I'm moving from a 5505 to a 5520 and moving to a different location. I have a certificate on the 5505 that I want to export to the 5520.Can I export that key/certificate and import to the new ASA? Is there a problem since its a different location with a different IP ? (Domain name is the same, I moved the name on the DNS also)Do a have to re-do the signing process with the CA ?
View 3 Replies
When I attempt to export the certificate for the quickvpn client via the router web interface, it looks as if the export works, and it asks me to save the zip file. However, upon opening the zip file I receive the error: The compressed folder is invalid or corrupted.
This happens in multiple browsers, from multiple machines.
i was connected to my rv042 via remote management / browser, and tried to add vpn clients. i generated a new certificate and then i clicked on export for clients. by doing this, the remote management disconnected and i cannot access the router anymore.
how can i get the new .pem file from remote? do i have to make somebody turn off and on the unit to get back remote access??
p.s.: after turning off an on i tried the same steps again: everytime i click on "export for admin" or "export for client", this kills the remote management and the unit must be hardreset. now: how do i get the newly created client certificate off that unit ?? otherwise i will have to drive 350 km just to grep that file ?!?!
I am setting up Clientless Anyconnect on ASA 5520. I have a Verisign Cert but when I go to Certificate Management-->CA Certificates-->Add, I put everything in and click "install certificate" I get an error. FYI I have the Primary Cert Authority Installed already?
View 1 Replies View RelatedIn my test lab I can't to make work my webvpn configuration = I have several components: MS AD, MS CS (but without NDES), router 2911 and client computer. Client and router have a certificate from MS CS. In my configuration I use authentication by certificate or aaa (LDAP) and authentication by aaa working good. But authentication by client certificate doesn't work. And my internal https services don't work also - "Invalid or no certificate", but this strange because I imported CA certificate for this.
My 2911 version: Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(3)T, RELEASE SOFTWARE (fc1)
My Config:
aaa authentication login webvpn group ldap local
ip local pool webvpn 192.168.200.1 192.168.200.254
bind authenticate root-dn cn=webvpn,ou=staff,dc=domain,dc=com password P@ssw0rd
webvpn gateway vpn
ip address <ip address> port 4443
ssl trustpoint root-ca
[code].....
I am planning to setup Clientless Web VPN on our ASA 5505 for secure access to a internal web resource from outside. When I checked the licensing details on the ASA using #sh ver I could notice thar Web VPN peers allowed is only 2 Does this mean that only two clientless simoultaneous connections are possible ?
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
[Code]....
I have 2 ipsec tunnel active on ASA5505 (secplus license).I would like to activate sslvpn also. Is it possible or there are issues in keeping active both services?
View 3 Replies View RelatedI am having trouble accessing shares via client SSL VPN. I have an ASA 5505 running 8.4(4)1 The share is on on Ubuntu server 11.04 running Samba 3.5.8
This may not be strictly a Cisco issue and it seems to be an interoperbility issue between ASA and Samba. Or simply the smb.conf configuration.
I suspect the issue is down to the interpretation of Lanman on the ASA as I know the usernames and passwords work correctly when accesing the shares from other platforms (Windows Vista and Ubuntu desktop 12.04)
When monitoring the Samba logs I get the following errors: (amongst others)
ntlm_password_check: NT MD4 password check failed for user testuser
Storing account testuser with RID 1000
check_ntlm_password: sam authentication for user [testuser] FAILED with error
[Code].....
I have a problem with latest Anyconnect Mobile clients, on any device(iPhone,PC..) I have this error message.Anyconnect cannot verify the VPN serverAll certificates(rootCA,userCER) - installed on client side, all of them are trusted.
View 1 Replies View RelatedAny instructions to configure an ASA to allow authentication by certificate only on an AnyConnect vpn?I'm running an ASA 5505 with 8.4(1) and AnyConnect 2.4.7030 on an Android phone.I currently have the AnyConnect client connecting ok using username / password for authentication.
I have loaded the company root certificate (internally generated) into the ASA "CA Certificates" and generated an Identity Certificate for the ASA.
There is ASA with remote access VPN and users are authenticated using third party signed certificates (CA is not local in ASA).When user certificate expires i can see it in syslog messages. For example:
%ASA-3-717009: Certificate validation failed. Certificate date is out-of-range, serial number: (...)
I would like to know if there is an opportunity to view user's certificate expiry date beforehand, say, 3 days before?
i am working on ISE 1.1.1, surprisingly i couldn't found certificate authority certifiate at certificate operation anymore.
would it be the change on GUI? So now where i can import the CA certificate to ISE?
I'm trying to migrate old data from WCS 7.0 to Prime 1.2 ... I have already created the zip file from WCS and imported it into the defaultRepo on Prime. I see it in the directory when I do a show repository defaultRepo so I have confirmed that it is there. My issue is that it appears Prime 1.2.1.012 won't accept the cli command of ncs migrate.
how I can proceed with the migration? I haven't been able to find any similar command in the Prime CLI so at this point I'm lost as to where I should go from here. I really don't want to have to tell the customer they have to downgrade to Prime 1.1 in order for them to perserve their maps especially since the Deployment Guide for Prime Infrastructure states that it is possible to migrate date from WCS 7.0 to Prime 1.2 as shown below ...
Data Migration
#
Data can be migrated from WCS 7.0, NCS 1.1, or LMS 4.x. More details on migrating data from each of these applications are spelled out in the following sections.
[Code].....
I installed a chained SSL cert on our anchor/guest 4402 a few years ago.We now have a need to replace the 4402 w/ a 5508, and I got everything configured, ready to go, except that darn cert.I can no longer locate the private key that was used to sign the original CSR.Is there any way to export the current cert from the 4402, so that I can import to the 5508? Or am I SOL?
View 3 Replies View RelatedI have done a WCS 7.0.220.0 to NCS migration prior to moving to Prime 1.2. I followed the instructions to export the WCS database via the export.bat all command and exported the database. However, when I import this zip fileto NCS there do not seem to be any of the original WCS templates. All the maps and AP details have migrated but no templates.
I have tried the export again and ploughed through the resultant zip file looking for anything that looks like template files but there is nothing immediately apparent that looks like templates.
Got an problem with LMS 3.2/Solaris.
See no devices both in DCR and RME, besides, in RME device counters (Normal/Pending/etc) are equal to current device count, but then you try to select them for any operation, you unsucceed - 0 device selected, no list of devices, unable to export, no ability to do anything.
Upgraded to 3.2 SP1, no change. Spend a lot of time digging through logs at /usr/adm/CSCOpx/logs, find no problems at all. Seems, that some database parts were corrupted.
I decided to reinstall LMS from the scratch, but to do so I need to export the DCR device data and credentials.
Database is alive (dbaccess.pl install going smoothly, then connection with user lmsdatafeed works and allows to connect and select data from any SQL tool), but this view is not enough for getting from the DCR both device data and credentials.
I have the DB password I set up during installation.
Is there any way to get data I need connecting to LMS database directly with some kind of sysdba SQL database user?
I am trying to export our network devices from ACS and I can't find out where it is exporting it. Under ACS 5.2 "Network ResourcesNetwork Devices and AAA Clients" you get the list of your network devices and at the bottom of the page there is an export button. When you click it you are given an option to password protect it which I didn't check the box and I pressed Start Export. The window flickers like it processed the request, but nothing happens. There isn't any pop-up to download the CSV. I have also tried setting up a software repo thinking it might just send it to that, but it didn't work either.
View 2 Replies View RelatedThis feature is not working on our LMS installation. I have tried different browsers but is always giving the same error. It seems to be Java related.
View 0 Replies View RelatedHow to export Air Quality reports from a 5508? I'm pretty sure I have read that we can not look back in time at the Air Quality report from the WLC, but can from NCS. If NCS was in the picture, can the Air Qaulity Report somehow be exported?
View 3 Replies View Relatedcisco 2651XM router with WIC1 adsl card and NM-16ESW switch
IOS: c2600-ipbasek9-mz.124-23.bin
I use the following config to export traffic from the adsl card to a fasterthernet port so I can look at the adsl traffic in wireshark on a pc:router(config)#ip traffic-export profile my_rite router(conf-rite)#int FastEthernet 0/0 router(conf-rite)#bidirectional router(conf-rite)#mac-address abcd.efgh.ijkl (mac address of PC) router(conf-rite)#exit router(config)#int dialer0 router(config-if)#ip traffic-export apply my_rite this config works and I can see stuff going on in wireshark but it's only one way. This config only shows traffic going out from my adsl card, but no incoming. There is defintely traffic going both ways because everything about my adsl connection is working perfectly. I've tried using a different fastethernet port, even tried exporting to a different pc but all I see is outgoing ie: source is my public ip address but never as destination . I have bidirectional in the config but it still only shows outgoing. I even tried a different IOS (c2600-adventerprisek9-mz.124-15.T8.bin) but still it doesn't show incoming traffic. Could it be my ISP in some way hiding incoming traffic from view?
Creating several Inventory-Report Templates via Report Designer I was asking myself how to export/import these templates for use on other systems, performing backup.
View 1 Replies View RelatedI am using a Thrid party NetFlow tool, Enabled NetFlow on the Cisco 6500 as per recommendations and getting only half amout of traffic passing thorugh the interfaces. I have verified with 3 different NetFlow based tools, everything showing the same value. Is there any bug in my Cisco 6500.
View 2 Replies View RelatedI´m wondering if it`s possible to export the defualt web auth portal(web login page) via tftp to a computer from the Cisco WLC 5508 and then modify it and then import that customized portal to the WLC 5508?
View 6 Replies View RelatedI want to export the ACS local user's records.Then import to other ACS5.3 server.But the export file not the user's password record.I cannot import it well....
View 1 Replies View RelatedI have new ASA 5520 units currently we are using ASA 5510... I have to migrate all the configuration to the new ASA 5520 units....I am wondering is there a possible way to export and import certificates from ASA 5510 to 5520....
how to export or copy all the configurations, plug-ins, certificates from 5510 to 5520.Existing configuration snapshot...CA certificates from third party installed for authentication and identity certificate from Verisign
WebVPN
Anyconnect
Plug-ins
IPSEC tunnels
NAT
We are trying to sniff traffic in one of our routers 2811 IOS 12.4(3f) capturing data into the flash memory and tftp later to one of our servers. We had followed the command procedure as it is indicate in Router IP Traffic Export Packet Capture Enhancements doc but it seems that the mode capture option is not alllowed in my router. My question is Why? I had read the doc and the hardware and software should support this feature.
ROM: System Bootstrap, Version 12.4(1r) [hqluong 1r], RELEASE SOFTWARE (fc1)
yourname uptime is 2 weeks, 4 days, 22 hours, 14 minutesSystem returned to ROM by power-onSystem image file is "flash:c2800nm-ipbase-mz.124-3f.bin"
Cisco 2811 (revision 53.51) with 251904K/10240K bytes of memory.Processor board ID FCZ104174196 FastEthernet interfacesDRAM configuration is 64 bits wide with parity enabled.239K bytes of non-volatile configuration memory.62720K bytes of ATA CompactFlash (Read/Write)
I have an ACS applicance that had a version 5.1 and i did an upgrade to 5.3 with latest patch.For some reason, the runtime process got stuck in (reinitializing and restarting) state.i did the recommended action to perform ACS stop and ACS start and even hard reset of the appliance, but it did not cut itThis process turned out to be a bug and it should have been fixed in version 5.3, but it has not i guess
i know that acs reset-config will solve the issue, but i have a problem here , the license file will be deleted as well with the config and i cannot find a way to export the license and then import it into the reseted config ACS hardware. Unfortunately, the license file is not saved anywhere in the company and i cannot affort to lose it.how to export the license from the applicance (CSACS-1120)?
In Cisco ASDM 7.1(1), webvpn configuration, it is possible to configure bookmarks with "vdi://" links to Citrix's or Vmware's Virtual Desktop Infrastructures, but we couldn't find any configuration resource (conf guide) on official Cisco site: if it is actually possible to integrate Vmware View Client into ASA 9.1 WebVpn solution?
View 1 Replies View RelatedI have three ASA5505, two firewalls connected to central VPN hub. the central inside network is 192.168.0.0/24,Network A is 192.168.1.0/24,Network B is 192.168.2.0/24,In one of this site (central), I have server with NetFlow collector.,I will collect the traffic information from all ASA at the my one serverCan I configure source IP address (or source interface - inside) for NetFlow packet, originate from ASA? (for example from site A)If it is not possible I think, I can rewrite my access lists and permit udp traffic from outside interface to server IP like this:access-list VPNACL permit udp host <Outside IP site A> host <Inside IP the Server> eq 9996,But I do not understand, what port I must be use in access list on Central site ASA. ,access-list VPNACL_A permit udp host <Inside IP the Server> host <Outside IP site A> eq 9996 ? or, in this place, must be source port in the udp netflow packet?
View 2 Replies View RelatedTo enable netflow export on ASR1001, do i need the firewall feaure license or not ?Docs are not really clear, NBAR requires FW license, but i am unsure about Netflow?
View 1 Replies View RelatedI try to export a Detailed Device Report to a CSV. It failes:
<HTML><META HTTP-EQUIV="content-type" CONTENT="text/html;charset=utf-8">
<H1>HTTP Status 500 - </H1><HR SIZE=1 noShade>
<P><B>type</B> Exception report</P><P><B>message</B> <U></U></P><P><B>description</B> <U>The server encountered an internal error () that prevented it from fulfilling this request.</U></P><P><B>exception</B>
[code].....
Exporting to PDF works OK.CW is running on Windows server. RME is 4.3.1
trying to export WCS data in order to migrate to the NCS but getting bellow error messages while following the Exporting WCS data doc:
D:Program FilesWCS7.0.172.0in>export D:wcs.zip
Error occurred during initialization of VM
Could not reserve enough space for object heap
Could not create the Java virtual machine.
The procedure i am tring to follow:
To export WCS data, follow these steps:
#Step 1 Stop the WCS server.
#Step 2 Run the export command through the script file and provide the path and export file name when prompted.
#Step 3 For Linux, run export.sh all /data/wcs.zip. For Windows, run export.bat all datawcs.zip.
I do have enough available space, the WCS runs as VM
I've seen a discussion about importing mac addresses into the mac filter db on a cisco controller but is there a way to export the mac filter db? I have a Cisco 5508.
View 2 Replies View Related
