FTD RA VPN with Microsoft NPS server

 ORIGINAL POST FROM Jatin Katyal  (Thanks)

Introduction
Steps needs to be followed on the Microsoft Radius server to configure group-lock and tunnel-group-lock
Configuration Steps

    Go to Remote Access Policies.
    Go to the remote access policy/network policy, make a right click on the policy and click on the "Properties"
    Click on Edit Profile.
    Click on Advanced Tab settings and add ( For IAS)
    Click on settings (For NPS)
    Scroll down to "Vendor-Specific" Radius attribute.
    Select it, from scroll down use custom and click on Add.
    Make sure Attribute Number is set to 26.
    Click on Add.
    Enter Vendor Code: 3076.
    Select radio button : Yes. It confirms.
    Click on Configure Attributes.
    Vendor-Assigned attribute number: 25 (group-lock) and 085 (tunnel-group-lock)
    Attribute format: String.
    Attribute Value: <group-policy-name> or <tunnel-group name>
    Apply.

In order to troubleshoot any issues look at event-viewer logs on Radius server.
Configure NPS Event Logging
NPS Events and Event Viewer

Finally, this document with ASA AAA configuration documentation could be useful too:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/aaa_radius.pdf

CUCM diagnose test

A quick and easy CUCM diagnostic test run via CLI.

utils diagnose test

Cisco VM ESXi wont boot (After restart)

Well, another day another bug!

Cisco bug CSCvh55176 for the official page.


I setup Unity connection fresh install on BE6K with ESXi 6.5. VM booted and worked properly, but after restart the VM didn't boot again and had only a black screen with a cursor, no messages, nothing..

A colleague run into this bug before me so I was provided with the resolution below:

You will need to:

-        boot VM with recovery ISO
-        Once the options appear, press ALT+F2. This will take you to bash prompt.
-        chroot /mnt/part1
-        /usr/bin/vmware-config-tools.pl -d
-        You may ignore the errors at the end
-        Exit and disconnect the ISO and make sure you will change the boot order again in BIOS

After above other VMs should be boot as well.

Unable to update phone setting after CUCM 12

When you try to edit a phone after you upgrade to CUCM 12 you get an error of 
"Update failed. SSH Password is not valid. SSH Password is an encrypted value containing up to 288 hexadecimal characters (0-9 and A-F)"

You have to run the following command on CLI in irder to clear any password set
run sql update device set sshpassword = '' where name = "SEP1234AAAABBBB"

 

Cisco FMC FTD user to IP mapping troubleshooting

To check whether user to IP mapping works correctly, SSH to FMC and FTD and run the following commands in order to check if the entries are there

expert
user_map_query.pl -i 10.10.10.10 (to check for IP to user mapping)
user_map_query.pl -u bob (to check user to IP mapping)
If results display "For policy = 1" then this is set to propagate to FTD


Another approach
expert
u2dump /var/sf/user_enforcement/user_ip_map.* > /var/tmp/user-ip-map.dump
vi /var/tmp/user-ip-map.dump 


Credit for some of the above goes to dependencyhell.net blog.

Anyconnect DNS issues on VPN

If you 're facing troubles with clients connecting to VPN and can't resolve DNS please check the following

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz27826/?rfs=qvred

In short
Anyconnect creates a static route on the client for the DHCP server. if your DHCP server also servers as DNS etc. this breaks the DNS resolution for your client.
Apply the following as workaround

group-policy DfltGrpPolicy attributes
  webvpn
     anyconnect-custom-attr no-dhcp-server-route
     anyconnect-custom-data no-dhcp-server-route no-dhcp-server-route true

group-policy <XXX> attributes 
  anyconnect-custom no-dhcp-server-route value no-dhcp-server-route

Google NTP service

Google's started a public network time protocol (NTP) servers.
You'll find the servers at time.google.com – 216.239.35.0

More info here: https://developers.google.com/time/