LDAP Source Query IP (Cisco ISR G2 WebSecurity)

Hi Cisco folks,
Goal:
I would like to implement Cisco ISR Connector with ScanSafe for the company.
I have followed the ISR Solution Guide carefully (found here:
http://www.cisco.com/en/US/docs/security/web_security/ISR_SS/ISR_ScanSafe_SolutionGuide.pdf)
So far I have managed to get a basic configuration working.
Problem:
This configuration consists of the basic Web Security features and a VPN to our internal network.
I would now like to implement authentication on the device with LDAP.
As far as I can tell the configuration is correct. (I followed the solution guide precisely)
The authentication though doesn't work.
Here an output from the debug:
*Feb 22 13:07:35.034: LDAP: LDAP: Queuing AAA request 52 for processing
*Feb 22 13:07:35.034: LDAP: Received queue event, new AAA request
*Feb 22 13:07:35.034: LDAP: LDAP authentication request
*Feb 22 13:07:35.034: LDAP: Username sanity check failed
*Feb 22 13:07:35.034: LDAP: Invalid hash index 512, nothing to remove
*Feb 22 13:07:35.038: LDAP: New LDAP request
*Feb 22 13:07:35.038: LDAP: Attempting first next available LDAP server
*Feb 22 13:07:35.038: LDAP: Got next LDAP server :scansafe-ldap-server
*Feb 22 13:07:35.038: LDAP: Free connection not available. Open a new one.
*Feb 22 13:07:35.038: LDAP: Opening ldap connection ( Internal IP of DC, 636 )ldap_open
ldap_init libldap 4.5 18-FEB-2000
open_ldap_connection
ldap_connect_to_host: Internal IP of DC
:636
*Feb 22 13:07:35.038: LDAP: socket 5 - connecting to Internal IP of DC (636)
*Feb 22 13:07:35.038: LDAP: socket 5 - connection in progress
*Feb 22 13:07:35.038: LDAP: Connection on socket 5
*Feb 22 13:07:35.038: LDAP: Connection to LDAP server (scansafe-ldap-server, Internal IP of DC) attempted
*Feb 22 13:07:35.038: LDAP: Connection state: DOWN => CONNECTING
*Feb 22 13:07:35.038: LDAP: LDAP request saved. Will be served after Root Bind is done.
*Feb 22 13:07:35.038: LDAP: LDAP request successfully processed
*Feb 22 13:08:05.038: LDAP: Received socket event
*Feb 22 13:08:05.038: LDAP: Process socket event for socket = 5
*Feb 22 13:08:05.038: LDAP: Server is not valid and non-TLS
*Feb 22 13:08:05.038: LDAP: Socket read event socket=5
*Feb 22 13:08:05.038: LDAP: Found socket ctx
*Feb 22 13:08:05.038: LDAP: ldap tcp transport closing on socket 5
*Feb 22 13:08:05.038: LDAP: Transport DOWN notification for scansafe-ldap-server/5
*Feb 22 13:08:05.038: LDAP: Clearing all ldap transactions
*Feb 22 13:08:05.038: LDAP: Triggering server failover for transit requet
*Feb 22 13:08:05.038: LDAP: Connection state: CONNECTING => DOWNldap_unbind
ldap_free_connection lc=0x8C5C14D4
ldap_free_connection: actually freed
As you can see the router can't contact our DC.
Now I did some sniffing and noticed that the router sends the LDAP query with the source address of the external interface (Public IP).
This results, that the queries are sent out into the internet with an internal destination IP. --> hence can't connect.
Question:
Now to my actual question.. How can I force the ISR to originate the LDAP queries from our internal interface ... which would then enter the VPN and connect to the DC?
Thanks in advance, and if you need any additional information, please don't hesitate to ask
Kind regards
- Sam

I recently went through this exact issue with Cisco TAC. The answers are quite unpleasant, but Cisco feels the LDAP protocol doesn't need a source-interface command because an LDAP server doesn't need a specific source IP. The "workaround" is to include your egress interface IP in the VPN tunnel so it will get encapsulated and be able to reach the LDAP server over the VPN. There is another even less desirable workaround to use a Virtual Tunnel Interface, but it is not practical for companies with more than 1 remote site or using the headend VPN concentrator for internet routing because of the requirement of the tunnel being ip any any.

Similar Messages

CSCul66951 LDAP routing query fails when user name is the same (6 july 2014)

in the case CSCul66951 LDAP routing query fails when user name is the same it is mentionned that the version 8.0.2-055 correct this bug ? How come i don't see this version on my menu Available upgrades from my IronPort C370 ?
Is there someone on the support team that have try this LDAP query on a IronPort C370 with this version in the development lab ?
Do i have to open a support Case to have this version of AsyncOS ?
Best regards,
Benoit Belair
University of Quebec in Montreal

Yes - CSCul66951 - this was included w/ the 8.0.1-HP1, and is rolled into 8.5.6-074 GA release.
See release notes, resolved issues:
http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-0/release_notes/ESA_8-0-1_HP1_Release_Notes.pdf
CSCun02766 - 8.5.6-063, which was superseded by the 8.5.6-074 GA release.
See release notes, resolved issues:
http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-5-6/ESA_8-5-6_Release_Notes.pdf

Cisco isr 819 cellular interface...

my cisco isr 819 constantly cycles between the gigabyte interface and the cellular...? _i have the device configured for auto failover with the gigabyte interface being the primary and the cellular as backup. _i used Cisco Configuration Pro to configure the router. _i have attached the router config for expert evaluation.....thanks in advance.

Yes you are correct Cinthia, it is the NAT and depending on which external interface i configure first with NAT, that's the only interface providing NAT to out going packets.
What i hope to achieve with my C819HG ISR router is provide the G0 interface as primary internet access. If that access goes down i want the Cellular0 interface to come up and provide a path to the internet. When the G0 access is restored i want the Cellular0 interface to go back to standby.
here is my config.....
! Last configuration change at 14:30:15 Chicago Thu Feb 19 2015 by ADMIN
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname rtr-cisco
boot-start-marker
boot-end-marker
aqm-register-fnf
no aaa new-model
clock timezone Chicago -6 0
clock summer-time Chicago date Apr 6 2003 2:00 Oct 26 2003 2:00
crypto pki trustpoint TP-self-signed-3083563774
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3083563774
revocation-check none
rsakeypair TP-self-signed-3083563774
crypto pki certificate chain TP-self-signed-3083563774
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33303833 35363337 3734301E 170D3135 30323133 32313035
35305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 30383335
36333737 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100AB4C 2DA1C3C3 CABBB054 765A1E14 A7BA0347 AFFD1913 B04113DD A21D7CEB
F09F6572 5BF58323 586BEF24 929003D4 4CAD8864 A00FF40A A59A9969 C12615A0
1DFE5527 BA6E2C27 33F75615 A36DA242 42862F33 D2823AA3 B838AA3B C938930A
6D48BD79 11BD9CF5 8B7BEBC8 8C6D9D34 6E5415EB A3CFF3C7 E48F20C4 B18B15FE
38BD0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 14B5AEAA D7E9FEF2 3A4FF79D 4251425F EF9F28DC 61301D06
03551D0E 04160414 B5AEAAD7 E9FEF23A 4FF79D42 51425FEF 9F28DC61 300D0609
2A864886 F70D0101 05050003 81810039 C6D2590C 0741F53E 62E6E7CE 62534CF9
3A8A6C79 BECBACD7 AF73FA4C 8ED5C059 58A7B08C FBCE2ED0 66196250 20C570AC
8D802A6B 5E33FFD7 580BBC4C 7C442C42 0F77E3FD F465B724 69D29CFF 19F59635
D55A9E71 290CE668 B2C74CA1 ED641A2E 714BC06F 17CE9E44 B998945A C1733318
BFDA96CD 9D66ACA7 B1D79229 8A1322
quit
ip dhcp excluded-address 172.17.37.1 172.17.37.9
ip dhcp excluded-address 172.17.37.16 172.17.37.254
ip dhcp pool ciscoPool
import all
network 172.17.37.0 255.255.255.0
dns-server 8.8.8.8 8.8.4.4
default-router 172.17.37.1
ip domain name sr.nwris.noaa.gov
ip cef
no ipv6 cef
multilink bundle-name authenticated
chat-script lte "" "AT!CALL1" TIMEOUT 20 "OK"
license udi pid C819HG-4G-V-K9 sn FTX181583HV
username ADMIN privilege 15 secret 4 wYSo2PORqoebHxp3dazS6tzNpgOc5RQBMmrsFZ5l6jE
controller Cellular 0
track 1 ip sla 1 reachability
ip ssh version 2
ip scp server enable
interface Cellular0
ip address negotiated
ip nat outside
ip virtual-reassembly in
encapsulation slip
dialer in-band
dialer string lte
dialer-group 1
async mode interactive
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface GigabitEthernet0
description $ETH-WAN$
ip address dhcp client-id GigabitEthernet0 hostname rtr-wxk37
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
interface Serial0
no ip address
shutdown
clock rate 2000000
interface Vlan1
ip address 172.17.37.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip local policy route-map track-primary-if
ip forward-protocol nd
no ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 1 interface Cellular0 overload
ip nat inside source list 2 interface GigabitEthernet0 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 track 1
ip route 0.0.0.0 0.0.0.0 Cellular0 253
ip sla auto discovery
ip sla 1
icmp-echo 8.8.8.8 source-interface GigabitEthernet0
ip sla schedule 1 life forever start-time now
dialer-list 1 protocol ip permit
route-map track-primary-if permit 1
match ip address 100
set interface GigabitEthernet0
route-map source permit 10
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 172.17.37.0 0.0.0.255
access-list 2 remark CCP_ACL Category=2
access-list 2 permit 172.17.37.0 0.0.0.255
access-list 100 remark CCP_ACL Category=0
access-list 100 permit icmp any host 8.8.8.8
control-plane
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
mgcp profile default
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line 3
script dialer lte
modem InOut
no exec
transport input all
rxspeed 100000000
txspeed 50000000
line vty 0 4
login local
transport input ssh
scheduler allocate 20000 1000
ntp update-calendar
ntp server 24.56.178.140 source GigabitEthernet0
ntp server 129.6.15.28 prefer source GigabitEthernet0
ntp server 132.163.4.102 source Cellular0
end

In DBI , how to find out the Source Query used for the Report

Hi All,
How to find out the Source Query used to display the data in the DBI Reports or Dashboards. We can get it in Apps Front end by Going to Help and Record Histroty. But DBI Runs in Internet Explorer so i dont know how to get the source query ( SELECT Query ) Used.
In IE we have View --> Source . But that does not help since it gives the HTML Coding and not the SELECT Query used.
If anyone has ever worked on it...Please help me in finding it.
Thanks,
Neeraj Shrivastava

Hi neeraj,
You can see the query used to display reports.Follow these steps to get the query.
1)Login to oracle apps
2)Select "Daily Business Intelligence Administrator" responsiblity.
3)Now click on "Enable/Disable Debugging" (Now u enabled debugging)
4)now open the report which you want to see the query of
5)In view source it displays query along with the bind varilables.
Feel free to ping me if you have any doubts
thanks
kittu

LDAP accept query (space within email) got pass

Version: 5.1.2-005
ldap accept query is very effective here and have been using since day-1.
Recently, we discover some backend mta log that rejecting invalid address.
We haven't change ironport or the backend ldap software for a while. So it is not something that due to recent change.
Here is a funny finding, note the space.
> ldaptest
Select which LDAP query to test:
1. MXLDAP.accept
2. MXLDAP.smtpauth
3. VDELDAP.accept
4. group
[1]> 1
Address to use in query:
[]> sys [email protected]
LDAP query test results:
Query: MXLDAP.accept
Address: sys [email protected]
Action: pass
LDAP query test finished.
I run a ldapsearch on the backend LDAP server and the ldapsearch does not return the 'sys [email protected]' as valid LDAP entry. So it seems it is not related to LDAP.
This is our ldap accept query
(&(|(mail={a})(mailalternateaddress={a}))(mailboxstatus=A)
Our ldap backend is Openwave MX LDAP directory.
We do considering upgrading to 5.5 version but it was not due to this problem. but rather than try to keep our version reasonably up-to-date.

In the latest version it is also accepting addresses that contain spaces. However, the exact behavior depends on how address parsing is configured on your listener.
If it is set to "loose parsing", it accepts but actually delivers the message to .
When using "strict parsing", it doesn't alter the recipient address and the message gets delivered to .
In the LDAP accept query however, it seems to ignore that setting. It always strips spaces from the address before it sends the query (you can see this in ldap debug).
I don't know whether all this is by design or not. Especially the ldapaccept part looks more like a bug to me, i'd expect it to check the address its going to use to deliver the mail. Its probably best to create a support request for this.

Passing Source Query Variables to Target query in RRI

Hello,
I Creating Jump Queries.
In the source query user is entering some variable(Dates), based on these varaibles I am creating formula variable in the source query.
I wanted pass the same varible values(which are entered by user) to target values(RRI) and use the same formula varaible in the target query.
Please advise me how can I do this.
Thanks
Venkat

Hello Venkat,
Please refer to note 1053310 for complete details about RRI and application rules.
The variables are passed implicity but you can explicity defined the rules for varaibles as well. You can define assignment details as required. I hope this will help.
Thanks and Regards,
Asit G Ramteke

In Procedure command, source query results not passed to target as # variables - why not?

Hi all,
I'm using ODI 11.1.1.6.0.
Has anyone had issues with this version with this feature?
I've just upgraded from 10.1.3.4.5.6_02 and feature doesn't work at all (not even in new procedures!) in my repository.
I've even tried creating a brand new repository then creating a new data server, new physical schema, new logical schema, mapped physical schema to the logical schema, and created a new procedure that does:-
Source tab (Oracle): SELECT scen_name FROM snp_scen
Target tab (ODI Tools): OdiStartScen -SCEN_NAME=DUMMY -SESSION_NAME=#scen_name
The session that's created has the name "#scen_name" and not the name from the result of the source query.
The DUMMY scenario is just generated from another procedure that has a single OdiSleep command.
Any ideas chaps?

Yet another bug...
Fixed in 11.1.1.6.4.

How to check the source query of tabular form ....

Hi All ,
is there any way to change the source query of tabular form ......
ya ... i could see it in the source but it is normal sql query ....
where as to generate the addrow functionality the sql query must be
Select empno , ADD_ITEM.TEXT(1,empno), ename ,ADD_ITEM.TEXT(2,ename)................
then where can i find this query .?
i could see that ADD button is calling ADDROW process and which inreturn calling ADD function ....
can any one tell me , where to see the code for this ADD function ....
as i checked it in db ..... it is not there at all.

You can have a look here for the manual tabular forms:
http://apex.oracle.com/pls/otn/f?p=31517:170
Denes Kubicek
http://deneskubicek.blogspot.com/
http://www.opal-consulting.de/training
http://apex.oracle.com/pls/otn/f?p=31517:1
http://www.amazon.de/Oracle-APEX-XE-Praxis/dp/3826655494
-------------------------------------------------------------------

LDAP Routing Query

Hi,
we have the following scenario:
There is just one single mail domain.
500 Mailboxes are on an Microsoft Exchange server with Active Directory, 500 Mailboxes are on a different server hosting POP3 Mailboxes.
Obviously I cannot use a LDAP Accept Query, as the AD doesn't have any knowledge about the POP3 mailboxes. The question is, can I still use LDAP for mailrouting, even if some account are not in the AD?

Well.... there are more LDAP directories that MS-Active Directory.
If I understand you right your main problem is how to route 50% of your recipient addresses to Exchange and 50% of them to the POP3 system. If you could, it would be nice to have a message accept policy that is LDAP driven.
I suggest you try to install a dedicated LDAP server for your Ironport(s). That LDAP server should be updated daily with the details from your AD and an export from the POP3 system. On the LINUX platform there are several options (OpenLDAP, Apache Directory, Fedora 389, etc).
If you make sure your import scripts also provisions the mail addresses of all users and (at least) an attribute like "mailHost" (your Exchange based 50% of your recipients would have a static value of "your.exchange.server" (=hostname of your Exchange bridgehead) as value, the other 50% would have "your.pop3.server" (=hostname of your POP3 server) as value.
After that you can create a mail routing LDAP query that makes sure the messages are routed correctly. The mailHost attribute will be used to determine where the message should be routed to. If needed, you can also run a message acceptance query against that same LDAP. That query would reject all mail addresses that are unknown to the directory.
If you have more questions about this, jus send me a message; I have some experience with this matter.
Steven

Importing users from LDAP source

Importing users from LDAP source, "first name"/"last name" are not imported.
Is there a way to get those from LDAP source?

Not currently. This is something we expect in a release late this year/early next as we introduce additional LDAP support enhancements.
Jason
>>> ZGajsak<[email protected]> 8/29/2012 3:16 PM >>>
Importing users from LDAP source, "first name"/"last name" are not
imported.
Is there a way to get those from LDAP source?
ZGajsak
ZGajsak's Profile: http://forums.novell.com/member.php?userid=14389
View this thread: http://forums.novell.com/showthread.php?t=459442

Cisco ISR G2 SIP Calls Capacity

Dear all,
We're planning for Cisco Voice Gateway configuration with SIP trunk, till now no E1s are used.
I would like to know how can we calculate the number of simulataneous calls that a cisco ISR G2 router (1921. 2921.3945,etc...) can support ?
How much sip simultaneous calls each ISR G2 model can support ?
Is it better to use SIP or we must get into E1 PRI ?
Regards,

The Q and A below has the call capacity you are looking for
Table 1. Number of IP-to-IP Calls per Platform
Platform
Maximum Number of Simultaneous Calls (Flow-Through)
Cisco 3945E
2500
Cisco 3925E
2100
Cisco 3945
950
Cisco 3925
800
Cisco 2951
500
Cisco 2921
400
Cisco 2911
200
Cisco 2901
100
Cisco ASR 1004; and Cisco ASR 1006 Router Processor 2 (RP2)
5000; 16000*
Cisco ASR 1002, ASR 1004, and ASR 1006 RP1
1750
Cisco AS5350XM and AS5400XM
600
Cisco 3845
500
Cisco 3825
400
Cisco 2851
225
Cisco 2821
200
Cisco 2811
110
Cisco 2801
55
http://www.cisco.com/en/US/prod/collateral/voicesw/ps6790/gatecont/ps5640/prod_qas09186a00801da69b.html
Please rate all useful posts
"opportunity is a haughty goddess who waste no time with those who are unprepared"

Rate limit in Cisco ISR 4451X

Hello friends,
I have a problem; now i'm changing the router that have at work of Cisco 3925 to Cisco ISR 4451X but in the new router i can't put the command that have in my old router:
rate-limit input access-group 110 16384000 3072000 6144000 conform-action transmit exceed-action drop
Can someone help me telling what command replace it or which is the equivalent?
Atte.
Percy

Edison,
Thanks for helping with this it is greatly appreciated. I have been playing around with this and have managed to get the policing working successfully on the SVI.
The problem was basically the direction the policing was being applied. Initially I was applying the service policies to the customer SVIs in an inbound direction. This would only be traffic coming into the VLAN interface from within the VLAN; therefore, in terms of internet traffic this would be upload and NOT the required download.
In order to resolve this, I have applied the service policy to the Internet facing VLAN. Please see below -
Class Maps and Policy Maps
class-map match-all CUST-A-VL10-CMAP1
match input-interface FastEthernet1/0/24
class-map match-all CUST-A-VL10-CMAP2
match access-group name CUST-A-VL10-ACL-POL
policy-map CUST-A-VL10-PMAP1
class CUST-A-VL10-CMAP1
police 100000 18750 exceed-action drop
policy-map CUST-A-VL10-PARENT-PMAP1
class CUST-A-VL10-CMAP2
set ip precedence 1
service-policy CUST-A-VL10-PMAP1
VLAN Confguration
interface Vlan300
ip address ************
service-policy input CUST-A-VL10-PARENT-PMAP1
This works successfully and polices the traffic as expected. However, I have now run into the problem with assigning multiple service policies to the VLAN interface. As this is the internet facing VLAN for the routing of traffic to and from the internet, all customer service policies need to be applied to this interface. When I attempt to apply more than one service policy to this VLAN i receive the following error -
(config-if)#service-policy input CUST-B-VL20-PARENT-PMAP1
Policy map CUST-A-VL10-PARENT-PMAP1 is already attached
Looks like another couple of hours needed working around this problem!!
Thanks
Nick

LDAP group query failure during per-recipient scanning, poss

I am trying to figure out what this is referring to:
LDAP group query failure during per-recipient scanning, possible LDAP misconfiguration or unreachable server
I can still send test messages from my e-mail.
Is it possible tht a user is trying to send in corectly..hmmm

If you create a LDAP debug log from within the GUI, this will give you a more in depth look into the query that is being sent to your LDAP server and also more important any errors that are being returned.
Great log for troubleshooting any LDAP related issues.

Effect on VIBE users when AD OU in LDAP source modified

Hi,
I need to rename some OU's in my Active Directory. I will ofcourse modify the LDAP source entry in the VIBE config area to reflect the new...

Hi,
we got a problem in Vibe 4:
In a working area are some unread messages. If you click on these (in example 38 unread), a box appears with no...

Manage Cisco ISR routers as one device

I'm looking for a tool that allows me to manage two Cisco ISR routers (2911) as one device ("cluster" device or "virtual" device).
Both routers are connected directly to the internet and are using HSRP to perform a function of the virtual default gateway for LAN devices.
What about Cisco ASA in Active/Active or Active/Passive Failover mode?
Thanks,
Jernej

No, this is not currently possible. The devices need to be managed using their individual IP addresses (i.e. not the virtual IP of HSRP). You'll generally want to do that for the time being since both devices will have their own CPU, memory, buffer, etc. characteristics.

LDAP Source Query IP (Cisco ISR G2 WebSecurity)

Similar Messages

Maybe you are looking for