Hi,   I have a question about a VPN solution between a office in Dubai and and HQ, first i was looking into setting up a IPSEC VPN between 2 Cisco ISR 4k routers. but i believe this is being blocked in Dubai, Unfortunatally Cisco ISR does not support site to site vpn over SSL. So my question is if there is a different solution for this.   Thanks in advance! ... View more

Hi,   I am running into a small issue with BGP, see below example setup.   Router A ---- Leased Line ---- Router B   Between the two routers we run a eBGP session. The link sometimes gets a hit, when this happens the interface on Router A will go down, but the interface on Router B will stay up. We have BGP Fall-Over configured on Router A, so when the interface goes down the route will disappear from RIB and BGP will skip the hold down timers. But this does not happen on Router B, as the interface stays up on that side. So router B will still have the 180 seconds hold timer. Is there a way for BGP to tell Router B that the session is down and it can skip hold timers, or could there be another way to achieve this? Was thinking about IPSLA and EEM or just tweak the timers for this specific neighbor, but dont think that is the cleanest solution.   Hope someone can help me out with this.    Thanks in advance!   Br,   JP ... View more

Hi,   We have some customer networks when IPSEC VPN tunnels are blocked by a firewall. Now its quite hard to request to open up these ports, as they are just not willing to do this.    Now SSL VPN's are mostly not blocked as its over port 443. I dont think its possible, as the SSL VPN functionality on ASAs is a client/server relationship. But is there a solution to have a SSL based VPN between two asa's?   How about changing the port for IPSEC VPN, there is a global command to do this, but can this also be done on a per peer basis?   Thanks in advance!   Br,   Jan Pieter de Boer. ... View more

Hi,   I have a question about route manipulation in OSPF. See below info / sample topology.   - The connection between router A and B is a Gigabit Ethernet Connection and is in Area 0 of OSPF 93 process. - Between Router A and C i have a IPSEC over GRE tunnel. Same for the connection between Router B and C. These tunnel interfaces are in Area 6 of OSPF process 93. - When i do sh ip route 10.93.108.1 on Router A (With Tunnel connection shut down between Router A and C ) i get below info. Routing entry for 10.93.108.0/22 Known via "ospf 93", distance 110, metric 22, type extern 1 Last update from 1.1.1.42 on GigabitEthernet0/2, 00:01:02 ago Routing Descriptor Blocks: * 1.1.1.42, from 10.93.108.1, 00:01:02 ago, via GigabitEthernet0/2 Route metric is 22, traffic share count is 1 - Now when i do this with tunnel connection between Router A and C unshut i get below information. Routing entry for 10.93.108.0/22 Known via "ospf 93", distance 110, metric 25, type extern 1 Last update from 10.93.69.65 on Tunnel20, 00:00:03 ago Routing Descriptor Blocks: * 10.93.69.65, from 10.93.108.1, 00:00:03 ago, via Tunnel20 Route metric is 25, traffic share count is 1 - Both routes are externall type one routes, this i configured under the OSPF process configuration on Router C. O E1 10.93.108.0/22 [110/22] via 1.1.1.42, 00:00:03, GigabitEthernet0/2 O E1 10.93.108.0/22 [110/25] via 10.93.69.65, 00:01:29, Tunnel20     Now what i would like to accomplish is that traffic towards 10.93.108.0/22 will always flow over the tunnel between Router B and Router C. So if traffic for example enters Router A then Router A should forward this to Router B and Router B will send it to Router C.    This is currently not the case, when the tunnel between router A and C is enabled Router A prefers to send it to Router C over the tunnel even though the metric for the route to Router B is lower 22 in this case.   Now the route selection is as below   1. intra-routes over 2, inter-routes over ( Both routes learned are inter area routes) 3. E1 over (Both Routes learned are E1 Routes) 4. E2 over 5. N1 (Not applicable) 6. N2  (Not applicable)   So then it would come to metric size wright? Which can be manipulated by using ospf cost on the interface. Which i do. As far as i know the router will only choose the closest egress point if metric is also a tie. Which is not true in this case.    I also tried doing this with E2 routes, According to some posts E2 routes do not count ospf cost per interface (Which is not entirely true) so that will always be a tie metric of 20 is the default. I cannot manipulate this under the OSPF configuration as these routes come from one router. I could do this when the same route was announced from 2 different routers.    I am testing this in Virl, could it be that this is a bug in Cisco Virl or am i missing something?   Thanks in advance!   Br,   JP ... View more

Hi,   We have a Cisco 3945 router, where we installed a securityk9 license on. This was a evaluation license, now we ordered a license to make the license permanent.    I loaded the license to the router, and installed it with license install command. Normally when you do this it generates a syslog message that the license will be active after a reboot.   This was not the case when i upgraded from a evaluation license to a permanent license, so it seems a reboot is not needed. But i want to make sure, so that the service doesn't stop when the evaluation period is over.   Now show version shows: security      securityk9           Permanent      securityk9   and show license detail shows: Index: 8 Feature: securityk9 Version: 1.0 License Type: Permanent License State: Active, In Use License Count: Non-Counted License Priority: Medium Store Index: 2 Store Name: Primary License Storage Index: 9 Feature: securityk9 Version: 1.0 License Type: Evaluation License State: Inactive Evaluation total period: 8 weeks 4 days Evaluation period left: 1 week 2 days Period used: 7 weeks 1 day License Count: Non-Counted License Priority: Low Store Index: 1 Store Name: Primary License Storage   Did this get changed in the new IOS version ?   Thanks in advance for your time and reply. ... View more