Hi guys,   I come today with some funny/tricky ACL issue. I have this classic setup:  - ASA (default route to the router) <----> 4000 series ISR router  - ISR router has two interfaces Gi0/0 toward ASA and Gi0/1 toward ISP  - default route is installed on ISR router from Gi0/1 with next hop: ISP_IP  - ACL is applied on Gi0/1 on the IN direction (and that's the only ACL I am using) show run | i access-group ip access-group BOUNDARY-IPV4-ACL in  - I want to enable ICMP traceroute from a PC behind ASA (I have taken care of ASA config) to Internet   Fun facts:  - if I remove the ACL from Gi0/1 traceroute shows as expected including ISP_IP  - with the ACL on, I see all hops but the ISP_IP   ACL config: 140 deny icmp any any fragments 180 permit icmp any any echo-reply (46782 matches) 190 permit icmp any any unreachable (536737 matches) 200 permit icmp any any time-exceeded (2770525 matches) 205 permit icmp any any traceroute 210 permit icmp any any packet-too-big 230 deny icmp any any (160680 matches)   What am I missing, guys? ... View more

Hi guys,   I was wandering what is your "in production method" for software upgrade on 4300 series. From the documentation I found out about two methods:   - consolidated package aka old school IOS router upgrade path where you just copy bin file and mention it as boot system path  - individual package aka new method. Here's config example for it: SUMMARY STEPS 1. show version 2. dir bootflash: 3. show platform 4. mkdir bootflash: URL-to-directory-name 5. request platform software package expandfile URL-to-consolidated-package to URL-to-directory-name 6. reload 7. boot URL-to-directory-name/packages.conf 8. show version installed   Now why would someone pick the new method if it requires console access to manually specify the boot image under ROMMON?   Thanks, Florin. ... View more