Re: [OSL | CCIE_Security] Remote Mangement Of ASA

2012-07-07 Thread Piotr Tokarzewski
Hi, You must set management interface: management-access inside and then use this interface instead of outside: SSh 10.70.X.X Inside SSh 10.60.X.X Inside Regards Piotr 2012/7/7 Parvez Ahmad parvez.ahma...@gmail.com Hello, Topology

Re: [OSL | CCIE_Security] Remote Mangement Of ASA

2012-07-07 Thread Karthik sagar
You need to have the management-access inside global command. http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/access_management.html#wp1071406 If your VPN tunnel terminates on one interface, but you want to manage the adaptive security appliance by accessing a different

[OSL | CCIE_Security] Thanks to IPexpert

2012-07-07 Thread Kingsley Charles
Hi Wayne IPexpert has brought up lot of CCIEs. I would like to thank Wayne and team for providing this service to CCIE aspiring candidates. Also, I would like to thank you for giving me the opportunity for writing their CCIE v3 book. Reference link to the CCIE Sec book

Re: [OSL | CCIE_Security] My dream comes true

2012-07-07 Thread Pemasiri Devanarayana
Hi Kings, Congrats..you really deserved this.!! One thing I want to say, please stay with the OSL, you have been contributed a lot for this forum and there are many beneficiaries.. Regards, Pemasiri - CCIE Sec 28327 On Sat, Jul 7, 2012 at 12:38 AM, Marko Milivojevic mar...@ipexpert.comwrote:

Re: [OSL | CCIE_Security] Remote Mangement Of ASA

2012-07-07 Thread Parvez Ahmad
Hi Piotr, Could you please explain why SSH 10.70.X.X Inside? Regards, Parvez On Sat, Jul 7, 2012 at 12:06 PM, Piotr Tokarzewski piotr.tokarzew...@gmail.com wrote: Hi, You must set management interface: management-access inside and then use this interface instead of outside: SSh

[OSL | CCIE_Security] CoPP - which MQC?

2012-07-07 Thread Radim Jurica
Hello, regarding to CoPP question 6.1 in Configuration Parctise Labs. Task Configure CoPP protection on R2, allowing ICMP pings sourced from the RFC 1918 address space only. Any ICMP packets sourced from nonprivate address space to R2 should be dropped. Do not configure any parameters under

Re: [OSL | CCIE_Security] CoPP - which MQC?

2012-07-07 Thread Fawad Khan
Both will work. On Saturday, July 7, 2012, Radim Jurica wrote: Hello, regarding to CoPP question 6.1 in Configuration Parctise Labs. Task Configure CoPP protection on R2, allowing ICMP pings sourced from the RFC 1918 address space only. Any ICMP packets sourced from nonprivate

Re: [OSL | CCIE_Security] Thanks to IPexpert

2012-07-07 Thread Wayne Lawson
Kingsley - You're a great friend and an even better person and engineer. We have been honored to help you and we're very proud of your accomplishment! Regards, Wayne A. Lawson II - CCIE #5244 Founder President IPexpert, Inc., Proctor Labs, Inc., Masonic e-Institute of Technology, Inc.,

Re: [OSL | CCIE_Security] Thanks to IPexpert

2012-07-07 Thread Kingsley Charles
Thanks Wayne :-) With regards Kings On Sat, Jul 7, 2012 at 8:19 PM, Wayne Lawson wlaw...@ipexpert.com wrote: Kingsley - You're a great friend and an even better person and engineer. We have been honored to help you and we're very proud of your accomplishment! Regards, Wayne A. Lawson II

Re: [OSL | CCIE_Security] My dream comes true

2012-07-07 Thread Likavec, Jaromir
Kings!!! Congratulations! It’s very good news. Regards Jaro -- Jaromir Likavecjaromir.lika...@igd.fraunhofer.demailto:jaromir.lika...@igd.fraunhofer.de Fraunhofer Institut fuer Graphische Datenverarbeitung Fraunhofer str. 5, 64283 Darmstadt Tel.: 06151/155-314 ; Fax: 06151/155-399

Re: [OSL | CCIE_Security] Remote Mangement Of ASA

2012-07-07 Thread Jason Madsen
Hi everyone, If I understood Parvez' email, the VPN is not a LAN-2-LAN between ASAs. It looks as though the VPN is between ASA1 and the RTR. Based on that topology, I think his original SSH statements look ok. However, let me know if I missed something. Parvez, SSH traffic to the ASA

Re: [OSL | CCIE_Security] Remote Mangement Of ASA

2012-07-07 Thread Fawad Khan
Have you tried run a debug or packet capture I confirm that the packet is reaching the outside interface. Since it working from inside hence I am ruling out the aaa authentication and username requirements. On Saturday, July 7, 2012, Jason Madsen wrote: Hi everyone, If I understood Parvez'

[OSL | CCIE_Security] Multicasting in the LAB?

2012-07-07 Thread Likavec, Jaromir
Hello, What way is multicasting coming in the LAB except in the GET VPN Thanks Jaro ___ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com Are you a CCNP or CCIE and looking for a job? Check out

[OSL | CCIE_Security] Certificate maps,

2012-07-07 Thread Mike Rojas
Hey Guys, Just wanted to throw this one out. Sometimes I got freaked out about my certificate map not matching against what I am looking for on the Certificate of the peer, for example: 7 23:06:51.734: ISAKMP:(4003): processing ID payload. message ID = 0 Jul 7 23:06:51.734: ISAKMP

Re: [OSL | CCIE_Security] Multicasting in the LAB?

2012-07-07 Thread Bruno Silva
Hi, I think the only way multicast is comming to the lab is with GETVPN...as far as I know of course... Eniado via iPad Em 07/07/2012, às 15:08, Likavec, Jaromir jaromir.lika...@igd.fraunhofer.de escreveu: Hello, What way is multicasting coming in the LAB except in the GET VPN

[OSL | CCIE_Security] NAR explanation

2012-07-07 Thread Mike Rojas
Hello, I need a brief explanation of NAR. The only one to make it work is using asterisks. The documentation is no way near clear on how to put the permitted addresses. This is because I need to permit a user coming from certain IP addresses. I think that what I dont understand is how to

Re: [OSL | CCIE_Security] NAR explanation

2012-07-07 Thread Kingsley Charles
Do as Yusuf as mentioned in his practice labs. For example for any all 10.0.0.0/8 addresses, use 10.* or 10* With regards Kings On Sun, Jul 8, 2012 at 9:06 AM, Mike Rojas mike_c...@hotmail.com wrote: Hello, I need a brief explanation of NAR. The only one to make it work is using