Cisco VPN :: 2811 / How To Generate And Write A Clients Certificate On Etoken
Sep 28, 2011
I need:
cisco 2811 IOS CA as server
cisco vpn client + etoken (aladdin) as client
certificate enrollment from cisco vpn client and vpn connection with it works at present, but I don't know how to use etoken with it, how to write the client's cert. to a token.i used this doc:Configuring IPSec Between Cisco IOS Routers and Cisco VPN Client Using Entrust Certificates[URL]in chapter "Certificate Enrollment for the Cisco VPN Client", in section 3 there is a screenshot with an example of a certificate enrollment, where the specified name (CN) as vpnclient, but in section 5 "view the certificate ", common name specified as Joe Smith, etc.where this client's data is obtained? it's not clear to me... how to generate and write a client's certificate on etoken, who uses cisco vpn client with it for connect to server?
I have a pair of ACS appliances running 5.1 code. The appliances are set up as a replicated pair. I have valid local and trusted certificate authority certificates on the primary.
The trusted certificate authority certificate gets replicated to the secondary. Obviously the local certificate doesn't get replicated. I need to generate a certificate signing request on the secondary but it doesn't seem to allow you to do it.
Right now the Self-signed Certificate on my RV180W generates errors as it was issued to the MAC address instead of the current IP address. Need instructions on Generating a Self-Signed certificate (or 1 from my Windows Server 2012 Certification Authority) that will eliminate the constant barreage of certificate errors I get when trying to access the management interface of my device? the internal domain is mythos.local, netbios name of MYTHOS, and the device name in question is surtur.
I have installed a new SSL certificate on our ASA 5500. I removed the old one, installed the new one. And associated the trust points with the interface we use for Web Connect and Any Connect connections.
They are still seeing the old expired certificates. Users can still log in and authenticate but I would rather them see the correct certificate.
I need this SSL certficate installation on my acs appliance 1120 for PEAP clients.I have exported SSL server certficate from my old acs 3.3 server which is under acscertstore folder issued by CA vendor . I need to reuse this same SSL certificate on my acs appliance .ACS appliance certficate setup requires following two certificate to be installed for PEAP clients authentication
1) Server Certificate
2) CA certificate
Server Certificate : For server certifcate , I have my old certificate which is exported from my old acs 3.3 server , when i tried to download my server certficate via ftp server on my acs appliance , its looking for private key & private key file .Private key & file is generated intially on CSR request when this server certificate is requested to CA vendor for my old acs 3.3 . I dont know the private key password . If i need private key & file , then i need to generate new CSR from my acs appliance and i need to submit this CSR output to my CA vendor to generate new SSL server certificate .which is something like new server certificate request .CA certficate : For CA certficate , when i open my existing SSL certificate under detials tab in CRL distribution point , i could see below URL . whn i open this URL it giving certificate revocation list . [1]CRL Distribution Point.
We are deploying BYOD with Cisco ISE 1.1.2 and WLC (5508) using 802.1x authentication.Windows clients cannot connect to 802.1x SSID with the following error on ISE:Authentication failed : 12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
The client doesn't have preconfigured wifi profile or root certificate installed.The concept of BYOD suppose that you can connect your device without any installed certificates and preconfigured wifi-profiles.
The problem is that Windows 7 supplicant does not send TLS alert in pop up window, when connecting to 802.1x SSID.If this alert is seen, than you can accept it and proceed the connection. After that you will be asked to install ROOT-cert, get your own cert and etc.So, the question is: how to make the windows supplicant to show the pop-up window with TLS alert?
p.s. the attached file shows the example of pop up TLS-alert window
There is ASA with remote access VPN and users are authenticated using third party signed certificates (CA is not local in ASA).When user certificate expires i can see it in syslog messages. For example:
%ASA-3-717009: Certificate validation failed. Certificate date is out-of-range, serial number: (...)
I would like to know if there is an opportunity to view user's certificate expiry date beforehand, say, 3 days before?
We are already having a True business ID certificate from Geotrust for our SSL VPN on CISCO ASA 5510.this is working fine.
We are now changing our device from ASA 5510 to ASA5520 in failover setup. As we check with Geotrust they are asking us to create a new CSR with same parameters from new ASA5520 device and reissue the certificate from their site.In this context how to create a new CSR from ASA5520 8.2(5). create CSR from ASA 5520 8.2(5)
I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
We currently have an ASA 5520 communicating with 10 ASA 5510's, all on static outside addresses. I was asked to add 5 additional 5510's on dynamic address. All worked well in testing until it was decided that some of the dynamic clients needed to talk to each other.
I have an issue with rme 4.2 from LMS 3.1 When I try to generate a syslog report this shows me nothing. I locate SyslogCollector.log file and I see sometnig wrong.
I am running CiscoWorks LMS 4.0.1 since 6 months and I wanted to generate today a report about the interface utilization on 2 Cisco switches (Catalyst 3750G). The corresponding job is created, it runs and then i get "succeeded with info" in the "Run Status" column. When I want to click then on the "View Report" link, I get the following error: "Could not generate the report. Either data is not available for the specified duration or the report job failed."
I tried the same procedure with 2 other switches but I have got the same result.
I have 4 desktops cat5 to Dlink DIR 615 router. All work fine. Any wireless clients, laptop or netbooks, see the desktop computers for a while then disconnect somehow. All machines can see the Internet through the router at all times. The desktops disappear from the laptop/netbooks but the wireless machines can be seen from the desktop computers but clicking on them gets 'Access Denied' message after a wait.3 desktops = XP, 1 98SE. All laptop/netbooks = XP
we have a policy on ACS to disable user account (Internal user identify store) after X days if password is not changed. However, a few days before the password expires, there is no notification for users unless he happens to log in IOS router (tacacs) through console. in other words, if he logs into IOS devices through VTY, there is no notification at all.some users got locked out becuase they were not notified to change password. What setting on ACS 5.2 must be configured to display warning on VTY before password expires?
I am unable to generate bug summary report in RME. Even I can not generate PSIRT report as well..LMS always gives error "incorrect cisco.com credential. enter correct credential" I have checked my credentials are correct... it gives me error no BTKT:0014..I am using LMS 3.1 attaaching snap shot of my patch level and application version running on LMS...
I have configured an Cisco 881 router in our lab with netflow commands and pointed to our network monitoring tool and I want to check if the tool can collect valid traffic statistics from this router (eg. utilization). The problem this router has nothing plugged into a production LAN that would potentially generate traffic to measure using this tool.
Is there a way to configure a Cisco router (ex. Cisco 881 router) to artificially generate network traffic to test that I have setup the monitoring tool correct to capture future utilization statistics?
I have a WCS server running the version 6.0.170.0. I have already added few WLCs running the version 7.0 to this WCS. It is working fine. And now I have added two new controllers running the version 7.0.98.0 to the existing WCS server. When i add the floor layouts to the WCS and position the access points from the new controllers, the heat map is not generated automatically.
I want to see log for write on ASA5520. who & when write lastly and who write before. How to see this log. In show vershon i see last modified date, but not log.
Basically i need to test to see where the telephone lines are terminated, because when they where built into the walls the used standard cat5e cable to terminate it to an RJ-11 jack but over in the wiring panel it (i assume it is anyways) terminates to an RJ-45 jack but im not sure if this is really the cable for the telephone or something else, so i have a phone connected to the wall jack and a computer on this end and i would like to send a dial tone or any tone in general that the phone can pickup.
I have a TP-Link Wireless Router (TL-WR340G) and I use it for both Wired and Wireless connection. I have two desktops that connects to the router through cables and I also have 2 notebooks that connects through WiFi.
Now, I want to know if there is any software that can generate passwords which I can assign into individual PCs that connects with Wifi. For example, Notebook #1 has the password "abcdefghij" and the Notebook #2 has the password "1234567890" and they can both connect to the WLAN.
How to setup 2 PC to write to the same file simultaneous without loosingdata or messing up the data from any two pc in a peer to peer network?Let say a file reside on PC1, both user open a file and edit the same timeand save the data and the file contain both data from both computerwithout messing up the content from either user
I have a Netgear WNDR4500 running the stock firmware, acting as a router for my home. I also have 2 routers that are flashed with DD-WRT (Linksys WRT54G and Asus WL-520GU) running as client bridges. The Netgear is 192.168.1.1 and the other 2 client bridges are 192.168.1.2 and 192.168.10.3. The Netgear router is performing DHCP giving addresses from 192.168.10.100 to 192.168.10.254. I have numerous machines connected to the Netgear, wirelessly and wired, and numerous machines wired to each client bridge. All machines have IP addresses that are 192.168.10.100, 192.168.10.101, 192.168.10.102, etc... Everything is working fine, but I have one question: When I access the Netgear router, it shows the client bridges as clients, machines that are wired and wireless to the Netgear router are listed as clients, but the client list does not show any clients that are connected to the client bridges. I assumed that since the router is performing DHCP that all clients would show up.
We got a replacement ASA 5580 from Cisco. We were not aware of PAK, Is there any other possible to generate Activation key? Can we generate PAK or Activation Key using SO (service order) number?
I want to use IP SLA to perform simple up/down monitoring of an IP host and to generate a syslog alert if the host goes down. I have a 2650XM router running 12.4(23) IP Voice IOS. My basic IP SLA config is hown below:
ip sla monitor 10 type echo protocol ipIcmpEcho 10.55.1.1 timeout 1000 frequency 10 ip sla monitor schedule 10 life forever start-time now.
