Cisco FMC/FTD useful flex configs

See anyconnect usernames in the log (good for brute force attackes) 

Once / Append

no loggin hide username

Disable CSD (related to AnyConnect posture)

Every time / Append

tunnel-group DefaultWEBVPNGroup webvpn-attributes

without-csd

VPN idle policy

Once / Append

group-policy .DefaultS2SGroupPolicy attributes

vpn-idle-timeout none

vpn-session-timeout none

Control plane ACL

Once / Append

access-group $Anyconnect_Block_Bad in interface OUTSIDE control-plane

Enable threat detection

Every time / Append

threat-detection service invalid-vpn-access

threat-detection service remote-access-client-initiations hold-down 10 threshold 20

threat-detection service remote-access-authentication hold-down 10 threshold 20

Disable AnyConnect webpage

Once / Append

webvpn

keepout "503: Service Unavailable"

Enable  AnyConnect webpage

Once / Append

webvpn

no keepout "503 Service Unavailable"

activate trial license on palo alto firewall

Log into https://support.paloaltonetworks.com/

Go into Products > Assets

Find your firewalls by serial

Click the edit asset (pencil icon) on the right

Go to Licenses & Subscriptions at the top

Review in case there are any licenses there waiting to be activated (activate those if the real purchased licenses are there)

If they are not appearing and we need them in a rush, we can try apply a temp license

Click "activate License" button at the bottom

Choose activate trial license

Tick the box for the licenses we need

Agree and Submit

fixing cisco umbrella AD connector issues

Some AD connectors were in a state of error

The customer had not actioned the API key and AD username updates.

Step 1 - Fix the API key as per cisco's instructions

Make sure to save your secrets in a pw fault

https://www.cisco.com/c/en/us/support/docs/security/umbrella/225982-configure-and-verify-new-authentication.html

Step 2 - Confirm password for opendns_connector user, now cisco_connector

Testing pw cmd:

• runas /netonly /user:OpenDNS_Connector@domain.int notepad.exe

Testing pw powershell:

Add-Type -AssemblyName System.DirectoryServices.AccountManagement

$ctx = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('Domain','domain.int')

$ctx.ValidateCredentials('OpenDNS_Connector', (Read-Host 'Password'))

Update the username in AD to Cisco_Connector

Reset the password if needed

Step 3 - Download latest connector installer and script from umbrella dashboard 

Step 4 - Uninstall connector, run script, re-install connector

Uninstall old connector

Run AD script 

Install connector, choose AD

Enter the Cisco_Connector password we updated above

Step 5 - Check logs and wait for cloud sync (15 min)

Check logs in

C:\Program Files (x86)\Cisco\CiscoADConnector\v1.x.x

CiscoAuditClient

2026-10-02 10:34:01.522: Bearer token request Successful

2026-10-02 10:34:01.522: GetBearerToken() Success: 200

CiscoAuditClient.error

Check for errors

Hard refresh the umbrella dashboard ctrl + F5.

If sync issues are not resolve gather logs and raise case with cisco TAC