Author: Chathura Ariyadasa

♚Father ♚Innovative Technical Architect ♚ Cyber Security Strategist ♞ vCISO | vCIO ♞ Blogger & an Adrenaline junkie...

Firepower IPSEC VPN tunnel issues with Remote ACL

When you work with Cisco Firepower firewall systems, you may come across issues related to ACLs. What happens is Firepower systems drop any remote traffic even if the correct ACLs are in place. To resolve this issue a workaround can be applied. 

The parameter is sysopt connection permit-vpn can be enabled. On ASA systems, this is enabled by default. But not on firepower systems. We will look at how we can enable this parameter on Firepower Device Manager (FDM).

Go to FDM GUI > Device > Advanced Configuration > View Configuration

Click on FlexConfig Objects and click on the ‘+’ icon to create a new FlexConfig object, give it a name

Click on the ‘+’ icon for the ‘Variables’ section. Give the variable any name, and select ‘string’ as its type. Enter ‘sysopt’ (without quotes) as the value, and click ok.

In the template section, type {{vpnSysVar}} connection permit-vpn

Go to Flexconfig policy and add the newly created Flexconfig object. 

Finally, Save and deploy the changes. 

 

Remove Inactive Tenants from Horizon DaaS Service Center

When the Tenant installation fails, you need to clean up those inactive tenants. In order to do that, you need to delete the relevant columns from the Service provider appliance. We will look at how to delete that information. 

NOTE: All the commands are in Bold Italic

Log into the Service Provider floating IP through SSH

Connect to the Fabric database psql -U admin fdb

Find the tenant ID select id, org_name from organization;

Disable the tenant, using the captured IDs

UPDATE organization SET is_disabled=’t’ where id=’xxxx’;

Finally, we need to delete the records from the below tables

  • Compute Pool – delete from compute_pool where org_id=xxxx;
  • Billing Summary – delete from billing_summary where org_id=xxxx;
  • Organization – delete from organization where id=xxxx;
  • Appliance – delete from appliance where org_id=xxxx;