issue with loading Itunes. I receive a missing dll file notice. Then another error message. I have reinstalled Windows & still get the error. I did not get the error until I recently did an ITunes update.

I am having an issue with ITunes after a recent ITunes update. I can not open ITunes, I get a message missing MSVCR80.dll file, Then an error 7 message. I have redone the OS for Windows 7 and restarted the computer. I keep getting the errors.

Do the following:
Uninstall from Windows the following five programs: iTunes, Apple Software Update, Apple Mobile Device Support, Bonjour and Apple Application Support. You do this from an applet in Control Panel called Programs & Features (in Windows 8, 7, or Vista) or Add or Remove Programs (in Windows XP).
Download the latest version of iTunes from Apple and note the location you're saving it to so you can find it once it's done.
Run the iTunes installation as an administrator, just Right click iTunes installer and Run as Administrator.

ASA Vpn load balancing and failover

Hello all.
We have two asa5520 configured as primary and standby unit in failover configuration, and all is working properly.
Is it possible, with this configuration (failover), to configure vpn load balancing/clustering?
Thanks
Daniele

Hi Wajih,
I am testing this right now. In my case, I want A and B are failover pairs with A as the primary, (A+B) together as one member in cluster with other ASAs C and D. Here is what I found out:
1, After the active/standby working, configure the load banlancing in the master, the cluster IP worked.
2, after "no fail ac" in A, cluster IP stopped working. Seems the vpn load banlance configuration wasn't copied over to the standby B.
3, In the active (now it's the secondary B), manually configure vpn load banlancing, then the cluster IP worked.
4, "no fail ac" in the B and make the the primary A active, the cluster IP still worked.
5, after "no fail ac" in A, cluster IP stopped working. show vpn load and found out the load banlance was disabled.
6, "no fail ac" in the B and make the the primary A active, the cluster IP then worked.
Based on above, the secondary B's VPN load banlance will be disabled when B becomes active in failover role. If that's true, these two features can't work together. Or maybe there is some configuration I'm missing -- maybe having C or D as the cluster master will help. The ASAs are 5510 with 8.4(2)
Thanks,
Rick.

I am having an issue with my adobe acrobat 9 pro. Every time I try to open a pdf from someone it opens it up with my free adobe reader rather than the Acrobat 9 pro so then I don't have all of the functions of 9 pro. How do I get it to open with 9 pro ins

I am having an issue with my adobe acrobat 9 pro. Every time I try to open a pdf from someone it opens it up with my free adobe reader rather than the Acrobat 9 pro so then I don't have all of the functions of 9 pro. How do I get it to open with 9 pro instead of the free reader?

It may depend on the plugin that is loaded into your browser. However, right click on a PDF and select the Open With option and go to the default button to select Acrobat as the default. That might do it.

VPN load balancing and ASA !!!

Hi netpros,
I have a couple of questions about this and hope you might be able to assist me.
1.- Are VPN load balancing and failover (Active/Active) mutually exclusive ..? I mean they can't be used at the same time correct ..?
2.- How does the ASA handle the return traffic from the Internal LAN towards the remote client .. Because the cluster only requires ONE public virtual IP address, which will work for incoming packets .. but what about the return traffic which has knowledge of the DHCP scope's default gateway IP address only .. ? How gets the returned packet redirected from the default gateway IP address to the respective ASA internal IP address .?
3.- VPN load balancing only applies to remote clients using easy VPN technology (easy vpn client, hardware client , pIX using easy vpn client etc ) and does not work with static LAN-LAN tunnel .. correct ..?
Your comments are much appreciated

Hi Gilbert ..
1.- Thanks I wanted to make sure.
2.- I know that .. my question is in regards the return packets .. for example if I have the below IP schema:
ASA1: Public 20.20.20.20
Private 192.168.1.1
ASA2: Public 20.20.20.21
Private 192.168.1.2
Cluster virutal IP: 20.20.20.10
Default gateway for segment 192.168.1.0 is 192.168.1.1
Let's say that a vpn client tries to connect and the cluster instructs the client to connect to ASA2 20.20.20.21. The packets reach the internal server at 192.168.1.100. The internal server then sends the return packets back to the client by forwarding them to its default gateway which is 192.168.1.1 (ASA1). Here is my question .. how does the cluster handles this because the return packet are supposed to be directed to ASA2 192.168.1.2
3.- Any idea about this one ..?
Cheers,

Having major issues with Adobe Media Encoder (AME) - exporting with weird image flickering/colour anomalies, crashing regularly, freezing during encode...!

Hi Guys
I am having some real issues with Adobe Media Encoder (AME) at the moment. It appears that I am unable to encode an h.264 for Vimeo from a Premiere Pro Project file at the moment without at least some weird image issues that are not supposed to be there. These include weird flickering, colour changes, artefacts etc. This is if I am lucky...often I am unable to get the process to complete as the application either crashes and tells me there has been a problem or it simply freezes and I have to force quit the application and often restart my machine.
The problem seems to not to just be with h.264 for the web encodes but also with BluRay h.264 as well. As yet I haven't seen if there is a problem with MPEG-2 for DVD so I will check this out too!
Does anyone else see this happening or does anyone know what might be the problem?
I thought the Premiere Pro project might have been corrupt so tried a different project but the same issues were happening here too.
Any help would be really gratefully received.
Cheers
EDIT - I have just found this online which is exactly the problem I am having! Thanks a bloody bunch Apple! 10.9.3 causing headaches for Mac Pro users | MacIssues
Message was edited by: Alex Cameron

Agreed, I now have a project to GET OUT, and AME crashes consistently 1/3 into the render. It appears to halt all processing after (real time) 00:02:30
Am seriously considering uninstalling CC as I am beginning to find other issues in some apps, and going back to CS6/MC just so I can get work out. Durn it Adobe this is AWFUL!!
Alright, let's try to be constructive instead of throwing rocks... but the frustration level is high, and I have material on deadline. Let's get with this, guys...
What OS Win7, 64-bit
What version of AME/PPro (Please be specific by getting the full version number in the About Adobe Media Encoder screen) 8.2.0.54 Ppro: 8.2.0 (65)
When is it crashing (Again, the more detail here about where it was in the encoding process the better) roughly 1/3 into the sequence, always on exactly the same frame - tried replacing the clip with something different to see if it was a timeline error, and NO EFFECT.
What is your source (PPro project or media file (what kind?)) PPro
If the source if a PPro project, does it work when exporting directly from PPro? NO
What format are you exporting to? H.264, QT, WM, tried everything my client can play.
Do other formats work? MPEG2, QuickTime, etc? NO
Have you tried with GPU rendering on? How about turning it off by switching to Software-only mode? Mine doesn't have any choice, it's software-only.
Have you tried disabling Native Sequence Loading? (AME Preferences: General > Enable Native Sequence Loading) No effect
Other things I tried: uninstalling/reinstalling AME, setting cache to a fast local disk.

Ok, so I have a 1g macbook Pro and I'm having an issue with the graphics card, so I believe.

     I believe I'm having an issue with the graphics card. For one, when I'm using programs like iMovie '11, SPORE, or the Sims 3 for long periods (hours usualy) of time, the computer will be perfectly fine. It gets warmish-hot, like usuall, all of a sudden it will randomly freeze for 5 to 10 seconds, then shut down and reststart. This happens, espically on the Sims 3 I can play for a while, but when I try to save it will shut down on me.
     Also, I got a new iPod touch 4g on the 25th, the first few times I tried syncing and downloading, it started off fine, but after 10 min. it would restart. Now it works ok, but I still monitor it just incase.
     Can anyone help me understand why all of this is happening? I beleve the graphics card isn't good enough, even though it meets the standards for iLife, and The Sims 3. My graphics card is a ATI,RadeonX1600. The laptop has 2 GB RAM runs at 2.16GHz with an Intel Core Duo on OS X Snow Lepard (10.6.8). Thanks everyone.

Threads are just processes that link together like the threads in these discussions, well, maybe that is a bad example given how disjointed these get
It looks like you are not pushing the cpu or hard drive enough to cause your behavior. Not sure what the temperature limit on that cpu is, on the newer models it is around 100-110 °C which is notciabley hot, and the system shutsdown for self protection at the thermal limit.
You could be hitting a thermal limit causing that behavior...so do you see good behavior at lower load levela on the system? Does this only happen with when you are under the high graphic loads?
Trying to zero in on when this occurs to see if we an isolate the problem.

Is anyone else having an issue with performance in Mavericks?

My computer is brand new. Just bought it a week ago. Since I installed Mavericks, I have been having very big issues with performance. It now takes forever to start up, it loads programs extremely slowly, and it randomly freezes for a few minutes at a time. Is anyone else having these issues? I have already re-installed the OS. What else can I do?

Mavericks has certainly made up for all the problem-free updates I've had in the past! I have significant system drag (endless spinning beachballs....), Safari is incredibly slow, Mail - gmail & icloud - almost unusable. I'm desperately hoping the first OS update fixes things.

Having an issue with vpn load balancing certificate on the vip

Similar Messages

Maybe you are looking for