ASA - Identity Options

Hi
Does anyone know if Identity Options can be used with remote access VPN filters?
I am pulling users / groups down from AD and if I create a normal access list they are available for me to use.
However, if I configure a VPN filter they are not shown and therefore not available for me to use.
Kind Regards
Terry

Does this user richard exist under sulu? This ID is and admin ID?
Follow this link and configure every step as I mentioned and let us know if you run into any issues.
https://supportforums.cisco.com/docs/DOC-20366/
-Kurel

Similar Messages

My iPhone has two identical options under "iTunes wi-fi sync" that are the same computer. I only have one user on my computer, and I tried moving my iTunes file in Finder to organize it and now my library's not synced with my phone. Help?

My iPhone has two identical options under "iTunes wi-fi sync" that are the same computer. I only have one user on my computer, and I tried moving my iTunes file in Finder to organize it and now my library's not synced with my phone. Help?

I have the same problem. Right now my iPhone 5S shows 3 instances of the computer to which it is connected under Settings » General » iTunes WiFi Sync. I'm having problems connecting and syncing, and this is probably the cause: the phone chooses one of these connections, and it isn't the one that's actually in use. What's probably happening is that the phone and computer establish a connection using a dynamic IP address, the address becomes "disassociated" due to error, another address is associated, the phone retains each address/link, and each link is displayed as if it represents a separate computer (the fact that the name of the computer is identical is ignored, as the only thing that is considered important is the IP address). But that's all conjecture. More important, I'm not sure how to fix the problem. A network reset doesn't do it.

BB10 10.2.1 - Enterprise WIFI - Outer Identity Option missing?

Hi,
just got myself a Blackberry Q5 and i love the System.
I have one huge Problem tho, i cant connect to my works wlan with my new device.
My guess its because i cant specify the outer identity/roaming identy/anonymous identity in the wlan configuration.
This is the network configuration:
Security: 802.1x EAP
EAP-Method: TTLS
Phase 2-Authentification: PAP
Besides that i need a special certificate which was allready in place my login/password and also the "outer identity": [email protected]
Well the last thing is the problem, there is no way to specify this in the bb10 system. it worked on my playbook before so i really wonder why this was removed.
My IT Team told me its not possible to connect without this option, and yes i tried for over an hour. this option is available on android for example and it works fine.
Maybe im just missing it but if not please take this into consideration for a next update. i cant be the only one which needs this really badly.
Thanks
Greetings,
Nils

Wow first reply after all these month
The timing is funny tho.
It wasnt the missing outer identy that blocked my connection back then and i could get it working.
But 2 days ago the network it changed wifi config and now the correct outer identy is mandatory for connection.
Well as you may guess i cant connect since then to my works wifi.
Because of this a installed the latest 10.3.1 leak on my q5 to see if it was added but sadly still no way to specify outer identity. this is really annoying because i dont have a good signal at work.
This is a real bummer... i really hope this will be fixed soon or i have to see if i have to replace my phone.
having no wifi/internet on my phone 2/3 of the week is not a option
but as you may guess, there wasnt much interest in this mayor problem.....

ASA Identity Firewall

Hi,
I have setup an Identity Firewall on a ASA version 5.6 on a DMZ interface.
I have installed the ADAgent on a domain member Win2008 and configured as follows:
aaa-server ADAGENT_SERVER protocol radius
ad-agent-mode
aaa-server ADAGENT_SERVER (VPN) host 172.17.v.x key *****
I have configured the LDAP connection to the DC as follows:
aaa-server DOMAIN_SERVER protocol ldap
aaa-server DOMAIN_SERVER (VPN) host 172.17.v.z
ldap-base-dn DC=YYY,DC=local
ldap-scope subtree
ldap-login-password *****
ldap-login-dn vvvvv
server-type microsoft
The identity config is as follows:
user-identity domain YYY aaa-server DOMAIN_SERVER
user-identity default-domain YYY
user-identity action netbios-response-fail remove-user-ip
user-identity logout-probe netbios local-system
user-identity ad-agent aaa-server ADAGENT_SERVER
user-identity user-not-found enable
access-list 122 extended permit ip user YYY\ashdew any any
where ashdew is a domain user and ACL 122(only one line) is applied on the dmz interface and NAT is properly configured.
The ADagent has been properly tested and ASA can register to it.
The ASA can connect to AD DC controller and query user database.
I have placed a laptop ip 172.17.h.x on the DMZ and can ping the DMZ interface.
The laptop cannot authenticate on the domain and the asa does not seem to retrieve the user identity
Do I need to add extra rules in the access-list 122 to permit trafic to DC?
Can I check on the AD Agent if it can retrieve the user to ip mapping ?
Thanks
Ashley

Thanks Karsten,
Great its clear now. I know the DMZ seems a bit odd. Actually, the DMZ is only accessible through the any-connect VPN.
In the DMZ, we will have a citrix farm to access internal resources through identity management.
We are testing with a laptop in the first place.
Now, we have allowed in the acl to access AD, the laptop authenticates in the domain but then all connections are refused since the AD Agent is not retrieving the mapping.
Is there a way to check if the ADAgent is properly retrieved the mapping. We suspect the problem is here.
We did a capture on the ASA and we have found that the ASA contact the ADAgent when the user authenticates but then ADAgent does not return any ip mapping. The ASA sees the user as ip as user-not -found .
Thanks again for your help,
Ashley

ASA QoS options

I was looking at this article regarding QoS implementation on the ASA through VPN tunnels
https://supportforums.cisco.com/docs/DOC-1230
I though that you could either do a traffic policing policy, OR a traffic shaping policy on one interface (or for one tunnel).
The author seems to suggest we can do both.
Can we? Will there be a conflict?

Hi Colin,
No, we can't. Also in the doc Panos mentioned this while defining shaping:
Traffic Shaping with Prioritization
Now, lets assume that we have the same ASA as in the previous case. And we now want to traffic shape all traffic and prioritize the voice through the VPN.
Check out the service-policies he applied:
In case of policing:
ASA(config-pmap-c)# service-policy police-priority-policy interface outside
In case of shaping:
ASA(config-pmap-c)# service-policy shape-priority-policy interface outside
For further clarity, check this section on configuration guide which explains how various QOS features interact:
http://www.cisco.com/en/US/customer/docs/security/asa/asa84/configuration/guide/conns_qos.html#wp1234418
As per above link:
Typically, if you enable traffic shaping, you do not also enable policing for the same traffic, although the ASA does not restrict you from configuring this.
Because it won't make much of a sense anyways.
HTH.
Sourav

How can i add new identity in file option of menu bar

''locking as a duplicate - https://support.mozilla.com/en-US/questions/869755''
how can i add new identity option in file option of menu bar

There are, but not with a DVD written as a movie disk. It must be closed when completed, or it doesn't work.
Apple's built in Burn utility also automatically closes any data CD, DVD or Blu-ray disk you burn. Doesn't matter how much space is unused, you can't use it. You'd have to use a more advanced disk creation app, such as Toast Titanium. I then have the option of choosing to write the data as a session:
I can keep doing this until the disk is full. If I've written five sessions to the disk, when I put it in the drive, five CD/DVD icons will appear on the desktop since the OS will treat each session as if they are separate physical disks. At any point you choose Write Disk when writing a group of data, that means you're closing the disk, and again can't add anything after that. So if I had written two sessions, and the third was Write Disk, it's over. I can't put anything else on that disk.

Is there any way to activate the keep identity setting when using a Transfer SQL Server Object Task?

Is there any way to add the "Keep Identity" option to the tables selected for transfer in a Transfer SQL Server Object Task? It seems that would be very useful, yet I can't find an easily available setting for it. I would prefer to
accomplish this within the Transfer SQL Server Object Task since it can copy any new fields added to the source tables, as opposed to having to rebuild a custom Data Flow Task any time a table structure is altered. I thought setting "CopyPrimaryKeys"
to True would do the trick, but I found that only ensures that the column settings are transferred; when the transfer happens, the destination id column is populated based on the specified seed and increment value, not what's actually in the source table.
I'd like to point out that replication isn't really an option here. This is a package that runs a few times a day to keep some data on our website up to date with data in our protected corporate environment.

IIRW there is FastLoadKeepIdentity specifies
whether to keep an identity in OLEDB destination
Best Regards,Uri Dimant SQL Server MVP,
http://sqlblog.com/blogs/uri_dimant/
MS SQL optimization: MS SQL Development and Optimization
MS SQL Consulting:
Large scale of database and data cleansing
Remote DBA Services:
Improves MS SQL Database Performance
SQL Server Integration Services:
Business Intelligence

Identity firewall with OpenLDAP ?!

Hi Guys
I am interested to use identity firewall but I am using OpenLDAP , as far as I know there is no OpenLDAP agent like AD Agent!
Does it mean that I only able to use OpenLDAP for VPN authentication and not for identity feature ?
Thanks
Ehsan

Probably the answer is Yes I guess , ASA identity feature works only with Microsoft Active Directory !!!!

ASA DHCP Request incorrect hostname length

I have an ASA 5505 with software version 8.2(1). It is making DHCP requests for IPSec clients that connect to the ASA. The DHCP requests packets the ASA makes have an extra '00' appended to the hostname field, and the length field is the size of the hostname + 1.
The DHCP server is Microsoft Server 2003 and this causes the hostname to be registered with an unknown character which appears as []hostname. Then when server 2003 tries to update the DNS record, it fails because of the invalid character in the hostname.
Is there anyway to have the ASA have the correct length for the hostname field in the DHCP packet, or a workaround that will solve this problem?

I am thinking it may not be option 12 in the DHCP packet, but option 81. I have included a portion of the DHCP request from the ASA below:
   Option: (t=53,l=1) DHCP Message Type = DHCP Request
        Option: (53) DHCP Message Type
        Length: 1
        Value: 03
    Option: (t=57,l=2) Maximum DHCP Message Size = 1152
        Option: (57) Maximum DHCP Message Size
        Length: 2
        Value: 0480
    Option: (t=61,l=42) Client identifier
        Option: (61) Client identifier
        Length: 42
        Value: 00636973636F2D303032312E353537352E636131372D6D79...
    Option: (t=54,l=4) Server Identifier = 192.168.8.3
        Option: (54) Server Identifier
        Length: 4
        Value: C0A80803
    Option: (t=50,l=4) Requested IP Address = 192.168.8.105
        Option: (50) Requested IP Address
        Length: 4
        Value: C0A80869
    Option: (t=12,l=11) Host Name = "myhostname"
        Option: (12) Host Name
        Length: 11
        Value: 6D79686F73746E616D6500
    Option: (t=51,l=4) IP Address Lease Time = 8 days
        Option: (51) IP Address Lease Time
        Length: 4
        Value: 000A8C00
    Option: (t=55,l=6) Parameter Request List
        Option: (55) Parameter Request List
        Length: 6
        Value: 01060F2C0321
        1 = Subnet Mask
        6 = Domain Name Server
        15 = Domain Name
        44 = NetBIOS over TCP/IP Name Server
        3 = Router
        33 = Static Route
    Option: (t=81,l=14) Client Fully Qualified Domain Name
        Option: (81) Client Fully Qualified Domain Name
        Length: 14
        Value: 0400000A6D79686F73746E616D65
        Flags: 0x04
        0000 .... = Reserved flags: 0x00
        .... 0... = Server DDNS: Some server updates
        .... .1.. = Encoding: Binary encoding
        .... ..0. = Server overrides: No override
        .... ...0 = Server: Client
        A-RR result: 0
        PTR-RR result: 0
        Client name: 0A6D79686F73746E616D65
    End Option
    Padding
Notice in option 81 the Client Name has a leading binary value of 0A (which is a new line): 0A6D79686F73746E616D65.
Does CSCsz07757 relate to that? Is there a way to have the ASA not include option 81 as part of the DHCP requests it makes?
Thank you.

What ASA objects does PRSM import - monitor mode?

Hello! I need a little clarification, as I believe published documentation is ambiguous. When PRSM performs ASA device discovery, i.e., imports an ASA with NGFW SSP device under monitor mode only, what objects are imported? Documentation (PRSM User Guide, page 84) indicates "The following objects will be imported: network, network object group, service, service object group, time range, and ASA identity user group object". It is unclear if these objects are imported under monitor mode or managed mode.
Thanks very large,
David D.

Hi all, this post can be officially closed. The issue had nothing to do with the ASA but required a firmware upgrade on the WAN router which boosted the throughput on the external interface on the ASA to 10Mbps and the inside throughput naturally corrected itself to what was expected.
Thanks to everybody who looked at this issue.
Andrew

Cisco anyconnect 3.1 - Certificate Validation Failure.

When i try to start a SSL VPN connection to the ASA(8.4) with anyconnect 3.1, Cisco anyconnect receives a message saying "No Valid Certificates Available for Authentication".
Prior to the test;
     On the ASA, i have obtain CA certificate and its identity certificate. (Both certificates obtain from windows 2008 CA).
          * ASA identity certificate's have EKU attribute = Server Authentication,   Key Usage = Digital Signature, Key Encipherment.
     On the PC in which anyconnect installed, i have obtain User Certificate (this User certificate also obtain from the same windows 2008 CA)
          * Prior to obtaining User certificate from the windows2008 CA, ASA acts as a SCEP proxy onbehalf of the client PC.
          * User Certificate's has EKU attribute = Client Authentication.
As in the ASDM Logs, it almost work.
In days of troubleshooting, i still could not find the cause of this problem. Error message as appeared on anyconnect;
Is there anyone could help.???
Keshara from Sri Lanka.

Just run into this as well. We have CRL checking turned on. Turned out to be the CRL server was down. But that was the same message I got when the client wouldn't connect.

Accessing websites running on non-standard ports or with self-signed ssl certs?

I've got some sites running using self-signed ssl's that also run on non-standard ports. Firefox home doesn't seem to open these pages it just sits there with the spinner loading and a blank screen...
Anyone else noticed this?

If the ASA is using a certificate issued by a CA that is in the client's trusted root CA store, then the ASA identity certificate does not need to be imported by the client.
That's why it's generally recommend to go the route of using a well-know public CA as they are alreay included in most modern browsers and thus the client doesn't need to know how to import certificates etc.
If you are using a local CA that is not in the client's trusted root CA store to issue your ASA identity certificate or self-signing certificates on the ASA then you need to take additional steps at the client.
In the first case, you would import the root CA certificate in the trusted root CA store of the client. After that, any certificates it has issued (i.e the ASA's identity certificate) would automatically be trusted by the client.
In the second case, the ASA's identity certificate itself would have be installed on the client since it (the ASA) is essentially acting as it's own root CA. I usually install them in my client's Trusted Root CA store but I guess that's technically not required, as long as the client knows to trust that certificate.

Exporting direct from FCP vs. sending to Compressor?

I've done both, but the choice ends up being a coin toss. So I'm curious if there's any accepted wisdom as to the Pros & Cons of each workflow (using the current versions of each app, and in a hypothetical All Things Being Equal scenario)?
In other words, if you were to create the exact same "Master File" from a given FCP Project using each route (in terms of the finished file's dimensions, frame rate, etc), and you selected the exact same codec/quality options to create that file (assuming the identical options exist to be chosen), would there still potentially be any significant difference between the two files? Either in terms of file size, length of time it takes for the file to be created, or any appreciable difference in image quality (despite the theoretically identical file settings)?
Because a difference in any one of those three categories might be enough to tip the scales towards using one workflow vs. the other, depending on the priorities in a given situation.
(And for the sake of this comparison, I'm leaving aside the issue of which app could still be used for other tasks while the export is in progress. Let's just assume for the sake of argument that in both cases the machine would not be being used for ANY other work during each of the exports.)
Any theories? Real-world experiences? Or has some 3rd-party test site already attempted this kind of direct comparison (using the latest versions of FCP-X and Compressor 4.x)?
Thanks,
John B
Toronto

Without considering every possibility, here are a couple of general thoughts.
Given the same Compressor preset there should be no quality difference between the output from a master fie to Compressor and sending it from the timeline to Compressor. There are speed differences and exporting from FCP X is the fastest workflow. Lately, I've found second fastest to be Send to Compressor. But the inferences differences aren't great.
Most of this depends on one's workflow preferences. The most lengthy workflow is to first export a master file and then bring that into Compressor;. Funnily enough, that is how I work because I want to have an iFrame master file that I can compress for different purposes over time.
One user recently posted that he used Send-to-Compresssor because it gave him the opportunity to pause the processes without losing his work.
In the past (particularly with legacy FCP) the Send-to-Comnpressor workflow was something I avoided. It was slow and unreliable. 10.0.x to 4.0.x was faster but troubled in other ways. The latest versions, however, seem to get it done efficiently.
Final thought: if you do your own tests, check o ensure you have similar amounts of free memory. Otherwise, it's not a "fair fight"/
Russ
edit: override the auto complete

Hide "my number" doesn't work

I got a new 8900 replacement (under warranty) and I know this worked on my old phone but somehow it's not working on this new one.
Inside the Call log, menu >> options>>general options>>
Show "My Number " = NO
But my number still shows up whenever i'm making a phone call.
I tried turn off and on. Battery pull too. Double checked after battery pull, and it is "NO"...
Help?
Thanks.

the show my number option is whether you want to see your number on the call screen, when you dial a number it shows your number, that's all that does. I'm not 100% sure how to hide your number but it might be the "restrict my identity" option on the same menu

No sound when playing imported files...

Hey all. Super noob with garage band, but searched around and couldnt find the answers.
After opening the audio files, and dragging in a song, we hit "PLAY" button and can see the track progressing, but hear no sound. What are we doing wrong?
Thanks.

No waverform that I can see, if you mean some visual measure of sound. I do not think the track is muted, the volume is turned up both on the track bar as well as the main time measure bar. As far as output, just fooling around I opened up Preferences and for audio output it had identical options, one on top of the other. They were both titled Built-in Output, so I switched to to other, and no luck.
If I select the Garage Band samples, they will play though.

ASA - Identity Options

Similar Messages

Maybe you are looking for