Cisco TMSXE customer requirements

Similar Questions

• How can I recover all Hyperion planning, HFM, Audits FDMEE on a common location? Customer requirment is

  Customer requirment is to get all the AUDITS of all modules of Hyperion (HFM, HP, FDMEE, ODI, HBR) on a common location.

  (1) that connected?

  (2) that he/she access?

  (3) who is disconnected?

  (4) any codification, data forms, reports of changes access

  Ask you please give me the details

  Thanks in advance

  For beginners - generate audit reports

  and implementation of the Audit trails

  See you soon

  John

• Cisco ISO Custom - VMWare ESXi 5.5 Upd 2 - VMware Update Manager still shows update 2 required

  Hi all

  I just updated one of my guests with the latest cisco image provided on the vmware website (Vmware-ESXi-5.5.0-2068190-custom-Cisco-5.5.2.3).  After the application as an upgrade of the host and then doing a scan against the host in the Update Manager, it shows that ESXi complete update 2 is missing?

  I know this is maybe more a problem of vmware, but wanted to see if someone had run into this?

  This thank you for the quick response.

• Cisco VPN and Cisco 2651 customer support

  I 2651 and remote VPN client

  Client can successfully establish VPN to 2651 but nothing through this tunnel. In the stats customers there are no decrypted packets. In 2651 I saw the incoming packets but no response. What evil? (This cisco also make VPN tunnel with each other)

  2651 config:

  version 12.3

  customer password username

  AAA new-model

  AAA authentication login userauthen local

  AAA - the id of the joint session

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key xxxx address xx.xx.xx.xx

  ISAKMP crypto nat keepalive 20

  !

  ISAKMP crypto client configuration group 3000client

  xxxxxxxxxxxx key

  DNS 192.168.77.1

  win 192.168.77.1

  area xxx.xx

  pool ippool

  ACL 111

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac M-Chel

  !

  Crypto-map dynamic dynmap 10

  game of transformation-M-Chel

  !

  !

  card crypto client TunnelMap of authentication list userauthen

  card crypto isakmp authorization list groupauthor TunnelMap

  client configuration address card crypto TunnelMap answer

  map TunnelMap 1 ipsec-isakmp crypto

  defined peer xx.xx.xx.xx

  game of transformation-M-Chel

  match address 110

  map TunnelMap 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  !

  interface FastEthernet0/0

  Description link to DMZ

  IP address xxx.xxx.xxx.252 255.255.255.224

  no ip route cache

  no ip mroute-cache

  automatic duplex

  automatic speed

  No cdp enable

  no cache route NCLC

  NAT outside IP

  card crypto TunnelMap

  !

  interface FastEthernet0/1

  Description network internal

  IP 192.168.77.17 255.255.255.0

  no ip route cache

  no ip mroute-cache

  automatic duplex

  automatic speed

  No cdp enable

  NAT outside IP

  no cache route NCLC

  !

  local pool IP 192.168.10.1 ippool 192.168.10.50

  IP nat inside source list 1 interface FastEthernet0/0 overload

  IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx permanent

  !

  access-list 110 permit ip 192.168.77.0 0.0.0.255 host xx.xx.xx.xx

  access-list 111 allow ip 192.168.77.0 0.0.0.255 192.168.10.0 0.0.0.255

  Two things:

  You have not defined a group of authorization specifying that authorization for VPN clients will be done locally. Add the following:

  AAA authorization groupauthor LAN

  And your NAT statement is probably wrong, even if you have not shown that the ACL 1 is equal to. follow these steps:

  IP nat inside source list 100 int fa0/0 overload

  access-list 100 deny ip 192.168.77.0 0.0.0.255 host xx.xx.xx.xx

  access-list 100 deny ip 192.168.77.0 0.0.0.255 192.168.10.0 0.0.0.255

  access-list 100 permit ip 192.168.77.0 0.0.0.255 any

  no nat ip within the source list 1 int Fa0/0 overload

  Note that if you get an error after this last order saying NAT entries are in use, leave the config mode, do:

  clear the ip nat trans *.

  return to mode config, and then retype the command. You must make sure that when you do a 'wr t', there is only a single command 'ip nat inside source... ". "in the config and it is the one that refers to ACL 100.

• ESXi 6.0 Cisco ISO Custom

  When Cisco going to ESXi ISO custom 6.0?  The 5.5 Update 2 ISO is there. I looked on the VMware site

  https://my.VMware.com/Web/VMware/details?downloadGroup=ESXI600&ProductID=491&rPId=7929#custom_iso

  and I do not see listed Cisco.   HP released 3/30, 4/6, NEC Hitachi 4/12 there.

  Just FYI: it is now available, see

  https://my.VMware.com/Web/VMware/details?downloadGroup=OEM-ESXI60GA-Cisco&ProductID=491

  At soon Walter.

• Cisco NetFlow and required IOS image

  Hello team Netpro-

  I am preparing the documents concerning the deployment of Netflow version 5 for about 20 sites around the world. I would like to know what IOS images can support this technology. Currently, some of our routers run the following IOS Images:

  (C7200-SPSERVICESK9-M), Version 12.4 (6) T, RELEASE SOFTWARE (fc1)

  (C2800NM-SPSERVICESK9-M), Version 12.4 (6) T, RELEASE SOFTWARE (fc1)

  (C3845-SPSERVICESK9-M), Version 12.3 (11) T10, VERSION of the SOFTWARE (fc4)

  (C3825-SPSERVICESK9-M), Version 12.4 (6) T2, RELEASE SOFTWARE (fc1)

  (C7200-IS-M), Version 12.4 (7), VERSION of the SOFTWARE (fc6)

  Don't you think that we still need an IOS update or not?

  Thank you in advance.

  Jay

  Also the information provided by the previous poster, I don't think you need to upgrade with the current images, that you have running, most SPSERVICES k9 images 12.4 versions take support netflow.

  I also suggest go on this link, and the link provided in front of me.

  http://www.Cisco.com/en/us/docs/iOS/12_4/NetFlow/configuration/guide/onf_gsg.html#wp1043332

  You can check in the search of features here in feature navigator http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp

  Another simple way to check is by typing a question mark to the cli without entering the command on routers.

  example for this script very basic bellows on a router netflow put an exclamation mark without actual setting command

  interface

  IP route-cache?

  route IP cache flow

  Router (config) #ip import-export flows?

  Router (config) #ip flow-export versions?<-- should="" show="" all="" the="" versions="" supported="" 1,5,9,="">

  Router (config) #ip flow-cache timeout?

  stream of Router (config) #ip - high -?<--- for="" top="" talkers="">

  IP flow-export destination

  IP flow-export version 5

  IP flow-cache timeout active 1

  flow-cache IP 15 idle timeout

  IP high speed-flyers

  Top 10

  Sorting bytes

  (C3845-SPSERVICESK9-M), Version 12.3 (11) T10, VERSION of the SOFTWARE (fc4)< ---="" this="" one="" should="" also="" be="" able="" to="" support="">

  PLS note any useful message if it helps

  Rgds

  Jorge

• iOS 8.0 our apple and ISE of CISCO [RESOLVED] custom portal users

  Hi guys,.
  I was wondering why after updating to iOS 8.0 our apple users, cannot
  go to the online portal ISE, we do em to connect via a WLC wich
  redirects web-auth, to ISE (radius server) process

  So what if we use the internal portal (Note2) wlc 5508 process all right
  After the update to 8.0 apple IOS devices cannot reach our custom portal
  None...

  everyone has experienced the same?

  BR

  Eugenio

  Glad that you got this work and good work on the search for a solution to your problem (+ 5 from me). Also, thank you for taking the time to come back and share it.

  If your problem is resolved, you must mark the thread as "Answered" :)

  One thing to consider too is CWA (Central Web Auth) instead of what you are doing is LWA (Local Web Auth). It's always better to CWA, there are many benefits to it.

  Thank you for evaluating useful messages!

• VPN between cisco unified customer 3.6.3 and Pix 501 6.2 (1) with the MS CA server

  Hello

  I have Microsoft CA server with the latest support CEP and pix 501 that gets the digital certificate. I also have the client certificate of Cisco, but VPN doesn't work

  In the IPSec Log Viewer, I constantly "CM_IKE_ESTABLISH_FAIL."

  It worked well prior to Win2k server has been completely updated with the latest patches.

  The pix configuration is identical to that of article http://www.cisco.com/warp/public/471/configipsecsmart.html

  I reinstall the stand-alone CA and support CEP server but not had any luck.

  What could be wrong?

  It looks like IKE implementation problem. Make DH group 2 policy ISAKMP.

  Visit this link:

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/PIX/pix_v53/IPSec/exvpncl.htm

• Cisco TMS - custom with MXP endpoint command problem

  Hi all

  I have try to disable the RCDO H264 with the TMS custom custom on all the endpoints (to solve a customer problem with lync2013)

  It works for the endpoint of C SERIES but does not work for the MXP endpoint.

  I have try it with this command:

  You have already encountered this problem?

  Do you know a solution?

  Thank you in advance

  Samy

  What version of TMS are you currently using?

  I have TMS 14.3.1, and if you are looking for in models of configuration in TMS under MXP, you should see the configuration item to disable this option for you.

  In any case...

  Off

  May be easier to use the TMS configuration, but the string above should work.

  I hope this helps.

  VR

  Patrick

• Cisco UCS 260 M 2 5.5 U3 - custom image and compatibility

  TAC has a customer turned and pointed toward a compatibility table for an installed UCS - C 260M 2, stating that the firmware of the UCS and the latest version of Vmware is not supported.

  They are suggesting that the client moves to fimware 1.5 (9) and they use a customized image of Cisco for Vmware.

  This facility is for UC/EAC, so I have to make sure that the versions supported in the docwiki for these products as well is the Vmware version.

  http://www.Cisco.com/Web/TechDoc/UCS/interoperability/matrix/matrix.html

  The drop down menu shows Vmware 5.5 U3 is a supported version and I find that 5.5 is supported in the dockwiki. So far so good.

  However, when I try to find a custom image for 5.5 U3 image only I find it:

  https://my.VMware.com/Web/VMware/details?ProductID=353&downloadGroup=OEM...

  VMware 5.5 U3a. The version of the driver specified on this page do not match driver versions indicating the interoperability matrix must be used.

  First, is there a customized image of Cisco for 5.5 U3, could someone point me to this image so that these versions of the drivers are the same?

  Secondly, can I use ISO customized Cisco to upgrade a vanilla install Vmware 5.1 U3?

  -GDR

  Greetings.

  The Cisco Custom images are just a collection of pilots who were up-to-date at the time wherever it has been presented to VMware.  It is expected that iso custom will exactly match the interoperability matrix (it could have at the time, it was created), but at least provide newer drivers than what is usually installed in the general VMware releases.

  The interoperability matrix will list the specific driver, i.e. igb driver intel 1 GB network interface.  Download you the version of the driver for VMware site and install adapt you to the requirements notified by the interoperability matrix.

  You should be able to use a custom Cisco ISO to upgrade.  When your custom installation ISO analyzes your existing system, it will see a higher version of the drivers/VIBs and update those.  The Cisco with custom isos are simply the original VMware updated versions the drivers injected into them.

  Thank you

  Kirk...

• AnyConnect + possible PSK (pre-shared key) as under with cisco vpn client ikev1 and ikev2

  Is it possible to create a VPN Anyconnect of RA with just the name of user and password + pre-shared key (Group) for the connection, as could do for ikev1 with cisco VPN client? I am running 8.4.X ASA code and looks like tunnel-group commands have 8.2.X somewhat change. If you change the group type of the tunnel for remote access, now there is no option for IKEv2 PSK. This is only available when you choose the type

  Type of TG_TEST FW1 (config) # tunnel - group?

  set up the mode commands/options:
  Site IPSec IPSec-l2l group
  Remote access using IPSec-IPSec-ra (DEPRECATED) group
  remote access remote access (IPSec and WebVPN) group
  WebVPN WebVPN Group (DEPRECATED)

  FW1(config-tunnel-General) # tunnel - group TG_TEST ipsec-attributes
  FW1(config-tunnel-IPSec) #?

  configuration of the tunnel-group commands:
  any required authorization request users to allow successfully in order to
  Connect (DEPRECATED)
  Allow chain issuing of the certificate
  output attribute tunnel-group IPSec configuration
  mode
  help help for group orders of tunnel configuration
  IKEv1 configure IKEv1
  ISAKMP policy configure ISAKMP
  not to remove a pair of attribute value
  by the peer-id-validate Validate identity of the peer using the peer
  certificate
  negotiation to Enable password update in RADIUS RADIUS with expiry
  authentication (DEPRECATED)

  FW1(config-tunnel-IPSec) # ikev1?

  the tunnel-group-ipsec mode commands/options:
  pre-shared key associate a key shared in advance with the connection policy

  I'm getting old so I hope that it is not in another complaint curmudgeonly on the loss of functionality. :)

  Many small businesses do not want to invest in the PKI. It is usually a pain to deploy, backup, make redundant, etc..

  But it would be nice to have a bit more security on VPN other than just the connections of username and password.

  If this is not possible, it is possible to configure the Anyconnect customer to IKEv1 with PSK and name at the level of the Group client?

  If this is not possible, WTH did cisco end customer VPN cisco as a choice of VPN connection (other than to get more fresh mail of license)?

  I really hope that something like this exists still!

  THX,

  WR

  You are welcome

  In addition to two factors, you can also do double authentication (ie the two using the user name and password). Each set of credentials can come from a Bank of different identities.

  With this scheme, you can can configure a local user name (common) with password on the SAA (think of it as your analog PSK) and the other be the AD user identification information.

• Cisco ACS, multiple CA, assignment of VLAN relevant to the domain

  Hi all

  I searched for a solution to a specific customer requirement.

  I want authenticate users with certificates from different RootCA wireless and assign them to one VLAN based on their field?  Ideally, using the same SSID and a Cisco ACS server.

  Is this possible?  Has anyone seen that it works?

  I realize that the ACS can have trust company for the relevant RootCA (dunno what version is needed for this?).  And that assignment VLAN is also possible to a unique SSID based on RADIUS attributes.  But I am not sure that these parts would fit together?

  Would appreciate some advice!

  Thanks in advance

  Rob

  Hello

  Yes, this is possible. I suggest that you implement one by one to make sure that everything works, but no problem to do so. All recent versions of ACS allow this.

  You can do mapping group from ad groups (a group for each area, so if you want to) and assign the vlan based on the mapping of this group.

  GBA can trust several certification authorities and authenticate users with certificates of all these cases. It's just a matter of import these number certificate in the trust list.

  And you can assign the vlan and use only one ssid as well.

  I can't guide you on the procedure that it depends on which version you have and if you have IOS ap or WLC, but it is basically each function separated as in the config Guide and just used all together.

  Nicolas

  ===

  Remember responses of the rate that you find useful

• Windows 2003 cannot access remote network via Cisco VPN

  I have two computers at home, an XP Pro SP2 and another is Windows 2003 server SP1. If I set Cisco VPN XP (version 4.6) the Office (ASA 5510), I can access the office network resources. However, if I set the Cisco VPN on 2003, can I? t do the same thing. After studying the two routing tables, I think XP has this road: 192.168.0.0 255.255.0.0 192.168.101.5 192.168.101.5 1, but the 2003 doesn't? t. If I add this route manually (rou? add 192.168.0.0 mask 255.255.255.0 192.168.101.3) 2003, then I can access resources. Why?

  tale of 2003 routing.

  Active routes:

  Network Destination gateway metric Interface subnet mask

  0.0.0.0 0.0.0.0 192.168.10.1 192.168.10.3 40

  x.x.x.37 255.255.255.255 192.168.10.1 192.168.10.3 1

  127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

  192.168.10.0 255.255.255.0 192.168.10.3 192.168.10.3 40

  192.168.10.3 255.255.255.255 127.0.0.1 127.0.0.1 40

  192.168.10.255 255.255.255.255 192.168.10.3 192.168.10.3 40

  192.168.101.0 255.255.255.0 192.168.101.3 192.168.101.3 10

  192.168.101.3 255.255.255.255 127.0.0.1 127.0.0.1 10

  192.168.101.255 255.255.255.255 192.168.101.3 192.168.101.3 10

  224.0.0.0 240.0.0.0 192.168.10.3 192.168.10.3 40

  224.0.0.0 240.0.0.0 192.168.101.3 192.168.101.3 10

  255.255.255.255 255.255.255.255 192.168.10.3 192.168.10.3 1

  255.255.255.255 255.255.255.255 192.168.101.3 192.168.101.3 1

  Default gateway: 192.168.10.1

  ===========================================================================

  Persistent routes:

  None

  VPN client has not been tested on Win2003. Customer requirements are described here:

  http://www.Cisco.com/univercd/CC/TD/doc/product/VPN/client/4_6/relnt/4604cln.htm#wp1024664

  and the show to competition of WinXP is supported.

• TMS must be upgraded before TMSXE?

  Hi team,

  I don't know if I should post this question here, but I'm running MSD 14.4.0 and TMSXE 4.0 and want to update both. I want to upgrade the 14.6.2 TMS and the TMSXE to 4.1, can someone tell me what I should be upgraded first. I took a glance at the following link and it shows that the TMSXE should be the first. I'm what some confused because the other told me that the TMS must be first of all, if someone can check, thanks. P14

  http://www.Cisco.com/c/dam/en/us/TD/docs/Telepresence/infrastructure/TMS...

  Hello

  According to the TMSXE deployment guide (page 24)

  http://www.Cisco.com/c/dam/en/us/TD/docs/Telepresence/infrastructure/TMS...

  You must also pass to the required version of the Cisco MSDS before beginning any installation or upgrade of Cisco TMSXE.

  Manish

  -Does the rate of useful messages-

• Cisco close timeout

  Hi all

  When a proximity of Cisco device (customer request) left the room where a Cisco Telepresence device,

  It seems to take 5 minutes to do this unplug/timeout

  Is there a setting within the Cisco Telepresence/application system that reduce this time-out?

  Thank you

  Kent

  Hello Kent,

  In CE8 the customer has an option on the touch panel 10 to turn off close to a button if the presentation in the Hall needs confidentiality, this will actually turn off nearby and unplug all the blocks matched until the new enabled.

  It s knows that it takes time for the twinning will be lost when you leave the room because of the symbolic exchange. You can read more here:

  https://supportforums.Cisco.com/document/12159326/troubleshooting-guide-Cisco-proximity

  Manish