Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Alexander Cousins
Alexander Cousins
Beginner
Hi there. I am trying to help out on a more regular basis in order to give a little back after many years of support.
Recent Badges
Stats
Member since
08-22-2006
26
Posts
10
Helpful
3
Solutions
05-12-2014
01:17 AM
The class-default command is there as an additional permit line. Since we are not looking to restrict any other management traffic. As it stands it will permit other management traffic like NTP and SNMP. Its probably best to be more specific and move these up to the permit line and block everything else but since this looks like a production node I put the safest not securest default in. HTH
... View more
05-09-2014
01:21 PM
Just spotted this may not work on your switch as control-plane functionality can be fairly limited.
... View more
05-09-2014
01:08 PM
Hi Darren What you are trying to achieve cannot be achieved in that way. You could apply an access list to all of the SVI blocking ssh but that not really clean either. I have achieved the above on a router by enabling control plane-policing and them permitting the packets to the required IP address through an access list reference in a class map. The configuration is shown below. ip access-list extended SSH-MGMT permit tcp any host 10.0.7.254 eq 22 class-map match-all SSH-MGMT match access-group name SSH-MGMT ip access-list extended SSH-NON-MGMT permit tcp any any eq 22 class-map match-any SSH-NON-MGMT match access-group name SSH-NON-MGMT policy-map SSH_PM class SSH-MGMT class SSH-NON-MGMT drop class class-default control-plane host service-policy input SSH_PM ___________________________________ Router#sh policy-map control-plane all Control Plane Host Service-policy input: SSH_PM Class-map: SSH-MGMT (match-all) 1487 packets, 120959 bytes 5 minute offered rate 0 bps Match: access-group name SSH-MGMT Class-map: SSH-NON-MGMT (match-any) 9 packets, 670 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: access-group name SSH-NON-MGMT 9 packets, 670 bytes 5 minute rate 0 bps drop Class-map: class-default (match-any) 128 packets, 35832 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any If this works for you please remember to rate the support and mark as solved. Lex
... View more
05-08-2014
02:56 PM
Hi Is eigrp running over the VPN? I would guess so. Sounds like either the VPN is getting stuck or eigrp is not detecting the loss of connection. Could even be an asymmetric routing issue. Try enabling "crypto isakmp keepalive 10 periodic" to monitor the ipsec session and reset it if failed. Also are both rremotes anchored on the same VPN tunnel at the core? Try setting up differing tunnels for each remote with different passwords. Hope that helps
... View more
05-08-2014
02:34 PM
Hi David I would suggest you contact either your local Cisco account manager or local Cisco reseller to run through the options. They have access to the resources which will most accurately and honestly allow you to apraise the value of there solutions and make the right decision. They may also be able to help identify the most economical purchasing route. Good luck with it.
... View more
05-08-2014
02:20 PM
No problem. I hope it has helped and if you think it has please take a second to rate my response or mark as answered. Good luck with it.
... View more
05-06-2014
11:08 PM
In that case the diagram at the top would really help as it does not appear to be working. Are you able to update the diagram?
... View more
05-06-2014
08:35 PM
Hi JohnPete Have you considered VM-FEX as an alternative to the 1000v? They are both based on the same technologies but the architecture of VM-FEX is such that it replicates the operation and configuration of a FEX module and more importantly is aligned with the architecture of vPC. HTH
... View more
05-06-2014
02:11 PM
That sounds like a much better plan. Also probably more resilient and leaves the responsibility for transport with the ISP where it belongs. Good luck with it.
... View more
05-06-2014
02:06 PM
Hi I did this accidently a while ago and the module worked but did not provide power. As with most things it's highly platform and software specific so no gaurentees. It may be worth just be getting the PSU module if you think you may need it at a later date. At which point raising a PO for just a PSU will be a pain. HTH
... View more
05-06-2014
01:55 PM
Hi tlockett This is a typical request from the server guys as it's simple for them and complex for you to sort safely. VPLS is not an option on the 2911 so that's out of the question. Do your 2911 have spare routed interfaces that you could use to connect using l2tpv3? If they do that Will be your simplest solution. However be aware that this is not a scalable. Also the performance when running l2tpv3 will take a hit as the router will have to encapsulate the frames, this is a problem at small packet sizes and not ideal. This may also be a limiting factor on the performance of any backup solution run over the connection. Worst case the volume of replication traffic could hammer the router and put it at risk. Before you do it check with the server guys how much bandwidth will be required under both normal and failed conditions and make sure the router has the capacity to deal with it. Meanwhile it may be an idea to encourage them to explore backup solutions that support L3 clustering, automation of gateway switching, possible some clever DNS solutions could help. Pretty much any solution other than l2tpv3. Sorry not to be more positive but at least you have options. HTH
... View more
05-06-2014
01:05 PM
This is possible using a tracked object. With a delay defined under the track object as shown below. IP SLA 1 Icmp-echo 3.3.3.3 Track 1 IP SLA 1 reachability Delay down 60 up 60 IP route 1.1.1.1 255.255.255.1 2.2.2.2 track 1 Apologies for the format I am on a mobile device. HTH
... View more
05-06-2014
12:24 AM
Hi bluezone 1 - Yes the set the default information originate on the 7204s. 2 - In the majority of cases the routers will use the default with the lowest composite metric to reach the closest gateway. Where a tie break exists my guess it that it would not load share but install the router to 7204B. If it did load share you could prevent this by setting maximum-paths to 1 under the OSPF process. Let us know how you get on. Lex
... View more
05-05-2014
03:58 PM
If the hosts on the ports that are not trunked off a FEX need to communicate with hosts on a FEX or vPC connection then yes i believe you need those VLANS on the Peer link as well. Only if you have isolated VLANS between would you go down the additional trunk route.
... View more
05-05-2014
11:21 AM
Excellent point Enrico inbound traffic will also be a challenge. A feasible although slightly complicated approach would be to tag the routes as they are redistributed (assuming they are connected subnets on each router) into ospf. This tag could be used to identify which routes have a prefered inbound route through either 7204A or 7204B. This would allow inbound and outbound traffic balancing to be performed in OSPF which i am assuming your are more comfortable with. The rough logic would be: On each router look at the ospf routing table. If the prefered default is from 7204 A set route tag 1 Redistribute connected subnets tag 1 If it is 7204 B then use route tag 2 Redistribute connected subnets tag 2 When redistributing from OSPF to BGP on 7204A use a route map to match tag 2 and prepend 3 dummy instance of your AS. This will ensure that these routes are not prefered via this router unless a failure occurs. The same configuration could also be used in mirrored configuration on 7204B. This would allow an almost identical inbound and outbound traffic paths under non failure conditions and also allow some balancing of traffic although it is a bit manual (so is BGP for that matter). HTH
... View more
05-04-2017
Hi PatriciaNot sure if its a temporary issue but the mail server is
rejecting inbound mails (from me...
05-12-2014
The class-default command is there as an additional permit line. Since
we are not looking to restric...
05-09-2014
Just spotted this may not work on your switch as control-plane
functionality can be fairly limited.
05-09-2014
Hi DarrenWhat you are trying to achieve cannot be achieved in that way.
You could apply an access li...
05-08-2014
Hi Is eigrp running over the VPN? I would guess so.Sounds like either
the VPN is getting stuck or ei...
05-08-2014
Hi DavidI would suggest you contact either your local Cisco account
manager or local Cisco reseller ...
05-08-2014
No problem. I hope it has helped and if you think it has please take a
second to rate my response or...
05-06-2014
In that case the diagram at the top would really help as it does not
appear to be working. Are you a...
05-06-2014
Hi JohnPeteHave you considered VM-FEX as an alternative to the 1000v?
They are both based on the sam...
05-06-2014
That sounds like a much better plan. Also probably more resilient and
leaves the responsibility for ...
05-06-2014
Hi I did this accidently a while ago and the module worked but did not
provide power. As with most t...
05-06-2014
Hi tlockettThis is a typical request from the server guys as it's simple
for them and complex for yo...
05-06-2014
This is possible using a tracked object. With a delay defined under the
track object as shown below....
05-06-2014
Hi bluezone1 - Yes the set the default information originate on the
7204s.2 - In the majority of cas...
Public Statistics
| Date Registered | 08-22-2006 11:26 PM |
| Date Last Visited | 10-09-2017 01:21 PM |
| Total Messages Posted | 26 |
| Total Helpful Votes Received | 10 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
