오늘은 Cisco ASA Remote Access VPN에서 사용할 인증서 Self Signed Certificate를 생성하고 이 인증서는 Remote Access VPN용으로 사용해 보겠습니다.
1. 시간을 설정합니다.
conf t clock set 13:48:00 17 Apr 2025
or
ntp server 64.235.61.113
2. Hostname이랑 Domain-name를 설정합니다.
conf t hostname asa1 domain-name kevin.rest
3. key 생성 - key name: VPN-RSA-KEY
asa1(config)# crypto key generate rsa label VPN-RSA-KEY modulus 1024 INFO: The name for the keys will be: VPN-RSA-KEY Keypair generation process begin. Please wait... asa1(config)#
asa1(config)# show crypto key mypubkey rsa | begin VPN-RSA-KEY Key name: VPN-RSA-KEY Usage: General Purpose Key Modulus Size (bits): 1024 Storage: config Key Data:
오늘은 Cisco ASA에서 NTP Server 설정과 NTP Zone를 설정해 보겠습니다.
1. 싱가폴 NTP Server List 확인
google 에서 Singapore NTP server 검색
server 0.sg.pool.ntp.org server 1.sg.pool.ntp.org server 2.sg.pool.ntp.org server 3.sg.pool.ntp.org
IP주소 확인
C:\Users\admin>ping 0.sg.pool.ntp.org
Pinging 0.sg.pool.ntp.org [173.234.15.82] with 32 bytes of data: Reply from 173.234.15.82: bytes=32 time=40ms TTL=55 Reply from 173.234.15.82: bytes=32 time=38ms TTL=55 Reply from 173.234.15.82: bytes=32 time=39ms TTL=55 Reply from 173.234.15.82: bytes=32 time=40ms TTL=55
Ping statistics for 173.234.15.82: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 38ms, Maximum = 40ms, Average = 39ms
Router#license smart trust idtoken OGJjMmQwZDgtMWY3Zi00ZTdlLTk1YzctYjRjMzQ0Y all force
Router# *Mar 4 04:56:30.279: %CRYPTO_ENGINE-5-KEY_DELETED: A key named SLA-KeyPair has been removed from key storage[OK] *Mar 4 04:56:32.118: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named SLA-KeyPair has been generated or imported by crypto-engine *Mar 4 04:56:32.177: %PKI-6-CONFIGAUTOSAVE: Running configuration saved to NVRAM *Mar 4 04:56:34.590: %SYS-6-PRIVCFG_ENCRYPT_SUCCESS: Successfully encrypted private config file *Mar 4 04:56:37.118: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C8200-1N-4T,S:XXXXXX. Router# Router# Router# Router#
WLC01#show ip int brie Interface IP-Address OK? Method Status Protocol GigabitEthernet1 unassigned YES unset up up GigabitEthernet2 unassigned YES unset up up GigabitEthernet3 192.168.10.182 YES NVRAM up up Loopback10 1.1.1.1 YES TFTP up up Port-channel1 unassigned YES unset up up Vlan1 unassigned YES NVRAM up up Vlan100 192.168.100.182 YES NVRAM up up Vlan110 192.168.110.254 YES NVRAM up up Vlan120 192.168.120.254 YES NVRAM up up Vlan130 192.168.130.254 YES NVRAM up up WLC01#
10. Client 에서 TEST01를 접속하고 IP주소를 확 합니다.
11. WLC에서 DHCP Binding 확인
WLC01#show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type State Interface Hardware address/ User name 192.168.110.11 0056.6c31.3130 Mar 01 2025 12:48 PM Automatic Selecting Vlan110 WLC01#
지금까지 [C9800CL][#14]- DHCP - WLC Internal DHCP - option 5 글을 읽어주셔서 감사합니다.
Security -> Layter2 -> None를 설정해서 SSID 패스워드 없이 접속 가능 하게 합니다.
테스트 용도이기 때문에 이렇게 설정합니다.
그리고 Save버튼을 클릭 합니다.
4. VLAN 설정
Configuration -> Layer2 -> VLAN
Add버튼을 클릭 합니다.
4. Policy 설정
아래처럼 설정합니다.
아래처럼 VLAN를 설정하고 나머지를 디폴트 값으로 두고 SAVE버튼을 클릭 합니다.
5. TAG설정 - POLICY
Name: TEST01-POLICY-TAG
WLAN: TEST01
PLOICY: TEST01_POLICY
6. TAG 설정 - SITE
Name: TEST_SITE_TAG
아래처럼 설정 합니다.
6. AP에 TAG 설정
7. 설정값을 적용하면 AP가 재부팅이 됩니다.
8. DC SWITCH에서 DHCP 설정
DHCP ip dhcp excluded-address 192.168.110.1 192.168.110.230 ! ip dhcp pool VL110 network 192.168.110.0 255.255.255.0 default-router 192.168.110.1 dns-server 8.8.8.8 ! VLAN 110 ! Int vlan 110 ip add 192.168.110.1 255.255.255.0 no shutdown
9. DHCP Binding 확인
SW01#show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type State Interface Hardware address/ User name SW01#
10. Client 에서 TEST01를 접속하고 IP주소를 확 합니다.
11. DC BackBone Swtich에서 DHCP Binding 확인
SW01#show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type State Interface Hardware address/ User name 192.168.110.239 011e.e792.411c.f0 Mar 02 2025 06:56 AM Automatic Active Vlan110 SW01#
SW01#ping 192.168.110.239 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.110.239, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 12/19/48 ms SW01#
지금까지 [C9800CL][#10]- DHCP Bridging - Option1 - BackBone SW DHCP 글을 읽어주셔서 감사합니다.
오늘은 C8200라우터는 smart licensing using policy 모드를 사용 합니다.
IOS XE버전별로 License 동작하는 방식이 다릅니다.
IOS XE Release
Platform Requirements
CUBE Licensing
16.6.1 to 16.9.x
Smart Licensing mode is optional
RTU licensing only
16.10.x
Smart Licensing mode only
RTU licensing only
16.11.1a to 17.1.x
Smart Licensing mode only
Continued registration is required to enable CUBE features
Smart Licensing only*
Trunk license requests are set by manual configuration
No license policing if out of compliance
SIP processing disabled in the 'Eval-Expired' state
17.2.1r to 17.3.1a
Smart Licensing mode only
Continued registration is required in order to enable CUBE features
Smart Licensing only*
Trunk license requests are set dynamically by usage
No license policing if out of compliance
SIP processing disabled in the 'Eval-Expired' state
17.3.2 onwards
Smart Licensing with the use of Policy mode only
License use must be reported within the account policy to enable CUBE features
Smart Licensing only*
Trunk license use is measured periodically and reported as per the Smart Account policy
In accordance with policy, license policing reports are not acknowledged (SIP processing is disabled otherwise)
Step Summary
conf t
license boot level network-essentials
interface GigabitEthernet 0/0/0
ip add [IP address] [subnet] or ip add dhcp
no shutdown
exit
ip name-server 8.8.8.8
ip domain lookup source-interface GigabitEthernet 0/0/0
ip http client source-interface GigabitEthernet 0/0/0
license smart transport smart
license smart url default
ip route 0.0.0.0 0.0.0.0 [nexthop] if dhcp no need ip route command
end
show run
show ip int brie
show ip route
확인 후 저장 그리고 재부팅
write memory
reload
1. show version를 통해서 IOS XE버전을 확인 합니다.
2. 기본 설정을 합니다.
conf t license boot level network-essentials interface GigabitEthernet 0/0/0 ip add dhcp no shutdown exit ip name-server 8.8.8.8 ip domain lookup source-interface GigabitEthernet0/0/0 ip http client source-interface GigabitEthernet0/0/0 license smart transport smart license smart url default
3. 인터페이스 상태 확인 라우팅 상태 확인
그리고 외부 통신 확인
Router#show ip int brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0/0 172.20.10.3 YES DHCP up up GigabitEthernet0/0/1 unassigned YES unset administratively down down GigabitEthernet0/0/2 unassigned YES unset administratively down down GigabitEthernet0/0/3 unassigned YES unset administratively down down
Router#show ip route Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route H - NHRP, G - NHRP registered, g - NHRP registration summary o - ODR, P - periodic downloaded static route, l - LISP a - application route + - replicated route, % - next hop override, p - overrides from PfR & - replicated local route overrides by connected
Gateway of last resort is 172.20.10.1 to network 0.0.0.0
S* 0.0.0.0/0 [254/0] via 172.20.10.1 172.20.0.0/16 is variably subnetted, 2 subnets, 2 masks C 172.20.10.0/28 is directly connected, GigabitEthernet0/0/0 L 172.20.10.3/32 is directly connected, GigabitEthernet0/0/0 Router#ping 8.8.8.8 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: !!!!!
license smart trust idtoken ODVkNDkyYmUtNzc4MS00OWZiLWEzMzMtZTY2YmZhYTQxNjA5LTE3NDEzMzc2%0AMDYzNzN8L0pjaVh0K09pT3J1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX all force
Router# *Feb 13 01:38:52.352: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named SLA-KeyPair has been generated or imported by crypto-engine *Feb 13 01:38:52.414: %PKI-6-CONFIGAUTOSAVE: Running configuration saved to NVRAM[OK] *Feb 13 01:38:55.470: %SYS-6-PRIVCFG_ENCRYPT_SUCCESS: Successfully encrypted private config file *Feb 13 01:38:55.493: %CRYPTO_SL_TP_LEVELS-6-VAR_NEW_VALUE: Setting crypto bidir throughput to: 10000 kbps *Feb 13 01:38:58.298: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C8200L-1N-4T,XXXXXXXXXXX Router#
정상적으로 등록 되면 위에처럼 표시 됩니다.
6. License를 확인 합니다.
아래처럼 SA/VA에 고객사 정보가 확인 되면 정상적으로 등록 된것입니다.
Router#show license summary Account Information: Smart Account: 고객사 정보 확인 가능 Virtual Account: XXXXX
License Usage: License Entitlement Tag Count Status ----------------------------------------------------------------------------- network-essentials_10M (ESR_P_10M_E) 1 IN USE Router US Export Lic... (DNA_HSEC) 0 NOT IN USE
또는 아래 명령어도 주로 사용 됩니다.
Router#show license status Utility: Status: DISABLED
Smart Licensing Using Policy: Status: ENABLED
Account Information: Smart Account: 고객사 정보 Virtual Account: XXXXX
Data Privacy: Sending Hostname: yes Callhome hostname privacy: DISABLED Smart Licensing hostname privacy: DISABLED Version privacy: DISABLED
Policy: Policy in use: Merged from multiple sources. Reporting ACK required: yes (CISCO default) Unenforced/Non-Export Perpetual Attributes: First report requirement (days): 365 (CISCO default) Reporting frequency (days): 0 (CISCO default) Report on change (days): 90 (CISCO default) Unenforced/Non-Export Subscription Attributes: First report requirement (days): 90 (CISCO default) Reporting frequency (days): 90 (CISCO default) Report on change (days): 90 (CISCO default) Enforced (Perpetual/Subscription) License Attributes: First report requirement (days): 0 (CISCO default) Reporting frequency (days): 0 (CISCO default) Report on change (days): 0 (CISCO default) Export (Perpetual/Subscription) License Attributes: First report requirement (days): 0 (CISCO default) Reporting frequency (days): 0 (CISCO default) Report on change (days): 0 (CISCO default)
Miscellaneous: Custom Id: <empty>
Usage Reporting: Last ACK received: <none> Next ACK deadline: Feb 13 01:31:19 2026 UTC Reporting push interval: 0 (no reporting) Next ACK push check: Feb 13 02:09:10 2025 UTC Next report push: <none> Last report push: Feb 13 01:39:08 2025 UTC Last report file write: <none>
Trust Code Installed: Feb 13 01:38:58 2025 UTC
Router#
지금까지 [2025][C8200][#2] Register License to CSSM - smart licensing using policy 글을 읽어주셔서 감사합니다.
Router#show version Cisco IOS XE Software, Version 17.06.06a Cisco IOS Software [Bengaluru], c8000be Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 17.6.6a, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2023 by Cisco Systems, Inc. Compiled Fri 20-Oct-23 18:26 by mcpre
2. cisco 홈페이지에서 현재 시점에서 8200 router ios xe 추천 버전을 확인 합니다.
3. 파일을 다운로드 받고 파일을 USB에 복사합니다.
4. MD5 Checksum를 확인 합니다. 추후에 파일을 라우터에 복사하고 MD5 Checksum를 이용해서 파일이 잘 복사 되었는지 확인합니다. 만약에 파일이 깨진 상태에서 Upgrdae 업그레이드 하면 Upgrade가 Failed하고 Rommon mode로 빠질수 있습니다. 꼭 업그레이드 또는 다운그레이드 전에 파일 복사 후 MD5 체크섬을 확인 합니다.
C8200 라우터 Firmware Install 방식은 2가지가 있습니다.
1. ios xe file를 파일로 복사하고 boot config를 통해서 부팅 시키는 방법
2. install mode로 펌웨어를 설치하는 방법
현재 라우터 install mode인지 레거시 모드인지 확인하는 방법
아래처럼 표시 되면 install mode입니다.
Router#show install summary [ R0 ] Installed Package(s) Information: State (St): I - Inactive, U - Activated & Uncommitted, C - Activated & Committed, D - Deactivated & Uncommitted -------------------------------------------------------------------------------- Type St Filename/Version -------------------------------------------------------------------------------- IMG C 17.06.06a.0.6
-------------------------------------------------------------------------------- Auto abort timer: inactive --------------------------------------------------------------------------------
Router#
또는 Bin 파일이 없고, Package 파일만 보이면 install mode입니다.
Router#dir flash: Directory of bootflash:/
429089 drwx 57344 Feb 10 2025 05:32:00 +00:00 tracelogs 267169 drwx 4096 Feb 10 2025 05:19:36 +00:00 pnp-tech 11 -rw- 248 Feb 10 2025 05:19:29 +00:00 .iox_dir_list 412897 drwx 4096 Feb 10 2025 05:19:23 +00:00 license_evlog 24295 -rw- 30 Feb 10 2025 05:18:46 +00:00 throughput_monitor_params 24292 -rw- 134899 Feb 10 2025 05:18:40 +00:00 memleak.tcl 24290 -rw- 1092 Feb 10 2025 05:18:09 +00:00 mode_event_log 89057 drwx 4096 Feb 10 2025 05:17:48 +00:00 .installer 12 drwx 4096 Feb 10 2025 04:29:43 +00:00 lost+found 226689 drwx 4096 Aug 26 2024 16:49:41 +00:00 .prst_sync 275265 drwx 4096 Aug 26 2024 16:42:04 +00:00 .dbpersist 437185 drwx 4096 Aug 26 2024 16:33:30 +00:00 sysboot 420993 drwx 4096 Aug 26 2024 16:31:49 +00:00 .rollback_timer 291458 -rw- 9338 Aug 26 2024 16:28:08 +00:00 packages.conf 291478 -rw- 43301928 Aug 26 2024 16:28:08 +00:00 c8000be-rpboot.17.06.06a.SPA.pkg 291477 -rw- 623141956 Aug 26 2024 16:27:18 +00:00 c8000be-mono-universalk9.17.06.06a.SPA.pkg 291476 -rw- 156728 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_nim_adpt.17.06.06a.SPA.pkg 291475 -rw- 2094136 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_dsp_sp2700.17.06.06a.SPA.pkg 291474 -rw- 14259252 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_async.17.06.06a.SPA.pkg 291473 -rw- 11093044 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_1t3e3.17.06.06a.SPA.pkg 291472 -rw- 2475056 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_10g.17.06.06a.SPA.pkg 291471 -rw- 10253360 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_prince.17.06.06a.SPA.pkg 291470 -rw- 5571636 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_nim_xdsl.17.06.06a.SPA.pkg 291469 -rw- 5334068 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_ssd.17.06.06a.SPA.pkg 291468 -rw- 11523124 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_shdsl.17.06.06a.SPA.pkg 291467 -rw- 2966576 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_ge.17.06.06a.SPA.pkg 291466 -rw- 17646644 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_cwan.17.06.06a.SPA.pkg 291465 -rw- 4793400 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_bri_st_fw.17.06.06a.SPA.pkg 291464 -rw- 12870708 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_async.17.06.06a.SPA.pkg 291463 -rw- 11310132 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_ngwic_t1e1.17.06.06a.SPA.pkg 291462 -rw- 18342964 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dsp_tilegx.17.06.06a.SPA.pkg 291461 -rw- 1963060 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dsp_sp2700.17.06.06a.SPA.pkg 291460 -rw- 6681656 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dsp_analogbri.17.06.06a.SPA.pkg 291459 -rw- 54324 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dreamliner.17.06.06a.SPA.pkg 186209 drwx 4096 Aug 26 2024 16:20:23 +00:00 iox_host_data_share 364321 drwx 4096 Aug 26 2024 16:20:17 +00:00 core 210497 drwx 4096 Aug 26 2024 16:20:02 +00:00 guest-share 170017 drwx 4096 Aug 26 2024 16:19:55 +00:00 onep 129537 drwx 4096 Aug 26 2024 16:19:54 +00:00 pnp-info 121441 drwx 4096 Aug 26 2024 16:19:23 +00:00 virtual-instance 24294 -rw- 1923 Aug 26 2024 16:19:18 +00:00 trustidrootx3_ca_092024.ca 24293 -rw- 20109 Aug 26 2024 16:19:18 +00:00 ios_core.p7b 340033 drwx 4096 Aug 26 2024 16:19:03 +00:00 ss_disc 24291 -rw- 5242880 Aug 26 2024 16:19:03 +00:00 ssd 307649 drwx 4096 Aug 26 2024 16:18:49 +00:00 .ssh
7361155072 bytes total (6161752064 bytes free) Router#
System configuration has been modified. Press Yes(y) to save the configuration and proceed. Press No(n) for proceeding without saving the configuration. Press Quit(q) to exit, you may save configuration and re-enter the command. [y/n/q] y Building configuration... [OK]Modified configuration has been saved
*Feb 10 06:15:04.641: %SYS-6-PRIVCFG_ENCRYPT_SUCCESS: Successfully encrypted private config file *Feb 10 06:15:05.160: %INSTALL-5-INSTALL_START_INFO: R0/0: install_engine: Started install one-shot bootflash:c8000be-universalk9.17.09.05e.SPA.bininstall_add_activate_commit: Adding PACKAGE install_add_activate_commit: Checking whether new add is allowed ....
--- Starting Add --- Performing Add on Active/Standby [1] Add package(s) on R0 [1] Finished Add on R0 Checking status of Add on [R0] Add: Passed on [R0] Finished Add
This operation may require a reload of the system. Do you want to proceed? [y/n] y --- Starting Activate --- Performing Activate on Active/Standby
재부팅이 완료 될때까지 기다립니다.
5. Version 확인
Router# show install summary [ R0 ] Installed Package(s) Information: State (St): I - Inactive, U - Activated & Uncommitted, C - Activated & Committed, D - Deactivated & Uncommitted -------------------------------------------------------------------------------- Type St Filename/Version -------------------------------------------------------------------------------- IMG C 17.09.05e.0.80
-------------------------------------------------------------------------------- Auto abort timer: inactive --------------------------------------------------------------------------------
Router#
6. 기존에 Package가 Flash:에 존재 합니다. 필요없는 파일은 삭제합니다.
Router#dir flash: Directory of bootflash:/
89057 drwx 4096 Feb 10 2025 06:29:40 +00:00 .installer 412897 drwx 4096 Feb 10 2025 06:28:09 +00:00 license_evlog 24295 -rw- 30 Feb 10 2025 06:28:09 +00:00 throughput_monitor_params 24292 -rw- 137940 Feb 10 2025 06:28:05 +00:00 memleak.tcl 226689 drwx 4096 Feb 10 2025 06:27:59 +00:00 .prst_sync 24289 -rw- 1939 Feb 10 2025 06:27:50 +00:00 trustidrootx3_ca_062035.ca 24290 -rwx 1274 Feb 10 2025 06:27:45 +00:00 mode_event_log 429089 drwx 57344 Feb 10 2025 06:27:42 +00:00 tracelogs 64769 drwx 4096 Feb 10 2025 06:27:04 +00:00 SHARED-IOX 420993 drwx 4096 Feb 10 2025 06:25:25 +00:00 .rollback_timer 16 -rw- 9330 Feb 10 2025 06:24:28 +00:00 packages.conf 404802 -rw- 9330 Feb 10 2025 06:18:05 +00:00 c8000be-universalk9.17.09.05e.SPA.conf 226691 -rw- 38283450 Feb 10 2025 06:18:05 +00:00 c8000be-rpboot.17.09.05e.SPA.pkg 404821 -rw- 679469056 Feb 10 2025 06:17:20 +00:00 c8000be-mono-universalk9.17.09.05e.SPA.pkg 404820 -rw- 167936 Feb 10 2025 06:17:08 +00:00 c8000be-firmware_sm_nim_adpt.17.09.05e.SPA.pkg 404819 -rw- 2138112 Feb 10 2025 06:17:08 +00:00 c8000be-firmware_sm_dsp_sp2700.17.09.05e.SPA.pkg 404818 -rw- 14557184 Feb 10 2025 06:17:08 +00:00 c8000be-firmware_sm_async.17.09.05e.SPA.pkg 404817 -rw- 11366400 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_sm_1t3e3.17.09.05e.SPA.pkg 404816 -rw- 2535424 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_sm_10g.17.09.05e.SPA.pkg 404815 -rw- 10432512 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_prince.17.09.05e.SPA.pkg 404814 -rw- 5677056 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_nim_xdsl.17.09.05e.SPA.pkg 404813 -rw- 5431296 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_nim_ssd.17.09.05e.SPA.pkg 404812 -rw- 11714560 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_nim_shdsl.17.09.05e.SPA.pkg 404811 -rw- 2994176 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_ge.17.09.05e.SPA.pkg 404810 -rw- 17960960 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_cwan.17.09.05e.SPA.pkg 404809 -rw- 4894720 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_bri_st_fw.17.09.05e.SPA.pkg 404808 -rw- 13139968 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_async.17.09.05e.SPA.pkg 404807 -rw- 11497472 Feb 10 2025 06:17:05 +00:00 c8000be-firmware_ngwic_t1e1.17.09.05e.SPA.pkg 404806 -rw- 18649088 Feb 10 2025 06:17:05 +00:00 c8000be-firmware_dsp_tilegx.17.09.05e.SPA.pkg 404805 -rw- 2007040 Feb 10 2025 06:17:04 +00:00 c8000be-firmware_dsp_sp2700.17.09.05e.SPA.pkg 404804 -rw- 6799360 Feb 10 2025 06:17:04 +00:00 c8000be-firmware_dsp_analogbri.17.09.05e.SPA.pkg 404803 -rw- 65536 Feb 10 2025 06:17:04 +00:00 c8000be-firmware_dreamliner.17.09.05e.SPA.pkg 13 -rw- 859360566 Feb 10 2025 06:06:59 +00:00 c8000be-universalk9.17.09.05e.SPA.bin 267169 drwx 4096 Feb 10 2025 05:19:36 +00:00 pnp-tech 11 -rw- 248 Feb 10 2025 05:19:29 +00:00 .iox_dir_list 12 drwx 4096 Feb 10 2025 04:29:43 +00:00 lost+found 275265 drwx 4096 Aug 26 2024 16:42:04 +00:00 .dbpersist 437185 drwx 4096 Aug 26 2024 16:33:30 +00:00 sysboot 291478 -rw- 43301928 Aug 26 2024 16:28:08 +00:00 c8000be-rpboot.17.06.06a.SPA.pkg 291477 -rw- 623141956 Aug 26 2024 16:27:18 +00:00 c8000be-mono-universalk9.17.06.06a.SPA.pkg 291476 -rw- 156728 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_nim_adpt.17.06.06a.SPA.pkg 291475 -rw- 2094136 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_dsp_sp2700.17.06.06a.SPA.pkg 291474 -rw- 14259252 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_async.17.06.06a.SPA.pkg 291473 -rw- 11093044 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_1t3e3.17.06.06a.SPA.pkg 291472 -rw- 2475056 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_sm_10g.17.06.06a.SPA.pkg 291471 -rw- 10253360 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_prince.17.06.06a.SPA.pkg 291470 -rw- 5571636 Aug 26 2024 16:27:07 +00:00 c8000be-firmware_nim_xdsl.17.06.06a.SPA.pkg 291469 -rw- 5334068 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_ssd.17.06.06a.SPA.pkg 291468 -rw- 11523124 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_shdsl.17.06.06a.SPA.pkg 291467 -rw- 2966576 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_ge.17.06.06a.SPA.pkg 291466 -rw- 17646644 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_cwan.17.06.06a.SPA.pkg 291465 -rw- 4793400 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_bri_st_fw.17.06.06a.SPA.pkg 291464 -rw- 12870708 Aug 26 2024 16:27:06 +00:00 c8000be-firmware_nim_async.17.06.06a.SPA.pkg 291463 -rw- 11310132 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_ngwic_t1e1.17.06.06a.SPA.pkg 291462 -rw- 18342964 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dsp_tilegx.17.06.06a.SPA.pkg 291461 -rw- 1963060 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dsp_sp2700.17.06.06a.SPA.pkg 291460 -rw- 6681656 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dsp_analogbri.17.06.06a.SPA.pkg 291459 -rw- 54324 Aug 26 2024 16:27:05 +00:00 c8000be-firmware_dreamliner.17.06.06a.SPA.pkg 186209 drwx 4096 Aug 26 2024 16:20:23 +00:00 iox_host_data_share 364321 drwx 4096 Aug 26 2024 16:20:17 +00:00 core 210497 drwx 4096 Aug 26 2024 16:20:02 +00:00 guest-share 170017 drwx 4096 Aug 26 2024 16:19:55 +00:00 onep 129537 drwx 4096 Aug 26 2024 16:19:54 +00:00 pnp-info 121441 drwx 4096 Aug 26 2024 16:19:23 +00:00 virtual-instance 24294 -rw- 1923 Aug 26 2024 16:19:18 +00:00 trustidrootx3_ca_092024.ca 24293 -rw- 20109 Aug 26 2024 16:19:18 +00:00 ios_core.p7b 24291 -rw- 5242880 Aug 26 2024 16:19:03 +00:00 ssd 307649 drwx 4096 Aug 26 2024 16:18:49 +00:00 .ssh
Router#install remove inactive install_remove: START Mon Feb 10 06:34:40 UTC 2025 install_remove: Removing IMG Cleaning up unnecessary package files No path specified, will use booted path /bootflash/packages.conf
Cleaning /bootflash Scanning boot directory for packages ... done. Preparing packages list to delete ... [R0]: /bootflash/packages.conf File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_dreamliner.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_dsp_analogbri.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_dsp_sp2700.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_dsp_tilegx.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_ngwic_t1e1.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_nim_async.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_nim_bri_st_fw.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_nim_cwan.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_nim_ge.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_nim_shdsl.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_nim_ssd.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_nim_xdsl.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_prince.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_sm_10g.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_sm_1t3e3.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_sm_async.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_sm_dsp_sp2700.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-firmware_sm_nim_adpt.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-mono-universalk9.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-rpboot.17.09.05e.SPA.pkg File is in use, will not delete. [R0]: /bootflash/c8000be-universalk9.17.09.05e.SPA.conf File is in use, will not delete.
--- Starting Post_Remove_Cleanup --- Performing REMOVE_POSTCHECK on all members Finished Post_Remove_Cleanup SUCCESS: install_remove Mon Feb 10 06:35:12 UTC 2025
89057 drwx 4096 Feb 10 2025 06:35:13 +00:00 .installer 412897 drwx 4096 Feb 10 2025 06:28:09 +00:00 license_evlog 24295 -rw- 30 Feb 10 2025 06:28:09 +00:00 throughput_monitor_params 24292 -rw- 137940 Feb 10 2025 06:28:05 +00:00 memleak.tcl 226689 drwx 4096 Feb 10 2025 06:27:59 +00:00 .prst_sync 24289 -rw- 1939 Feb 10 2025 06:27:50 +00:00 trustidrootx3_ca_062035.ca 24290 -rwx 1274 Feb 10 2025 06:27:45 +00:00 mode_event_log 429089 drwx 57344 Feb 10 2025 06:27:42 +00:00 tracelogs 64769 drwx 4096 Feb 10 2025 06:27:04 +00:00 SHARED-IOX 420993 drwx 4096 Feb 10 2025 06:25:25 +00:00 .rollback_timer 16 -rw- 9330 Feb 10 2025 06:24:28 +00:00 packages.conf 404802 -rw- 9330 Feb 10 2025 06:18:05 +00:00 c8000be-universalk9.17.09.05e.SPA.conf 226691 -rw- 38283450 Feb 10 2025 06:18:05 +00:00 c8000be-rpboot.17.09.05e.SPA.pkg 404821 -rw- 679469056 Feb 10 2025 06:17:20 +00:00 c8000be-mono-universalk9.17.09.05e.SPA.pkg 404820 -rw- 167936 Feb 10 2025 06:17:08 +00:00 c8000be-firmware_sm_nim_adpt.17.09.05e.SPA.pkg 404819 -rw- 2138112 Feb 10 2025 06:17:08 +00:00 c8000be-firmware_sm_dsp_sp2700.17.09.05e.SPA.pkg 404818 -rw- 14557184 Feb 10 2025 06:17:08 +00:00 c8000be-firmware_sm_async.17.09.05e.SPA.pkg 404817 -rw- 11366400 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_sm_1t3e3.17.09.05e.SPA.pkg 404816 -rw- 2535424 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_sm_10g.17.09.05e.SPA.pkg 404815 -rw- 10432512 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_prince.17.09.05e.SPA.pkg 404814 -rw- 5677056 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_nim_xdsl.17.09.05e.SPA.pkg 404813 -rw- 5431296 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_nim_ssd.17.09.05e.SPA.pkg 404812 -rw- 11714560 Feb 10 2025 06:17:07 +00:00 c8000be-firmware_nim_shdsl.17.09.05e.SPA.pkg 404811 -rw- 2994176 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_ge.17.09.05e.SPA.pkg 404810 -rw- 17960960 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_cwan.17.09.05e.SPA.pkg 404809 -rw- 4894720 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_bri_st_fw.17.09.05e.SPA.pkg 404808 -rw- 13139968 Feb 10 2025 06:17:06 +00:00 c8000be-firmware_nim_async.17.09.05e.SPA.pkg 404807 -rw- 11497472 Feb 10 2025 06:17:05 +00:00 c8000be-firmware_ngwic_t1e1.17.09.05e.SPA.pkg 404806 -rw- 18649088 Feb 10 2025 06:17:05 +00:00 c8000be-firmware_dsp_tilegx.17.09.05e.SPA.pkg 404805 -rw- 2007040 Feb 10 2025 06:17:04 +00:00 c8000be-firmware_dsp_sp2700.17.09.05e.SPA.pkg 404804 -rw- 6799360 Feb 10 2025 06:17:04 +00:00 c8000be-firmware_dsp_analogbri.17.09.05e.SPA.pkg 404803 -rw- 65536 Feb 10 2025 06:17:04 +00:00 c8000be-firmware_dreamliner.17.09.05e.SPA.pkg 267169 drwx 4096 Feb 10 2025 05:19:36 +00:00 pnp-tech 11 -rw- 248 Feb 10 2025 05:19:29 +00:00 .iox_dir_list 12 drwx 4096 Feb 10 2025 04:29:43 +00:00 lost+found 275265 drwx 4096 Aug 26 2024 16:42:04 +00:00 .dbpersist 437185 drwx 4096 Aug 26 2024 16:33:30 +00:00 sysboot 186209 drwx 4096 Aug 26 2024 16:20:23 +00:00 iox_host_data_share 364321 drwx 4096 Aug 26 2024 16:20:17 +00:00 core 210497 drwx 4096 Aug 26 2024 16:20:02 +00:00 guest-share 170017 drwx 4096 Aug 26 2024 16:19:55 +00:00 onep 129537 drwx 4096 Aug 26 2024 16:19:54 +00:00 pnp-info 121441 drwx 4096 Aug 26 2024 16:19:23 +00:00 virtual-instance 24294 -rw- 1923 Aug 26 2024 16:19:18 +00:00 trustidrootx3_ca_092024.ca 24293 -rw- 20109 Aug 26 2024 16:19:18 +00:00 ios_core.p7b 24291 -rw- 5242880 Aug 26 2024 16:19:03 +00:00 ssd 307649 drwx 4096 Aug 26 2024 16:18:49 +00:00 .ssh
7361155072 bytes total (6116417536 bytes free) Router#
show version
Router# show version Cisco IOS XE Software, Version 17.09.05e Cisco IOS Software [Cupertino], c8000be Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 17.9.5e, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2024 by Cisco Systems, Inc. Compiled Thu 12-Dec-24 19:05 by mcpre
Cisco IOS-XE software, Copyright (c) 2005-2024 by cisco Systems, Inc. All rights reserved. Certain components of Cisco IOS-XE software are licensed under the GNU General Public License ("GPL") Version 2.0. The software code licensed under GPL Version 2.0 is free software that comes with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such GPL code under the terms of GPL Version 2.0. For more details, see the documentation or "License Notice" file accompanying the IOS-XE software, or the applicable URL provided on the flyer accompanying the IOS-XE software.
ROM: 17.6(8.1r)
Router uptime is 9 minutes Uptime for this control processor is 9 minutes System returned to ROM by Reload Command System image file is "bootflash:packages.conf" Last reload reason: Reload Command
This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately.
The support for Smart Licensing started with Cisco IOS XE 16.10.1. In the Cisco IOS XE 17.3.2 and 17.4.1, support to a simplified method for Smart Licensing with the use of Policies mode only License was started.
IOS XE Release
Platform Requirements
CUBE Licensing
16.6.1 to 16.9.x
Smart Licensing mode is optional
RTU licensing only
16.10.x
Smart Licensing mode only
RTU licensing only
16.11.1a to 17.1.x
Smart Licensing mode only
Continued registration is required to enable CUBE features
Smart Licensing only*
Trunk license requests are set by manual configuration
No license policing if out of compliance
SIP processing disabled in the 'Eval-Expired' state
17.2.1r to 17.3.1a
Smart Licensing mode only
Continued registration is required in order to enable CUBE features
Smart Licensing only*
Trunk license requests are set dynamically by usage
No license policing if out of compliance
SIP processing disabled in the 'Eval-Expired' state
17.3.2 onwards
Smart Licensing with the use of Policy mode only
License use must be reported within the account policy to enable CUBE features
Smart Licensing only*
Trunk license use is measured periodically and reported as per the Smart Account policy
In accordance with policy, license policing reports are not acknowledged (SIP processing is disabled otherwise)
Username : kevin Index : 62470 Assigned IP : 192.168.200.100 Public IP : 192.168.10.102 Protocol : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel License : AnyConnect Premium Encryption : AnyConnect-Parent: (1)none SSL-Tunnel: (1)AES-GCM-256 DTLS-Tunnel: (1)AES256 Hashing : AnyConnect-Parent: (1)none SSL-Tunnel: (1)SHA384 DTLS-Tunnel: (1)SHA1 Bytes Tx : 58544 Bytes Rx : 54607 Group Policy : ANYCONNECT_POLICY Tunnel Group : MY_TUNNEL Login Time : 12:24:54 UTC Sun Feb 2 2025 Duration : 0h:12m:24s Inactivity : 0h:00m:00s VLAN Mapping : N/A VLAN : none Audt Sess ID : 0a0101fe0f406000679f6416 Security Grp : none ASAv#
아래 명령어를 통해서 라이센스 남은 갯수도 확인 가능 합니다.
ASAv# show vpn-sessiondb license-summary --------------------------------------------------------------------------- VPN Licenses and Configured Limits Summary --------------------------------------------------------------------------- Status : Capacity : Installed : Limit ----------------------------------------- AnyConnect Premium : ENABLED : 250 : 2 : NONE AnyConnect Essentials : DISABLED : 250 : 0 : NONE Other VPN (Available by Default) : ENABLED : 250 : 250 : NONE Shared License Server : DISABLED Shared License Participant : DISABLED AnyConnect for Mobile : DISABLED(Requires Premium or Essentials) Advanced Endpoint Assessment : DISABLED(Requires Premium) AnyConnect for Cisco VPN Phone : DISABLED VPN-3DES-AES : ENABLED VPN-DES : ENABLED ---------------------------------------------------------------------------
--------------------------------------------------------------------------- VPN Licenses Usage Summary --------------------------------------------------------------------------- Local : Shared : All : Peak : Eff. : In Use : In Use : In Use : In Use : Limit : Usage ---------------------------------------------------- AnyConnect Premium : 1 : 0 : 1 : 2 : 2 : 50% AnyConnect Client : : 1 : 1 : 50% AnyConnect Mobile : : 0 : 0 : 0% Clientless VPN : : 0 : 1 : 0% Generic IKEv2 Client : : 0 : 0 : 0% Other VPN : : 0 : 0 : 250 : 0% Cisco VPN Client : : 0 : 0 : 0% L2TP Clients Site-to-Site VPN : : 0 : 0 : 0% ---------------------------------------------------------------------------
ASAv#
anyconnect Permium 라이센스가 2개 이고, 현재 PC에서 접속 해서 한개를 사용하고 있고, Usage에 50% 표시 되었습니다.
ASAv# show version
Cisco Adaptive Security Appliance Software Version 9.8(1) Firepower Extensible Operating System Version 2.2(1.47) Device Manager Version 7.22(1)
Compiled on Wed 10-May-17 15:38 PDT by builders System image file is "boot:/asa981-smp-k8.bin" Config file at boot was "startup-config"
ASAv up 6 hours 21 mins
Hardware: ASAv, 2048 MB RAM, CPU Xeon E5 series 2394 MHz, Model Id: ASAv10 Internal ATA Compact Flash, 8192MB Slot 1: ATA Compact Flash, 8192MB BIOS Flash Firmware Hub @ 0x0, 0KB
0: Ext: Management0/0 : address is 50fd.e000.3500, irq 11 1: Ext: GigabitEthernet0/0 : address is 50fd.e000.3501, irq 11 2: Ext: GigabitEthernet0/1 : address is 50fd.e000.3502, irq 10 3: Ext: GigabitEthernet0/2 : address is 50fd.e000.3503, irq 10 4: Ext: GigabitEthernet0/3 : address is 50fd.e000.3504, irq 11 5: Ext: GigabitEthernet0/4 : address is 50fd.e000.3505, irq 11 6: Ext: GigabitEthernet0/5 : address is 50fd.e000.3506, irq 10 7: Ext: GigabitEthernet0/6 : address is 50fd.e000.3507, irq 10
License mode: Smart Licensing ASAv Platform License State: Unlicensed No active entitlement: no feature tier and no throughput level configured *Memory resource allocation is more than the permitted limit.
Licensed features for this platform: Maximum VLANs : 50 Inside Hosts : Unlimited Failover : Active/Standby Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 0 Carrier : Disabled AnyConnect Premium Peers : 2 AnyConnect Essentials : Disabled Other VPN Peers : 250 Total VPN Peers : 250
지금까지 [ASA #06] - Remote Access VPN current user check 글을 읽어주셔서 감사합니다.
Cisco Adaptive Security Appliance Software Version 9.8(1) Firepower Extensible Operating System Version 2.2(1.47) Device Manager Version 7.22(1)
Compiled on Wed 10-May-17 15:38 PDT by builders System image file is "boot:/asa981-smp-k8.bin" Config file at boot was "startup-config"
ASAv up 6 hours 4 mins
Hardware: ASAv, 2048 MB RAM, CPU Xeon E5 series 2394 MHz, Model Id: ASAv10 Internal ATA Compact Flash, 8192MB Slot 1: ATA Compact Flash, 8192MB BIOS Flash Firmware Hub @ 0x0, 0KB
0: Ext: Management0/0 : address is 50fd.e000.3500, irq 11 1: Ext: GigabitEthernet0/0 : address is 50fd.e000.3501, irq 11 2: Ext: GigabitEthernet0/1 : address is 50fd.e000.3502, irq 10 3: Ext: GigabitEthernet0/2 : address is 50fd.e000.3503, irq 10 4: Ext: GigabitEthernet0/3 : address is 50fd.e000.3504, irq 11 5: Ext: GigabitEthernet0/4 : address is 50fd.e000.3505, irq 11 6: Ext: GigabitEthernet0/5 : address is 50fd.e000.3506, irq 10 7: Ext: GigabitEthernet0/6 : address is 50fd.e000.3507, irq 10
License mode: Smart Licensing ASAv Platform License State: Unlicensed No active entitlement: no feature tier and no throughput level configured *Memory resource allocation is more than the permitted limit.
Licensed features for this platform: Maximum VLANs : 50 Inside Hosts : Unlimited Failover : Active/Standby Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 0 Carrier : Disabled AnyConnect Premium Peers : 2 AnyConnect Essentials : Disabled Other VPN Peers : 250 Total VPN Peers : 250 AnyConnect for Mobile : Disabled AnyConnect for Cisco VPN Phone : Disabled Advanced Endpoint Assessment : Disabled Shared License : Disabled Total TLS Proxy Sessions : 2 Botnet Traffic Filter : Enabled Cluster : Disabled
Serial Number: 9A2U9VPUTQH
Image type : Release Key version : A
Configuration last modified by enable_15 at 12:15:07.479 UTC Sun Feb 2 2025 ASAv#
ASAv# show vpn-sessiondb license-summary
ASAv는 Anyconnect Capacity는 250개 까지 가능하고 License 기본제공 2개 까지만 가능 합니다.
아래 정보를 보시면 현재 라이센스 사용수, 최대치 사용수까지 확인 가능 합니다.
ASAv# show vpn-sessiondb license-summary --------------------------------------------------------------------------- VPN Licenses and Configured Limits Summary --------------------------------------------------------------------------- Status : Capacity : Installed : Limit ----------------------------------------- AnyConnect Premium : ENABLED : 250 : 2 : NONE AnyConnect Essentials : DISABLED : 250 : 0 : NONE Other VPN (Available by Default) : ENABLED : 250 : 250 : NONE Shared License Server : DISABLED Shared License Participant : DISABLED AnyConnect for Mobile : DISABLED(Requires Premium or Essentials) Advanced Endpoint Assessment : DISABLED(Requires Premium) AnyConnect for Cisco VPN Phone : DISABLED VPN-3DES-AES : ENABLED VPN-DES : ENABLED ---------------------------------------------------------------------------
--------------------------------------------------------------------------- VPN Licenses Usage Summary --------------------------------------------------------------------------- Local : Shared : All : Peak : Eff. : In Use : In Use : In Use : In Use : Limit : Usage ---------------------------------------------------- AnyConnect Premium : 0 : 0 : 0 : 2 : 2 : 0% AnyConnect Client : : 0 : 1 : 0% AnyConnect Mobile : : 0 : 0 : 0% Clientless VPN : : 0 : 1 : 0% Generic IKEv2 Client : : 0 : 0 : 0% Other VPN : : 0 : 0 : 250 : 0% Cisco VPN Client : : 0 : 0 : 0% L2TP Clients Site-to-Site VPN : : 0 : 0 : 0% ---------------------------------------------------------------------------
ASAv# show nameif Interface Name Security GigabitEthernet0/0 outside 0 GigabitEthernet0/1 inside 100 Management0/0 MGMT 0 ASAv# show int ASAv# show interface ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 unassigned YES unset administratively down down GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 192.168.100.250 YES manual up up ASAv#
Remote Access User가 VPN통해서 내부에 있는 자원에 통신 할려고 방화벽 정책이 필요 합니다.
G0/0 outside - ACL name - outsideacl
G0/1 inside - ACL name - insideacl
G0/2 DMZ - ACL name -dmzacl
ASAv# show interface ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 10.10.10.254 YES manual up up GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 192.168.100.250 YES manual up up ASAv#
SW 설정
interface GigabitEthernet0/1 no switchport ip address 10.10.10.10 255.255.255.0 negotiation auto ip route 0.0.0.0 0.0.0.0 10.10.10.254
방화벽 정책 설정
ASAv(config)# access-list outsideacl extended permit ip 192.168.200.0 255.255.255.0 10.10.10.0 255.255.255.0 ASAv(config)# access-group outsideacl in interface outside
Secure Client 접속후 Ping 10.10.10.10 하면 아래처럼 성공 합니다.
ASAv# show access-list access-list cached ACL log flows: total 1, denied 1 (deny-flow-max 4096) alert-interval 300 access-list SPLIT_TUNNEL; 2 elements; name hash: 0x63aa8f22 access-list SPLIT_TUNNEL line 1 standard permit 10.1.1.0 255.255.255.0 (hitcnt=0) 0x96d75e6a access-list SPLIT_TUNNEL line 2 standard permit 10.10.10.0 255.255.255.0 (hitcnt=0) 0x23138585 access-list outsideacl; 1 elements; name hash: 0x945119d1 access-list outsideacl line 1 extended permit ip 192.168.200.0 255.255.255.0 10.10.10.0 255.255.255.0 (hitcnt=1) 0xb46d0730 ASAv#
만약에 Remote Access VPN USER들은 outbound access-list 없이 그냥 BYpass하고 싶으면 아래 명령어를 입력합니다.
ASA1(config)# sysopt connection permit-vpn
지금까지 [ASA #04] - Remote Access VPN 글을 읽어주셔서 감사합니다.
204561552 bytes copied in 628.840 secs (325734 bytes/sec) ASAv#
7. dir flash:를 통해서 asdm 이미지 파일을 확인 합니다.
ASAv# dir flash:
Directory of disk0:/
7 -rwx 0 11:39:22 May 21 2017 use_ttyS0 11 drwx 4096 03:12:34 Feb 02 2025 smart-log 8 drwx 4096 03:10:50 Feb 02 2025 log 12 drwx 4096 03:12:40 Feb 02 2025 coredumpinfo 84 -rwx 204561552 07:24:47 Feb 02 2025 asdm-openjre-7221.bin
8. ASDM를 사용하기 위해서 아래처럼 설정 합니다.
ASAv# conf t ASAv(config)# asdm image disk0:/asdm-openjre-7221.bin ASAv(config)# http server enable ASAv(config)# http 0.0.0.0 0.0.0.0 inside ASAv(config)# username kevin password XXXXXXX privilege 15 ASAv(config)#
9. inside interface는 Gi0/1이고 IP주소는 10.1.1.254입니다.
ASAv# show int ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 unassigned YES unset administratively down down GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 192.168.100.250 YES manual up up ASAv#
ASAv# show nameif Interface Name Security GigabitEthernet0/0 outside 0 GigabitEthernet0/1 inside 100 Management0/0 MGMT 0 ASAv#
아래처럼 접속을 시도 합니다. 그리고 Install ASDM Launcher를 클릭 합니다.
ciscoasa# conf t ciscoasa# hostname asa ASA# ASA(config)# int e0 ASA(config-if)# nameif outside INFO: Security level for "outside" set to 0 by default. ASA(config-if)# ip add 192.168.10.77 255.255.255.0 ASA(config-if)# no sh ASA(config)# int e1 ASA(config-if)# nameif inside ASA(config-if)# ip add 10.1.1.254 255.255.255.0 ASA(config-if)# no sh ASA(config-if)#
ASAv# show nameif Interface Name Security GigabitEthernet0/0 outside 0 GigabitEthernet0/1 inside 100 ASAv#
Interface 확인
ASAv# show interface ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 unassigned YES unset administratively down down GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 unassigned YES unset administratively down up ASAv#
Default Gateway 확인
ASAv# show route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, + - replicated route Gateway of last resort is 192.168.10.253 to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [1/0] via 192.168.10.253, outside C 10.1.1.0 255.255.255.0 is directly connected, inside L 10.1.1.254 255.255.255.255 is directly connected, inside C 192.168.10.0 255.255.255.0 is directly connected, outside L 192.168.10.78 255.255.255.255 is directly connected, outside
15:34:48.330 [main] INFO com.cisco.profiler.persistence.LocalDb - Local db registration EndpointCert, index 0 15:34:48.331 [main] INFO com.cisco.profiler.persistence.LocalDb - About to persist the partitions to /opt/CSCOcpm/appsrv/apache-tomcat/config/redisPartitions.properties 15:34:48.332 [main] INFO com.cisco.profiler.persistence.LocalDb - Updated properties : /opt/CSCOcpm/appsrv/apache-tomcat/config/redisPartitions.properties
15:34:54.270 [main] INFO cohttp://m.cisco.cpm.infrastructure.confd.repository.impl.RepositoryServiceImpl - copyOut json { "sourceFile" : "/opt/ca_export/ise_ca_key_pairs_of_ISE01", "RepoName" : "FTP" } 15:34:54.500 [main] INFO cohttp://m.cisco.cpm.infrastructure.confd.RESTConfHandler - The Value of CallStatus for post method : 200 The following 5 CA key pairs were exported to repository 'FTP' at 'ise_ca_key_pairs_of_ISE01': Subject:CN=Certificate Services Root CA - ISE01 Issuer:CN=Certificate Services Root CA - ISE01 Serial#:0x413c9d5d-c09747fb-9c348f1d-7fd4cf7f
Subject:CN=Certificate Services Node CA - ISE01 Issuer:CN=Certificate Services Root CA - ISE01 Serial#:0x5841ef07-45b14321-809f1f89-84880a6a
Subject:CN=Certificate Services Endpoint Sub CA - ISE01 Issuer:CN=Certificate Services Node CA - ISE01 Serial#:0x182e0062-bca04359-808d8ced-5a4fbab8
Subject:CN=Certificate Services Endpoint RA - ISE01 Issuer:CN=Certificate Services Endpoint Sub CA - ISE01 Serial#:0x4351ef77-1d74489e-aa438fe2-846bcfb8
Subject:CN=Certificate Services OCSP Responder - ISE01 Issuer:CN=Certificate Services Endpoint Sub CA - ISE01 Serial#:0x15e01788-34114c7f-aff55275-a1cc761d
ISE CA keys export completed successfully
이렇게 인증서 백업이 완료 되었습니다.
FTP 서버에 폴더에서 확인 합니다.
CLI에서 [8]Import Internal CA Store 눌러서 복구도 가능 합니다.
이부분은 생략 하갰습니다.
지금까지 [2025][CISCO ISE#32] - Export/Import Certificate에 대해서 알아보았습니다.
ADE-OS stands for Application Deployment Engine Operating System. This is the operating system on which ISE runs, which is based on Red Hat Enterprise Linux (RHEL). When restoring ADE-OS you would be restoring OS level configuration. This would include all of the operating system configuration data that is configured when setting up the ISE node. Things like hostname, IP addresses, NTP, enabling SSH, default gateway, and name servers.
Restoring the ADE-OS configuration would be used if you want an exact duplicate of the ISE server the backup was taken from. However, this can cause issues if these servers exist on the same network at the same time for obvious reasons. If you want to stand up a new ISE server with the same configuration but with a different IP and hostname, it is not recommended to restore the ADE-OS configuration.
자동으로 로그아웃되고 GUI에서 더 이상 복구 진행 상황을 확인이 불가능 합니다.
Putty로 cisco ise에 접속 합니다.
ISE01/admin#show restore status %% Configuration restore status %% ---------------------------- % backup name: 20250113-BACKUP-CFG10-250113-1242.tar.gpg % repository: FTP % start date: Mon Jan 13 13:22:01 SGT 2025 % scheduled: no % triggered from: Admin web UI % host: ISE01.test.local % status: Restore is in progress... % progress %: 30 % progress message: Extracting backup data
%% Operation restore status %% ------------------------ % No data found. Try 'show restore history' or ISE operation audit report ISE01/admin#
위와 같이 CLI에서 확인 가능 합니다. 100%까지 기다립니다.
100% 완료 되면 아래처럼 표시 됩니다.
ISE01/admin#show restore status %% Configuration restore status %% ---------------------------- % backup name: 20250113-BACKUP-CFG10-250113-1242.tar.gpg % repository: FTP % start date: Mon Jan 13 13:22:01 SGT 2025 % scheduled: no % triggered from: Admin web UI % host: ISE01.test.local % status: restore 20250113-BACKUP-CFG10-250113-1242.tar.gpg from repository FTP: success
%% Operation restore status %% ------------------------ % No data found. Try 'show restore history' or ISE operation audit report ISE01/admin# ISE01/admin#
ISE01/admin#show restore history Mon Jan 13 14:24:40 +08 2025: restore 20250113-BACKUP-CFG10-250113-1242.tar.gpg from repository FTP: success ISE01/admin#
복구가 완료 되었습니다.
cisco ISE GUI접속해서 복구 하기전에 생성 했던 User가 사라졌는지 확인 합니다.
지금까지 [2025][CISCO ISE#31] - configuration restore 글을 읽어주셔서 감사합니다.
