CSM ip address is blocked by the FWSM

Hello,
I have csm 3.3.1 sp3 and fwsm 4.0(4), to monitor the fwsm i am using the device manager from the csm.
The problem is that when asdm opens from csm it works for few seconds and csm losses connection to the fwsm.
I checked the logs on the fwsm and i found that it denied the ip of csm on the inside interface of the fwsm with port 443.
Off course i have enabled http server and allowed the ip of the csm to access the fwsm "http 10.139.2.253 255.255.255.255 inside"
i tried to open the asdm from my own workstation and it worked fine without any problem.
i also have ASA 8.2.1 which i monitor by csm without any problems.
Any idea how to fix this issue? Why the FWSM is blocking the ip of CSM where it should not?
Thank you and Regards,

Hello,
Has any body faced this problem before?
When opening asdm for FWSM by the CSM client causes problem, where the asdm loose the connection after a while
But when i open asdm directly and not bt csm client, it works fine.
Regards,

Similar Messages

The recommended number of IP addresses to block, which can be added to one rule Windows Firewall

Good afternoon.
Interested in the question, I need to create
a rule to deny access the server with the
specified IP address. List of large
- about 50 thousand. So
how can I add an IP rule blocking
connections from IP addresses. If they
will be in Rule 10000 does not
affect whether it is the speed of the
server and of the whole will be
any changes in your work?
The bottom line is that I have added
10,000 IP rule. Through the
API Windows Firewall, I realized that the maximum number
of IP addresses that I can add is equal
10000 (10001 already swears "array bounds are invalid").
Rule added - these IP-addresses
are blocked. The question is - Will the
fact that the rule as many IP
addresses on the server rate.
Is it possible to set this rule remotely on
multiple servers?

Hi,
I can't find any document about this limitation.
But it is not recommended to add so many rules in Windows Firewall. It will be resource intensive.
Could you use the wildcard? It can reduce the number of the rules.
Best Regards.
Steven Lee
TechNet Community Support

The document Address doesn't show the block when country isn't USA

hello
i have a little problem, when I create a new document for a customer which ship to address's country is different from USA, the document Address doesn't show the block. i checked the bp address in the bp master data and the block is written, also when i click on the ... button near the ship or bill to address the block has a value !! but when i go back to the document, there is an empty space where the block has to be in the document address.
is there any configuration to solve this problem
thanks a lot!

Hi,
The configuration is under Admin-Setup-BP-Address Format. Each country has a built-in format for address initially.
Thanks,
Gordon

How to block IP addresses or IP blocks through the 5505 ASDM interface, not through command lines?

Is it possible to block IP addresses or IP blocks through the 5505 ASDM interface, and not through command lines? If so, how?

Unfortunately I can't share any information on the router. It's company policy. But, if you could let me know where in the GUI interface of the router where I can find the ACL and how to enter the IPs to block I would really appreciate it.

Dynamic Calc processor cannot lock more than [100] ESM blocks during the calculation, please increase CalcLockBlock setting and then retry(a small data cache setting could also cause this problem, please check the data cache size setting).

Hi,
Our Environment is Essbase 11.1.2.2 and working on Essbase EAS and Shared Services components.One of our user tried to run the Cal Script of one Application and faced this error.
Dynamic Calc processor cannot lock more than [100] ESM blocks during the calculation, please increase CalcLockBlock setting and then retry(a small data cache setting could also cause this problem, please check the data cache size setting).
I have done some Google and found that we need to add something in Essbase.cfg file like below.
1012704 Dynamic Calc processor cannot lock more than number ESM blocks during the calculation, please increase CalcLockBlock setting and then retry (a small data cache setting could also cause this problem, please check the data cache size setting).
Possible Problems
Analytic Services could not lock enough blocks to perform the calculation.
Possible Solutions
Increase the number of blocks that Analytic Services can allocate for a calculation:
Set the maximum number of blocks that Analytic Services can allocate to at least 500.
If you do not have an $ARBORPATH/bin/essbase.cfg file on the server computer, create one using a text editor.
In the essbase.cfg file on the server computer, set CALCLOCKBLOCKHIGH to 500.
Stop and restart Analytic Server.
Add the SET LOCKBLOCK HIGH command to the beginning of the calculation script.
Set the data cache large enough to hold all the blocks specified in the CALCLOCKBLOCKHIGH setting.
Determine the block size.
Set the data catche size.
Actually in our Server Config file(essbase.cfg) we dont have below data added.
CalcLockBlockHigh 2000
CalcLockBlockDefault 200
CalcLockBlocklow 50
So my doubt is if we edit the Essbase.cfg file and add the above settings and restart the services will it work? and if so why should we change the Server config file if the problem is with one application Cal Script. Please guide me how to proceed.
Regards,
Naveen

Your calculation needs to hold more blocks in memory than your current set up allows.
From the docs (quoting so I don't have to write it, not to be a smarta***:
CALCLOCKBLOCK specifies the number of blocks that can be fixed at each level of the SET LOCKBLOCK HIGH | DEFAULT | LOW calculation script command.
When a block is calculated, Essbase fixes (gets addressability to) the block along with the blocks containing its children. Essbase calculates the block and then releases it along with the blocks containing its children. By default, Essbase allows up to 100 blocks to be fixed concurrently when calculating a block. This is sufficient for most database calculations. However, you may want to set a number higher than 100 if you are consolidating very large numbers of children in a formula calculation. This ensures that Essbase can fix all the required blocks when calculating a data block and that performance will not be impaired.
Example
If the essbase.cfg file contains the following settings:
CALCLOCKBLOCKHIGH 500 CALCLOCKBLOCKDEFAULT 200 CALCLOCKBLOCKLOW 50
then you can use the following SET LOCKBLOCK setting commands in a calculation script:
SET LOCKBLOCK HIGH;
means that Essbase can fix up to 500 data blocks when calculating one block.
Support doc is saying to change your config file so those settings can be made available for any calc script to use.
On a side note, if this was working previously and now isn't then it is worth investigating if this is simply due to standard growth or a recent change that has made an unexpected significant impact.

When I open firefox I get this message; The address isn't valid The URL is not valid and cannot be loaded.

I get this message whenever I open firefox or a new tab. Anything I had tabbed to the top has gone, and the original homepage which shows all my recent visits is invalid. The full message is:
The address isn't valid
The URL is not valid and cannot be loaded.
Web addresses are usually written like http://www.example.com/
Make sure that you're using forward slashes (i.e. /).
Try Again.
Help mee!!!

Hi fredmcd-hotmail
It's not that I'm typing anything in wrong, it's when I first open Firefox or a new tab. Instead of displaying the firefox page showing my recently viewed websites it's just an invalid URL. Why would I be blocked from this page?
Thanks

How do you create/add additional LAN IP blocks to the Westell A90-9100?

I have a Linksys at home and the double NAT is killing me. I'd prefer to add another IP block to the ethernet interface of the Westell, but it is not as cut and dry as the Linksys router I have. Is there a way to do this, or am I stuck with the typical port-forwarding configs? The devices I seem to have minor issues with are the media hub and the UMI telepresence. They are functional, but some of the features are not working. If there was only one device setup for NAT while routing IP addresses to the linksys that would work for me.
Westell = 192.168.1.1
Linksys E4200 = WAN: 192.168.1.254 and LAN 192.168.11.1 (NAT Enabled)
I'd like to add a static route from the Westell to the Linksys and remove the NAT on the Linksys, but when I did so, all traffic was blocked at the Westell. I tried RIP, but that did nothing for me.
I'd prefer not to convert the E4200 into a switch due to the extra features on it like the USB port for an external drive.
Any suggestions?
Thanks

I agree with the last suggestion. There's no need to have port forwarding rules in both the westell and linksys . So kill your port forwarding rules you made for.the linksys in the westell , assign the linksys a static ip and then dump it in the dmz. Then let the linksys handle all the port forwarding and additional ip blocks or VLANS

All Emails Sent to Verizon Email Addresses Are Blocked - Please Help

Hello,
Email messages that our company sends to Verizon recipients are being blocked by the anti-spam system. I have copied a sample failure message below. I have submitted whitelist requests several times, but get automated messages in return saying the IP is dynamically assigned (see below). Our IP address is static, not dynamically assigned. No spam is going out from the system, and we are not on any of the blacklists. Our emails to [email protected] and [email protected] are also being blocked, so I have found nowhere else to turn for assistance.
Can you please help or assign an agent to help us in this matter? We have many customers who are not receiving their online purchases or responses to their requests for assistance from us because Verizon is blocking all emails to them from our servers. We certainly don't want to have to post to our online store that we cannot sell to or assist anyone with a Verizon email address.
The mail server in question is: *******
IP address: ******
Your help would be greatly appreciated.
Thank you,
TraciG
MailEnable: Message Delivery Failure.
Reason: ME-E0193: [629A7226243B4A9D90F818B13EEF69C2.MAI] Message Delivery Failure.
Your message addressed to the target domain (verizon.net) could not be delivered because the mail server responsible for this domain returned a permanent error.
The server returned:
571 Email from ****** is currently blocked by Verizon Online's anti-spam system. The email sender or Email Service Provider may visit http://www.verizon.net/whitelist and request removal of the block. 141223
After investigation, Verizon Online Security has determined that e-mail from your IP address will not be allowed access to the Verizon Online e-mail domain due to one or more of the following reasons:
Your IP has been blocked because of spam issues or because your ISP indicates that it is dynamically assigned
Once you have addressed any security-related issues on your network, you should contact Verizon Online Security via this form. At that time, we will work with you to restore normal e-mail traffic or to take other action as we deem appropriate.
Sincerely,
Verizon Online Security
http://www2.verizon.net/policies
[email protected]
Solved!
Go to Solution.

Hi TraciG,
Your issue has been escalated to a Verizon agent. Before the agent can begin assisting you, they will need to collect further information from you. Please go to your profile page for the forum and look at the top of the middle column where you will find an area titled "My Support Cases". You can reach your profile page by clicking on your name beside your post, or at the top left of this page underneath the title of the board.
Under "My Support Cases" you will find a link to the private board where you and the agent may exchange information. The title of your post is the link. This should be checked on a frequent basis, as the agent may be waiting for information from you before they can proceed with any actions. To ensure you know when they have responded to you, at the top of your support case there is a drop down menu for support case options. Open that and choose "subscribe". Please keep all correspondence regarding your issue in the private support portal.

Get blocker from the (self) deadlock trace file

Hi,
Recently I had an issue on a 10.2.0.4 single instance database where deadlocks were occurring. The following test case reproduces the problem (I create three parent tables, one child table with indexed foreign keys to all three parent tables and a procedure which performs an insert into the child table in an autonomous transaction):
create table parent_1(id number primary key);
create table parent_2(id number primary key);
create table parent_3(id number primary key);
create table child( id_c number primary key,
                   id_p1 number,
                   id_p2 number,
                   id_p3 number,
                   constraint fk_id_p1 foreign key (id_p1) references parent_1(id),
                   constraint fk_id_p2 foreign key (id_p2) references parent_2(id),
                   constraint fk_id_p3 foreign key (id_p3) references parent_3(id)
create index i_id_p1 on child(id_p1);
create index i_id_p2 on child(id_p2);
create index i_id_p3 on child(id_p3);
create or replace procedure insert_into_child as
pragma autonomous_transaction;
begin
insert into child(id_c, id_p1, id_p2, id_p3) values(1,1,1,1);
commit;
end;
insert into parent_1 values(1);
insert into parent_2 values(1);
commit;And now the action that causes the deadlock:
SQL> insert into parent_3 values(1);
1 row created.
SQL> exec insert_into_child;
BEGIN insert_into_child; END;
ERROR at line 1:
ORA-00060: deadlock detected while waiting for resource
ORA-06512: at "SCOTT.INSERT_INTO_CHILD", line 4
ORA-06512: at line 1My question is: how can I determine which table the insert into CHILD was waiting on? It could be waiting on PARENT_1, PARENT_2, PARENT_3, a combination of them or even on CHILD if I tried to insert a duplicate primary key in CHILD. Since we have the full testcase we know that it was waiting on PARENT_3 (or better said, it was waiting for the "parent" transaction to perform a commit/rollback), but is it possible to determine that solely from the deadlock trace file? I'm asking that because to pinpoint the problem I had to perform redo log mining, pl/sql tracing with DBMS_TRACE and manual debugging on a clone of the production database which was restored to a SCN just before the deadlock occurred. So, I had to do quite a lot of work to get to the blocker table and if this information is already in the deadlock trace file, it would have saved me a lot of time.
Below is the deadlock trace file. From the "DML LOCK" part I guess that the child table (tab=227042) holds a mode 3 lock (SX), all the other three parent tables have mode 2 locks (SS), but from this extract I can't see that parent_3 (tab=227040) is blocking the insert into child:
Deadlock graph:
                       ---------Blocker(s)-------- ---------Waiter(s)---------
Resource Name          process session holds waits process session holds waits
TX-00070029-00749150        23     476     X             23     476           S
session 476: DID 0001-0017-00000003     session 476: DID 0001-0017-00000003
Rows waited on:
Session 476: obj - rowid = 000376E2 - AAA3biAAEAAA4BwAAA
(dictionary objn - 227042, file - 4, block - 229488, slot - 0)
Information on the OTHER waiting sessions:
End of information on OTHER waiting sessions.
Current SQL statement for this session:
INSERT INTO CHILD(ID_C, ID_P1, ID_P2, ID_P3) VALUES(1,1,1,1)
----- PL/SQL Call Stack -----
object      line object
handle    number name
3989eef50         4 procedure SCOTT.INSERT_INTO_CHILD
391f3d870         1 anonymous block
        SO: 397691978, type: 36, owner: 39686af98, flag: INIT/-/-/0x00
        DML LOCK: tab=227042 flg=11 chi=0
                  his[0]: mod=3 spn=35288
        (enqueue) TM-000376E2-00000000 DID: 0001-0017-00000003
        lv: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 res_flag: 0x6
        res: 0x398341fe8, mode: SX, lock_flag: 0x0
        own: 0x3980df420, sess: 0x3980df420, proc: 0x39859c660, prv: 0x398341ff8
        SO: 397691878, type: 36, owner: 39686af98, flag: INIT/-/-/0x00
        DML LOCK: tab=227040 flg=11 chi=0
                  his[0]: mod=2 spn=35288
        (enqueue) TM-000376E0-00000000 DID: 0001-0017-00000003
        lv: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 res_flag: 0x6
        res: 0x3983386e8, mode: SS, lock_flag: 0x0
        own: 0x3980df420, sess: 0x3980df420, proc: 0x39859c660, prv: 0x3983386f8
        SO: 397691778, type: 36, owner: 39686af98, flag: INIT/-/-/0x00
        DML LOCK: tab=227038 flg=11 chi=0
                  his[0]: mod=2 spn=35288
        (enqueue) TM-000376DE-00000000 DID: 0001-0017-00000003
        lv: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 res_flag: 0x6
        res: 0x398340f58, mode: SS, lock_flag: 0x0
        own: 0x3980df420, sess: 0x3980df420, proc: 0x39859c660, prv: 0x398340f68
        SO: 397691678, type: 36, owner: 39686af98, flag: INIT/-/-/0x00
        DML LOCK: tab=227036 flg=11 chi=0
                  his[0]: mod=2 spn=35288
        (enqueue) TM-000376DC-00000000 DID: 0001-0017-00000003
        lv: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 res_flag: 0x6
        res: 0x39833f358, mode: SS, lock_flag: 0x0
        own: 0x3980df420, sess: 0x3980df420, proc: 0x39859c660, prv: 0x39833f368
      ----------------------------------------Thank you in advance for any comments,
Jure

Hi Jonathan,
thank you very much for your reply which more than answers my question. I think it actually clears a lot of doubts I had about TX locks, since your mentioning of "undo segment header transaction table" pointed me in the right direction for further research on this topic (honestly, I didn't know what's "behind" TX locks). So if I understood correctly, to determine which table is the blocker (in the testcase presented above), you have to have some kind of history of executed SQL statements (e.g. by mining redo logs)?
The statement you wrote:
At this point, and with your example, the waiting session is waiting on a TX (transaction) lock - this means it has not idea (and no interest) in the actual data involved, it is merely waiting for an undo segment header transaction table slot to clear. and the example with the savepoint you gave, made me think of some of the consequences of that behaviour. That is probably the reason why it is not possible to get the "blocker" table from v$lock (although sometimes it's possible to get it from v$session.row_wait_obj#) when a session tries to change a row another session holds in exclusive mode, e.g.:
create table t1 (id number);
insert into t1 values (1);
commit;
Session 126:
SID = 126> update t1 set id=2 where id=1;
1 row updated.
Session 146:
SID = 146> update t1 set id=2 where id=1;
{session hangs}
In a separate session:
SQL> SELECT   CASE
2                  WHEN TYPE = 'TM'
3                     THEN (SELECT object_name
4                             FROM user_objects
5                            WHERE object_id = l.id1)
6               END object_name,
7                  SID, TYPE, id1, id2, lmode, request, BLOCK
8          FROM v$lock l
9         WHERE SID IN (126, 146)
10     ORDER BY SID, TYPE, 1
11 /
OBJECT_NAME    SID TY        ID1        ID2      LMODE    REQUEST      BLOCK
T1             126 TM      68447          0          3          0          0
               126 TX     262153       4669          6          0          1
T1             146 TM      68447          0          3          0          0
               146 TX     262153       4669          0          6          0The only thing I can tell from this output is that session 146 is trying to get a TX lock in exclusive mode, and session 126 is blocking it, the reason of the blocking being unknown from this view alone.
Since I'd like to get a better understanding on the mechanics behind this (e.g. why the blocked session can't know the segment that is waiting for, since it has to go to the same segment's data block to find the address of the undo segment header transaction table slot? ; can we get the content/structure of the transaction table in the data block - probably by making a block dump?), do you have any source where a more in depth explanation what happens "behind the scenes" is available (perhaps in Oracle Core?)? Some time ago I found a link on your blog http://jonathanlewis.wordpress.com/2010/06/21/locks/ which points to Franck Pachot's article where he nicely explains the various locking modes: http://knol.google.com/k/oracle-table-lock-modes#. There I also found Kyle Hailey's presentation about locks http://www.perfvision.com/papers/09_enqueues.ppt where slide 23 nicely depicts what's going on when acquiring TX locks. Of course I'll try to search on my own, but any other source (especially from an authority like you) is more than welcome.
Thank you again and regards,
Jure

Can an email address be blocked in apple mail?

can an email address be blocked in apple mail?

Hi .
Try the suggestion here > How to Block a Sender in Mac OS X Mail

My billing address is correct, but the i keep getting that my security code is incorrect and can't download apps. I have re-entered all of my information in my account, but still get error message. How to over-ride?

My billing address is correct, but the i keep getting that my security code is incorrect and can't download apps. I have re-entered all of my information in my account, but still get error message. How to over-ride?

If you have American Express, your 4-digit security code is on the front. If you have VISA or MasterCard, your 3-digit security code is outside the signature block on the back of your credit card. It happens to me also.

This message has been blocked because the HELO/EHLO domain is invalid

Hi friends,
We are using cisco ironport c170. Today we cannot send email for particular email id(domain). the error msg as below,
Diagnostic information for administrators:
Generating server: sgm.svc.com.sg
[email protected]
[182.**.**.51] #<[182.**.**.51] #5.0.0 smtp; 5.1.0 - Unknown address error 554-'5.7.1 [SPAM] This message
has been blocked because the HELO/EHLO domain is invalid.' (delivery attempts: 0)> #SMTP#
Original message headers:
X-IronPort-AV: E=Sophos;i="4.97,682,1389715200";
d="scan'208,217";a="3362301"
Received: from abcct01.abc.com ([10.**.**.33]) by
sgm.svc.com.sg with ESMTP/TLS/AES128-SHA; 19 Mar 2014 11:17:45 +0800
Received: from abcMB01.abc.com ([fe80::99bb:22a0:nnaa:25cc]) by
abcCT01.abc.com ([::1]) with mapi id 14.03.0123.003; Wed, 19 Mar
2014 11:18:13 +0800
From: "test" <[email protected]>
To: "[email protected]" <[email protected]>
Subject: Testing Email
Thread-Topic: Testing Email
Thread-Index: Ac9DIdjTsP9HUS2QTF6cZp6PKztE8g==
Date: Wed, 19 Mar 2014 03:18:12 +0000
Message-ID: <[email protected]>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.**.**.210]
Content-Type: multipart/alternative;
boundary="_000_1329D1768D6FBE4A90657F034B26A7E217D7ADD5abcMB01_"
MIME-Version: 1.0
Thank you.

The HELO/EHLO domain that your Cisco IronPort Email Security Appliance (ESA) uses is based on the hostname you configure for your delivery interface under Network -> IP Interfaces. Please ensure that a valid hostname is configured. This hostname should match the rDNS records for the public IP address used by your ESA.
Once addressed - you should be able to take the domain in question, and attempt to telnet port 25, and attempt the standard SMTP testing...
$ telnet mail.test.com 25
Trying XYZ.XY.124.XX...
Connected to mail.test.com.
Escape character is '^]'.
220 mail.test.com ESMTP
helo foo.com
250 mail.test.com
mail from: [email protected]
250 sender <[email protected]> ok
rcpt to: [email protected]
250 recipient <[email protected]> ok
data
354 go ahead
Subject: Test
TESTING
250 ok: Message 8102 accepted
I hope this helps!
-Robert
(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

My email address is blocked from 3g

My email address is blocked from 3g - it was spammed last week, and now the 3g network rejects the connection. Wifi works fine, but, can't always be on wifi. Any ideas? It's an iphone 4, mail account is through a site I own. The network is AT&T, but Safari, phone and texts work fine.

Right click the item, choose to "Delete".

Where is red building block in the URL bar and then select Allow

I am an OU student and in order to allow a java upgrade to work I need find this 'red building block in a URL bar'. For me this gobbledegook..please help

The leftmost side of the address bar. See the following articles for screenshots.
* [[How to enable Java if it's been blocked]]
* [[Why do I have to click to activate plugins?]]

CSM Is it possible to have the vserver (VIP) IP in a different subnet range

CSM - Is it possible to have the vserver (VIP) IP in a different subnet range than the real IP addresses in the serverfarm that is bound to it?
In other words, as an example a typical bridge configuration is like this:
vlan 221 client
ip address 10.20.220.2 255.255.255.0
gateway 10.20.220.1
vlan 220 server
ip address 10.20.220.2 255.255.255.0
<<<<<<<<<<<<Two VLANs with the same IP address are bridged together>>>>>>>>>>>>>>>>>.
serverfarm WEBFARM
nat server
no nat client
real 10.20.220.10
inservice
real 10.20.220.20
inservice
vserver WEB
virtual 10.20.220.100 tcp www
serverfarm WEBFARM
persistent rebalance
inservice
==================================================================================
NOW:
=====
Is it possible to do something like this:
==================================================================================
vlan 221 client
ip address 10.20.220.2 255.255.255.0
gateway 10.20.220.1
vlan 220 server
ip address 10.20.220.2 255.255.255.0
<<<<<<<<<<<<Two VLANs with the same IP address are bridged together>>>>>>>>>>>>>>>>>.
serverfarm WEBFARM
nat server
no nat client
real 10.20.220.10
inservice
real 10.20.220.20
inservice
vserver WEB
virtual 50.40.220.99 tcp www <<<<<<<<<< Place the IP address in a different subnet than the IP's in the serverfarm >>>>>>>>>>>>>>>
serverfarm WEBFARM
persistent rebalance
inservice
<<<<<<<<On the MSFC place a static route to route the 50.40.220.99 address towards the CSM IP on vlan 221>>>>>>>>>.
ip route 50.40.220.99 255.255.255.255 10.20.220.2
Please if somebody knows if this is or is not possible it would be highly appreciated to hear your feedback.

Pointers to examples - much appreciated.

CSM ip address is blocked by the FWSM

Similar Messages

Maybe you are looking for