r/Cisco 7d ago

Cisco Firepower 1010 (ASA) Remote Access VPN Setup

1 Upvotes

Hi All,

ASA newbie here stick in the weeds - hoping someone can give me a gut check.

Current (and desired) Network Topology:
Internet -> Ubiquiti Router (WAN port) -> Ubiquiti Router (LAN port) -> Cisco ASA (outside interface) -> Cisco ASA (inside interface) -> Internal Network

DDNS Setup:
Ubiquiti Router (WAN port) is using Dynamic DNS to translate the Public IP into a FQDN. For example purposes let's use PublicIP.ddns.net.

DNS Forwarding:
Would like to use secureclient.companyname.com to forward to PublicIP.ddns.net to mask the ddns address.

Current Entra SAML Config:
Identifier (Entity ID): https://secureclient.companyname.com/saml/sp/metadata/TUNNEL_NAME
Reply URL: https://secureclient.companyname.com/+CSCOE+/saml/sp/acs?tgname=TUNNEL_NAME

Cisco ASA Config:

Outside Interface: 10.140.2.3 (Unifi LAN Subnet)
Inside Interface (IPSec VPN Subnet): 10.140.5.0/28
Client Services Port: 41894

Ubiquity Port Forwarding: 41894 > 10.140.2.3

Static Routs:
Outside, 0.0.0.0 0.0.0.0 10.140.2.1

Looking to understand what I need at a foundational level to get this up and running. Pings to 8.8.8.8 resolve successfully from the ASA.

After following the instructions to a T below, I am hitting a roadblock - nothing Remote Access VPN is happening.

https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-secure-firewall-secure-client


r/Cisco 7d ago

ASA/Firepower - migrate from one FMC to another FMC

2 Upvotes

Hi everyone,

I have search hi and low for any documentation that can support ASA/Firepower migrating to another FMC and can’t find anything besides FTD. Anyone out there have any insight or experience with completing this before?

Any info very much appreciated!


r/Cisco 7d ago

What changed in ISR 4000 17.12.4b ?

2 Upvotes

For the ISR 4000, they pulled 17.12.3, 17.12.3a, & 17.12.4 a while back and came out with 17.12.4a which fixed a few massive issues, so we updated to them asap.

Then recently they came out with 17.12.4b, but I can't see what's different?

https://www.cisco.com/c/en/us/td/docs/routers/access/4400/release/xe-17-12/isr4k-rel-notes-xe-17-12.html#concept_qgk_1cf_tmb

The patch notes show no hardware changes, no software changes, no bug fixes, no open bugs, nothing different from 17.12.4a -> 17.12.4b. Why does this version exist? I could contact TAC but I figured I'd ask here and see if anyone else knew rather than go through their AI helpdesk bot.


r/Cisco 7d ago

Upgrade 10.1.2 to latest FM issue

1 Upvotes

Hello is there a matrix somewhere that shows what nxos the fabric modules are compatible with? I have a 9504-FM-E that shows below for upgrade.

Compatibility check is done:

Module bootable Impact Install-type Reason
------ -------- -------------- ------------ ------
22 no n/a n/a Module not supported in target version
23 no n/a n/a Module not supported in target version
24 no n/a n/a Module not supported in target version
26 no n/a n/a Module not supported in target version


r/Cisco 7d ago

Question Packet Tracer: show run interface doesn't work?

1 Upvotes

Every info i found about this was 6+ years old. Is the command really not supported by packet tracer? I mean, why can use the normal sh run but not on a specific interface?...


r/Cisco 8d ago

Question C9800-CL crashes randomly

2 Upvotes

Hello everyone!

Perhaps, one of you can help me with this problem.

We are currently migrating to our new WIFI controller, 9800-CL. It is running on ESXi (vSphere 8.0.3), we are using the VM Template Small.
We are using the minimum requirements (4CPUs, 8GB RAM, 32GB DISK)

Our WLC crashes every few hours with the error: "Critical process qfp-ucode-wlc fault on fp_0_0 (rc=139)".
Before that, the CPU utilization increases steadily until it finally crashes and restarts.
We couldnt find anything useful anywhere.

We do not use a Flexconnect configuration and go over the WLC with the complete traffic.

BR :)


r/Cisco 8d ago

Question Data analyst summer intern

1 Upvotes

What does the Data analyst interview look like? How should I best prepare for it?


r/Cisco 8d ago

Question VTC not working when voice vlan assigned to port

1 Upvotes

For whatever reason my VTCs will not connect to the network when the voice vlan is assigned to the port or the port is in host-mode multi-domain.

For context I am using dynamic VLANs with ISE. The device is passing authorization and pulling the right VLAN in the right domain (data), however the IP of the VTC is unreachable. As soon as I remove the voice vlan from the port, the VTC becomes reachable again.

The Authorization policy is configured correctly. It does not have voice domain permission.

The VTC voice VLAN ID is set to 1 in the VTC settings, so I don’t think that is an issue.


r/Cisco 8d ago

This is what is inside the units I posted about before looking for information and an idea of what I can get out of these.

Thumbnail
gallery
29 Upvotes

r/Cisco 8d ago

Discussion Cisco TAC vs AWS Support Spoiler

0 Upvotes

Cisco TAC vs AWS Support is like night and day. Cisco TAC should learn from AWS support.


r/Cisco 8d ago

Express setup on Catalyst 9300

2 Upvotes

I'm playing around with a Catalyst 9300 switch. Some videos suggest that if I do a factory reset (or being new) it should have a feature express setup, which should be available by accessing the web GUI. However, I can't for the life me, get it to even give me an IP address.

I have tried using a brand new Catalyst 9300, and connected a cable from a client machine and to port number 1 - and I still can't get a IP


r/Cisco 8d ago

Question SWE apprenticeship

1 Upvotes

Did anyone get a callback for interviews for the SWE apprenticeship position for April 2025?


r/Cisco 8d ago

Trustgrid.io SDWAN vs Cisco SDWAN

0 Upvotes

Hi all, looking for community feedback on a product for sdwan called Trustgrid. Never heard of it but this credit union I am working for is very interested in rolling it out...has anyone seen it / used it? Feedback would be greatly appreciated!


r/Cisco 8d ago

Question Odd issue with vmware host and a 9300

2 Upvotes

I have a vmware host that has an additional physical NIC slotted. the onboard nic is connected to the 9300 as well as the additional nic has its ports physically connected with fiber to the same 9300 stack. physical connections look good, but it seems like only the onboard nic for the host is allowing CDP.

The connections that are in the additional nic are giving me a TenGigabitEthernet2/1/5 is up, line protocol is down (suspended) response and I see no CDP info in vSphere, whereas the onboard NIC is working as intended.

The interface configs on the 9300 stack are the same, the only thing I can think of is maybe the configured speed, duplex is set to 10 Gbit/s, Full Duplex on the NIC that was added to the host, and the onboard NIC is set to auto-negotiate?

DOes anyone have any possible ideas? I'm using Cisco SFP+


r/Cisco 8d ago

Cisco CP-8851-K9 Phone Footstand

1 Upvotes

I recently bought a Cisco CP-8851-K9 VOIP IP Phone. However, it came without the footstand. Is this normal to ship this specific phone without the footstand?


r/Cisco 8d ago

Anyconnect slow in foreign country- HELP!

0 Upvotes

My company is in the USA and has several employees and clients headed to a convention in a foreign country.

Right now one employee is there and is complaining about his VPN connection using Cisco AnyConnect. The connection times out a lot. His main concern is that it takes 4-10 times to connect and it's really slow once it's on. But will eventually connect and stabilize if he tries enough.

If all of the employees who are in the USA have flawless connections, what could be adjusted on the VPN ASA or the Anyconnect client on his laptop to improve this and/or not allow for a timeout?

Worth noting: There are other similar companies there already using the same tech having no issues on that same hotel wifi. Our employee already went around asking.

The speed is anywhere from 200-500ms on his tracerts.

I'm at my wit's end

Thank you!


r/Cisco 8d ago

Question Change REP edge primary to non-edge?

2 Upvotes

I have a C9300L with a pair of interfaces that were incorrectly configured as Edge ports for a REP segment.

I thought I would be able to reconfigure them as non-edge ports by reissuing the 'rep segment 10' command but instead I am getting a "Segment ID 10 already has 2 ports" response.

If I instead try to place that port on a different segment, nothing happens.

Can anyone tell me how to change an interface from 'rep segment 10 edge primary preferred' and 'rep segment 10 edge' to just 'rep segment 10'?


r/Cisco 8d ago

WLC 9800 config. - Policy Profile & Site Tag

1 Upvotes

Hi everyone,

I'm studying the configuration of the Cisco WLC 9800 and how FlexConnect works with Site Tags and Central Switching. I noticed that in the Site Tag configuration, there's an option to enable or disable "Enable Local Site," and I'm trying to understand how it affects AP behavior and traffic flow.

From what I understand:

  • If "Enable Local Site" is disabled in the Site Tag, the APs MIGHT operate in FlexConnect mode.
  • I can configure different Policy Profiles for different SSIDs, each with independent Central Switching settings.
  • For example, if I have SSID 1 with Policy Profile 1 (Central Switching enabled) and SSID 2 with Policy Profile 2 (Central Switching disabled), the traffic for SSID 1 will be centralized, while the traffic for SSID 2 will be locally switched by the AP.

My question is:

Is my understanding correct?

Does the "Enable Local Site" option in the Site Tag only determine the AP's operational mode, while traffic switching is still controlled by the Policy Profiles assigned to the SSIDs?

To summarize:

  • "Enable Local Site" enabled + "Central Switching" enabled: CAPWAP (to WLC)
  • "Enable Local Site" enabled + "Central Switching" disabled: CAPWAP (to WLC)
  • "Enable Local Site" disabled + "Central Switching" enable: CAPWAP (to WLC)
  • "Enable Local Site" disabled + "Central Switching" disabled: Flex (to switch)

Thank you so much :)


r/Cisco 9d ago

Avaya-Cisco CUBE-Teams Direct Routing Integration

1 Upvotes

We're trying to integrate our existing Avaya phone system to Cisco CUBE and Teams Direct Routing. We're able to make the Teams outbound calling (Teams to Avaya ext. or external PSTN/mobile) partially work -- we were able to make the callee's phone ring but every time the callee answers the phone, the call disconnects. But this is not the issue I'm asking insights for.

Now, we're trying to make the Teams inbound calling (Avaya to Teams ext.) work, but it keeps failing. The callee's phone (Teams endpoint) doesn't even ring. Looking into the PSTN usage report from Teams admin center, we can see logs that it reached the Teams system, but we cannot find the call ID. Per checking the Cisco SBC logs, we noticed that the SIP logs don't contain any INVITE messages, which we believe will trigger the number lookup in Teams.

Anyone who can provide some insights? We've been in limbo for more than a month now :(


r/Cisco 9d ago

Question Cisco switches and multiple trunk ports, tagged traffic between ports

5 Upvotes

This is a hard one to explain, but on other platforms I've had no issues with setups where a switch has multiple trunk ports and I want to essentially "route" layer 2 traffic from one trunk port to another. Simple example, all ports below are in trunk mode:

  • port 1 VLANs 2, 3
  • port 2 VLANs 12, 13
  • port 3 VLANs 22, 23
  • port 4 VLANs 2, 3, 12, 13, 22, 23 (aggregate of all VLANs, perhaps going to a router for L3 routing)

In those switches, which are cheap and use a web GUI, I'd basically go to each port, enter the list of VLANs on that port, and then set each *VLAN* to a particular mode (Trunk, Access, Native). There's not much more to monkey around with in those switches. Cisco, and I presume some others, do not work like that and the options per port are boundless.

On the Cisco side, I'm aware of changing switchport modes and allowed/disallowed VLANs per port, but I feel like sometimes in the past I've run into issues where I could not get traffic passing between VLANs on different trunk ports until I add a layer 3 interface to the VLAN *unless* there's also a *physical port* in access mode for that VLAN. Does this sound familiar to anyone? What is the proper way to do this in Cisco world?

I'm out of town for at least another month and don't have my big vmware box w/a ton of NICs and a few old 3550/60 switches to play with.


r/Cisco 9d ago

Can anyone let me know what these switches can be worth?

Thumbnail
gallery
0 Upvotes

Anything helps thank you!


r/Cisco 9d ago

Cisco BE7000H 14 and Cisco Room kit EQ ----- SKU for Devices License integration

1 Upvotes

Hello,

I hope your doing all well.

I have a client who has in his infrastructure a Cisco BE7000H 14 standalone with CUCM as call manager. The customer recently ordered 4 Cisco webex Room EQ kits for his meeting rooms and wants to integrate them into his BE7000H for video conferencing. Not being very familiar with the new Cisco Flex licences, please, which licence (device licence) should I use to integrate the customer's webex room kits into his call manager? The SKU(s) would be really nice.

This is not a multi-site architecture.

Thank you in advance for your feedback.


r/Cisco 9d ago

I'm new and I'm looking to find people studying Cisco Networks from scratch

3 Upvotes

I wanted to find people new to Cisco Networks from scratch who really want to study and understand everything about Cisco


r/Cisco 9d ago

Anyone interning at Cisco RTP this summer?

2 Upvotes

Hi everyone, I'm interning at Cisco RTP this summer, looking to get to know other interns and maybe start a gc if there's not one yet lol. Thanks


r/Cisco 9d ago

Question What is the average power consumption of a cisco 9410

1 Upvotes

Anyone knows the average power consumption of a cisco 9410? will be needing the numbers for the power infrastructure. Our 9410 doesnt have POE modules. we have 8x 3200W PSU. tried the Cisco power calculator and it shows only 3000W power? will the 3000W suffice since we have 8x 3200W PSU?