cisco firepower flex config gothcha

 I was trying to apply some flex config but it wasn't appearing in the CLI.

After opening a case with TAC he showed that we need to edit the objects in

Device -> Flexconfig

Now we can deploy the policy to make the changes.

He also mentioned we should use AD authentication method

Also we found from the debug the mapping of our group should be as follows

CN=AD_GROUP_NAME,OU=VPN,OU=Groups,DC=CUSTOMER,DC=COM

cisco anyconnect debug commands

Depending on which auth method you are using

Set putty to log

Get public IP from user

debug ldap 255

debug radius all

debug webvpn 255

watch the log and connect with your anyconnect user

source NAT on palo alto firewall

For the source translation use dynamic-ip-and-port even if you are NAT'ing to a static IP. In the palo world static is only used for 1 to 1 translation.

Switched it to dynamic and issue resolved

src zone: inside

dst zone: MYMAP-30

src: N-10.40.0.0-16

dst: H-10.90.32.44-32

Src translation:

dynamic-ip-and-port

H-172.20.200.1-32

troubleshoot S2S VPN on palo alto firewall

Do the usual checking settings match on both end.

Make sure you have an ACL to allow the traffic

Is there any NAT that needs to happen ?

Palo VPN commands

Check P1

show vpn ike-sa

show vpn ike-sa gateway EXIGENT-210

Check P2

show vpn ipsec-sa 

show vpn ipsec-sa tunnel EXIGENT:ProxyID1

Check encaps/decaps

show vpn flow name EXIGENT:ProxyID1

If you need to take it further you can run debugs

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

copy (tftp) files to each switch in a cisco switch stack

copy tftp: flash1:

copy tftp: flash2:

copy tftp: flash3:

etc

On the master set the boot var for all switches

boot system switch all flash:image.bin

https://community.cisco.com/t5/switching/boot-system-command-for-quot-switch-2-quot-of-stack/td-p/1119357

reset cisco 2960

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-2950-series-switches/12040-pswdrec-2900xl.html#topic1

download packet capture (pcap) file from FMC / FTD / firepower

connect to the sensor of the FTD

use "system support diagnostic-cli" to go into ASA CLI

setup your capture as normal and capture your traffic.

Once complete "copy /pcap capture: disk0:"

now type exit twice to get out of ASA CLI

type "expert"

cd to "/mnt/disk0"

cp MYCAP.pcap /ngfw/var/common

On the FMC web interface

Devices -> hammer + wrech icon -> advanced 

Go into advanced troubleshooting -> File download

Enter MYCAP.pcap and click download.