The Cisco IronPort Appliances are geared and operated by powerful collections of software’s better known as AsyncOS. The AsyncOS is a collection of base operating system (OS), device drivers, memory management, process scheduling, and all the application and scanning software. Few unique features of AsyncOS are its high performance and security.

The AsyscOS fundamentals are built on FreeBSD, low-level components are written in C programing language. However, most of the application software and the entire management interface is written in Python and use a coroutine-based model called shrapnel.

AsysncOS versions are referred as the Major.Minor.Point-Build number format as shown below.

One interesting fact about the AsyncOS software builds is. It is complete and self-contained. When an AsyncOS is upgraded from, one version to another, the entire build image is upgraded rather than individual upgrade component.

When it comes to Email Security, no other product is as powerful as Cisco IronPort. Therefore, we opted Cisco IronPort C370 as our email security gateway. Since its inception into our network, I am searching for a great reference and study guide for the Cisco IronPort products.

At the beginning, I was depending more or less on Cisco Web Site resources, which are great. However, the moment I discovered that Chris Porter is writing a book with a title “Email Security with Cisco Iron Port” I was excited. Immediately I contacted Jamie Adams at Cisco Press, as usual she arranged a copy of book for me for a review and reference.

The title “Email Security with Cisco IronPort” is tailored made for those professionals who have a good understanding of  basic networking concepts.  The author Chris Porter did an amazing job especially with the Introduction part. I really loved it, be it the overview or history of AsyncOS versions. I think the author is quite smart in addressing his readers, be they are beginners or experts of the subject. He knows how to keep them intact.

The title “Email Security with Cisco IronPort” consists of 15 chapters covering the concepts like ESA products, the WEB user interface, Command Line interface in IronPort, and much more in detail and in simple language.

The main highlight of “Email Security with Cisco IronPort” book is the configurations recommended by Chris Porter.

After reading this title, it really enriched my knowledge and made my quite competent in managing Cisco IronPort devices, I would definitely recommend this title to all those professionals who are keen to know more about Email Security with Cisco IronPort devices.

Recently, I configured our Cisco IPS Sensors modules SSM-40 installed in the Cisco ASA 5540 and Cisco IPS 4270 sensor to auto update the signature behind our Blue Coat Proxy SG, upon configuration, I discovered that the auto updates failed. When I tried to know status by using Cisco IOS command.

 “show statistics host” I discovered the auto updates failed, and the command was giving the following errors

IPS#show statistics host

Auto Update Statistics

lastDirectoryReadAttempt = 19:31:09 CST Thu May 9 2013

= Read directory: https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl

= Error: AutoUpdate exception: HTTP connection failed [1,110]   <–

lastDownloadAttempt = 19:08:10 CST Thu May 9 2013

lastInstallAttempt = 19:08:44 CST Thu May 9 2013

nextAttempt = 19:35:00 CST Thu May 9 2013

These errors generally observed in IPS sensors running 7.0(7) and 7.0(8) due to a bug “CSCub08230”. In order to overcome this problem available work around is either to download the signature update package manually from Cisco.com and apply the updates manually to the IPS sensors or to upgrade the Cisco IPS sensors to latest  update of 7.2.

The strange thing is that the IPS Sensors were communicating with the Cisco Servers they could be able to connect bypass the proxy servers as shown in my below capture.

However, they failed to update signature simply because the initial connection to the locator service is performed using the HTTPS connection, and the once sensor is authenticated by the digital certificate provided by the server. The connection is switched over to HTTP for the auto-update process. This changer over from HTTPS to HTTP is failing due to the bug “CSCub08230”

Hence, temporarily I was forced to revert my configuration and allow IPS sensors to communicate directly with Cisco servers bypassing our bluecoat proxy server.

The below example shows how to enable this feature

CiscoSwitch(config)# monitor session 1 source interface g0/1

CiscoSwitch(config)# monitor session 1 destination interface g0/2 encapsulation replicate

We had a special request from one of our clinicians; he was trying to access one of the health care portal with the URL http://apps.xxx.xx.sa:2000/. While he was trying to access the same portal from his office it was not accessible, whereas the same portal can accessed from any other location except our office.

While troubleshooting this issue we thought may be our Bluecoat proxy SG was blocking the port 2000 but that was not the case. We were facing the same problem even with static NAT from our ASA 5540 firewall.

One thing was sure the ASA 5540 firewall was blocking the access to the URL http://apps.xxx.xx.sa:2000/. We reviewed all our access list still nothing was wrong with that.  We thought might be some policy map is blocking the access, when we disabled the default policy-map as shown below

policy-map global_policy

 class inspection_default

  inspect dns migrated_dns_map_1

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

  inspect esmtp

sec/FW01-MB-IE-001(config)# policy-map global_policy

sec/FW01-MB-IE-001(config-pmap)# no class inspection_default

The url started working. Now one thing was sure, the problem lies with policy map. We cannot disable the default policy-map which Cisco configured by default in all ASA or PIX firewall, after reading the following documents from Cisco Systems

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/inspect.html

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/inspect_overview.html

It was clear certain HTTP traffic need a special handling. When we enabled the default policy-map and added a command “inspect http”  as shown below the url can be accessed from our internal LAN.

 sec/FW01-MB-IE-001(config)# policy-map global_policy

sec/FW01-MB-IE-001(config-pmap)#  class inspection_default

sec/FW01-MB-IE-001(config-pmap-c)# inspect http

Those folks who are already ready or in the processes of final prep to write an exam they don’t need to panic as the current CCNA Wireless Certification track 640-721 are available until May 11, 2012.

The new CCNA Wireless Certification track 640-722 IUWNE comprises of the current version of software program such as Autonomous, wireless LAN controller (WLC), and Clients.

So gear up for the new exam and always there is Cisco press to offer self-study guides , let’s hope Cisco Press will come out soon with the study material for the new track.

According to Cisco Systems the error “socket SO_UDPCHECKSUM option setting failed error” has no negative impact on the Cisco Catalyst 6500 series Switch. The work around is to remove IP SLA configuration or upgrade the IOS version.

This error appeared for the first time in the IOS version 12.2(33)SXI1 and this bug is fixed in following IOS versions

12.2(32.8.11)SX291
12.2(32.8.11)XJC273.11
12.2(33.2.4)SXI
12.2(32.8.1)YCA273.15
12.2(33)SXI3
12.2(32.8.15)YCA273.10
12.2(33)SXI4
15.0(1)SY

So if you happen to see the following error in your Cisco Catalyst 6500 Series switch don’t panic, the bug has least impact on device the only work around is either to remove the IP SLA or to upgrade the IOS of the device.

Cisco Systems are conducting the Cisco Expo Saudi Arabia, on the 5th and 6th of December 2011 at the King Fahad Cultural Centre, Riyadh Saudi Arabia. This year Cisco came out with a theme “Innovate Together”. Well I am sure this event provides a great opportunity to connect, collaborate and communicate with leading IT professionals in the region. Cisco Expo is a platform where we get an opportunity to discuss a variety of topics ranging from global megatrends, their societal and economic impact, to innovation and relevance to the technology architectures.

Cisco System and their partner have planned few presentations and demonstration will focus around the power of collaboration, video, cloud and virtualization, borderless network and emerging technologies that are transforming business to networked enterprises driving business results, productivity, competitiveness and societal change.

So want to be at Cisco Expo Saudi Arabia, register now.

“Cisco is committed to working with our service provider customers to deliver next-generation IP-based video experiences across devices,” said Marthin De Beer, senior vice president and general manager of Cisco’s Emerging Business Group. “Service providers globally are embracing our Videoscape vision, and today with the acquisition of BNI Video, we are augmenting our Videoscape platform and giving customers a clear migration path to Videoscape.”

“As a founding investor in BNI Video, Comcast Ventures recognized the potential for this technology to play a critical role in advancing video experiences for Comcast’s customers,” said Tony Werner, chief technology officer, Comcast. “With the combined expertise in IP video systems, Cisco and BNI Video offer service providers a compelling software and infrastructure platform to efficiently deliver video content to multiple devices.”

“Time Warner Cable invested early in BNI Video, as it brought a unique software platform to market that addresses the back-office complexities of delivering TV Everywhere services,” said Mike LaJoie, chief technology officer, Time Warner Cable. “Combining forces with Cisco presents an opportunity to take video service providers to the next level with Internet video, helping to manage networks more efficiently to deliver advanced TV entertainment experiences to consumers.”

Upon the close of the acquisition, BNI Video employees will be integrated into Cisco’s Service Provider Video Technology Group. Under the terms of the agreement, Cisco will pay approximately $99 million in cash and retention-based incentives in exchange for all shares of BNI Video. The acquisition is subject to various standard closing conditions and is expected to be complete in the second quarter of Cisco’s fiscal year 2012.

I thought Blade servers that Cisco Systems, they must be joking; honestly I thought it was a crazy move from Cisco Systems. But they outperformed many of their competitors. In just two years, sales of the Unified Computing System are outpacing market growth for x86 blades, and Cisco has become the #3 player worldwide in x86 blade server factory revenue

Blades are forecast to be the fastest growing segment of the x86 server market and market data illustrates the impact of UCS innovation: businesses worldwide shifted over 10% of the x86 blade market to UCS, and in the U.S. nearly 20%. Cisco’s rapid growth underscores their leadership in the industry transition to fabric computing and converged infrastructure. Cisco reported 5,400 UCS customers and an annualized order run rate of $900M for UCS product orders.

According to IDC press release HP maintained the number 1 spot in the server blade market in 1Q11 with 50.0% revenue share, while IBM finished with 20.2% revenue share. Cisco and Dell rounded out the top 4 with 9.4% and 8.4% factory revenue share, respectively.