On Cisco switches you can review single port configuration
show running-config interface Gi4/0/13
In case you would like to reset single port configuration:
Config t
default interface GigabitEthernet 4/0/13
Showing posts with label Cisco. Show all posts
Showing posts with label Cisco. Show all posts
Network #PKI-4-TRUSTPOOL_EXPIRATION_WARNING
We faced, on several Cisco switches, this warning:
Mar 8 11:11:52.680: %PKI-4-TRUSTPOOL_EXPIRATION_WARNING: The Trustpool will expire in 20 days
Mar 8 11:11:52.680: %PKI-4-TRUSTPOOL_AUTO_UPDATE_DISABLED: Auto-trustpool update is disabled.
In Cisco IOS XE version 17.12.04, the auto-update feature for the PKI trustpool is enabled by default. This means the device will automatically download and update the trustpool bundle from Cisco's servers when necessary.
How Auto-Update
Works
When the PKI trustpool is due
for an update—due to reasons like certificate expiration, reissuance, or the
addition of new trusted certificates—the system will:Cisco
- Attempt to download the updated
trustpool bundle from the configured URL.
- If the download is successful, the
trustpool is updated.
- If the download fails, the system will
retry at increasing intervals: 20 days, 15 days, 10 days, 5 days, 4 days,
3 days, 2 days, 1 day, and then hourly until successful.Cisco
This process ensures that the
device maintains an up-to-date set of trusted root certificates, which is
crucial for secure operations like HTTPS, VPNs, and Smart Licensing.
unfortunately, in our case, this configuration command was missing
crypto pki trustpool policy
cabundle url http://www.cisco.com/security/pki/trs/ios.p7b
revocation-check none
to manual import certificate you must launch, through config t, this command:
crypto pki trustpool import url http://www.cisco.com/security/pki/trs/ios.p7b
to avoid problems we launched this
to view certificate status this is command
show crypto pki trustpool policy
[other articles]
https://community.cisco.com/t5/switching/trustpool-expiration-on-3750-x/m-p/2423362#M286822
PKI Trustpool Management
CISCO #HOW TO ENABLE DHCP ON SPECIFIC VLAN #switch #routers
Here they are commands that are required to, on a Router/L3 Switch, enable DHCP service.
There are other settings but, this example, simple give you a general idea:
Switch# config t
Switch(config)#
Switch(config)# ip dhcp pool description_or_vlan_name
Switch(config-dhcp)# network lower_vlan_ip subnet
Switch(config-dhcp)# domain-name domain name
Switch(config-dhcp)# dns-server dns_server_1 dns_server_2
Switch(config-dhcp)# default-router default_gateway_ip
Switch(config-dhcp)# ip dhcp excluded-address lower_vlan_ip_range upper_vlan_ip_range
Switch(config-dhcp)# ip dhcp excluded-address lower_vlan_ip_range upper_vlan_ip_range
related articles:
CISCO - Show the Complete Configuration without Breaks/Pauses on Cisco Router/Switches, ASA Firewall and WLC
On Cisco Network devices you could have necessity to show running configuration withouth breaks/pauses:
switches/router:
show terminal | in Length
terminal length 0
show run
show run brief
WLC
config paging disable
show run-config" to display the config.
Cisco ASA
Pager (saved)
terminal pager (telnet session not saved)
The default is 24 lines; 0 means no page limit.
1. Type "pager 0" in priviledged mode to set your terminal to display without any breaks.
2. Type "show run-config" to display the config.
3. Type "pager 20" in priviledged mode to set your terminal to display with breaks every 20 lines.
full article:
Cisco - ISE password recovery/Reset
I am taking note, on blog, about Cisco ISE procedure that is necessary, to be followed, in case admin password expired/do not work properly
Consider that you should, proceed to https Ise Admin password account reset too.
Application reset-passwd ise admin
After Cisco ISE Server reboot, through vmware/HyperVisore console, you should check that all services are up and running, using this command
Show application status ise
Finally, after password reset, you should save Cisco ISE running config.
Copy running-config startup-config
Monitor - Syslog using PRTG or Kiwi Syslog Server
On old blog article I already mentioned several monitoring/security tools
I am highlighting Kiwi Syslog Server that permit to:
- Centrally manage syslog messages, snmp traps and windows Event logs.
- Store and archive logs, receive promptly alerts based on critical events.
- Respornd to syslog messages
- Email alerting
- Diagnose network issues
Freeware - SolarWinds All Free Network/System/Security/DB/clients monitoring tools
<==============>
About configuring Kiwi Syslog on Cisco devices, here it is a small guide/tutorial
Kiwi Syslog Server Getting Started Guide
About configuring Syslog, on Cisco ASA, you can review this guide:
ASA Syslog Configuration Example
<==============>
At the same time I would like to mention that PRTG (free up to 100 sensors) has possibility to use sensor acting as syslog server
https://www.solarwinds.com/kiwi-syslog-server/use-cases/network-troubleshooting
Here they are old PRTG blog articles
Server - PRTG Network Monitor Tool
Monitoring - PRTG monitors freeware version until 100 sensors
Tips - Webex Cache cleaning procedure
There is an easy and quick procedure necessary , to be done, to clear Cisco Webex Cache.
It is really easy, but, in any case, I take note, about it, on blog.
Be aware that, on Citrix Environment, you should add, this path, to Exclusions list - folders that you should not syncronize (using Roaming profiles) (avoiding, in this case, to waste time during login and wasting disk space as well)
Cisco - Disable AnyConnect SSL VPN portal website
During these days I was wondering if it is possible to disable the Cisco ASA VPN page and continue to use SSL vpn with the client. These question was rasing due to security concerns about, a.e., AD user locking out.
Using ASDM you need to follow below steps.
Configuration > Connection Profiles > Check the box "Shut down portal login page"
This features seems to be confirmed in this very exhaustive article too:
https://www.linkedin.com/pulse/shutting-down-webvpn-portal-ftd-flexconfig-matt-albrecht
[original articles]
https://community.spiceworks.com/topic/2114883-disable-anyconnect-ssl-vpn-portal-website
https://community.cisco.com/t5/vpn/disabling-clientless-browser-based-vpn/td-p/3065988
Cisco - How to backup Cisco switches using TFTP
There are several ways on how backup Cisco switches (or other vendors name) can be done.
One of them is downloading TFTP client server
https://tftp.en.uptodown.com/windows
Launching it and deciding where saving configuration files.
Be aware taking note about client IP.
Later you need to connect to switches using any SSH clients (I warmly suggest using these clients:
- Solar-PuTTY Connect to any server or device in your network with Solar-PuTTY for Windows. This is an interesting Putty or PuttyCM alternative.
https://www.alessandromazzanti.com/2018/11/freeware-solarwinds-software-free-tools.html
and execute below commands on switches:
Router#copy running-config tftp:
Address or name of remote host []? 64.104.207.171
Destination filename [ce_2-confg]? backup_cfg_for_my_router
!!
1030 bytes copied in 2.489 secs (395 bytes/sec)
CE_2#
Where:- 64.104.207.171 must be substituted by your client ip address where tftp is under execution.
- backup_cfg_for_my_router is backup file name that will be created on client where tftp is under execution.
You can configure automatic backups, you simple need to read all article below indicated.
[original article]
Cisco - AnyConnect Domain Password change
Using Cisco Any Connect with AD users you may face that you account password is expired and you are unable to connect. To override problem you need to configure Cisco ASA to authenticate, to DC, indeed with normal LDAP standards (over 389 TCP port) using LDAPS (636 TCP port).
Your AD server must be able to authenticate via LDAPS (normally is not configured)
Here it is an article that explain how to do that
https://www.petenetlive.com/KB/Article/0001273
About LDAPS you can give a look to below article to have a major idea:
https://www.petenetlive.com/KB/Article/0000962
P.S. 1 for LDAP(s) testing purposes you can use ldp.exe DC utility Open utility:
C:\> ldp.exe
From Connection, select Connect.
Enter name of target domain controller.
Enter 636 as port number (this is the LDAPS port).
Click OK to confirm the connection works.
You're all done!
P.S. 2 consider that Citrix Netscaler requires LDAPs to permit users to change password when it is expired (otherwise user is blocked)
Cisco - WLC 3504 how to create new SSID and reset password
If you manage your wireless infrastructure using Cisco WLC 3504 here they are steps to create a new Wireless SSID and how you can reset password:
Server - DHCP Relay #Network #Windows Server side
During these months we worked on Network redisign project and ESX server substitution.
We had two projects convergence due to entirely infrastructure renewal (making zero point for our company).
About DHCP relay, that is the ability to lease IP to different VLANs here it the theoretically and operative part:
- On your L3 router o switch you must create VLAN interface with this row
ip address helper Server_IP
In this case you are pointing all DHCP requesta to Server_IP
https://blog.udemy.com/ip-helper-address/
https://www.ciscopress.com/articles/article.asp?p=330807&seqNum=9 - Configure DHCP Server (that usually is on another Server VLAN) to accept DHCP IP requests.
The Key point is to indicate, in below window, VLAN gateway IP.
This information is important to understand, dhcp server side, from which VLAN DHCP request is arriving from
http://gborgese.wikidot.com/dhcp-relay
https://www.itechguides.com/dhcp-relay-agent-configuration-in-windows-server-2016/
https://thesolving.com/server-room/how-to-configure-a-multiscope-dhcp-server-to-work-with-vlans-on-windows-server-2012/
Cisco - How to enable custom SNMP community on SF200
Here it is a simple and straight article that guide you through SNMP custom community configuration on Cisco SF200 and other models like (Cisco Small Business devices)
NETWORK - CISCO how to open a case #TAC
If you need to open a Cisco CASE hou need to:
1.) Logon here:
https://www.cisco.com/c/en/us/index.html
Support --> Contact Support --> Open New Case
Or using below link
https://mycase.cloudapps.cisco.com/case
2.) Open a new case
3.) Insert Serial Number, click on search button and then Next
4.) Final next page you need to fullfill case required fields (like title, problem description, email contacts etc. etc.)
Vmware - Installing Cisco ISE VM on ESX farm using OVF tool
Cisco ISE is an excellent product in conjuntion with cisco devices (such as Switches, core switches, WLC, AP and so on)
About VM installation we faced a situation where Cisco ISE 2.6 .OVA file was necessary to be imported in ESX 6.X (6.7 U3) Vmware farm.
We used OVF tool to do that, here there they are actions done about ISE 2.60 .OVA:
About VM installation we faced a situation where Cisco ISE 2.6 .OVA file was necessary to be imported in ESX 6.X (6.7 U3) Vmware farm.
We used OVF tool to do that, here there they are actions done about ISE 2.60 .OVA:
- Download Cisco ISE:
https://software.cisco.com/download/home/283801620/type/283802505/release/2.6.0 - Follow below Cisco articles:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/installation_guide/b_ise_InstallationGuide20/Installing_ISE_on_a_VMware_Virtual_Machine.html#task_326DAB6CBB544238B05768EAB3C18C6E
https://www.lookingpoint.com/blog/ise-getting-started - You must download and install OVF tools:
https://my.vmware.com/web/vmware/details?downloadGroup=OVFTOOL400&productId=353
https://code.vmware.com/web/tool/4.4.0/ovf - start --> command prompt with administrative rights.
C:\WINDOWS\system32>CD C:\Program Files\VMware\VMware OVF Tool
C:\Program Files\VMware\VMware OVF Tool\ovftool.exe --acceptAllEulas -ds= - To view .OVA content:
- C:\Program Files\VMware\VMware OVF Tool>ovftool.exe C:\=UTILITY\=NETWORK\ISE\ISE-2.6.0.156-virtual-SNS3615-SNS3655-600.ova
OVF version: 1.0
VirtualApp: falseName: ISE-2.6.0.156-virtual-SNS3615-SNS3655-600
Operating System: rhel7_64guest
Virtual Hardware:
Families: vmx-09
Number of CPUs: 16
Cores per socket: 4
Memory: 32.00 GB
Disks:
Index: 0
Instance ID: 9
Capacity: 600.00 GB
Disk Types: SCSI-VirtualSCSI
NICs:
Adapter Type: E1000
Connection: VM Network
Adapter Type: E1000
Connection: VM Network
Adapter Type: E1000
Connection: VM Network
Adapter Type: E1000
Connection: VM Network
Adapter Type: E1000
Connection: VM Network
Adapter Type: E1000
Connection: VM Network
Deployment Options:
Id: small
Label: Small
Description: Use this configuration for small deployments. This deployment
will need 16 vCPUs and 32768 Memory for the vApp.
Id: medium
Label: Medium
Description: Use this configuration for small deployments. This deployment
will need 24 vCPUs and 98304 Memory for the vApp. - C:\Program Files\VMware\VMware OVF Tool>ovftool.exe --acceptAllEulas -ds="datastore1" --net:"VM Network"="VM Network" C:\=UTILITY\=NETWORK\ISE\ISE-2.6.0.156-virtual-SNS3615-SNS3655-600.ova vi://ip_esx
- Opening OVA source: C:\=UTILITY\=NETWORK\ISE\ISE-2.6.0.156-virtual-SNS3615-SNS3655-600.ova
The manifest validates
Accept SSL fingerprint (xxxxxx) for host ip_esx as target type.
Fingerprint will be added to the known host file
Write 'yes' or 'no'
yes
Enter login information for target vi://ip_esx/
Username: root
Password: ********
Opening VI target: vi://root@ip_esx:443/
Warning:
- Line 109: Unable to parse 'enableMPTSupport' for attribute 'key' on element 'Config'.
Deploying to VI: vi://root@ip_esx:443/
Transfer Completed
Completed successfully - After this operation would be available on ESX Farm
Firewall - Two factor authentication with Cisco ASA SSL VPN
Here they are documentation and video that explain if and how to configure duo security on Cisco ASA SSL VPN
https://duo.com/docs/ciscoasa-ldap?ikey=DI3IO17MU1Y291MVX0H7&host=api-744bdf25.duosecurity.com#first-steps
https://duo.com/docs/ciscoasa-ldap?ikey=DI3IO17MU1Y291MVX0H7&host=api-744bdf25.duosecurity.com#first-steps
Networking - Cisco IP Base vs LAN Base differences
Today I would like to mention main differences about IP base vs LAN Base. (Cisco Switches)
High level differences are that LAN Base support only static IP routing.
More information could be found at below link as well:
https://community.cisco.com/t5/networking-documents/what-is-the-difference-between-an-ip-base-image-and-an-ip/ta-p/3117957
High level differences are that LAN Base support only static IP routing.
More information could be found at below link as well:
https://community.cisco.com/t5/networking-documents/what-is-the-difference-between-an-ip-base-image-and-an-ip/ta-p/3117957
Network - Cisco Smart Net Total Care Service
Today I am going to take note on my blog about different Cisco Services that are provided to end users.
At below link you might find more information and specific Cisco document .pdf with whole information.
https://www.cisco.com/c/en/us/services/technical/smart-net-total-care.html#~stickynav=2
https://www.cisco.com/c/dam/en/us/products/collateral/cloud-systems-management/smart-net-total-care/datasheet-c78-735459.pdf
What I would like to focus is on below image/Table for quick reading purpose:
At below link you might find more information and specific Cisco document .pdf with whole information.
https://www.cisco.com/c/en/us/services/technical/smart-net-total-care.html#~stickynav=2
https://www.cisco.com/c/dam/en/us/products/collateral/cloud-systems-management/smart-net-total-care/datasheet-c78-735459.pdf
What I would like to focus is on below image/Table for quick reading purpose:
Networking - Packet Tracer Free Cisco tool to have all network simulation done
There is an interesting free Cisco tools that permit you to have all sort of tests and simulations done using different Cisco devices.
An interesting part is that simulation and configuration setting up could be useful in production deployment environment as well withouth having all physical devices.:
You should register here:
https://www.netacad.com/
You might download packet tracer from below link and with several video and training on line:
https://www.netacad.com/courses/packet-tracer
Consider athat Packet Tracer is an exciting network design, simulation and modelling tool that allows you to develop your skill set in networking, cybersecurity, and the Internet of Things (IoT). It allows you to model complex systems without the need for dedicated equipment.
Here it is Cisco Acadamy link as well.
I hope to have time to publish more information and article related to this fantastic tool.
https://www.netacad.com/courses/all-courses
An interesting part is that simulation and configuration setting up could be useful in production deployment environment as well withouth having all physical devices.:
You should register here:
https://www.netacad.com/
You might download packet tracer from below link and with several video and training on line:
https://www.netacad.com/courses/packet-tracer
Consider athat Packet Tracer is an exciting network design, simulation and modelling tool that allows you to develop your skill set in networking, cybersecurity, and the Internet of Things (IoT). It allows you to model complex systems without the need for dedicated equipment.
Here it is Cisco Acadamy link as well.
I hope to have time to publish more information and article related to this fantastic tool.
https://www.netacad.com/courses/all-courses
Subscribe to:
Posts (Atom)