We have two phones, A and B  each with a shared line, in this case lets say its extension 100. Phone A has one line which is extension 100 and phone B has two lines, extension 100 and 200. Phone A has BLF for all phones in the Branch, it has a BLF for extension 200 on phone B. If Phone B picks up a call that comes in on 100 because phone A was unable to take the call, Phone A's BLF doesn't show that Phone B's line is busy (because they are on extension 100 not 200 which the BLF is setup for) I want for Phone A to have a BLF that monitors the other phones in the office status regardless of the line the other phones are using. How can I accomplish this in CUCM? ... View more

I am not familier with the Policy's of ARIN as it pertians to the use of VLSM. If an organization is issued an allocation range, lets just say its a small allocation of /24, are you allowed to multihome the advertisement of that /24 out of two locations using different subnet mask? Like a /25 or smaller?  ... View more

I have a Business unit that publishes an application that is externally available. We Reverse Proxy the VIP to allow the connection externally. They would like to impose different application timeouts for internal users (1 hour) and external users (30 Minutes) . The application can not differentiate between an external or internal source so our option is either seperate serverfarms with seperate real servers with different configuration files. My question is, is there any other way to do this within the ACE so that we don't have to spin up seperate Servers with different configuration files. I would also like  to maintain one VIP address if possible. ... View more

Could someone provide a good example of how to tag external EIGRP routes coming from a specific neighbor when using Nexus? We have ASAs performing Reverse Route Injection and redistribution into EIGRP. ASAs do not support route tagging for EIGRP Redistribution. I want to be able to tag those RRI routes which will show up in the EIGRP AS as External Routes. I am not clear how to do this on the Nexus since EIGRP is configured differently ... View more

We have a 3900 series G2 running 15.0(1)M4. It seems there are alot of differences with the 15.0 code. I was intrigued by the ability to do a port-channel on the router instead of having to use something like HSRP or GLBP for HA.  The router is going to be a sip gateway only so I wanted to give it dual links to our core switches for extra protection. I configured the device in the following way and to my surprise it works fine. Whats scary is I would think this would cause a loop because I did not have a port-channel configured on the other side and on the router if I do a show etherchanel summary nothing is present.  Any ideas? show run | beg interface ! interface Port-channel1 ip address 10.1.210.15 255.255.255.0 hold-queue 150 in ! interface GigabitEthernet0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/1 no ip address duplex auto speed auto channel-group 1 ! interface GigabitEthernet0/2 no ip address duplex auto speed auto channel-group 1 ! show etherchannel summary Flags:  D - down        P - in port-channel         I - stand-alone s - suspended         R - Layer3      S - Layer2         U - in use Group Port-channel  Ports -----+------------+----------------------------------------------------------- CORP_SIP_01# CORP_SIP_01#show ip int brief Interface                  IP-Address      OK? Method Status                Protocol GigabitEthernet0/0         unassigned      YES manual down                  down    GigabitEthernet0/1         unassigned      YES NVRAM  up                    up      GigabitEthernet0/2         unassigned      YES NVRAM  up                    up      Loopback0                  unassigned      YES unset  up                    up      Port-channel1              10.1.210.15     YES manual up                    up     ... View more

Would it be possible to perform 2 factor authentication in such a way as to require only a certificate but also verify the user is a member of a group within Active Directory? The goal being for the user to still have to enter nothing for a username and password since anyconnect will look at the user certificate store but in the background also check the username for a permitted group within Active directory. ... View more

I know this has been asked in a few different ways but I need to clarify the user experience under the following configuration My ASA uses ACS4.2 as a radius server and it also provides downloaded ACLs depending on the users group within LDAP Our Security department would like to implement two factor using RSA. The desired result would be to maintain the functionality of ACS and the Downloadable ACLs but use RSA secureID as another authentication source. What I am unclear of is what the user experience would be. If I was to setup Secureid / RSA server as an external Database within ACS and ASA using ACS as the Radius server.  When the client views the anyconnect window will they put LDAP username and password in click connect and then wait for some other challenge? Currently using ASA 8.3 Anyconnect 2.5.017 ACS 4.2 ... View more

    Hello all, I am trying to use a cisco 800 series router to configure two seperate vlans for a teleworker. One vlan will be the Corporate network and the other vlan will be the home network. I have SVIs setup for each network. Nat statements on the Home network SVI for inside and NAT outside on the outside interface that will use DHCP from DSL or cable modem. On the Corporate SVI I have the crypto ezvpn inside statement and on the same Outside interface I have the crypto ezvpn outside statement.. The VPN connects fine but it is trying to NAT my home network through the tunnel. Is there a way I can split the use of the outside interface so home traffic simply gets Patted to the dhcp given address and any traffic on the Corporate vlan goes over the ezvpn tunnel? Thanks ... View more