Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About nunnsby_2
nunnsby_2
Beginner
Currently studying towards CCIE R&S
Recent Badges
Stats
Member since
09-18-2009
11
Posts
5
Helpful
0
Solutions
Created by
nunnsby_2
in Unified Computing System Discussions
in Unified Computing System Discussions
01-23-2013
05:57 AM
01-23-2013
05:57 AM
Hi there, I can;t get the CIMC-Express component of the SRE to work. I have the followed the document here to the tee: http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/cimce/1.0/configuration/guide/CIMCe.html I have the SRE working and VMs installed and running on the Blade. I have the CIMC-E software installed and running on the Embedded Service Engine and can log into the webpage. So, the Second Core is UP and the Kernel is UP. The webpage gives an error of: "CIMC-E is not configured." This corresponds to the actual confirmation command on the CIMC of: se-192-168-1-14 /router # show hardware Could not communicate with the router. Please ensure WSMA is configured correctly by running the following commands: scope cimce set username <username> set password <password> set url <url> To see your current configuration, run: scope cimce show config se-192-168-1-14 /router # The router has wsma set up and the username is the same on both the router and the CIMCE. The above commands have been configured, yet it still is not working. Any ideas? Is this a bug? Regards
... View more
Labels:
Created by
nunnsby_2
in Server Networking
in Server Networking
09-06-2012
07:41 AM
09-06-2012
07:41 AM
I have a 910 SRE with UCS Express running on it. We recently imported it into the Corporate vCenter and I am getting a weird error everytime we try and Console to a VM on the SRE via the vSphere client. We get the same error when using the vSphere client from vCenter and connected directly via the IP Address/Hostname. The Error is: Unable to connect to the MKS: Failed to connect to server ctucssre01:902. I can confirm the IP and Server Name is in DNS, and the DNS lookup is working. The Hostname on the Module is correct too. The ports are open and a scan of the ports, including 902 shows it responding and active. If I look at the Security Profile settings of the Host, all ports are open and 902 is open. I have bounced/reloaded the module and still nothing. I even rebuilt the entire SRE, it is currently a test-lab unit. So, as it stands, I CAN see the host and the VMs in the vShere client. I CAN create VMs etc. I CAN see all the stats etc. But, ... I CANNOT CONSOLE to the VM through the vSphere console. Any thoughts?
... View more
Labels:
02-08-2012
11:58 AM
Hi all, busy building a lab environment at work using a 3745 with a NM-16AM and hoping to use it as a Console Terminal Server to access other routers on their Console ports. I am struggling to get this working, and spefically require help with the following: CABLING: RJ11 (4-wire) (modem port) to RJ45 (8-wire) (console port) I am not entirely sure of the "pinouts" for the wiring. I have searched the net and can mainly only find RJ45 to DB9 pinouts. It is driving me nuts. I am not great at "serial" technologies, so hence the issues. CONFIGS: As long as this is configured like a normal terminal server's "lines", and I am hoping it is, then I have the following, which should by all accounts be correct: ! line 97 - 112 for the modems appears in the configs ! int loop0 ip addr 172.16.0.1 255.255.255.255 ! ip host router1 2097 172.16.0.1 ! line 97 no exec transport input telnet ! I obviously am not getting any feedback from the remote console, so the issue is definitely pointing to cabling, as I do get the following when I connect to the host: Trying router1 (172.16.0.1, 2097)... Open but nothing further, which leads me to believe the config is right, but the cabling is not. Any assistance would be greatly appreciated, as this is seriously doing my head in. I am thinking mainly 2 things: 1) Cable wiring and pin-outs. What should they be? RJ11: 1,2,3,4 to RJ45: ?,?,?,? 2) Flow-control as I am only using 4 of the 8 provided wires on the console. Should it be enabled? If so, where? Any other hardware specific commands for this? Also, must anything else be configured on the remote router too, on the console port or the AUX port if that is used? Surely telnet is allowed by default, so it should see that without issues. Regards Richard
... View more
Labels:
Created by
nunnsby_2
in VPN and AnyConnect
in VPN and AnyConnect
10-31-2011
06:41 AM
10-31-2011
06:41 AM
Thanks Marcin, that's good enough for me. I'll play around with the configs on the 2801s I have and use those instead of the 1921 for now. Much appreciated for your help. Regards
... View more
Created by
nunnsby_2
in VPN and AnyConnect
in VPN and AnyConnect
10-31-2011
03:51 AM
10-31-2011
03:51 AM
Hi Marcin Thanks for the prompt response. Hmmmm, after having read so many posts about various technologies, I must admit that it appears I am getting confused, or have gotten confused with WebVPN, ASA, IOS, and SSL. Can you please confirm for me the following then: SSL-VPN - 10 user "free" license available with HSEC 18xx/28xx/... routers. (includes Web-VPN) 2 Free SSL-VPN licenses with the ASA range. - Obviously I have gotten confused with this. IPSec by default with a Sec-k( 19xx/29xx/etc 15.x IOS router. Is IPSec compatible with the AnyConnect client? Meaning can I configure the 1921 I have to provide EasyVPN to a AnyConnect client? I think it is SSL VPN only right? SSL for the rest fo the platforms, or those not explicitly mentioned here must be purchased. Regards
... View more
Created by
nunnsby_2
in VPN and AnyConnect
in VPN and AnyConnect
10-31-2011
01:46 AM
10-31-2011
01:46 AM
Hi There Struggling to enable the "free" 2 user SSL-VPN tunnel on the a 1921 Sec-K9 with IOS 15.1(3)T. Using CCP to do the SSL VPN, and under SSL VPN Manager config and it keeps: "Feature License (SSL_VPN) assocaiated with this feature is not deployed on the device. You may be able to configure this device, but the configuration will not be effective until the license is installed. Use the link below to install the license." I follow the link but I cannot enable any of the licenses. Also it shows 5000 user licenses and 1400+ days for valid periods. I have NOT downloaded any SSL licenses, as I am hoping the use the so called 2 free user licenses, purely for admin, that are apparently bundled in the IOS. I am hoping to configure either WebVPN, or use the device purely for AnyConnect connectivity for admin and remote support, hence do NOT want to purchase an expensive 10-user license bundle. Am I confused here? Must I go download a license for this device? Any help appreciated. Regards
... View more
Labels:
Created by
nunnsby_2
in Application Networking
in Application Networking
10-25-2011
06:54 AM
10-25-2011
06:54 AM
Ahhh, ok, that makes perfect sense now. That is pretty much what I was seeing, and was hoping to "hack" around it with configs. I have learnt more about how you can configure an ACE in the last week :), with numerous different solutions but nothing that was working because of the SSL-PROXY requirement. Thanks for your time and explanation. Much appreciated. Regards
... View more
Created by
nunnsby_2
in Application Networking
in Application Networking
10-24-2011
01:45 PM
10-24-2011
01:45 PM
Hi Surya Thanks for the prompt reply. I'm not quite sure what you mean when you say it ca only handle 2 certs. Can you elaborate please? It would appear to me that you can actually only bind one cert to an IP, based on using a VIP address for the server farm as per the CM in the PM. I can hack out the irrelevant bits tomorrow and post what I have done thus far. I have played with multiple lines of code and various ways of trying to do this, but the end result is that it appears once I have the CM set per VIP I can only set one SSL-Proxy, and so only one cert. If I use multiple CMs, as per the MultiMatch policy, it matches the first CM against the VIP and doesn't appear to move on as per the HTTP Header. If any of that makes sense? regards Sent from Cisco Technical Support iPad App
... View more
Created by
nunnsby_2
in Application Networking
in Application Networking
10-24-2011
11:03 AM
10-24-2011
11:03 AM
Hi There I have an interesting situation that I am trying to solve. I have 4 websites, each one with SSL Off-Loading on the ACE on the outside. All FOUR websites run on a single server on the inside, but each website is using a different port number for differentiation. Also, they are currently only available on TWO IPs on the outside! I know.....it's a mare! So, RSERVER = SERVER = 192.168.0.1 Each website has SSL Certs on the outside. https://website1.abc.com - https://website4.abc.com But, DNS is only bound to 2 IPs on the outside, as that is all we have available currently, until we free up more IPs. OUTSIDE: website1.abc.com = 172.16.0.1:443 website2.abc.com = 172.16.0.1:443 website3.abc.com = 172.16.0.2:443 website4.abc.com = 172.16.0.2:443 On the server we have: I NSIDE: 192.168.0.1 SERVER:8001 = website1.abc.com SERVER:8002 = website2.abc.com SERVER:8003 = website3.abc.com SERVER:8004 = website4.abc.com So, in a nutshell what I need to do is: Terminate SSL for each website, then match the HTTP header, and pass it to the SERVER on the right port. Sounds easy enough. But, I am struggling like hell. The VIPs (Wirtual IPs on the OUTSIDE are causing me grief) My steps seem to be breaking my ruleset. Individually they all work, but once I tie them to the VIPs on the outside, it seems to stop. The first site in each CM (class-map) match in the PM (Profile-Map) works but the subsequent site just breaks. I would post my config, but right now I have sooooooooooooo many variations, it looks like a dog's breakfast. Can anyone give advice on the process flow to follow to get this to work. My issue is arround the VIPs mainly. To be honest, I don't really care about Load-Balancing right now. That will come later when more servers are added to mix. And then we might have to do inbound NAT too to the Server Farm, but that can wait! :-o I have created a HEADER map for the headers, individual SERVER FARMS for each port on the RSERVER, ACLs matching the VIPs inbound on 443, CLASS-MAPs matching the HEADER and applying to SFARM, POLICY MAPS matching the CMAPs and doing Load-Balancing with SSL-PROXYs for the SSL headers. SERVICE-POLICY tieing it all together on Interface. But .... things are going hey-wire. So, steps are: RSERVER SFARMs = RSERVER:PORTs ACLs = VIPs CMAP = HEADER = URL LB PMAP = HEADER CMAP & SFARM PMAP MULITM = ACL CMAP + LB PMAP & SSL-Proxy SVC-POL = PMAP MULTIM
... View more
Labels:
03-17-2011
05:21 AM
Thanks Marco, Right Answer! I had missed an idle-timeout 0 setting, and the ICMP was not seen as interesting traffic, so was tearing down the link. Many thanks for your help. Regards
... View more
03-15-2011
06:17 AM
Hi There Having problems with the HWIC-3G-HSPA-G cards and crypto tunnels. We have recently ordered the new HWIC-3G-HSPA-G cards and are suddenly seeing some very weird things across these cards, specifically wrt crypto and the card resetting constantly. We are based in South Africa, using Vodacom as a Service Provider. The cards are running on both 2801's and new 1921's. The IOS version has been changed to the latest version, 15.1(3)T on all devices. The HWIC-3G-HSPA-G card has been upgraded to Firmware: K2_0_7_19AP. We are using ip nhrp with a Tunnel config for the Crypto config. We have a number of existing devices all 2801's with the older HWIC-3G-GSM cards, and they are working fine. Once the Tunnel is up on the GSM card, the link will stay up indefinitely. A simple 5000 repeat ping to the head end tunnel is 100% successful. No problems at all. However, running the HWIC-3G-HSPA-G card, the tunnel comes up, but will periodically reset. I am seeing the following errors in the logs: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! *Mar 15 19:39:02.587: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down *Mar 15 19:39:02.591: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is OFF. *Mar 15 19:39:04.591: %LINK-5-CHANGED: Interface Cellular0/3/0, changed state to reset... *Mar 15 19:39:09.591: %LINK-3-UPDOWN: Interface Cellular0/3/0, changed state to down...... *Mar 15 19:39:22.603: %LINK-3-UPDOWN: Interface Cellular0/3/0, changed state to up.. *Mar 15 19:39:25.315: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON... *Mar 15 19:39:32.599: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up.!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! This happens sporadically, for no reason. There is no issue on the head-end or anything else. I can however ping an Internet Address just fine 100%. so it is purely a Crypto Problem with respect to the operation on the Card, and this same thing happens across multiple platforms running that card. It appears the Tunnel breaks, then the Crypto gets torn down, not specifically the other way around. Any ideas? Any debugs I can do to troubleshoot the cause of the issue. Regards
... View more
Labels:
Created by
nunnsby_2
in Unified Computing System Discussions
01-23-2013
01-23-2013
Hi there, I can;t get the CIMC-Express component of the SRE to work. I
have the followed the documen...
Created by
nunnsby_2
in Server Networking
09-06-2012
09-06-2012
I have a 910 SRE with UCS Express running on it. We recently imported it
into the Corporate vCenter ...
02-08-2012
Hi all, busy building a lab environment at work using a 3745 with a
NM-16AM and hoping to use it as ...
10-31-2011
Thanks Marcin, that's good enough for me. I'll play around with the
configs on the 2801s I have and ...
10-31-2011
Hi MarcinThanks for the prompt response. Hmmmm, after having read so
many posts about various techno...
10-31-2011
Hi ThereStruggling to enable the "free" 2 user SSL-VPN tunnel on the a
1921 Sec-K9 with IOS 15.1(3)T...
Created by
nunnsby_2
in Application Networking
10-25-2011
10-25-2011
Ahhh, ok, that makes perfect sense now. That is pretty much what I was
seeing, and was hoping to "ha...
Created by
nunnsby_2
in Application Networking
10-24-2011
10-24-2011
Hi SuryaThanks for the prompt reply. I'm not quite sure what you mean
when you say it ca only handle...
Created by
nunnsby_2
in Application Networking
10-24-2011
10-24-2011
Hi ThereI have an interesting situation that I am trying to solve. I
have 4 websites, each one with ...
03-17-2011
Thanks Marco,Right Answer! I had missed an idle-timeout 0 setting, and
the ICMP was not seen as inte...
Public Statistics
| Date Registered | 09-18-2009 03:50 AM |
| Date Last Visited | 08-18-2017 03:54 AM |
| Total Messages Posted | 11 |
| Total Helpful Votes Received | 5 |
