Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About EDIT
EDIT
Here to help
Member since Jul 21, 2023
May 23 2024
Eddie Caballero
TX
Sales Engineer in the Cybersecurity industry
Community Record
11
Posts
0
Kudos
1
Solution
Badges
May 23 2024
8:19 AM
I do it was a internal DNS issue in my case. At that time I was using same domain name for both internal/external and although it worked with my Att router originally my assumption is it broke when I migrated to the MX. I've since moved to split brain DNS for my AD and also bought a public IP block so I use public IP on the MX outside interface essentially removing MX from being behind NAT device and allowing NAT at the MX
... View more
May 9 2024
3:28 PM
Thanks @Eric-Eddy @alemabrahao I deployed tunnel using Meraki AutoVPN feature. I am able to reach the private apps both internally and through a different ZTN solution. Will run pcaps and open ticket thanks again
... View more
May 4 2024
7:30 AM
After switching from Azure IDP to Duo IDP and got error "HTTP Error 404. The requested resource is not found." or "Application is unreachable Please contact your Administrator" upstream connect error or disconnect/reset before headers. reset reason: connection timeout" This was working previously with the following setup: Azure IDP with Azure SCIM Import to Umbrella 2 Private Apps, 2 Groups with each app a member of one groups What changed? Deployed Client Based Access and switched IDP to Duo to test on prem identities. Removed users from Azure SCIM and then enabled Umbrella on prem AD connector. Able to pass authentication and get the error after passing MFA. IDP logs or Secure Connect logs both show success and no blocks. Troubleshooting steps taken (Incognito browser mode): Removed Duo IDP (AD as the underlying identity store), and added back Azure as my IDP. Disabled on prem Umbrella connector and added users back to Azure SCIM and confirmed users groups appear in Secure Connect. Tested app access and get the same error or application not available. Removed/re-added private applications, app groups, Browser Access Rules, same error. Can confirm private apps reachable on internal network and private hostname resolvable with no issues. Removed/re-deployed site tunnels using Auto VPN from Secure Connect to Umbrella twice and tried different regions same error. Configured ZTNA for same apps using a different ZTN solution to isolate between ZTN solution, (Azure App Proxy) and worked with no error then removed it to avoid conflict on Secure Connect Clientless Access but same error in Secure Connect Validate Application Certificate Disabled (Enabled did not work previously but also not needed just wanted to note it here) Protocol same https Server Name Indication Logs have not been helpful because error is not related to authC or authZ.
... View more
Dec 23 2023
5:07 AM
Hoping someone can point me in the right direction. I've got a Windows client in Azure cloud that I can't connect VPN back to my VPN server (MX). I am able to reach my VPN server and authenticate with successful VPN welcome message but then connection fails after when it attempts to establish the connection. Tried 2 VPN clients, the Windows built in client and Cisco Secure Client. Cisco Secure Client Error: "Cisco Secure Client was not able to establish a connection to the specified source gateway. Please try connecting again." and "VPN establishment capability for a remote user is disabled. A VPN connection will not be established." 1. Try connection on both SAML and RADIUS 2. Uninstall/reinstall secure client per suggestion found online which includes manual deletion of any Cisco folders in AppData and Programs x86 Windows folders 3. Tried secure client version 5.1.0.136 and 5.1.142 4. Deleted VM/Re-deployed 5. Tried both SAML and RADIUS authentication When I try connecting through Windows client, I get the following error: "The remote connection was not made because the attempted VPN tunnels failed. The VPN server might be unreachable. If this connection is trying to use an L2TP/IPsec tunnel, the security parameters required for IPsec negotiation might not be configured correctly." Issue seems to be isolated to connection to Azure cloud since I can connect using other local windows clients when connecting from a public network. Even more interesting that I can't resolve my VPN server host name in Azure cloud but I can from other public networks so I changed DNS settings on the VM and pointed to Umbrella DNS but same error. This is the first time I have ever tried to VPN from an Azure VM so not sure if their are additional steps I need to take to establish the connection. I recently added Cisco+Secure Connect integration with Umbrella and I can see VPN hostname in Umbrella with "Allowed" result so it does not appear to be Umbrella that is blocking the connection.
... View more
Labels:
- Labels:
-
3rd Party VPN
-
Azure
-
Client VPN
-
Firewall
Jul 30 2023
5:36 AM
Thanks I found the issue and end up being unrelated to the setup. Confirming that my new setup now works.
... View more
Jul 29 2023
7:38 AM
Hi Team, Running into a networking and/or firewall issue where I'm not getting http and https traffic for host on my internal LAN. My setup is as follows: Previous working topology: Edge router (att BGW210) <> Virtual switch <> Web Server New topology not working: Edge router (att BGW210) <> MX Firewall <> MS Switch <> Virtual switch <> Web Server On my previous topology, only way it works if I setup port forwarding on the att router to the internal web server. However now that I've implemented the MX firewall and MS switch, can't get port forwarding to work. On my att router, I now have port forwarding http and https traffic to my MX firewall where I then configured port forwarding on the MX and set my web server as the destination LAN server. Not sure what step I'm missing buy any guidance would be greatly appreciated. Note that I tried packet captures on the switch uplink where not seeing any http or https traffic being sent from the MX.
... View more
Jul 23 2023
6:53 AM
Thanks @KarstenI for helping shed light on the misconfig and best practices. I now know which route to take 🤙
... View more
Jul 22 2023
11:47 AM
Ok thanks for the added info. It sounds like I need to test on a port where Cisco ISE is not connected to, at least in my use case. I have another laptop that I can physically connect to another switchport or connect my MR access point and do wireless 802.1x
... View more
Jul 22 2023
11:43 AM
Hi @KarstenI, not necessarily, really the end goal is to test wired 802.1x authentication. I was unaware that 802.1x for VMs is not best practice so thank you for sharing and any additional links you can provide for more detail would be greatly appreciated. In that case, will leave the VMs out of the flow and move forward with testing just my physical server. Is it possible to enable 802.1x for only the server hosting the Hyper V virtual switch? Trying to see if the following would work: 802.1x for PC hosting Hyper V switch where ISE sits behind the vswitch MS120-8<>HyperV switch<>physical end host <<<<< but I believe this would inherit the access policy causing issues for the hosted VMs? Or should it be the following?: MS120-8<>physical adapter of host<>Windows10 <<<< Taking vswitch out of the flow
... View more
Jul 22 2023
10:23 AM
@alemabrahao running latest 15.21.1 @KarstenI , Thanks for clarifying. I misunderstood the doc because it mentions it can be done on MS switches. My issue is that I'm trying to test RADIUS authentication using Cisco ISE as my RADIUS server and lose access to my all of my end host when I apply my RADIUS access policy to my switchport. My setup is as follows: Edge router<>MX67 Gateway<>MS120-8 Switch<>HyperV Virtual Switch<>End host Note: ISE host is connected to the virtual switch and the virtual switch is configured to support 802.1x Per Meraki MS doc, port must be in Access mode. The virtual switch is connected to an access port on the Meraki MS switch and the MS switch uplink is also set to access port. For my Meraki Access Policy, I set it the host mode to multi auth.
... View more
Jul 21 2023
1:35 PM
Recently deployed my Meraki MS120-8 on Cisco ISE and as I am testing out my access policy, I lose connection to any device behind the port (Hyper-V switch <> VMS). I thought enabling RADIUS testing would allow monitoring mode but I later realized that's just for a Keep Alive to the RADIUS box and not monitor mode. From the Meraki MS Access Policies doc, it shows the MS switch can do monitoring mode as well as a screenshot showing RADIUS monitoring as an option but I'm not seeing in the dashboard https://documentation.meraki.com/MS/Access_Control/MS_Switch_Access_Policies_(802.1X) <<< Under "Suspend Port Bounce", RADIUS Monitoring is an option. In the below screenshot, notice I do not have the option. Is there anything I'm missing to enable this feature since the traditional ACL approach via CLI is not available?
... View more
Labels:
- Labels:
-
Interfaces
-
Layer 2
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 1301 | Jul 30 2023 5:36 AM |
© 2024 Cisco Systems, Inc.
