So since my web auth cert is expiring I got it renewed from VeriSign and they sent me back the file. Do I need to again combine the "myprivatekey.pem" file and the new one that I got and then load it on the WLC? Can't find any guidelines and instructions from Cisco on this. Or do I need to go through the whole regenration of CSR process again etc?
View 3 RepliesI have a cisco 5508 WLC that I have setup WebAuth on and trying to install the certificate on. I have generated the csr and gotten my cert from Verisign (X.509, server platform=apache). I have followed the instruction via the cisco documentation url...I found an error in uploading and find out how to encrypt mykey: url...
I am also having exactly the same issue with a certificate from Thawte. I followed the unchained guide and have tried both with and without a password in the initial step key generation step, requesting a new cert each time. As with Jeensernchew's issue there are no errors in OpenSSL but when uploading the cert to the WLC get the following error. [code] The WLC is running version 6.0.196.0. I am using OpenSSL 1.0.0 29 Mar 2010.
When I requested the cert from Thawte I was asked to specify the device type, I chose Cisco, but as all the work and conversion is being done by OpenSSL, should I have chosen differently? When I do this I can load the cert in the 5508, but the controller fails and doesn't allow that VLAN or config access to the wireless network. I am at a loss of why I can load and it not work. I have verified my hostname and password and those are good.
We are currently evaluating ISE and I am stuck with the PEAP authentication (with Server side Cert).Our current setup consists of two 5508 controllers, 30+ access point. For authentication we are using PEAP with (server side Cert). We have an IAS server which is also acting as a CA server. We are using Cisco’s NAM as a supplicant on Windows XP & 7 workstations. I would like to use ISE for authentication. I would like to use PEAP with Server side Cert (similar setup like IAS). I want ISE to perform the same function in addition to profiling etc.....
I was able to integrate ISE with Active Directory but could not get it working with PEAP (server side Cert). I would also like to know if they used Microsoft’s CA server or Open SSL CA server or a third party CA server (Go Daddy, VeriSign etc.)Can you we ISE as a CA server just the way we used Microsoft’s IAS Server as a CA Server?
I have been having trouble lately getting a desktop pc that formally worked to now access the internet. I deleted the drivers and re-installed them and now it is saying it cannot renew the IP address. how to get this connected again? When I look at the hardware under device manager it says it is working properly. When I downloaded the driver again it did ask if I needed ver1 or version 3 Since my device has no version on it I chose version one.I also have a new N Rangeplus Linksys router because I thought maybe I was having router problems but that isn't it. This router is a Linksys G router and all the devices will work with it accept the one with this wireless card., I do want to change to the N router eventually.
View 4 Replies View RelatedI've got a brand new C887VA-W-E-K9 that is up and running on a BT VDSL connection. That side of it is fine... But the integrated AP module on it keeps reloading.. I can be on the AP console reading the config via 'sh run' and suddenly it'll be loading the OS again... There's no errors logged, no errors on the console or anything... (I also have yet to get the radio working, it starte dbefore I'd finished the config).
It doesn't seem to be anything I'm doing as if I just leave the console, it'll just sit there... reloading every few minutes... (Although sometimes it seems to stay up for longer).
The console just looks like this. WHich is taken from listing the running config and while sitting at the --more-- prompt... Bang...
interface GigabitEthernet0
description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router
no ip address
[Code].....
I have been confronted with an issue recently with two of my 3640 series router reloading endlessly.Initially i thought it could be a matter of MEM not well seated, but unfortunately it wasn't the problem.i have attached the gibberish produced when these routers are booted up.Be informed as well that these devices are loaded with max MEM.
View 1 Replies View RelatedI have problem with my Cisco 6506E switch.when it reloads its going to RMON mode, If I give Boot command I. The RMON, then only it will get load with the iOS image.
View 2 Replies View RelatedI installed a chained SSL cert on our anchor/guest 4402 a few years ago.We now have a need to replace the 4402 w/ a 5508, and I got everything configured, ready to go, except that darn cert.I can no longer locate the private key that was used to sign the original CSR.Is there any way to export the current cert from the 4402, so that I can import to the 5508? Or am I SOL?
View 3 Replies View RelatedI am wanting to use a cert signed by a digicert or verisign on my ASA so that anyconnect doesn't frreak out with the untrusted cert. I have created the CSR, and I uploaded the certificate, but it is still showing the old self signed untrusted cert.
View 5 Replies View RelatedWhen trying to do a cut-n-paste enrollment of a cisco 3725 router with a microsoft windows server 2003 CA i get the following error on the CA.Certificate Services denied request 8675 because The request subject name is invalid or too long. 0x80094001 (-2146877439). The request was for OID.1.2.840.113549.1.9.2=rtr31slied3.unit4agresso.com. Additional information: Error Constructing or Publishing Certificate This is when i use the router or webserver certificate.The only template that does work is the user certificate but then you get error messages that the router name doesnt match the cert name.The 3725 is running ios version 12.3(14)T3.How can we get the right templates to work ?
View 3 Replies View Relatedhow to install a wildcard certificate with only the .cer file. I've found quite a few things here in the forums, but everyone seems to also have a pkcs12 file, which I do not.
This is an ASA 5510 on ver 8.4.
I know that CSRs cannot be generated with multiple names, but if the SAN is added after the cert is ordered from Geo Trust, Veri sign, etc. can the CSS support using the cert?
View 1 Replies View RelatedI have a need to utilize two factor authentication using a machine certificate and users AD crednetials. What we would like to do is to have the ASA and AnyConnect verify the certificate exists, check against our in house CA for validity, if valid pass the user credentials to the AD servers and establish the tunnel. If not valid quarantine the session and pop a message to the user to contact the help desk ASAP. My guess is the following (using ASDM 6.6, ASA 8.6.1, ASA 5545-X):
1. under the connection profile I have select BOTH for authentication and added a AAA server group.
2. under Cert Management I have added the 3 certs that are present on all company mobile assets
- Cert America
- Cert Europe
- Cert Root
3. I have an identity cert installed from the company CA and it is selected as the device cert under connection profiles
4.Local Cert Authority is Disabled
5.Under Remote Access>Advanced>Certs for AnyConnect>
- I have mapped DefaultCertifiateMap pri 10 to Company_Cert connection profile
- The mapping is looking for Subject: CN: <Contains> (string) ----where string is a common component of each Cert listed in #2.
Question #1 - Is this correct for utilizing certs and AD auth or have a missed any steps?
Users are directed to a an initial installation URL - where the AnyConnect client performs the installation and passes down the intial AC profile which auths using only AD creds. On subsequent connections users who pass the certificate mapping check are migrated to the connection profile which uses the dual authentication method.
Question #2 - When I attempt a new installation of AnyConnect using the two factor URL . I receive an error "certificate validation error" and the installation fails - for the life of me I can not figure out why???? The machine has all three certs, using IE9 as the browser.
I am basically looking to install the wildcard on the outside interface for my ASA
View 1 Replies View RelatedWe currently are using a self-signed cert (for PEAP machine authentication) that was created on an ACS 3.3 appliance. That cert was manually installed on our laptops when they were configured for wireless conenctivity.My problem is, that self-signed cert will soon be expiring and I am not sure what needs to be done to issue a new cert AND deploy it to my Windows XP Pro clients without a service interruption. If possible, I'd like to leverage our exsiting AD infrastructure for this, but I need some direction, and time is of the essence!!
View 2 Replies View RelatedI've seen a bunch of discussions on the untrusted server cert error with self signed certs. But I have a valid wildcard that I use on my ASA. How do I make that work with out the untrusted server cert error?
View 5 Replies View RelatedI have a client that needs to update a certificate on their 2125 controller. They have created a .pfx cert that does not work because of file type. I wanted to see what the best pratice would be for me to follow installing this cert and do I need any additional cert like a CA. I found a document but am not so sure that it is exactly what I need.
AIR-WLC2125-K9 : JMX1248K0EL
System Information
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 6.0.188.0
RTOS Version..................................... 6.0.188.0
[code]....
Am I able to use an SSL cert in the proxy list for the same VIP but on a different port?
View 1 Replies View RelatedAny 3rd party CA to provide a root cert for the ACS & verify csr's generated by the 7925's? I've spoken with customer service at Verisign and GeoTrust and either i'm explaining it totally wrong or their not providing CA services for this type of secured environment. sHA1 using EAP-TLS.
View 1 Replies View RelatedI have ACS4 and i am planning to upgrade to ACS5.I would like to have such a rules:I have user1, one ASA device which is VPN concentrator for remote users.ASA have two different tunnel-groups: one which allow for logging via certificate (with mandatory pki authorization thru ACS) with disabled Xauth,and second tunnel-group with allow login thru typical Xauth with authorization thru ACS which users external database (RSA Tokens).So i have one user1 which can login thru VPN using RSA tokencode or certificate.For example: on phone user1 uses certificate, and on PC station the same user1 uses token password.For tunnel-group with pki authorization ASA checks username in ACS and in typical scenario login="CN from certificate" and password="CN from certificate". So we would need "two credentials" for the user - one for pki authorization, and second one external database (RSA token).Is such scenatio possible under ACS 5 ? where one user uses different credentials based on tunnel-group usage ?
View 2 Replies View RelatedI would like to use the NCS 1.2 to monitor Juniper SRX 210 firewall. When I try to import the MIB File from NCS, which show "Error: Failed to load MIB File "mib-802" because it is not in the resource path.what I can upload the MIB File from Juniper. [code]
View 0 Replies View RelatedI have came across some third-party ws-g5483's that I was thinking of using. But when I go to plug them in, nothing seems to happen. I have tried them in ws-c3548-xl-en and also a ws-c3524-pwr-xl-en with the same results. I know on the newer switches you can do the serviice unsupported-transceiver command but is there anything I can do to get these to work with older switches?
View 5 Replies View RelatedI use wireless internet connection and I see “third party setup = Yes under configuration. Is it about sharing data or being monitored
View 1 Replies View RelatedI am using a cisco asa5520 and i have set up remote access vpn with an AnyConnect connection profile.In the connection profile i have set up that users should authenticate using both certificate and AAA.Due to a high security requirement, the user certificate is issued from a 3rd party. This is working fine and the user now need a valid certificate and a username/password to authenticate successfully.I added the CA certificate as a associated trustpoint on the ASA box to get the certificate verification working.Problem:If Jane and Joe both have a valid certificate AND a valid username/password, Jane could authenticate using a combo of Joes certificate, and Janes username/password. Both are valid (isolated), but i only want jane to be able to authenticate with her username/password and her personal certificate.
View 1 Replies View RelatedI'm responsible for designing the network for a LAN party that will be held in October. There will be up to 400 participants and 25-30 crew members. 10 table rows, 40 participants and one 48-port gigabit switch on each table. Core network will be a couple of Cisco 3560G or similar. There will be 2xGbit between the table and core switches.So, how to set up VLANs and subnets for a 400+ people network?
1) Everything on one /23 subnet, or
2) Participants on one /23 subnet, separate subnets for servers, crew and wireless, or
3) Participants on two /24 subnets, separate subnets for servers/crew/wireless, or
4) Separate /26 subnets for each table switch and for servers/crew/wireless?
As far as I can see, the main disadvantage of all participants on one subnet is troubleshooting and isolating network problems - and the main disadvantages of separate subnets is more complex setup and that people cannot browse LAN games other than those on the same switch.
Does any one used third party SPF in Cisco ASR 1002 series routers, does it supports them.
View 2 Replies View RelatedI am thinking about running some third-party unified communications apps under VMWare ESXi5 on a Cisco SRE 900 module. According to the Cisco docs, third-party apps are supported on these modules (see table below) but the app in question is NOT on Cisco's list below.
[URL]
Some questions:
1. As long as the third-party app is capable of running under VMWare/VSphere ESXi5, is there anything on the SRE that would prevent you from running this third-party app even though it's not on Cisco's list?
2. What is Cisco's policy on the use of third-party apps that are not on their list? For example, will they take a support call on the SRE running a non-listed app. (I don't want to void any sort of support contract through the use of a third-party app not on their list).
I have a school club, but our school does not allow any wireless networks within the school perimeters.Wired are allowed, but wireless are not allowed.I plan to host a LAN party for my club, and we will have about 20-30 people.We cannot have any internet access, and I have not touched a wired stuff, There is a 24 ethernet switch, and if I buy one, and suppose I buy another 24 ethernet switch (I know there is a 48 ethernet switch), can I connect those two 24 ethernet switches to make 47 ports?* For a LAN party without internet access, can we use an ethernet switch or do we use something else?* For 20-30 people, it is recommended that we have a ~8mbps upload speed. When ethernet switches advertise 10mbps, is that upstream & downstream? When all the computers are hooked to 24 ports, does the advertised 10mbps go lower? (I have seen 100/10 mbps, and I don't know what that means)
View 4 Replies View RelatedI'm trying to connect a few of my devices to the wireless internet at home.
1.Xbox 360
2.Galaxy Tab 10.1
3.My Touch 4g
All of them can recognize the the network they just will not connect. All my freq are good 2.4 or 2.5. WEP Key works no problem, just the minute I try to connect the galaxy tab and cell phone just says "remembered, secured with WPA/WPA2 PSK." The xbox when running the test connection fails as well.
Running vista x64 home premium on HP DV7 1270us.
I had something odd happen to my Dlink router DIR-651 model. During the early evening hours someone changed the SSID name of my Router. Nothing else changed that I could see right off. So I reset the router to Factory Defaults.
View 1 Replies View RelatedI am attempting to install a third party SSL cert (GoDaddy) to properly secure the external interface of my 1811 ISR so that I can implement SSL VPN. I have tried using SDM 2.5, but that doesn't appear to be working. I am familiar with doing this on a Cisco 3005 Concentrator, but I'm not aware of how to install an intermediate cert on the 1811 (or if it's even possible), in order to properly have the GoDaddy cert properly imported and used for SSL VPN. I have gone through the CSR process and have the initial cert from them generated and have imported it, but it never appears to be identified correctly if I browse to the external interface on the router. The router always defaults to its self-signed cert.
View 1 Replies View RelatedI have windows 7 clients (supplicants), D-link access point (authenticator), Cisco acs 5.2 virtual appliance with evalution license (acts as authentication server - Radius server). I want to setup EAP authentication (PEAP) that users will be able connect to Wireless LAN with login-password. I've done some configurations, but I did not get any result. in ACS 5.2 I get this error message: 11014 RADIUS packet contains invalid attribute(s): RADIUS Request dropped.
View 5 Replies View RelatedWe have just installed a Cisco RV120W behind a third party firewall. All works correctly now, but we are struggling to get the Quick VPN clients connected. I have enabled port forwarding for PPTP & L2TP over IPSEC on the third party router, but still cannot connect (the RV120W was previously used as a primary router & worked perfectly). What ports do I need to open on the third party router to get this to work correctly?
View 4 Replies View Related