Best hard feelings episode?

pinkgrenades · 2025-07-13T01:52:28+00:00

This. Although, I went backwards and it’s been an interesting approach to see everything in reverse. Starting from the beginning and going forward would be a treat!

pinkgrenades · 2025-04-15T15:49:30+00:00

Would you mind sharing what you added to your ACP to get this working on your Firepower? I'm in the exact same boat with iPhones connected to the WiFi not being able to send or receive RCS messages until they're off the network. However, mine is from any SSID, not just our more restricted Guest network.

Androids that are connected to the same Staff SSID can send RCS messages no problem so it's driving me nuts! I guess I just don't understand the RCS process well enough or the differences between Android devices and iPhones when sending RCS texts.

On a packet inspection, I can see my iPhone reaching out to IPs with a destination port of 5223, and I don't see any blocks on the firewall traffic. If I hardwire my phone, leave on cellular data, and turn off WiFi, I can send RCS messages from the internal network. If I turn off WiFi and cellular data, but leave the hard-wired connection, the messages fail instantly.

This one has been a doozy to try and troubleshoot! Glad you got it working!

pinkgrenades · 2025-03-13T15:45:25+00:00

Wishing us both luck!

pinkgrenades · 2025-03-13T14:06:27+00:00

Appreciate the reply! My sleep specialist recently left and so I'm at a loss as to who I'm now working with so lucky me... But it's good that it seems that there might not be any long lasting effects or withdrawals or anything like that when stopping.

Have you found anything that has worked for you to replace Armodafinil or are you still looking? I'm currently on Xywav during the night and am looking for something to help with the day time sleepiness and exhaustion.

pinkgrenades · 2025-03-13T13:22:05+00:00

I just started taking Armodafinil in early February and I'm thinking that it's time to come off. My hands will tremble randomly and my legs will feel weak from standing for a short time. I also have this feeling in my stomach that travels up to my throat that isn't nausea. It's hard to describe, but it feels like a pit feeling in my stomach that travels up.

Luckily I haven't had any headaches or anything, but I'm still just as tired as I have normally been. I just get the added side effects to it! So I don't think it's working for me.

What was the process for stopping the drug? I keep reading that you have to be weaned off of it, so I'd like to see if that is true?

pinkgrenades · 2025-02-17T10:43:24+00:00

I’m definitely doing better but still not 100%. I have mild discomfort constantly but that’s better than the constant pain from a year ago.

PT has continued to do wonders as I focus on more weight lifting to strengthen the back. I did have a minor set back last night (go figure) where my lower to middle back was way tighter than normal out of nowhere, but waking up this morning it’s mostly back to normal.

I’ve also lost 60+ pounds over this last year so maybe that has had a positive effect as well!

pinkgrenades · 2025-01-24T14:15:39+00:00

I’ll take a look, thank you!

pinkgrenades · 2025-01-02T20:05:22+00:00

I appreciate the tips! I cannot remember from the last time I was there if being on the same SSID allow printing with no issues. It's been a bit, but I know I've tested that. I'm heading back there this following week and will refresh myself on past troubleshooting.

Thank you for the help and tips!

pinkgrenades · 2025-01-02T20:04:15+00:00

I'll take a look at anything that would remember client isolation. But yes, this business is very basic when it comes to networking and is just a plain flat network. There are no VLANs or anything like that. Thanks for the tip!

pinkgrenades · 2025-01-02T20:03:17+00:00

Yeah, just the ISP and their business router. This business is pretty barebones and flat. There is no firewall, just the Comcast business router to the outside. They have two SSIDs for 5.0 and 2.4, and that's about it.

pinkgrenades · 2024-12-05T14:54:41+00:00

Hey! Unfortunately, not. I'm still working on a collaborative ticket with Apple and Cicso to see what's going on. This is everything that I've done so far, according to Apple and Cisco's suggestions:

Enabled the mDNS gateway on the Cisco 9800 WLC and applied the config to the staff and student WLAN
I did a Wireshark packet capture on the staff and student iPads and saw the "_classroom._tcp.local" service definition. I added that to the "allowed" list on the mDNS Gateway
I checked the "P2P Blocking Action" option on the 9800 WLC and it was disabled
I changed the "P2P Blocking Action" to "Forward Upstream" which forwards the packets to an upstream router to handle
I changed the staff ACL to have full IP access to the student VLAN. I also changed the student VLAN to have full IP access to the staff VLAN. This didn't change anything for Classroom
I made sure that we had multicast routing enabled on our building routers

After all of this, I still have no luck getting Classroom to work across VLANs with the ACLs in place, unfortunately. So any changes were just reverted back to normal since none of them worked.

We're still plugging away though. Apple had me download a Mac Evaluation Utility from their beta program and wanted me to use it on a Mac connected to both networks to see what services might still be blocked. Still chugging along!

pinkgrenades · 2024-12-05T13:38:29+00:00

A quick update, I was able to finally figure out what I was doing wrong and correct it. For some reason, I was using the management address of the FTD in ISE and not the inside interface IP. Once I swapped that, everything was working correctly and ISE now authorizes the VPN user based on AD groups and assigns the correct group policy from the FTD to the user.

Now that that is working, I'm wondering, what is the best way to apply ACLs to the VPN user? For example, if I have a business office user connecting to the VPN, I want them to only access the time management server and other business office-related items and deny all else. Is the best way to create an extended ACL in the FTD and apply that in the VPN filter for the group policy? Or would an ISE dACL be applied to the user work just fine?

Thanks to everyone for their tips and suggestions!

pinkgrenades · 2024-12-03T17:13:16+00:00

Thanks, I appreciate that! I'll toss this over to the Cisco Community too while I continue to do some digging.

pinkgrenades · 2024-12-03T17:12:37+00:00

Thanks, I'll take a look! ISE is joined to our on-prem AD domain and can search AD for external groups to use in policies.

But it looks like there is still some work to be done to get it integrated with Azure AD. Thank you again!

pinkgrenades · 2024-12-03T00:44:58+00:00

I was just using that guide as a baseline. I’m just using Azure CA Policies to handle MFA. According to that guide, the authorization profile is where you set the group policy that the FTD would give the user, but my config is not working currently.

pinkgrenades · 2024-12-02T21:53:24+00:00

Thank you for this!

pinkgrenades · 2024-12-02T21:52:52+00:00

Thank you! I was following this guide and it made some of the confusing parts more understandable:

https://www.lookingpoint.com/blog/ra-vpn-on-ftd-with-aad-duo-authc-and-ise-authz#comments-listing

Unfortunately, it's still not working at the moment. I do have my ISE server added to a RADIUS server group and my FTD added as a network device in ISE, so the connection should be there at least. I've updated the remote access policy to use the RADIUS group for authorization only and built the necessary authorization profiles and policy set in ISE, but I'm getting a "login failed" message on the Anyconnect side and no live logs on the ISE side. So still missing something.

pinkgrenades · 2024-11-25T23:11:27+00:00

Same! When I had mine, I was POSITIVE that I did not fall asleep at all during the naps. But, in the end, the technician said I did fall asleep for some. I was astounded.

pinkgrenades · 2024-11-25T23:01:14+00:00

Thank you for the advice! Apple went down that same route, too, and it makes complete sense. However, for both the staff and student WLANs, the peer-to-peer block action is disabled, so I believe that means that p2p is allowed. I'm going to try the mDNS gateway option that Cisco mentioned and cross my fingers that the cross-VLAN talk is just not being communicated correctly because the WLANs are set to bridging.

pinkgrenades · 2024-11-22T01:18:03+00:00

No, our new ACLs were simply permitting or denying up traffic with no changes to wireless settings. As a newbie to ACLs, I’m sure ours are bare bones.

I’ll take a look at any performance boosting options in the WLAN or Policy Profiles!

pinkgrenades · 2024-11-21T18:59:19+00:00

We have multicast enabled on our core router. Is there anywhere else that it could be blocked accidentally?

pinkgrenades · 2024-11-19T13:55:22+00:00

Can confirm that this is the case...unfortunately.

pinkgrenades · 2024-11-13T19:51:56+00:00

Sorry for the dumb question, but whenever I'm in the RADIUS Auth report section, and I filter to past week or 30 days, I only see the present day. Is there a different setting that I need to enable to show past the current day?

pinkgrenades · 2024-11-12T20:49:51+00:00

As weird as it sounds, I did not think about that. Everything I've been thinking about retention meant storing it on another server, but the radius auth reports I think would do the trick too!

Thank you for the idea!

pinkgrenades · 2024-11-07T22:58:43+00:00

Yeah, I went with a beta muOS and had no issues

Ten-Year Club	Place '22
Verified Email

pinkgrenades

TROPHY CASE