show ports listening on cisco router

show tcp brief all

show control-plane host open-ports

dynamic split tunnel FTD

 https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/220247-configure-anyconnect-dynamic-split-tunne.html

gre tunnels not coming up

Have an issues but not sure of the cause, sometimes the GRE tunnel does not re-establish over a S2S VPN.

Save backup config and check routes

Ensure your S2S VPN config is correct, usually you will see VPN p1 up but GRE tunnel showing as up/down.

shut down both tunnel interfaces on either end

save the router config

reboot the remote router config

bring up tunnel interface in HQ router

Now bring it up on the remote router

Ensure all routes are in place

remote > HQ (tunnelxx)

HQ > remote (tunnelxx)

FMC 7.4 notes

Create a blank policy called onboarding with nothing attached 

This is if you are moving FTD's between FMC there is some unique things like NAT and interface zones so best to

Make sure to backup your policy

ASA side IP / routing conifg

delete the manager

wipe FTD

add to new manager (onboarding policy)

Once added switch to your new real policy

review eol switches for replacement

The eol doc will recommend a replacement path. If not your will need to figure it out.

check software and hardware

check for fibre connections

check cdp

check routing (2 eigrp neighbors we may need advantage license)

sh ver (check port numbers)

sh inv | i stack (check stack cables)

sh switch

Cisco ASA check for SSL running

show asp table socket | include SSL

show running-config all ssl

ip sla config examples

ip sla 1

tcp-connect 192.168.0.1 23 control disable (use telnet port)

ip schedule 1 start-time now life forever

sh ip sla stat

ip sla

tcp-connect 192.168.0.1 5555 source-ip 192.168.0.2 control enable (standard port)

R2

ip sla responder

***********************************

ip sla 2

icmp-echo 192.168.0.2 source-ip 192.168.0.1

freq 5

ip schedule 2 start-time now life forever

can use with the track object to change routes 

track 2 ip sla 2

sh track

*************************************

udp-echo

ip sla 3 

udp-echo 192.168.0.2 5000

freq 5

ip schedule 3 start-time now life forever

R2

ip sla responder udp-echo

*************************************

ip access-list extended SLA (acl if you want to see the ef packets going up)

permit ip any any dsp ef

permit ip any any

int fa0/0

ip access-group SLA in

int s0/1 

ip access-group SLA in

ip sla udp-jitter config

ip sla 4

udp-jitter 192.168.0.2 6000 g729a control enable

freq 5

ip schedule 4 start-time now life forever

show ip sla stat 1