If you are working with a partner this is the training you need http://tools.cisco.com/E-Learning-IT/LPCM/LpcmLLController?action=CourseDesc&COURSE_ID=4775 -Hoogen ... View more

I am not sure why you need to do it twice. Lets just say if your web server is in the Inside zone with an ip address of 192.168.1.10 and the public IP is 200.200.200.1, this is what you need to do. ! static (inside,outside) tcp 200.200.200.1 www 192.168.1.10 www netmask 255.255.255.255 ! access-list outside_in extended permit tcp any host 200.200.200.1 eq www ! access-group outside_in in interface outside ! This should help you out. Do the same way for the second server. -Hoogen ... View more

Hi Paolo That is exactly what I want to do. But I am not so sure about that command, I was looking at the dialer pool-member command http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_command_reference_chapter09186a0080080dc6.html#wp1019172 It kind of seems more appropriate. For two links I might use this command dialer pool-member 1 max-link 2 Do you think this is right? Thanx for your help :) Hoogen ... View more

I wouldn't want a permanent circuit, which like the channelized E1 would form. I need it to be dynamic and when i fires to that particular router it should fire only two channels. i could do a backup command after i configure the channelized E1 but any other solution? -Hoogen Thanx for the replies ... View more

I guess when you are talking about two servers having the same ip you are talking about the servers being clustered. So you don't have to worry about two servers having same ip. You just need your route inside command. Also i guess you would know for traffic moving from DMZ to inside you need a static nat and access-list to allow the traffic to flow. -Hoogen ... View more

That statement is not required, for traffic flowing from DMZ1 to DMZ2 you have already configured the nat statement and also the global statement, you don't need this statement. Is there anything else that is problematic do let us know. -Hoogen ... View more

ASA 5540 should do it for you. It depends on how you are grouping your servers and applying the policy. Two DMZ,s should do it. For the webserver communication you can't do much if they are going to be in the same segment. -Hoogen ... View more

Hi, The failover is only applicable to the ASA. For the IPS the configuration has to be replicated manually. IPS is always active. If traffic flows through it it will do the inspection. you could do the FTP part for the configuration. If you manage through CSM or VMS. You could possibly push same configuration to the IPS device and also tune signatures on both without having to do them seperately. omething to keep in mind. The 2 SSMs each need their own independant names and ip addresses. If you are using blocking/shunning then only one of the 2 SSMs can block/shun on the firewall. The rest of the configuration can be the same between the 2 sensors.Automatically copying the configuration on the secondary IPS is planned for the future according to Cisco. -Hoogen ... View more

Here you go access-list outside_int extended permit tcp host x.x.x.x host y.y.y.y eq 3389 access-group outside_int in interface OUTSIDE This is initiating a connection from the host x.x.x.x to the host y.y.y.y (from outside to inside). -Hoogen ... View more

I would say this should work. By default higher security to lower security level communication you only need your nat enabled. Nothing more. Only from lower to higher you need nat as well as access-list. Why have you used this statement nat (dmz1) 1 192.168.17.0 255.255.255.0 outside You could do without it. -Hoogen ... View more

I think it would be a NDA, but i guess i can say your numbers are at par. -Hoogen ... View more

Hi, Have a look at these websites. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_installation_and_configuration_guides_list.html Most of your information should be available here http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/tsd_products_support_series_home.html If you need more help do let us know how you want to set up your firewall. -Hoogen ... View more

Hi Gilles, Have I got it right atlast? Thanks, Hoogen ... View more

HI Gilles, Thanx a ton again. Well I am pretty new to this kind of deployment we stopped selling another kind of load balancer and started selling Cisco's recently. This is just my third deployment and the first one where i got a request from the customer that he needs his servers in the internal vlan to be load balanced. Now coming back to what i did, i thought that i needed to create a new ip that servers should talk to when talking to other servers in the same vlan. So what i did was that i created a client-group1 when server1 talks to the other servers 2,3 and 4 it talks to and a VIP address of 10.10.10.11. And if server 1,3,4 talks to server2 the VIP would be 10.10.10.12. Now as you have suggested my understanding is that I should be doing this way CS100(config)# group clients-group1 CS100(config-group[clients-group])# vip address 10.10.10.11 CS100(config-group[clients-group])# act acl 1 clause 46 permit any 10.10.10.0 255.255.255.0 destination any sourcegroup clients-group1 clause 99 permit any any destination any apply circuit-(VLAN10) In the above configuration if server 1(10.10.10.1) wants to talk to server 2,3,4 the VIP to contact would be 10.10.10.11 and also if server 2 (10.10.10.2) wants to talk to servers 1,3,4 it the VIP addr would be 10.10.10.11. Please correct me if my understanding is wrong. -Hoogen ... View more