I have a pair of older 6506E chassis with a VSS-720 configuration.  The VSS 720 uses a pair of ISLs that are 10G singlemode fiber links between the two chassis to provide the control plane link.  Do the new 9600s use the same type of connections for the control plane link or is there some new type of stacking cable that must be used?  The older VSS 720 configuration only supported two chassis for VSS.  Do you know if the newer chassis ( assuming they are using stackwise ) can be configured with more than two chassis?  For example, could I have three 9600R chassis operating under a common control plane?   Thanks!     ... View more

Config provided. Here's a twist: From the CLI on the 2911, if I ping an address that is on the far side fo the tunnel, I get no response.  If I traceroute to the same address, it reveals that the traffic is not entering the tunnel and is being sent directly to the outside interface (internet).  If I issue the ping command, and specify the source address as the inside address of the 2911, it gets a response.  If I issue the traceroute and specify the source address as the inside address of the 2911, it also completes and reveals that it goes through the tunnel.  My problem is that the 2911 router needs to be able to communicate with a radius server that is on the far side of the tunnel, but by default the traffic from the 2911 to the radius server is going to the outside internet interface instead of through the IPSec tunnel. ... View more

Config follows: hw-module sm 1 ! redundancy ! ip ssh version 2 ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp key ***** address 46.21.190.93 ! crypto isakmp client configuration group IPSecTunnel1 key ***** dns 46.21.190.93 domain vlrna.vlrad.loc ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set T-Set ah-sha-hmac esp-aes 256 ! crypto ipsec profile Tunnel1 set security-association lifetime seconds 3600 ! crypto dynamic-map Tunnel1 1 set transform-set T-Set reverse-route ! crypto map SDM_CMAP_1 1 ipsec-isakmp description Tunnel to46.21.190.93 set peer 46.21.190.93 set transform-set ESP-3DES-SHA match address 100 ! crypto map Tunnel1 client configuration address respond crypto map Tunnel1 1 ipsec-isakmp set peer 46.21.190.93 set transform-set T-Set match address Tunnel1 crypto map Tunnel1 2 ipsec-isakmp set peer 46.21.190.93 set transform-set T-Set match address Tunnel1 ! crypto map crypto-map-1 isakmp authorization list IPSecTunnel1 ! interface Embedded-Service-Engine0/0 no ip address ! interface GigabitEthernet0/1 description $ETH-LAN$ ip address 99.50.50.222 255.255.255.240 duplex auto speed auto crypto map SDM_CMAP_1 ! interface GigabitEthernet1/0 description $ETH-LAN$$SWDMADDR:10.10.144.2:80$ ip address 10.10.144.1 255.255.255.0 ip helper-address 10.6.24.93 ! interface GigabitEthernet1/1 description Internal switch interface connected to EtherSwitch Service Module no ip address ! ip http access-class 23 ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip route 0.0.0.0 0.0.0.0 99.50.50.209 ip route 10.10.144.0 255.255.255.0 GigabitEthernet1/0 ! ip access-list extended Tunnel1 permit ip 10.10.144.0 0.0.0.255 any permit ip 10.10.144.0 0.0.0.255 172.30.52.0 0.0.0.255 ip access-list extended Tunnel1end ! access-list 23 permit 10.6.0.0 0.0.255.255 access-list 100 remark IPSec Rule access-list 100 permit ip 10.10.144.0 0.0.0.255 10.0.0.0 0.255.255.255 ! control-plane ! ... View more

I was not able to ping the ISP gateway from another device on the outside VLAN.  Turned out that the ISP's router was configured not to respond to ICMP.  It is working now. Thanks! ... View more

License is a Security+ license Here's the config: ASA Version 8.2(2) ! hostname ciscoasa domain-name v****.v****.l** enable password ***** encrypted passwd ***** encrypted names name 10.0.0.0 IntraNet1 name 172.30.52.0 IntraNet2 ! interface Vlan1 nameif inside security-level 100 ip address 10.25.40.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 98.103.56.215 255.255.255.240 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 switchport access vlan 2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! ftp mode passive dns server-group DefaultDNS domain-name vlrna.vlrad.loc same-security-traffic permit inter-interface same-security-traffic permit intra-interface object-group network DM_INLINE_NETWORK_1 network-object IntraNet1 255.0.0.0 network-object IntraNet2 255.255.255.0 object-group network DM_INLINE_NETWORK_2 network-object IntraNet1 255.0.0.0 network-object IntraNet2 255.255.255.0 object-group service DM_INLINE_SERVICE_1 service-object icmp service-object icmp echo service-object icmp echo-reply access-list outside_cryptomap extended permit ip 10.25.40.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 access-list inside_nat0_outbound extended permit ip 10.25.40.0 255.255.255.0 object-group DM_INLINE_NETWORK_2 access-list icmp-allow extended permit object-group DM_INLINE_SERVICE_1 any any access-list outside_access_in extended permit icmp any any pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside icmp permit any outside asdm location IntraNet1 255.0.0.0 inside asdm location IntraNet2 255.255.255.0 inside no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 10.25.40.0 255.255.255.0 access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 98.103.56.209 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL aaa authentication serial console LOCAL http server enable http 10.32.128.0 255.255.255.0 inside http Vallourec-IntraNet 255.0.0.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set T-Set esp-aes-256 esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map outside_map0 1 match address outside_cryptomap crypto map outside_map0 1 set peer 12.33.192.93 crypto map outside_map0 1 set transform-set T-Set crypto map outside_map0 interface outside crypto isakmp identity address crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption aes hash md5 group 2 lifetime 86400 crypto isakmp policy 20 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet timeout 5 ssh IntraNet1 255.0.0.0 inside ssh timeout 5 console timeout 0 management-access inside dhcpd auto_config outside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username administrator password ******** encrypted privilege 15 username administrator attributes service-type admin tunnel-group 12.33.192.93 type ipsec-l2l tunnel-group 12.33.192.93 ipsec-attributes pre-shared-key ******* isakmp keepalive disable ! ! prompt hostname context call-home profile CiscoTAC-1   no active   destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService   destination address email callhome@cisco.com   destination transport-method http   subscribe-to-alert-group diagnostic   subscribe-to-alert-group environment   subscribe-to-alert-group inventory periodic monthly   subscribe-to-alert-group configuration periodic monthly   subscribe-to-alert-group telemetry periodic daily Cryptochecksum:c25208157555d6b43dac7797e1b0ea5c : end ... View more