Trustsec Mac Encryption Between Sites

Hi,
See attached - might make question more clear
we have a layer 2 connection between sites using a local provider for the link. On the remote side is a 3750-X and on the Main Campus side is a 2960. The link is connected via a VLAN. The VLAN interface exists on the Main Campus 5548, core switch
From What I understand, Trustsec cannot be configured on a logical interface but, if we were to configure the logical interfaces as a physical interfaces could we encrypt traffic between the 5548 and the 3750-X?
Even though it would also have to traverse through the 2960 as well?
And traverse the Layer 2 WAN link?
Any other suggestions for accomplishing this?
Thank you, Pat

No, it is not supported on the 2960 series. Also, if you want to encrypt traffic between sites, a better solution is to use IPsec tunnel, but you need a firewall or a router in each location.
It doesn't have to be anything expensive if you don't need a lot of bandwidth.
I use these and they work really well.
have a look:
http://www.amazon.com/Juniper-SSG-5-SB-Security-Services-Gateway/dp/B000IZDN88
HTH

Similar Messages

How to use Mac *encrypted* screen sharing from iOS

Hello,
I have a Mac Mini running Yosemite Server that I can access from a remote Mac, using Screen Sharing app. I have selected "Encrypt all network data" and this works very well.
Now I'd like to do the same thing from my iPhone or iPad (both are running iOS 8): access my Mini in the same way I already do from the remote Mac. But I want my connection to be as secure. All data must be encrypted between the Mini and my iOS device.
What is the best way to achieve that? What are the best iOS apps? I've tried some VNC apps but they don't seem to manage encrypted sessions. Did I miss a subtle setting, either on my Mini or on the iOS apps?
Any help is truly appreciated.

Hello,
I have a Mac Mini running Yosemite Server that I can access from a remote Mac, using Screen Sharing app. I have selected "Encrypt all network data" and this works very well.
Now I'd like to do the same thing from my iPhone or iPad (both are running iOS 8): access my Mini in the same way I already do from the remote Mac. But I want my connection to be as secure. All data must be encrypted between the Mini and my iOS device.
What is the best way to achieve that? What are the best iOS apps? I've tried some VNC apps but they don't seem to manage encrypted sessions. Did I miss a subtle setting, either on my Mini or on the iOS apps?
Any help is truly appreciated.

WS-4500X-32 Support for TrustSec MACsec Encryption

Hello all,
Does anyone know when will the WS-4500X-32 support the TrustSec MACsec Encryption ?
Thanks!
David

Hi,
MACSec support on the Catalyst 4500X as from IOS XE 3.5.0. As per the New Software Features in Release IOS XE 3.5.0E section of the release notes:
MACSec Encryption on Cisco Catalyst 4500-X
IEEE 802.1ae MACSec Layer 2 encryption
IEEE 802.1ae MACSec encryption on user-facing ports
IEEE 802.1ae MACSec encryption between switch-to-switch links using Cisco Security Association Protocol (SAP)
Regards

My computer screen is skipping and switching erratically between sites. Sometimes it just switches to a grey dashboard screen.Has anyone had this problem?

My computer screen is skipping and switching erratically between sites/functions. Sometimes it just switches to a grey dashboard screen. Has anyone had this problem?

Please tell us you iMac model and the Mac OSX version you run. iMacs have been in continuous production since 1998 in four broad families and hundreds of variants. Without knowing your specific Mac type, someone trying to help might give you advice inappropriate for your model.
A good place to start to determine in which family yours resides is to do "About this Mac" from your Apple menu (left end of menubar) to get this window:
Note I've indicated two entries with red arrows. Please tell us what your computer shows for "Version" under OSXn and for your processor.
The forum you are in now, "iMac (PPC)" is for iMacs made between 1998 and 2006.

What is difference between Site template and web template

What is difference between Site template and web template

Both are almost same, are you referring to Site Definitions vs web template?, if so, refer to the following post
http://blogs.msdn.com/b/vesku/archive/2011/07/22/site-definitions-vs-web-templates.aspx.
--Cheers

Unable to pass traffic between sites

I've read through dozens of posts and so far have had no luck getting any of the suggestions to work - combined with many of these posts being multiple years old...so I'm going to try posting something current and see if I get anywhere.
Scenario:
Site A - Cisco ASA 5510 running 8.4(4)1 with two interface connections to a Cisco ME 6500 (which I do not manage), one for internet and one for a MPLS connection.
Site B – connecting to an unknown switch which is connected to the MPLS network.
Site C – Cisco ASA 5505 running 7.2(3) with one connection to an unknown switch (which I do not manage) for internet access.
Site A to Site B traffic flows between the two without issue.
Site A to Site C is a site-to-site VPN connection. Traffic flows between the two without issue.
The main issue I’m having is that Site B cannot talk to Site C and vice versa. Also my client VPN connections to Site A cannot get to Site B or Site C.
My first question is; is this even possible? (I sure expected it to be). And if so, what the heck am I doing wrong???
I’ve included a config from Site A which is where I’m guessing the problem is. Any insight is appreciated.

"I'm not following what you mean by that."
Your Site "A" and "B" connected through MPLS cloud and they are not connected through vpn-connection, right? I assume that your site "B" cannot communicate to site "C", therefore you must permit site-B's subnet traffic transit between site "A" and site "C" i.e. Site-B should have access to "C", right ?
"I may be misunderstanding, but isn't that what this is: "route MPLS 10.17.0.0 255.255.0.0 10.17.250.2 1"."
Great 10.17.0.0/16 route meant for site "B", that is fine, you wouldn't need an additional one.
"You completely lost me there :)"
I presume that your Site "B" and "C" does not have direct MPLS connection, therefore Site "A" becomes a transit path for site "B" and "C". You allow site-B's transit through the vpn-tunnel between site "A" and "C". Your site "C" assumes that subnet belong to site "B" is directly connected at site "A" but in reality it connects via a MPLS cloud and one last thing is that a route needed at site-B to push site-C's traffic to Site "A", a static route would do that.
As you would permit site-B's traffic to pass through vpn-tunnel site "A" and "C", in other words your "A" become a hub for traffic flowing between site "B" and "C".
"Should the route be applied to the inside or the outside interface?"
Outside. Your tunnel terminated on the outside interface, right? If so then it must point to outside's default-gateway address.
object network SiteB-network
subnet 10.17.2.0 255.255.255.0
this would allow you to access site-c subnet when you are remote-in to Site-A.
nat (outside,outside) source static VPN-pool VPN-pool destination static SiteC-network SiteC-network
this is to allow Site-B to access site-C subnet via the tunnel between site A and C.
nat (MPLS,outside) source static SiteB-network SiteB-network destination static SiteC-network SiteC-network
object network inside-network
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source static inside-network inside-network destination static SiteC-network SiteC-network
access-list outside_cryptomap extended permit ip object inside-network object SiteC-network
this is allow Site-B to access site-C subnet via the tunnel between site A and C.
access-list outside_cryptomap extended permit ip object SiteB-network object SiteC-network
Thanks
Rizwan Rafeek

Why is Safari/Mac breaking this site?

What can we do to make Safari/Mac view this site without errors?
http://apcinternet.com/edenvale/
Site markup is 100% correct http://validator.w3.org/check?uri=http%3A%2F%2Fapcinternet.com%2Fedenvale%2F&cha rset=%28detect+automatically%29&doctype=Inline&group=0 and works perfectly on Firefox, IE7, IE6, Opera and even Safari/PC - but breaks badly on Safari/Mac.
Any thoughts would be very welcome.
Steve

Klaus, from what ulysses69 said above:
We don't have Macs, but our client and some colleagues do.
It's clear he is troubleshooting a problem with the web site when viewed in the Mac version of Safari.
To ulysses69: While clearly many of us are willing to help with this (and I kind of enjoy it, personally), questions like this are probably better suited to other web sites that have forums for general web site testing and troubleshooting. Apple's forums are specifically intended for questions and answers about problems using Apple's products, which isn't really what you're looking for. That said, I don't have a problem continuing in this thread. Just be aware that there are probably more effective places for this kind of question.

.mac encryption not compatible with popular AIM certificates

I recently switched on encryption in iChat AV 3. I was happy to test it out with my family, who use .mac screen names in iChat. I was bummed, however, to go to work and use my AIM account to IM back to my home computer.
My AIM account at work uses a Thawte certificate. No worky. I also tried an aimencrypt certificate. Also no worky. Is there a way to encrypt an AIM account and have encrypted IM sessions with encrypted .mac accounts?
If the answer is no, .mac encryption is mostly worthless. Not a great user experience to get excited about it and switch it on unknowingly. In fact, it's a poor one.
Thoughts?
Scott

Thanks, Ralph.
The problem with limiting encrypted communication to only paid .mac subscribers is that it signifigantly devalues the application. As encryption become more prevelant, fewer users will use iChat. In my opionion, that's not a good thing.
Similarly, the Groups section of .mac suffers virtually the same requirement. Unless the .mac subscriber base were to increase signifigantly from where it is now, both applications are not useful.
Cheers!
Scott
Gigabit Ethernet Power Mac G4 Mac OS X (10.4.1) Airport Extreme, TiVo Desktop, 4 HDDs, 1 GB RAM, DVD-A04, Zip 100, RAID 0, Dual displays

Is it possible to perform network data encryption between Oracle 11g databases without the advance security option?

Is it possible to perform network data encryption between Oracle 11g databases without the advance security option?
We are not licensed for the Oracle Advanced Security Option and I have been tasked to use Oracle Network Data Encryption in order to encryption network traffic between Oracle instances that reside on remote servers. From what I have read and my prior understanding this is not possible without ASO. Can someone confirm or disprove my research, thanks.

Hi, Srini Chavali-Oracle
As for http://www.oracle.com/technetwork/database/options/advanced-security/advanced-security-ds-12c-1898873.pdf?ssSourceSiteId… ASO is mentioned as TDE and Redacting Sensitive Data to Display. Network encryption is excluded.
As for Network Encryption - Oracle FAQ (of course this is not Oracle official) "Since June 2013, Net Encryption is now licensed with Oracle Enterprise Edition and doesn't require Oracle Advanced Security Option." Could you clarify this? Thanks.

How can I allow send referrers in site (same domain) only but not between sites?

I don't want other sites to know from which site I went there. (Sending referrer between sites.) However, some sites only function when referrer is sent on site (same domain).
Is there a way to accomplish this? No sending referrers between sites but in sites: yes? If not Firefox, Chrome?
Thanks.

Hi , I think this addon is what you need [https://addons.mozilla.org/en-US/firefox/addon/refcontrol RefControl]
About this Add-on:
You create a list of sites, and the referrer that should be sent for each site. You can choose to send that referrer unconditionally or only for third-party requests. Additionally, you can specify the default behavior for any site not in the list.

Are the Facetime Video and Audio encrypted between users?

Are the Facetime Video and Audio encrypted between users?

I don't know the answer but I hope someone who does will respond. I know Skype is encrypted and I know Google talk is not. I am a psychotherapist, and I use webcam to conduct therapy occasonally, and naturally, I need an encrypted audio/video to help maintain client confidentiality. I would love to use FaceTime. Despite some on this forum, I use it with Lion and I have less problems with FaceTime than I do Skype. But I can't use it for my clients until I know for sure that it is encrypted. Anyone out there with a knowledgable answer for both Cephsaiii and me?

Firefox hangs between sites....slow load time....sometime up to 2 minutes

6.0 is way too slow between sites.....some loads take up to 2 minutes to load. i have updated all plugins

Install Adblock Plus and add these filters to the Filter Rules. 
<pre><nowiki>||stumbleupon.com$third-party
||digg.com$third-party
||twitter.com$third-party
||twimg.com^$domain=~twitter.com
||fbcdn.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
||facebook.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
||facebook.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
||fbcdn.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
||addthis.com^
||gravatar.com^
||aolcdn.com^
||google-analytics.com^
||www.google.com/friendconnect^
*/friendconnect/friendconnect.js </nowiki></pre>
AdblockPlus 
https://addons.mozilla.org/firefox/1865/ 
Also, read this: 
http://adblockplus.org/en/getting_started

DFSR replication stopped between sites after all servers updated (Event 1202)

Hello,
I'm afraid, i will greatly appreciate any help on this one.
I'm working on it since 2 days without success (I read many thread without help).
So the fact:
I have 2 AD (2008 R2) on site 1 and 2 AD (2008 R2) on site 2.
I have also 2 files servers (2008) on site 1 and 2 files servers (2008 R2) on site 2.
The files servers run DFS system.
DFS Namespace is host on all AD.
DFS Replication and share are on all files servers.
After update all my servers. I got a big problem.
Communication between files servers and AD of site 2 isn't working properly now.
By this fact, DFSR is not working anymore between site 1 (all seem fine on this site) and site 2.
DFSR on site 2, pop this events all time:
Event 1202 - Source DFSR
The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused
by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.
Additional Information:
Error: 160 (One or more arguments are not correct.)
Event 1055 - Source GroupPolicy
The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
>dfsrdiag dumpadcfg
Operation Failed
>dfsrdiag pollad
Operation Failed
On ADs site 2, dcdiag /e don't reveal any issue.
I tried to install hotfix ref on this thread (without help) -> https://social.technet.microsoft.com/Forums/en-US/7d486eb5-6b03-471c-a4dc-65826e712fc3/dfsr-replication-event-id-1202-the-dfs-replication-service-failed-to-contact-domain-controller?forum=winserverfiles
I don't have issue with DNS (nslookup work fine).
Firewall are disable on all servers.
My problem looks a bit like here (but he don't speak about 2008 R2 - old article) -> blogs.technet.com/b/askds/archive/2011/04/08/restrictions-for-unauthenticated-rpc-clients-the-group-policy-that-punches-your-domain-in-the-face.asp
Any help will be greatly appreciate.
Fabien

Hi Fabien,
Do you use the ping command to check basic network connectivity? Please refer to the article below to clear bad information in Active Directory-integrated DNS:
How to clear bad information in Active Directory-integrated DNS
http://support.microsoft.com/kb/305967
You could also refer to the threads below to troubleshoot the issue:
DFSR failed to contact domain controller
https://social.technet.microsoft.com/Forums/windowsserver/en-US/eae32fb9-3234-402a-be8b-2ab9555fd25d/dfsr-failed-to-contact-domain-controller?forum=winserverfiles
GPO not replicating and GPO's during today not always applying
https://social.technet.microsoft.com/Forums/windowsserver/en-US/ff885ae8-497f-48c1-b30b-efea95016334/gpo-not-replicating-and-gpos-during-today-not-always-applying?forum=winserverGP
Best Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Solutions to overcome IP conflicts between sites

The company I work for recently bought out another company. Currently we haven't found the need to integrate them into our network but that some will come about in the near future. The problem we have is that both our internal networks are utilizing 10.x.x.x space and are too large to re-IP our networks. We have a VPN tunnel set up with them and are NATing them to selected resources at the moment but this is not a scalable solution moving forward. I'm looking for ideas/solutions to overcome this problem.

I think we would need more detail to understand how the engineer sees it working.
As I say VxLAN would allow you to merge the same IP subnet in both sites into the same vlan so that vlan now extends between sites.
Whether you want to do that is another matter.
Again, as far as I understand it, VxLAN is generally used in virtualised environments in DCs and I haven't see any cases of using it to extend client vlans in the way I think your engineer is proposing.
Doesn't mean it couldn't be done and I haven't used it so I wouldn't like to say one way or the other but I would have thought there would be new kit you would need eg. VxLAN gateways etc.
But like I say, as far as I can see, even if it was possible what he is proposing is to extend your L2 vlans between the companies and I would think carefully about that.
In addition I can't see how it would solve the problem of two devices using the same IP address as they couldn't exist in the same vlan.
Sorry I can't be more specific but I have no direct experience with it. I would certainly want to see some sort of proposed design etc. from the engineer though and all the implications spelt out before you go down that road.
Jon

Difference between .mac and private site uploads

My .mac site is perfect but the same site, when published to a folder and ftp'd to my private domain, has strange problems:
1. I use the the blog template for art reviews. Each review works fine on the .mac site but when I move around on the private domain site I get a 404 error. By moving around I mean using the "previous" and "next" buttons.
2. Some of the links from the home page to one of the review pages hasn't worked so I've had to take them off. But they worked on the .mac site and not on the private domain one.
3. I use the blog template for multiple art reviews, slide shows and press releases - and have the same problem no matter how I do it. And I've tried redoing it over and over and over.
Take a peek and you'll see.
Try the "next" button and see what happens on each of these sites:
http://www.theartofrwfirestone.com/Reviews/Entries/2007/4/3at_the_Walter_Wickiser_Gallery%2C_NY%2CNY.html
http://web.mac.com/franktobe/TheArt_of_R.W._Firestone/Reviews/Entries/2007/4/3_at_the_Walter_Wickiser_Gallery%2C _NY%2CNY.html

Hey, I understand why you asked why I deleted the public_html folder. I've been trying everything because NOTHING works. But I've got everything back in place and now my public_html folder has two items: an index.html file and the folder with all my pages. When I go to that folder on my desktop and click on the index file and then go into my REVIEWS (blog template) section, all the pages and links work.
BUT, when I do it online, I get NOT FOUND errors like this one. Thus my frustration.
Not Found
The requested URL /RWFSite/Reviews/Entries/2007/3/5â€œFeelingsâ€_Exhibition_at_Wickiser_Gallery,NYC.html was not found on this server.
Could it be that the page name is the title and it has special characters?
Could it be that the page name is too long?
Could it be that iWeb is not the right product for me?
Also, when this is all fixed, then I have to go into every html page and add keywords and description meta tags because iWeb doesn't seem to enable this feature.
Thanks for any and all help, suggestions or comments.

Trustsec Mac Encryption Between Sites

Similar Messages

Maybe you are looking for