Cisco ASA Domain Authentication and Trust (Allowing)
ASA Domain Authentication KB ID 0000973 Problem I cringed this morning when I was asked about this, last time I had to get a client to authenticate to a domain through a firewall, it was ‘entertaining’. The problem is Windows loves to use RPC, which likes to use random ports, so to make it work you either had to open TCP ports 49152 and 65535 (Yes I’m Serious). Or you had to registry hack all your domain controllers...
RSA SecurID Error – ‘106: The Web server is busy. Please try again later’
RSA SecurID Error KB ID 0000975 Problem Not the most descriptive of errors! In fact this has got nothing to do with the busyness of the web server at all. Solution : RSA SecurID Error What’s actually happening is the RSA agent on this machine (in this case a web server) cannot communicate with the RSA Authentication Manager. In my case the web server was in a DMZ, and the RSA Authentication Manager Appliance was in another DMZ....
CentOS TFTP Server (Install and Configure)
CentOS TFTP Server KB ID 0000998 Problem I needed to back up a Cisco firewall, and perform an upgrade remotely, despite my best efforts to use the ASDM and update via http, I had to go ‘old school’ and bring up a TFTP server on one of my CentOS Linux servers. Solution CentOS TFTP Server 1. Log onto the server and install the xinetd TFTP Server. Execute the following command and follow the on-screen prompts. Using username...
Windows – Setting Domain Time
Domain Time KB ID 0000112 Problem If you have arrived here, you have either noticed that the time is wrong on your server(s) or client PC(s), or you have looked in the event viewer and seen one of the following events being logged. Event ID’s 12, 22, 29, 36, 38, 47, and 50. Time Problem Events – On the PDC Emulator Event ID 12 (W32 Time Time Provider NtpClient: This machine is configured to use {text omitted}, but it is...
Cisco ASA: Mixing TCP and UDP in Object-Groups
KB ID 0001668 Problem I like object-groups, they can make your firewall configs a lot smaller/neater and if you need to add a host, network, range, or port, then you can simply add the new requirement to an existing group. But what if you want to allow both UDP and TCP ports, you can create a service group for TCP and add the ports and a service group for UDP and add the ports, and add them into your ACL where you would expect ports...