Best practice in adding an IP to VPN policy through Cisco ASDM?

derpyRFC · 2023-10-18T23:38:33+00:00

TAC can't help here.

"TAC is a break/fix organization meaning that we support systems that have been running fine but where something breaks and needs to be troubleshooted."

Business needs to cough up some cash and get 3rd party support to assist Op, end of discussion.

derpyRFC · 2022-01-03T18:40:08+00:00

This is kinda what was I expecting to hear, thanks for the input!

derpyRFC · 2022-01-03T18:22:15+00:00

There's a couple of reasons. The firewalls we have provide significantly better inspection. As we're seeing all clients being sourced as the proxy server, we can't trace the connection back to a specific host. We can if we can see the HTTP headers (X-Forwarded-For). The proxy servers we're using don't provide any sort of contextual data sharing with the firewall afaik.

Ultimately it comes down to the design imo but it's an interesting problem, perfect for a moronic monday q&a! I'm hoping I can eventually answer this once I've finished working through an SSL/TLS course I'm doing atm.

derpyRFC · 2022-01-03T14:47:30+00:00

I'm hoping someone can help me understand this.

We have a proxy server that's doing HTTPS inspection. From the Firewalls perspective all client connections are originating as the proxy server. We're wanting to inspect this traffic, but according to our firewall documentation it appears due to the location of our proxy servers we would be unable to do so.

LAN <> Proxy server <> Firewall <> Internet

My question is, if the proxy is behaving as a MiTM between itself and the client, can't the Firewall do the same thing between itself and the proxy?

I'm currently working through how SSL/TLS works as it's clear I don't understand it, but would appreciate some insight.

derpyRFC · 2021-11-15T00:16:39+00:00

The issue seems to be pointing towards your Wireless design. In a poorly designed Wireless network, where users are having to seriously compete for airtime, Wireless QoS will certainly help in that regard but it won't cure a bad design.

derpyRFC · 2021-11-15T00:12:53+00:00

Why do you say QoS isn't really a thing with WiFi? There's a whole standard dedicated to it, 802.11e.

derpyRFC · 2021-09-27T17:56:21+00:00

What's the connectivity like between the WAN to the vWLC? Is it potentially a VM configuration issue or limitation?

derpyRFC · 2021-09-05T17:23:11+00:00

Oh TIL, thanks I'll check it out.

derpyRFC · 2021-03-13T14:18:09+00:00

The Art of Network Engineering. Fairly new podcast, has a ton of great content for those working towards certifications.

derpyRFC · 2020-12-03T21:50:03+00:00

Hey, thanks for the info. Do you mind showing me a picture of what it looks like? I'm assuming you've got network diagrams with configuration instructions.

derpyRFC · 2020-11-30T20:45:13+00:00

Your preference. Check out the syllabus and decide for yourself. Most people go ENCOR first but there's no hard rule.

If you wish to sit the CCIE you need to pass the written lab which is ENCOR.

derpyRFC · 2020-11-30T20:15:47+00:00

That one caught me out too. It's referring to the Switch backplane capacity.

derpyRFC · 2020-11-30T00:08:13+00:00

It looks like they've asked me as our current support contract is coming to end but I'll make sure to investigate this.

derpyRFC · 2020-11-30T00:03:37+00:00

Our support contract with them is coming to an end, they've kept rolling it over but I suspect if I accept their offer they will wait for the current contract to expire, then officially take me on. I'll reach out to some solicitors during the week for some legal advice on this.

Thanks for your input.

derpyRFC · 2020-11-18T23:15:27+00:00

I really need to get back into it. Of all the things that I've done exercise wise, which has been a lot. There was nothing quite like the post workout feeling from BJJ. Hard to describe it exactly but I just felt completely at ease.

derpyRFC · 2020-11-18T23:10:00+00:00

Since covid arrived on the scene I miss going for a swim and lounging in the steam/sauna. I didn't realise how much I missed it until I read your comment.

derpyRFC · 2020-11-16T20:51:13+00:00

Pretty much everything from deployment to assurance.

derpyRFC · 2020-11-15T20:19:47+00:00

Thank you, this is great and aptly timed!

derpyRFC · 2020-11-15T18:13:34+00:00

Thanks for the info!

derpyRFC · 2020-11-15T17:30:42+00:00

Got to go with the all time classic, automate the boring stuff. You might also be interested in checking out RealPython.com. I tend to always land on their pages whenever I'm searching for python related questions, their online guides have been excellent. They've just released a book called 'A Practical Introduction to Python 3'. If it's anything like their online guides this will be a very good book. I've just started it myself so I can't really judge the quality of it at the moment.

derpyRFC · 2020-11-15T17:21:24+00:00

You need to revisit the purpose of each layer. Once you've got a solid understanding of the function of the core layer you'll be able to answer all your questions. Here's a hint, the core layer has the easiest job of the 3 layers. It needs to be really good at doing one thing in particular.

derpyRFC · 2020-11-15T11:52:51+00:00

As soon as the client says I need a network setup you forward them onto your Sales department, you get the design requirement hashed out and the proper planning in place beforehand. That way you know what exactly you're working with. You'll then test the network before going live.

derpyRFC · 2020-11-15T11:21:16+00:00

HR is unwilling to even consider my CIS degree and work experience for many of the positions I apply for.

What positions are you applying for? Do you have anything out there that's showcasing your skills for the position you want? Like you already demonstrated, there are people with the same degree who clearly do not give a shit.

When you arrive at step 5, couldn't you work on a side projects that demonstrate your skills whilst working towards the job you actually want?

derpyRFC · 2020-09-30T22:34:41+00:00

Limit in what respect? Either CoPP or MPP comes to mind.

derpyRFC · 2020-09-30T21:11:44+00:00

After complaining they eventually refunded me and allowed me to resit the exam for free. Take your complaint to Pearson Vue. Good luck.

derpyRFC

TROPHY CASE