IKEv2 AnyConnect and pool allocation via RADIUS

Similar Questions

• A problem when authentication via Radius ASA

  Hi all

  Please give me a helping hand. I have a problem when through ASA 5520 via Radius Authentication for ACS 4.0 via the VPN device. I need to configure secure authentication and NAC for remote user VPN. It simply does not work, but it works when you use Ganymede so all the connection seems to be ok as ACS succesfully authenticate a remote via MS AD VPN user when you use Ganymede. But I read that I can not use NAC when Ganymede using, I'm good? ASA and ACS journals indicate a problem with the shared key but I already double checked the key on both sides, the IP address is correct on SAA and I also tried all possible methods of RADIUS on SAA. Any idea where might be a problem?

  Hello

  When you use ACS 4.0, then make sure that the AAA Client for ASA entry you created on GBA, if under a NDG, then make sure that there is no key to the NDG level.

  Otherwise, pass entry client ASA as RADIUS ACS in NDG (Unassigned) on ACS.

  Kind regards

  Prem

• Type of cert for ikeV2 anyconnect

  Hello world

  I created the CSR for anyconnect IkeV2.

  When I ask the seller to cert that I should ask them what type of certificate that I needed for IkeV2?

  We do not want users to use ssl as https://xyz.com and to connect and download the client.

  We want machine pre installed with anyconnect and profile users and connect using IkeV2.

  Concerning

  Mahesh

  Each certificate provider has their own list of choices. Many understand Cisco among their choices. that is to say:

  http://www.InstantSSL.com/SSL-certificate-support/csr_generation/SSL-CER...

  In General, a standard server certificate just because we don't do a lot of fancy with it - just check identity. CN in the CSR must match the FQDN in this case...

• Clients vpn AnyConnect and cisco using the same certificate

  Can use the same certificate on the ASA client Anyconnect and cisco vpn ikev1-2?

  John.

  The certificate is to identify a user/machine rather than the Protocol, then Yes, generally 'yes' you can use the same certificate for SSL/IKEv1/IKEv2 connections.

  What you need to take care of, it's that said certificate is fulliling Elements of the Protocol, for example implmentations IKEv2 is 'necessary' particular KU are defined and client-server-auth/auth EKU are defined on the certificates.

  M.

• Memory not fully usable in the pool allocation?

  Hello

  We have a few "issues" with Org CDV is deployed under the pool allocation model. It is not possible to use the RAM allocated by 100% (or any value close to 100%). When you try to start the virtual machines, we receive an error for the allocation of resources of the vCenter (lack of resources...). It turns out when you look at the list of resources that 'Used a reservation' is greater than the sum of reservation of the virtual machines that is already running.

  Example of

  Org vDC has 13 GB of RAM allocated with 20% guarantee = list of resources gets 2662 MB of booking

  VM1 is configured with 5 GB RAM = Gets a booking of 1024MB

  VM2 is configured with 6 GB of RAM = Gets a booking of 1229 MB

  Sum of reserves VM = 2253MB

  Customers point of view, it seems that there are always 2 GB available RAM, RP views (calculated) there are still the 409 MB available that are 20% of the 2 GB of RAM. If the client sets up a new virtual machine with 2 GB, tries to start, but it does not work because of insufficient resources.

  When you look at the list of resources in detail, that it's somehow clearly why it fails. The used reserve is 2521 MB, so only 141 MB are available. It is about 700 MB usable for the customer.

  I think it has to do with the charge of the virtual machines, although the General value of resource pools does not explain this difference

  This also occurs when you use other percentages of RAM guaranteed.

  This behavior is - although somewhat understandable - boring.

  To avoid calls to the technical support of customers complain about this issue (in my opinion), there are 2 possibilities

  1. explain the situation/reason for customer and tell them to order more RAM. First of all I don't think that the majority will understand it or worries. And as long as we can't calculate how it takes over is a no go.

  2. Add a buffer to the quantity of RAM. It's what we right now - we add 10%. It works, but customers see that they have more available RAM that they ordered. Integration with billing is too difficult.

  Other vCloud Director users are aware of this issue, too? STI is expected to 'fix' that in future releases? As vCloud Director auto setting RP booking limits somwhow.

  Best regards

  Carsten

  Is it in vCloud 5.1.2 or 5.1.0/5.1.1? If you're on 5.1.2 and using a single cluster for the allocation (inelastic) pools, you can force elastic mode.

  explanation here is for the memory usage:

  Allocation Pool organization VDC changes vCloud Director 5.1.2

• Me and my dad is from the same Apple ID and I want to set up his own, but how it will get all his contacts, photos etc from my Apple ID? Or he will lose all? or I could keep them saved for him and send more via an application any?

  Me and my dad is from the same Apple ID and I want to set up his own, but how it will get all his contacts, photos etc from my Apple ID? Or he will lose all? or I could keep them saved for him and send more via an application any? I don't know how to resolve this issue, if someone could point me in the right direction.

  Have him create a id Apple here- create and start using a Apple - Apple Support ID, and then both you can create an album-photo sharing Photo Sharing - Apple Support iCloud

• If please help me solve a 400 error message that I receive for a site I've visited several times and is accessible via the Safari browser.

  I am an owner fitbit and downloaded their app on my macbook pro several weeks ago. I have consulted this app to review the progress of fitbit several times a day since. Today, I can't do that. I can not even access the Fitbit site. I get an error 400 - your browser sent an invalid request.

  I cannot access any other internet content through firefox.

  I can access my account and the Fitbit site via Safari. I can also access the Fitbit site and my account via my iphone. The problem seems to be something specific between my firefox and Fitbit.

  Thanks for your help.

  It seems that sometimes, cookies and cache files can be damaged (they not be saved correctly). Why does that happen? I don't really know. I don't know there are several reasons for this. If we could, we could stop him from past ever. Because we cannot do this, we have just this way again.

• How can I connect my nokia 6600 and a laptop via bluetooth

  How can I connect my nokia 6600 and a laptop via bluetooth to send information?

  This is so complicated. I have this suite of pc to 6600 installed in my laptop and I can't connect it.

  Can someone help me?

  Hello

  have you tried connecting your phone via bluetooth toshiba Device Manager?
  Device Manager is operating the BT device automatically then maybe the pc suite does not work.

  Welcome them

• Try to synchronize a mobile laptop and it connects via bluetooth, but will not be synchronized

  try to synchronize a mobile laptop and it connects via bluetooth but will not synchronize what I am doing wrong

   
  Moved from feedback
  Original title: device

  "You run a form any of sync on the PC software, usually supplied with the ' phone or available for download on the ' phone manufacturers site.

  As you do not tell us that "phone and helps OS it runs there is little more we can give."

• I recently installed Windows 7 and you connect via RDP.

  * Original title: activation of Aero?

  Hi, I recently installed Windows 7 and you connect via RDP. When I plugged in, I was greeted with Standard Windows, I went in tge customization panel but when I click on an aero theme, said that some parts of the theme have been disabled because I was using remote desktop. Is there a way I can enable Aero via Remote Desktop?

  Aero feature is disabled in all versions except versions ultimate and Enterprise

  Aero glass remoting

  https://en.Wikipedia.org/wiki/Windows_7_editions#Comparison_chart

• AnyConnect and SSL - VPN without client

  Are there problems in running Cisco AnyConnect and SSL - VPN without client side by side?

  I am currently looking into adding features for an ASA AnyConnect who currently set up to operate without SSL - VPN client. The system without client is not removed. I don't know how to set it up, I wonder if someone has already set up this or if there is no problem with this Setup?

  Hi Daniel

  It's a little complicated if you want a granular authentication and authorization, but it works.

  I'm running an ASA with IPSec, SSL Client and clientless SSL.

  Each of these virtual private networks with user/one-time-password name and certificate based authentic.

  The main challenge is to put in place its own structure of profile cards, connection profiles, group policies and dynamic access policies.

  Feel free to ask questions...

  Stephan

• Access Internet AnyConnect and ASA 8.3

  I have configured with ASA 8.3 AnyConnect and I am able to access everything on the internal LAN very well.  However, I can't connect to the Internet while I am connected to AnyConnect.  I tried different DNS servers in the AnyConnect profile, different parameters of Tunnel from Split.  I can't understand the issue of the Internet.  And the strange thing is that I can not solve them that addresses all the Internet, either through the AnyConnect connection.  When I try ping www.msn.com it just says that it cannot find the host www.msn.com.  Can someone please help with this question?

  Thank you

  Corey

  As well as the order, looking at the config that I feel need to add this as well after removing split tunnel configuration.

  network of the AnyConnect-INET object

  192.168.253.0 subnet 255.255.255.0

  interface NAT (outside, outside) dynamic source AnyConnect-INET

  Thank you

  Ajay

• AnyConnect and 2 certificates

  people

  I have a question regarding anyconnect and using 2 profiles on a single customer

  I use anyconnect ssl vpn to connect to several sites, each using certificates and name of user and password for authentication

  My problem is that when I 2 certificates in the store of my staff two different asas, I can't authenticate on one of the firewalls

  each certificate is named differently, i.e. mycert-site1 and site2 mycert

  anyone came across this before?

  Thanks to anyone who takes the time to answer

  Hello

  You have this option in a newer version of anyconnect:

  http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect24/release/notes/anyconnect24rn.html#wp1025402

  HTH,

  Marcin

• ESXi 5.1 - Exchange 2007 - file Page memory and CPU allocation

  I'm currently migrating a class Cluster CSC Exchange 2007 running on vmware on windows 2008, 2003.  It is also a SCC Cluster.  I followed all of the vmware and MS best practices, but not sure of one thing IM is the size of memory and CPU allocation page/swap file.  I have 5 Esxi hosts and each is running only Exchange 2007 comments according to vmware and MS recommendations when you use the Clustering of CSC.

  Each host has 2 CPUs to 6 cores per processor and 48 gb of Ram and that each host will have only a guest, would like to send it to the guest.  I read somewhere that it is recommended this page exchange 2007 memory size + 10 mb file.  Do I really need to get the page to the size of the file?  250 GB of disk space is a lot for swap files! IM also not sure what to set the allocation processor too.  If someone can point me in the right direction, I would be grateful.

  Thank you

  Dave

  Hi dlargeit,

  First of all, off - welcome to the VMTN forums!

  I'm with Josh26 I've ever seen any recommendations indicating that when a CCS cluster virtualization virtual machine by host is taken in charge. It is recommended to keep only a single node SCC by host (which is true for all virtual clusters or technologies like Exchange CSC/CCR/DAG), but there is nothing specific regarding the keep only a single virtual machine by host.

  On the file page, you are actually right on that.  For Exchange 2007, the paging file must be on the amount of memory configured as well as 10 MB to account for overhead costs of the kernel.  It is recommended by Microsoft and it is planned to provide enough space page Exchange should exchange more provide the necessary overhead if meet you a server failure and need to create a complete memory dump.

  You can find this recommendation here: http://technet.microsoft.com/library/aa996719 (EXCHG.80) .aspx

  In terms of CPU allocation, which should really be made according to your individual needs rather than just give all the resources the VM on the ESXi host.  Microsoft lists the maximum recommended for processor resources (Planning Processor Configurations: Exchange 2007 help) and it says that 12 hearts is the maximum for mailbox or Hub Transport box.  Is your really big enough environment need a lot of CPU resources?  Why not start small and increase it if necessary?

  You are in control of your own destiny in some of these configurations.  If you know the recommended page file size is 10 MB of RAM +, do not give the server more RAM is really needed, or you will have to pay for it in the consumed disk space to host the pagefile.  See the guide to memory resources (Planning Memory Configurations: Exchange 2007 help) to understand the maximum rates of memory for Exchange.  You will see that the maximum memory is 32GB, so there are very few reasons to assign all 48GB of RAM on your server, if it can even use.

  In short, the size of the server based on the real needs and I am confident, that you will have a virtualized Exchange system that performs as well as physical.

  Matt

  http://www.thelowercasew.com

• sign the document with 'Draw my signature' and send it via http-post

  Hello

  I have a pdf document with a signature field. When im opening with AcrobatReader XI, I can sign / Place Signature / draw my signature. I can't 'save a copy '. It works pretty well.

  Now, I place a button in the pdf document to be sent via http post to a given address. When I now open this PDF in the XI AcrobatReader, trying to sign. I can only do this with sign / Place Signature / use a certificate. But there is no way to "draw my signature."

  Did I miss an option to do this? Pls tell me if he has a chance to sign the document with 'Draw my signature' and send it via http-post.

  Or is this part of the concept? When I'm looking for a solution, I found EchoSign electronic signature.

  What is available depends on how the as is put in place. If you include a button with an action of type 'Submit form' and/or reader - enable the form, then e-signature (signature of drawing) will not be available in the player. If the document is compatible player then digitally signing will. So for what you want, do not Reader-enable the document and you can use the submitForm JavaScript method to submit. The site that has the JavaScript documentation was not available at the time I wrote this, but post again if you need help with that.