Cisco ISE CoA Posture 5417 & 11103 errors

I was getting the following errors with client Posture and CoA.

In the switch I was missing the server-key from radius author

aaa server radius dynamic-author
client 1.1.1.1 server-key secretkey
auth-type all

Palo Alto firewall URL whitelist

Just wanted to included a reference for declaring URL keywords for Whitelisting / blocking URL's in PA firewalls

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/url-filtering/block-and-allow-lists

SX20 not registering with CUCM

I had an SX20 not registering with CUCM, the error stated "reason=Failed to decrypt/verify signature of .."

The trick was to delete the security certificates of CUCM from SX20.

Go to Configuration -> Security -> CUCM and select "Delete CTL/ITL"

It would register in the next minutes, no need to restart.

Fortinet SSL VPN Windows 10

Recently I had to connect to a remote VPN session using Fortinet SSL VPN.
I installed the simple SSL VPN via Microsoft store on Windows 10 and I run into an issue because the firewall was using an untrusted certificate.
There are no relative option to change in the settings of the client, so searching the Internet I found the following solution that worked:
When you declare your server name use the following URL,

https://<vpn.server.addresss>:443/realmname?ignore-certificate-errors=1


relative Fortinet forum thread:
https://forum.fortinet.com/tm.aspx?m=118768&mpage=3

Windows QoS settings

Windows 10 don't allow applications to mark outgoing packets with QoS DSCP values.

In order to overcome this you have 2 options

• Create a group policy QoS which works only on domain networks
• Run a powershell command to create a group policy attached to all network connections Domain / Private / Public

The powershell command is (Match on executable name):

New-NetQosPolicy -Name "CiscoJabber" -AppPathNameMatchCondition "CiscoJabber.exe" -DSCPAction 46 

Use the following command to view the QoS policies as the powershell created policies don't show up in Local Computer Policy snap-in.

Get-NetQosPolicy

References:
Microsoft New-NetQoSPolicy
Microsoft   Get-NetQosPolicy

FTD policy configuration delpoy failed

Make sure that FlexConfig is proper.
Remove all policies (NAT/ FlexConfig/ Access etc). and create empty ones and assign them to the device, then push the policy, if this works try to enabled original policies one by one to pinpoint the issue.

FTD Configuration Reset

I recently run into an issue that I needed to clear the configuration on a FTD 2100 series .

The steps followed are

1. Remove the FTD from FMC
2. SSH to FTD 
3. configure manager delete
4. You will be prompted to reset the configuration, choose yes
5.  configure firewall transparent
6.  Check configuration is clear and..
7. configure firewall routed

Now you have a FTD with clear configuration.


Another way is to connect to FTD and run the following

1. connect local-mgmt
2. erase configuration

This will reset the configuration and you have to go through the setup again after you reboot the device. Keep in mind that FTD instance will be reinstalled after that.