I have a IOS firewall router connecting over ISDN (DDR) to a PIX. Topology as follows:
CISCO IOS 1712----isdn----800-PIX
The problem is that the peers try to communicate when not needed, causing the DDR to open up the ISDN link.
ISAKMP lifetime is 300 seconds
IPSec lifetime is 300 seconds.
I do not want to compromise these just yet. An access list would do, but exactly what? I have tried just allowing data between the secured hosts, but this did not work. It seems that the DDR only comes up when the peers communicate (both the firewalls), but it is exactly this communication that is causing the unnecessary costly call
When there is no traffic to be sent across and the SA expires, no re-negotiation takes place. Re-negotiation of a new SA happens only if traffic is being sent across and this is true if you have a large enough lifetime (say 15 to 20 minutes). With a lifetime of a 2 to 3 minutes, renegotiation will take place. Try a slightly larger lifetime and it might work. Either way, 300 secs is too short a lifetime, and must be stressing out system resources.
RADIUS and Symantec VIP.
I will use screenshots of ASDM, and at the end I will add the required CLI commands. the diagram below show a diagram of the steps the FW goes through when using 2FA authentication:
As you can see in Fig. 1&nbs...
Unable to get signature update from cisco.com
1. Make sure the router can get name resolution. Configure the router with a proper DNS name server.
ISR4451#utd threat-inspection signature update server cisco username xxxxx password yyyyy