Networking-Notes

// Check pigtail for errors connect to expert mode sudo pigtail  ======================= //Capture from  FTD cli connect to expert mode tcpdump -n -i management0 host 1.1.1.1     <-- Destination ctrl c to stop

After an upgrade cisco router couldnt establish ipsec tunnel During debugs i see the below logs # debug cry isa sa *Jun 16 19:47:12.296 EEST: ISAKMP: (0):retransmitting phase 1 MM_NO_STATE... *Jun 16 19:47:12.296 EEST: ISAKMP: (0):: incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 *Jun 16 19:47:12.296 EEST: ISAKMP: (0):retransmitting phase 1 MM_NO_STATE *Jun 16 19:47:12.296 EEST: ISAKMP-PAK: (0):sending packet to 88.28.206.154 my_port 500 peer_port 500 (I) MM_NO_STATE *Jun 16 19:47:12.296 EEST: ISAKMP: (0):Sending an IKE IPv4 Packet. *Jun 16 19:47:12.296 EEST: ISAKMP: (0):retransmitting phase 1 MM_NO_STATE... *Jun 16 19:47:12.296 EEST: ISAKMP: (0):: incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 From the logs the issue seems to be phase 1. If you see there are increment attempts. Which means PH1 is cannot be established As we know isakmp is the PH1 of the IKEv1 IPsec.   Cisco deprecated DH group 5 form supported algorithms on XE...

  The issue was licensing The issue was the license under >Management Appliance> System administration > Smart licensing   There was an error there stating that sma stopped communication with smart account for more than 90 days. Go to    sma cli and run >Grep >16 " Tue Jan 14 00:24:08 2025 Warning: Failed to renew certificate of the product with Smart Software Manager due to {"product_instance_identifier":["ProductInstance '870ae19a-351-4bbc-a73a-b8b9aef26166' is not valid"]} " "To resolve this you need to go and re-register the SMA to smart account (smart license > Action > Reregister. Need to create token) " Mon Jan 20 12:20:35 2025 Info: Renew authorization of the product with Smart Software Manager is successful. “

Use case: Split tunnel remote access VPN   In split tunnel VPN most of the times we are passing clients networks (most of the times private addresses) over the tunnel. That means that the remote workers they are using their local internet line to access the internet.   What if they want to “pass” some urls over the tunnel? Most of the cases that happens if the specific destination need to be accessed from the gateway address.     The solution for this is Dynamic split tunnelling.   This can be configured from group-policy > Anyconnect   > Custom Attributes > +   Select Dynamic Split tunnelling And then Add the url need to be accessed over the split tunnel. *Reminder to allow this traffic from VPN filter if used and access controll used if  sysopt connection permit-vpn is enabled Documentation

  grep "212.77" Access_Logs    //Search in access Logs for specific IP grep  1 facebook grep 1 403  <- deny connections Enter the number of the log you wish to grep.      ####edo evalle to expression pou theli na kami match. []> 1 Enter the regular expression to grep. []> gmama  ||facebook  ||  Do you want this search to be case insensitive? [Y]>  Do you want to search for non-matching lines? [N]>  Do you want to tail the logs? [N]> Y Do you want to paginate the output? [N]> tail Access_Logs Live search by using ip and domain as filter grep "10.20.210.52.*box.com" Access_Logs -t

  #Show fault  To display fault information  # connect fxos To connect to the FXOS command shell(4100/9300). (fxos) # show interface ethernet X/Y To view Ethernet interface status. (fxos) # show port-channel summary To display summarised information about configured port channels. (fxos) # show lacp counters interface port-channel X Displays LACP traffic statistics for a particular portchannel (fxos) # show lacp interface ethernet X/Y Displays LACP information for the Ethernet interfaces. (fxos) # show lacp internal event-history interface ethernet X/Y Displays internal LACP events for the specified Ethernet interface

 FTD Version 7.2.5 when trying to create a cluster  FTD CLI sec-dcfw-01#  Detected Cluster Master. Beginning configuration replication from Master. .. Cryptochecksum (changed): 2f2f9cae ea5dbc33 a1eb4bda 3379b6fb  End configuration replication from Master. Unit is kicked out from cluster because of interface health check failure. Cluster disable is performing cleanup..done. All data interfaces have been shutdown due to clustering being disabled. To recover either enable clustering or remove cluster group configuration. Searching the error i found the bug https://bst.cisco.com/quickview/bug/CSCus54932 Upgrade to 7.4.2 (currently recommended) the cluster builded as expected.

  First check the FTD Memory > show memory  Free memory:        8373597176 bytes (81%) Used memory:        1992966480 bytes (19%) -------------     ------------------ Total memory:      10366563656 bytes (100%) Login as expert and check TOP. just to see what utilizing the memory > expert  FW01:~$ sudo su We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:     #1) Respect the privacy of others.     #2) Think before you type.     #3) With great power comes great responsibility. Password:  > expert  FW01:~$ sudo su We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:     #1) Respect the privacy of others.     #2) Think before you type.     #3) With great power comes great responsibi...

 Solarwinds Interface monitoring on Asymmetric lines Be aware that if you have asymmetric Download and Upload speed from your ISP and add the device on the solarwind you have to manually set the bandwidth of the interface as by default is "reading" the configured one. Even if you have configuration for bandwith and Bandwith receved.

 Useful Windows Commands Try First 1. Press “ Windows key ”, start typing “ command prompt ” on the start screen. 2. “ Command Prompt ” will appear in the list, now “ Right click ” on command prompt. 3. Click on “ Run as administrator ”, if you get a UAC prompt click on “ Yes ”. 4. Now type the command “ netsh winsock reset ”, press “ Enter ”. Check 802.1x logs of the supplicant On the client side, go to  Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational  for wireless issues. For wired network access issues, go to  ..\Wired-AutoConfig/Operational .      https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/802-1x-authentication-issues-troubleshooting

  Control plane ACLs cisco FTD On cisco firewall traffic destined to the firewall cannot be blocked by ACP. Even if you do not bypass the ACLs. Talking about control plane traffic. Eg remote access vpn. Geolocation based is not supported. https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs65322?rfs=iqvred   The solution with control plane ACL is well documented in the below link. https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221457-configure-control-plane-access-control-p.html#toc-hId-689510534

ISE Logging are missing when change the Secondary as Primary monitoring ISE01 -- PRI(A), SEC(M) ISE02 -- SEC(A), PRI(M) To resolve this go to Administraton - System - Logging - Log Settings and disable ISE Messaging Settings.

Reset the session database on cisco ISE - No way to reset the session from GUI ISE02/admin# application configure ise Selection configuration option [1]Reset M&T Session Database    <- This will clear all the sessions.  [4]Reset M&T Database            <- This will delete the logs also. Run this if [1] is not working. 1 You are about to reset the M&T session database. Following this operation, an application restart will be required. Are you sure you want to proceed? y/n [n]: y

  Bypass users from a splash page  Configure a new Group Policy (Network-Wide > Group Policies).  Splash page bypass can be configured by selecting "Bypass" in "Splash" dropdown, see the picture below: Leaving anything else as "use SSID default" will ensure that all the other global configuration is left untouched. Once a group policy is assigned, navigate to  Network-wide > Clients > click on the clients name > look for Group Policy > change from Normal to the group policy you created.

Run Upgrade Readiness Tool (URT) to validate config DB upgrade from 2.7,3.0,3.1 to 3.2. This is a signed bundle for image integrity (ise-urtbundle-3.2.0.542a-1.0.0.SPA.x86_64.tar.gz) In this case i am running ise 3.1 patch 7 and will upgrade to 3.2 As we are running an HA the URT need to run on secondary admin node. Got the below error once i tried to run it on Primary Checking ISE persona ======================================================   - Failed (URT can only be run on Secondary Admin Node or Standalone % Application install or upgrade cancelled. ise03/admin# ====================================================== *Note When you need to run it on secondary note, you have to generate on secondary the key (crypto host_key add host 10.10.10.10) and then you can run the URT. Below is URT logging ise04/adMIN# application install ise-urtbundle-3.2.0.542a-1.0.0.SPA.x86_64.tar.gz  ""SFTP-SRV01"" Save the current ADE-OS running configuration? (yes/no) [yes] ? yes Gen...

  Go to Administration-System-Maintenance and select Repository Add new repository and complete the required fields After this the setup need this additional command to work You have to login through cli and run the below command ise/admin# crypto host_key add host 10.10.10.10 Where 10.10.10.10 is your SFTP server Thanks to https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/215348-how-to-configure-repository-on-identity.html#toc-hId--287746172

SECURITY WSA //Check WSA authenticated Users //authcache Then select LIST option ISE //Check restore status for backup and restore procedure // show restore status (here i wish you this command to finish and not stay forever in progress) //check process status // show application status ise //restart ISE application // application start ise //Add SFTP command// crypto host_key add host 10.10.10.10 //Rset ISE GUI password  application reset-passwd ise <username-here> //Factory reset cisco ISE from cli  // reset-config Copy From FTP  //copy ftp://cisco:cisco@10.10.10.10/C9800-CL-universalk9.17.09.03.SPA.bin bootflash:

  Check IP to User mapping on FMC expert user_map_query.pl -i 10.10.10.10 (to check for IP to user mapping) user_map_query.pl -u bob  (to check user to IP mapping) If results display "For policy = 1" then this is set to propagate to FTD Credit to my old colleague Panos blog  😊 https://nettechnotes.blogspot.com/2018/11/cisco-fmc-ftd-user-to-ip-mapping.html

Working on 2 ftds today, one those FTD2120 was continuously booting in rommon. At the beginning I didn’t realized that was confreg issue. Thus, I proceeded and fully reimaged the device. Once I reimaged on the reload FTD stacked again on rommon. Then I realized that was something wrong with confreg on rommon Running the help command I saw the confreg command Running the confreg I saw the below "Configuration Register: 0x00000000"   Then I run the command  confreg 0x1 from rommon rommon 9 >   confreg 0x1 You must reset or power cycle for new config to take effect   rommon 10 > reboot Restarting the system... After that everything was ok 😊

  Having a customer running FTDs managed by FMC configured for remote access vpn. The authentication is performed through LDAP.   Taking a request that they can’t login with anyconnect and the message login failed appeared. Then I resetted my own password from AD as I didn’t save it when I created it (if I don’t save it on KeePass then always need a reset). I tried to login with my credentials and I successfully connected.   Then I knew that the issue was with specific user. I checked the FW config and everything was there correctly!   Intead of resetting the password I proceeded with some debugs on the firewall to better understand and find the issue. Before that I connected on FTD cli then on system support diagnostic-cli    sho debug debug aaa authentication enabled at level 1 debug aaa authentication enabled at level 1 (persistent) debug aaa authorization enabled at level 1 debug aaa authorization enabled at level 1 (pers...