Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Alex Pfeil
Online
Alex Pfeil
Member since
01-08-2008
Contributor
Created by
Alex Pfeil
in VPN and AnyConnect
in VPN and AnyConnect
02-21-2019
07:23 AM
02-21-2019
07:23 AM
I am not sure if this is considered a work-around or the solution.
The solution is to disable the IP Layer Filtering in Umbrella on a per PC basis.
... View more
02-20-2019
02:03 PM
Yes, I have seen issues with PoE and 2960x switches. It could make sense that the power is spread between different ports on the switch and you could overwhelm one said group of ports, but I have never read anything saying that. I have always thought that you should be able to do a show power inline and look at the results. It should tell you how much power you have and how much power is being used.
I agree to try the firmware first and then TAC it.
... View more
02-20-2019
01:54 PM
If you want to save time, these two can automate the process.
SolarWinds Network Topology Mapper
NetBrain
... View more
02-20-2019
01:50 PM
Try using a secondary subnet liket this.
interface VLAN 12 ip address 10.12.12.42 255.255.255.0 ip nat outside ! interface VLAN 6 ip address 172.31.6.1 255.255.255.0 ip address 172.31.7.1 255.255.255.0 secondary ip nat inside ! interface VLAN 23 ip address 172.31.23.1 255.255.255.0 ip nat outside ! interface VLAN 24 ip address 172.31.24.1 255.255.255.0 ip nat outside ! interface VLAN 25 ip address 172.31.25.1 255.255.255.0 ip nat outside ! interface VLAN 26 ip address 172.31.26.1 255.255.255.0 ip nat outside ! interface VLAN 27 ip address 172.31.27.1 255.255.255.0 ip nat outside
no ip nat inside source static 172.31.6.2 10.12.12.2 route-map RM_SERVER_PRODU ip nat inside source static 172.31.6.2 172.31.7.2
If you only want to translate certain IP addresses going to 172.31.6.2, you can use a route-map then. However, no route-map is necessary.
Please mark helpful posts.
... View more
02-20-2019
01:00 PM
I agree that you should run the no boot system command first because the boot system command is an additive command meaning that it does not replace the previous boot system command.
... View more
02-20-2019
12:56 PM
You can also run an extended ping to the IP address, and run she show ip nat translation command.
... View more
02-20-2019
12:52 PM
Does it work from the 10.12.12.0 subnet? If so, try adding the ip nat outside command to another of your VLANs besides the inside one.
... View more
02-20-2019
12:47 PM
For small business routers and switches, we plug them into a UPS, or power line conditioner and let them power off when the power is lost. What is the equipment that you are powering off. If you have a data center with UCS chassis and many servers, the process can be very different. You will have to basically list off the equipment you are trying to gracefully shutdown, if you want to receive a good answer.
... View more
02-20-2019
12:41 PM
You should be able to delete the old flash file and reload. If you used the boot system flash command as below, and it did not work. You have to change the config-register. lookup the config-register, make the change, reload, and then change it back after it returns online.
boot system flash:/newimagename
You can delete the old image in the directory like this:
delete /force /recursive flash:/c2960-lanlitek9-mz.152-2.E7
... View more
02-20-2019
12:26 PM
It seems to me like you do not need a route-map. Just access the telnet service directly to the IP address without NAT for any of the local VLANs. You could then just do NAT for 10.x address out from that interface.
172.31.23.1 - telnet to 172.31.6.2 not to 10.12.12.2 10.12.12.10 - telnet to 10.12.12.2 - which gets translated to 172.31.6.2 Hope this makes sense.
... View more
Created by
Alex Pfeil
in Security Blogs
in Security Blogs
02-20-2019
12:16 PM
02-20-2019
12:16 PM
Thanks for posting how Umbrella works. Very informative!
... View more
02-20-2019
11:53 AM
Do your other VLANs have to access the server via the NAT address?
... View more
Created by
Alex Pfeil
in VPN and AnyConnect
in VPN and AnyConnect
02-18-2019
09:39 AM
02-18-2019
09:39 AM
I am working with my Cisco team to get an answer on this. If they cannot get an answer, I will submit this to TAC. I think it would definitely be helpful to other people out there running into the same issue to get an answer on this.
Thanks,
Alex
... View more
02-18-2019
09:33 AM
The official answer is that after 5 idle minutes, the user authentication is reset. I believe the idle time starts counting after they login.
Since it was only 5 minutes, I went ahead and ran a test. I caught a user that had been logged in for 12 seconds. When the idle time hit 5:00 minutes, it gets rid of the authenticated user. I even caught the user being removed from the show uauth with 1 Authenticated user still in the command. After running the command shortly after, it showed 0 Authenticated users.
NotmyASAname# show uauth Current Most Seen Authenticated Users 1 4 Authen In Progress 0 11 user 'username' at 10.1.2.3, authenticated (idle for 0:00:12) absolute timeout: 0:05:00 inactivity timeout: 0:00:00 NotmyASAname#
user 'username' at 10.1.2.3, authenticated (idle for 0:04:59) absolute timeout: 0:05:00 inactivity timeout: 0:00:00 NotmyASAname# show uauth Current Most Seen Authenticated Users 1 4 Authen In Progress 0 11 NotmyASAname# show uauth Current Most Seen Authenticated Users 0 4 Authen In Progress 0 11 NotmyASAname# show uauth
... View more
Created by
Alex Pfeil
in Identity Services Engine (ISE)
02-27-2019 04:49 PM
02-27-2019 04:49 PM
I have read that it was not a best practice. I just wanted to make sure.
Created by
Alex Pfeil
in Identity Services Engine (ISE)
02-27-2019 04:45 PM
02-27-2019 04:45 PM
I am deploying 802.1x and the command access-session template monitor
was in a best practices config...
Created by
Alex Pfeil
in Identity Services Engine (ISE)
02-27-2019 11:26 AM
02-27-2019 11:26 AM
We were trying to determine if there is a solution to limit then number
of MAC addresses learned on ...
Created by
Alex Pfeil
in Switching
02-27-2019 05:49 AM
02-27-2019 05:49 AM
I have read in multiple forums that some people effectively shut off
device tracking with the ip dev...
Created by
Alex Pfeil
in Switching
02-27-2019 05:44 AM
02-27-2019 05:44 AM
I have read a couple of posts that state IPDT is automatically enabled
when features on a switch are...
02-27-2019 05:36 AM
I ran into the IP device tracking issue where clients/servers were
seeing duplicate IP addresses. My...
Created by
Alex Pfeil
in Identity Services Engine (ISE)
02-26-2019 12:00 PM
02-26-2019 12:00 PM
Is there any change on the best practice for port-security and
multi-auth. This discussion dates bac...
02-21-2019 11:29 AM
It sounds like you are not going to stack these using the stack module
and cables plugged into the b...
Created by
Alex Pfeil
in Switching
02-21-2019 07:28 AM
02-21-2019 07:28 AM
The boot system command was entered incorrectly. boot system
c2960-lanlitek9-mz.152-4.E6.bin It shou...
Created by
Alex Pfeil
in VPN and AnyConnect
02-21-2019 07:23 AM
02-21-2019 07:23 AM
I am not sure if this is considered a work-around or the solution. The
solution is to disable the IP...
Created by
Alex Pfeil
in Identity Services Engine (ISE)
02-21-2019 03:29 AM
02-21-2019 03:29 AM
Thank you for the EAP chaining examples.
Created by
Alex Pfeil
in Identity Services Engine (ISE)
02-21-2019 03:26 AM
02-21-2019 03:26 AM
This would be the best solution since an AP could be unplugged and
plugged into another port. This o...
02-20-2019 02:03 PM
Yes, I have seen issues with PoE and 2960x switches. It could make sense
that the power is spread be...
02-20-2019 01:54 PM
If you want to save time, these two can automate the process. SolarWinds
Network Topology Mapper Net...
Public Statistics
| Date Registered | 01-08-2008 12:55 PM |
| Date Last Visited | 07-10-2019 11:22 AM |
| Total Messages Posted | 543 |
| Total Helpful Votes Received | 381 |
.jpg "VIP Engager"){kind=icon}
Helpful Votes From
