Cisco FMC/FTD useful flex configs

See anyconnect usernames in the log (good for brute force attackes) 

Once / Append

no loggin hide username

Disable CSD (related to AnyConnect posture)

Every time / Append

tunnel-group DefaultWEBVPNGroup webvpn-attributes

without-csd

VPN idle policy

Once / Append

group-policy .DefaultS2SGroupPolicy attributes

vpn-idle-timeout none

vpn-session-timeout none

Control plane ACL

Once / Append

access-group $Anyconnect_Block_Bad in interface OUTSIDE control-plane

Enable threat detection

Every time / Append

threat-detection service invalid-vpn-access

threat-detection service remote-access-client-initiations hold-down 10 threshold 20

threat-detection service remote-access-authentication hold-down 10 threshold 20

Disable AnyConnect webpage

Once / Append

webvpn

keepout "503: Service Unavailable"

Enable  AnyConnect webpage

Once / Append

webvpn

no keepout "503 Service Unavailable"

activate trial license on palo alto firewall

Log into https://support.paloaltonetworks.com/

Go into Products > Assets

Find your firewalls by serial

Click the edit asset (pencil icon) on the right

Go to Licenses & Subscriptions at the top

Review in case there are any licenses there waiting to be activated (activate those if the real purchased licenses are there)

If they are not appearing and we need them in a rush, we can try apply a temp license

Click "activate License" button at the bottom

Choose activate trial license

Tick the box for the licenses we need

Agree and Submit

fixing cisco umbrella AD connector issues

Some AD connectors were in a state of error

The customer had not actioned the API key and AD username updates.

Step 1 - Fix the API key as per cisco's instructions

Make sure to save your secrets in a pw fault

https://www.cisco.com/c/en/us/support/docs/security/umbrella/225982-configure-and-verify-new-authentication.html

Step 2 - Confirm password for opendns_connector user, now cisco_connector

Testing pw cmd:

• runas /netonly /user:OpenDNS_Connector@domain.int notepad.exe

Testing pw powershell:

Add-Type -AssemblyName System.DirectoryServices.AccountManagement

$ctx = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('Domain','domain.int')

$ctx.ValidateCredentials('OpenDNS_Connector', (Read-Host 'Password'))

Update the username in AD to Cisco_Connector

Reset the password if needed

Step 3 - Download latest connector installer and script from umbrella dashboard 

Step 4 - Uninstall connector, run script, re-install connector

Uninstall old connector

Run AD script 

Install connector, choose AD

Enter the Cisco_Connector password we updated above

Step 5 - Check logs and wait for cloud sync (15 min)

Check logs in

C:\Program Files (x86)\Cisco\CiscoADConnector\v1.x.x

CiscoAuditClient

2026-10-02 10:34:01.522: Bearer token request Successful

2026-10-02 10:34:01.522: GetBearerToken() Success: 200

CiscoAuditClient.error

Check for errors

Hard refresh the umbrella dashboard ctrl + F5.

If sync issues are not resolve gather logs and raise case with cisco TAC

palo alto updates quirk

Sometimes to get the updates to load 

Go to

dynamic updates

check now

software untick all boxes

check now

now look for version eg 11.2.10

click download

If its still not showing check firewall rules allow management IP's to access paloalto updates

investigate failover on palo alto firewall

 Log into both firewalls

In the Dashboard > High Availability widget, you may notice the primary has change from active to passive.

On both firewalls go to 

• Monitor > System
• Filter the log 
• subtype eq ha

You should see a reason for the failover. 

Often the link monitors fail (internet connection issue). You can check them here

• Device > High Availability > Link and Path Monitoring 
• Link group will show the interfaces that need to be up (Layer 2)
• Path group will show the IP's the firewall will try to ping to confirm link is up (Layer 3)

 Have seen the auto updates trigger failovers as well

palo alto nat across S2S VPN to reach mgmt interface

Customer had 192.168.x.x network overlapping

I needed to reach 192.168.0.82

I decided to NAT on customer side.

I sent traffic to 172.17.19.0 (This was in the VPN proxy ID)

172.17.19.0 (cust side) <> 172.16.100.0 (my side)

Now for NAT

Source Zone: VPN-ZONE (don't forget tunnel interface setup)

Destination zone: LAN

Source add: 172.16.100.0

Destination add: 172.17.19.0

Translated packet

Destination address translation

Translation type: Static IP

Translated address: N-192.168.0.0-24

Also note that mgmt interface IP config is not sync'd so you will need to get your IP's allowed under 

device > setup > interfaces > management > permitted IP addresses 

switch meraki mx to new internet connection

*** Important 

Cisco messed up the local status page passwords. Autogenerated pws but they weren't stored by cisco or given to customers.

Step 1 - Make sure local status page is enabled and pw reset

• Network wide > configure > general 
• Scroll down to Device configuration
• Make sure "local device status page enabled" is selected in the drop down
• Change password, enter a 14 char pw with numbers/upper and lower case and symbol
• Click update
• Allow time for cloud to sync

Step 2 - Test local status page before switching

• Before switching anything 
• Plug laptop into a meraki LAN port (check the port is on right vlan)
• Visit the local status page for MX it should be http://wired.meraki.com
• One customer said it only worked in edge but not chrome 
• test login works

Step 3 - Switch over to new interconnection and reconfig

• Switch over to new internet connection
• Plug WAN port into the new ISP
• Log into local status page. 
• Config the new settings and save
• Give it a few minutes to connect to cloud (check LEDs)
• It should come online and appear in cloud
• You may also change the cloud config to match 

Meraki status pages

MR - http://ap.meraki.com

MS - http://switch.meraki.com 

MX - http://mx.meraki.com or http://wired.meraki.com

MG - http://mg.meraki.com

Any - http://setup.meraki.com or http://my.meraki.com

FYI - Cisco reset local status page passwords, it used to be admin and the serial of the device but in 2025 cisco auto generated one and asked users to set a password.

https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page