ASDM "this app can't run on your PC" - Windows 10

C:\Users\ivan.popov>ver
Microsoft Windows [Version 10.0.19041.329]
After installing the latest java and trying to start Cisco ASDM:







Solution: change target in shortcut (right-click - Properties - Target) to :
C:\Windows\System32\wscript.exe invisible.vbs run.bat

Cisco vlan mapping

Router# configure terminal 

Router(config)# interface gigabitethernet 5/2 

Router(config-if)# switchport vlan mapping 1649 755 

Router(config-if)# end 

Router# 

This example shows how to verify the configuration:

Router# show interface gigabitethernet 5/2 vlan mapping 

State: enabled

Original VLAN Translated VLAN

------------- ---------------

  1649           755 

Full article (cisco.com) 

Cisco ASA SMTP Banner Corruption

telnet test.mail.com
On port 25:
220 ***************************

On port 587:
220 test.mail.com ESMTP

This can cause delayed and undeliverable mail, especially for larger messages, such as those with attachments.
 
Easy and dummy way to fix

ASA(config)#policy-map global_policy
ASA(config-pmap)#class inspection_default
ASA(config-pmap-c)#no inspect esmtp
(old school PIX: no fixup protocol SMTP 25)

Right way (if we gonna fix only banner corruption):
N.B. Banner re-writen is a issue when we perform test via telnet MX.MAIL.COM 25
More info here: http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113423-asa-esmtp-smtp-inspection.html

  policy-map type inspect esmtp new_estmp_inspect_map
    description Don't touch my banner
    parameters
      no mask-banner

  policy-map global-policy
    class class-default
      inspect esmtp new_esmtp_inspect_map
  service-policy global-policy global

the advantage instead of deactivating is, that you are still able inspect other criteria like:

    match sender-address length ..
    match mime filename length ..
    match cmd line length ..
    match cmd rcpt count ..
    match body line length ..
List of available (e)smpt commands can be found here: http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/69309-smtp-esmtp-ios-fw.html
Some simple troubleshooting commands:
show ip inspect all
debug ip inspect smtp
Deeper-look-int-topic here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/inspect_basic.html#wp1224614

Cisco PPTP server - basic user management

Cisco router act as a PPTP server and provide remote conectivity to office resources
I. Show currently active pptp connections and see

1. remote address of dialed client

ar1.SOF10#sh vpdn tunnel pptp
PPTP Tunnel Information Total tunnels 1 sessions 1

LocID State Remote Address Port Sessions VPDN Group
698 estabd 85.187.36.7 53720 1 VPN

2. Username of remote dialer and localy assigned Virtual interface as well

ar1.SOF10#sh vpdn session pptp
PPTP Session Information Total tunnels 1 sessions 1
LocID RemID TunID Intf Username State Last Chg Uniq ID
694 53720 698 Vi5 ipopov estabd 00:09:30 713
Local Interface: Vi5 (Virtual-Access5)

3. IP address assigned to remote user
ar1.SOF10#sh ip rou conn | i Virtual-Access5
C 194.12.234.22/32 is directly connected, Virtual-Access5

II. Disconect particular user

ar1.SOF10#clear vpdn tunnel pptp id 698

default route backup

При горната картинка Remote Office комуникира с Central Office през L2 свързаност. Целта е когато падне основната връзка трафика да се изнася през L3 VPN закачен за dedicated за това машина с минимална (сиреч никаква) намеса на потребителите в Remote Office
Най-лесният начин ми се стори - смяна на default route на R2  към RAS-a при отпадане на основната връзка. Отпадането се трак-ва с ip sla (и в двата края рутерите са cisco)

ip sla monitor 1
# cisco-то ще ping-вa 192.168.61.1 
#със source р2р IP - да съм сигурен, защото 192.168.61.1 може да се вижда

#от друго място (през VPN-a примерно)
 type echo protocol ipIcmpEcho 192.168.61.1 source-ipaddr 192.168.61.2
#и ще чака 1000ms да му отговори нещото отсреща
 timeout 1000
tag CHANGE-DEFAULT-ROUTE
# на всеки 2 sec ще прави по 1 ping
 frequency 2
exit
# schedule-вам цялата анджиклЪмЪ да се случва non-stop и да започне сега
ip sla monitor schedule 1 life forever start-time now
# подтвърждавам reachability нa 192.168.61.1
track 10 rtr 1 reachability
# правя reverse triger т.е ako track 10 is not true then mark "event"
track 11 list boolean and
 object 10 not
# apply this default route if "event" occur (track 11 == true if track 10 <> true)
ip route 0.0.0.0 0.0.0.0 192.168.64.152 track 11  

Когато primary връзката се възтанови, track 10 == true; track 11 == false 0.0.0.0/0 via 192.168.64.152 не се инсталира в рутинг таблицата и трафика си тръгва през prez 192.168.61.1