Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About gatlin007
Stats
Member since
11-04-2004
255
Posts
142
Helpful
41
Solutions
06-04-2010
09:02 AM
kolawole1, Can you give us an example of a source address that isnt being properly routed to the ISA server based on a destination port? Thanks, Chris http://travelingtech.net
... View more
05-30-2010
03:29 PM
There isn’t much support for per tunnel bandwidth statistics on the ASA. I would rely on netflow on the IOS router. Export your netflow statistics to a netflow collector and pull reports based on the routers public interface focused on IPSEC traffic destined to the ASA’s public IP address. Here’s an open source netflow collector http://neye.unsupported.info/ If you have some money to invest I recommend Statseeker because it scales very well for bandwidth monitoring and has a built in netflow collector. http://www.statseeker.com/ Christopher Gatlin http://travelingtech.net
... View more
05-30-2010
08:29 AM
The ASA is a good firewall and IPSEC tunnel endpoint. For dual homed routing solutions a router with the firewall feature set is a better fit. This gives the network advanced routing features, IPSEC and stateful inspection all on one box. Christopher Gatlin http://travelingtech.net
... View more
05-28-2010
03:25 PM
Using one OSPF area for all branches enables a ‘cookie cutter’ approach that simplifies provisioning and NOC supportability. Functionally it works well. The less variables the NOC has to deal with the more successful the NOC will be. The more successful the NOC is the more time engineers have for studying for the next CCIE exam; or perhaps a beer. Christopher Gatlin http://www.travelingtech.net
... View more
05-28-2010
01:10 PM
This absolutely makes sense and is becoming more and more of an issue in enterprise networks. You can NAT the customer addresses after the packets are decrypted. Your internal network: 10.1.1.0/24 Customer encrypted network: 10.2.2.0/24 You discover 10.2.2.0/24 in your enterprise routing table and determine there is an overlapping IP address problem. Build the IPSEC rules (Interesting traffic selection) to account for the addresses the customer will send through the tunnel. Then install the following static in based on 172.16.1.0/24 not being currently used in your network. static (outside,inside) 172.16.1.0 10.2.2.0 255.255.255.0 # If a route is needed install this static – may need to redistribute # into the IGP. route outside 172.16.1.0 255.255.255.0 Christopher Gatlin http://www.travelingtech.net
... View more
05-28-2010
07:50 AM
Reaching out to the telcos and getting your remote site prefixes properly routed would be the best solution; however I understand how painful that can be. If your switches support GRE you could install tunnels between your sites, taking the routing decision for remote sites out of the MPLS VPN clouds. Christopher Gatlin http://travelingtech.net
... View more
05-27-2010
02:04 PM
There is the possibility of asymmetric routing in and out of the tunnel and /32 routes for specific hosts will be difficult to manage. In order to prevent asymmetric situations it’s easier to send all enterprise traffic over the GRE/IPSEC tunnel. The security people will admire it as well. Because there’s an OSPF area 0 at HQ and an OSPF area 1 at DR, there is the possibility of problems if HQ fails isolating the DR site from the backbone area; especially if the OSPF routing domain is extended into the branches. I would extend OSPF area 0 into the data center to prevent an HQ failure from separating nodes from the backbone area. Then use the same OSPF area number for all branches over the GRE interfaces. Build GRE tunnels sourcing the WAN interface at the branch. On the HQ, DR sides also use the WAN interface; this will prevent the GRE tunnel from back feeding through the other hub site. Sometimes it’s better to use loopbacks, but in your topology stick to the WAN interfaces. Don’t redistribute OSPF into BGP. This will ensure enterprise traffic takes the OSPF route learned over the tunnel. If enterprise routes are in the BGP table they will be preferred because of eBGP admin distance realized with your service provider. If you only have a few branches I’d stick with regular GRE tunnels; if you have lots of branches consider DMVPN. Regards, Christopher Gatlin http://www.travelingtech.net
... View more
05-26-2010
07:22 AM
It’s difficult to scale a NAT solution to HQ and DR over several branches. If you have equipment that supports GRE I would recommend developing a routing protocol relationship over GRE tunnels that are then encrypted with IPSEC. If you aren’t using equipment that supports GRE I strongly suggest looking into acquiring some. This will ensure the packet forwarding decision is based on a dynamic routing protocol versus a static ACL used to define ‘interesting traffic’. Something nice to have in a DR situation. -The packet comes into the branch router from the branch LAN -Branch router has a route for destination address over a GRE tunnel -Branch router has an IPSEC tunnel that matches the GRE headers. The static ACL for ‘interesting traffic’ never had to change – It’s always matching GRE source/destination pair. - HQ router receives an IPSEC packets and decrypts it - The decrypted packet now has a GRE header; HQ router removes GRE header as the tunnel interface evaluates it. - HQ router evaluates the destination address and forwards according to its route table. Here is one example: http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009438e.shtml Best regards, Christopher Gatlin http://www.travelingtech.net
... View more
Created by
gatlin007
in Other Network Architecture Subjects
in Other Network Architecture Subjects
08-02-2005
08:39 PM
08-02-2005
08:39 PM
Thanks Michael, That doc is exactly what I’ve been looking for! Chris
... View more
Created by
gatlin007
in Other Network Architecture Subjects
in Other Network Architecture Subjects
07-27-2005
08:10 PM
07-27-2005
08:10 PM
Is there a good rule of thumb for selecting the bust parameter on the 3550 in regards so the aggregate-policer command? mls qos aggregate-policer hero 8000000 1500000 exceed-action drop
... View more
Labels:
07-05-2005
03:41 PM
Thanks guys!!! I adjusted it as per your advice and it worked great. Chris Gatlin ------------------------------- Switch#show ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is not set 1.0.0.0/24 is subnetted, 1 subnets C 1.1.1.0 is directly connected, FastEthernet0/5 2.0.0.0/24 is subnetted, 1 subnets C 2.2.2.0 is directly connected, FastEthernet0/3 5.0.0.0/32 is subnetted, 1 subnets D 5.5.5.5 [90/276160] via 2.2.2.2, 00:02:55, FastEthernet0/3 [90/284160] via 1.1.1.2, 00:02:55, FastEthernet0/5 10.0.0.0/32 is subnetted, 2 subnets C 10.0.0.3 is directly connected, Loopback0 D 10.0.0.1 [90/276160] via 2.2.2.2, 00:02:55, FastEthernet0/3 Switch# Switch# Switch#show ip ei top det IP-EIGRP Topology Table for AS(100)/ID(10.0.0.3) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 5.5.5.5/32, 1 successors, FD is 276160, serno 10, Stats m(17)M(17)A(17)c(1) via 2.2.2.2 (276160/248256), FastEthernet0/3 via 1.1.1.2 (284160/256256), FastEthernet0/5 P 1.1.1.0/24, 1 successors, FD is 28160, serno 2 via Connected, FastEthernet0/5 P 2.2.2.0/24, 1 successors, FD is 28160, serno 5 via Connected, FastEthernet0/3 P 10.0.0.3/32, 1 successors, FD is 128256, serno 1 via Connected, Loopback0 P 10.0.0.1/32, 1 successors, FD is 276160, serno 9 via 2.2.2.2 (276160/248256), FastEthernet0/3 Switch# Switch#show run | be router ei router eigrp 100 variance 2 offset-list 0 in 120000 FastEthernet0/3 network 0.0.0.0 no auto-summary
... View more
07-05-2005
12:13 PM
SSHv2 crash I have a Cisco 2821 router running c2800nm-advsecurityk9-mz.123-11.T.bin code. When I SSHv2 to this router and run an aggressive extended ping from it my session locks up and I get the following output from the console. When I say aggressive I’m sending around 10,000 packets. ------------------------------- %TCP-6-NOBUFF: TTY322, no buffer available -Process= "SSH Process", ipl= 0, pid= 4 -Traceback= 409C5450 40FD4D94 40FDD750 40FDDAC0 4179DEC0 4179F6BC 4179F51C 409D7810 40A1C914 417A285C 417A3028 414E038C 414E0370 %TCP-6-NOBUFF: TTY322, no buffer available -Process= "SSH Process", ipl= 0, pid= 4 -Traceback= 409C5450 40FD4D94 40FDD750 40FDDAC0 4179DEC0 4179F6BC 4179F51C 409D7810 40A1C914 417A285C 417A3028 414E038C 414E0370 %TCP-6-NOBUFF: TTY322, no buffer available -Process= "SSH Process", ipl= 0, pid= 4 -Traceback= 409C5450 40FD4D94 40FDD750 40FDDAC0 4179DEC0 4179F6BC 4179F51C 409D7810 40A1C914 417A285C 417A3028 414E038C 414E0370 ----------------------------------- As this continues the router becomes unresponsive and eventually stops passing any traffic. Has anyone else seen this behavior? When I use SSHv1 or telnet with the same aggressive extended ping I have no problems. Thanks, Chris
... View more
Labels:
07-05-2005
11:54 AM
I’m attempting to configure unequal cost load balancing with EIGRP and haven had any luck. In the following output I’m attempting to load balance between fa0/3 and fa0/5 for the 5.5.5.5 host. If I make the metrics equal it does it no problem. As soon as I change the metric it only populates one route in the routing table. ----------------------------- Switch# Switch#show ip pro *** IP Routing is NSF aware *** Routing Protocol is "eigrp 100" Outgoing update filter list for all interfaces is not set Incoming update filter list for all interfaces is not set Default networks flagged in outgoing updates Default networks accepted from incoming updates EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0 EIGRP maximum hopcount 100 EIGRP maximum metric variance 4 Redistributing: eigrp 100 EIGRP NSF-aware route hold timer is 240s Automatic network summarization is not in effect Maximum path: 4 Routing for Networks: 0.0.0.0 Routing Information Sources: Gateway Distance Last Update 2.2.2.2 90 00:01:29 1.1.1.2 90 00:01:29 Distance: internal 90 external 170 Switch# Switch# Switch#show ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is not set 1.0.0.0/24 is subnetted, 1 subnets C 1.1.1.0 is directly connected, FastEthernet0/5 2.0.0.0/24 is subnetted, 1 subnets C 2.2.2.0 is directly connected, FastEthernet0/3 5.0.0.0/32 is subnetted, 1 subnets D 5.5.5.5 [90/156160] via 2.2.2.2, 00:01:39, FastEthernet0/3 10.0.0.0/32 is subnetted, 2 subnets C 10.0.0.3 is directly connected, Loopback0 D 10.0.0.1 [90/156160] via 2.2.2.2, 00:01:55, FastEthernet0/3 Switch# Switch# Switch# Switch#show ip ei top det IP-EIGRP Topology Table for AS(100)/ID(10.0.0.3) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 5.5.5.5/32, 1 successors, FD is 156160, serno 6 via 2.2.2.2 (156160/128256), FastEthernet0/3 via 1.1.1.2 (284160/256256), FastEthernet0/5 P 1.1.1.0/24, 1 successors, FD is 28160, serno 15 via Connected, FastEthernet0/5 P 2.2.2.0/24, 1 successors, FD is 28160, serno 4 via Connected, FastEthernet0/3 P 10.0.0.3/32, 1 successors, FD is 128256, serno 1 via Connected, Loopback0 P 10.0.0.1/32, 1 successors, FD is 156160, serno 5 via 2.2.2.2 (156160/128256), FastEthernet0/3 Switch# Switch#show run | be router ei router eigrp 100 variance 4 network 0.0.0.0 no auto-summary !
... View more
Labels:
06-10-2005
10:29 AM
In the following output, what does the IV size refer too? Thanks, Chris --------------------------------- inbound esp sas: spi: 0x3491ACD6(881962198) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2000, flow_id: 1, crypto map: test sa timing: remaining key lifetime (k/sec): (4607840/3301) IV size: 8 bytes replay detection support: Y
... View more
Labels:
- « Previous
- Next »
06-04-2010
kolawole1,Can you give us an example of a source address that isnt being
properly routed to the ISA ...
05-30-2010
There isn’t much support for per tunnel bandwidth statistics on the ASA.
I would rely on netflow on ...
05-30-2010
The ASA is a good firewall and IPSEC tunnel endpoint. For dual homed
routing solutions a router with...
05-28-2010
Using one OSPF area for all branches enables a ‘cookie cutter’ approach
that simplifies provisioning...
05-28-2010
This absolutely makes sense and is becoming more and more of an issue in
enterprise networks. You ca...
05-27-2010
There is the possibility of asymmetric routing in and out of the tunnel
and /32 routes for specific ...
05-26-2010
It’s difficult to scale a NAT solution to HQ and DR over several
branches.If you have equipment that...
Created by
gatlin007
in Other Network Architecture Subjects
08-02-2005
08-02-2005
Thanks Michael, That doc is exactly what I’ve been looking for!Chris
Created by
gatlin007
in Other Network Architecture Subjects
07-27-2005
07-27-2005
Is there a good rule of thumb for selecting the bust parameter on the
3550 in regards so the aggrega...
07-05-2005
Thanks guys!!!I adjusted it as per your advice and it worked great.Chris
Gatlin---------------------...
07-05-2005
SSHv2 crashI have a Cisco 2821 router running
c2800nm-advsecurityk9-mz.123-11.T.bin code.When I SSHv...
07-05-2005
I’m attempting to configure unequal cost load balancing with EIGRP and
haven had any luck. In the fo...
- « Previous
- Next »
Public Statistics
| Date Registered | 11-04-2004 01:55 PM |
| Date Last Visited | 05-08-2019 12:01 AM |
| Total Messages Posted | 255 |
| Total Helpful Votes Received | 142 |
Helpful Votes Given To
.jpg "Hall of Fame Guru"){kind=icon}
Helpful Votes From
