Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Ian Underwood
Ian Underwood
Beginner
Cisco-certified network engineer with substantial LAN/WAN experience in service provider and enterprise environments. Substantial experience in TDM connectivity and metro Ethernet networks. Interested in design and support of multi-site networks of any size.
Active Certifications: CCNA / CCNP
Specialties: IP Routing & Switching in a Cisco environment with a focus on routing protocols (OSPF / ISIS / EIGRP / BGP), IP Multicast design, Visio documentation, Infinera DWDM.
Network monitoring w/ SolarWinds Orion series, Splunk 4.3+
Secondary basic expertise with *nix operating systems (RHEL, FreeBSD) and VMWare ESXi 5-6.
I am primarily interested in complex enterprise routing & switching environments for single clients and their partner organizations.
Cisco-certified network engineer with substantial LAN/WAN experience in service provider and enterprise environments. Substantial experience in TDM connectivity and metro Ethernet networks. Interested in design and support of multi-site networks of any size.
Active Certifications: CCNA / CCNP
Specialties: IP Routing & Switching in a Cisco environment with
Recent Badges
Stats
Member since
08-09-2012
17
Posts
0
Helpful
1
Solution
10-02-2019
01:21 PM
Here is an interesting scenario: I have a set of IPTV multicast sources on an SVI (172.28.40.0/24), and due to some future planning I am looking to move those into another address range (10.2.13.0/24). I also have an unused ISR 3945 which connects to both of these networks. What I would like to do is configure NAT between these networks so I can move from an IGMP join (S,G: 172.28.40.11, 239.28.40.15) to the new target range (S,G: 10.2.13.11, 239.28.40.15). I have read the following: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book/iadnat-multicast-dynamic.html, but I need to use SSM. I have tried placing 10.2.13.0/24 as ip nat outside, and 172.28.40.0/24 as ip nat inside and done some static translations. These seem to work for unicast traffic. My suspicion is that this is not a supported scenario, but I figured I would ask the group.
... View more
Labels:
Created by
Ian Underwood
in Switching
in Switching
10-09-2018
08:08 AM
10-09-2018
08:08 AM
I can use the MAC OUI for detection, but it wasn't among the things I was looking to do, especially since MAC list is bound to grow over time. I'd rather use LLDP inputs as something better-determined. I was hoping it would be possible to either augment or find some other way of adding specific items to the device classifier through the config. It is what it is, I suppose.
... View more
10-08-2018
06:55 AM
My organization is deploying some new 9407 switches for campus access, and one feature I've been looking at is using auto smart ports to set the ports for different settings, depending on what gets plugged in.
One of my challenges is that we are using a non-Cisco vendor for desktop switches that a user may have at their desk. While I can do detection based upon the MAC address, I'd much rather take advantage of LLDP as a more reliable means of detection, especially if the use of these small switches extends beyond the pilot.
I came across a document, "Auto Smartport with Custom Trigger", which led me to find the dc_default_profiles.txt. This looks like the file I would need to either modify or augment in order to use this kind of detection. Unfortunately, there is no clear documentation on how the file is structured, or how it can be updated / replaced.
Of course, the header contains this:
# ------------------------------------------------------------------
# Profile, Rules and check definition for the IOS rule engine
# Copyright (c) 2010-2013, 2017 by Cisco Systems, Inc.
# All rights reserved.
# **** THIS FILE IS AUTO-GENERATED FROM XML FILE - DO NOT EDIT *****
# ------------------------------------------------------------------
It appears there are a few sections:
Count of OUI vendor strings
Lines of OUI vendors, 1 per line.
Count of OUI hash entries
Lines of OUI hashes. 2 lines. hash, then vendor in list above.
Count of Checks
Lines of checks, which have this format: attr_type,id,attr_tag,operation,val_type,val
Then Rules
And a list of rules: # rule_term format: term_type, {attr_type, id}, op ...
Now here's my problem. There is no documentation to either add to, augment, or whatnot. Since authentication is not required on a per-port basis, it doesn't seem sensible to deploy something like ISE.
Does anyone have suggestions?
... View more
Labels:
Created by
Ian Underwood
in Switching
in Switching
07-24-2018
06:12 PM
07-24-2018
06:12 PM
After some rethinking, I managed to get this routing scenario working. My suspicion why this was not working is due to the VRF only having one actual interface present in its routing table.
As such, I moved the translation into the global table and changed NAT to the following:
All interior interfaces on the global table to "ip nat inside"
VASILeft800 as "ip nat outside"
Removed NAT from VASIRight800 and the exterior interface
ip nat inside source static 10.40.100.56 100.96.2.2
ip nat outside source static 172.30.0.100 100.96.1.4 add-route
Since these translations are done in and with interfaces in the global table, I could run into a pickle if I get two peers with colliding space.
It does work:
RT1#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
--- --- --- 100.96.1.4 172.30.0.100
--- 100.96.2.2 10.40.100.56 --- ---
icmp 100.96.2.2:10105 10.40.100.56:10105 100.96.1.4:10105 172.30.0.100:10105
Total number of translations: 3
The flows look good:
IPV4 SRC ADDR IPV4 DST ADDR INTF INPUT IP TOS IP PROT intf output
=============== =============== ==================== ====== ======= ====================
10.40.100.56 100.96.1.4 Te0/1/2 0x00 1 vl899
100.96.2.2 172.30.0.100 Te0/1/2 0x00 1 vl899
100.96.2.2 172.30.0.100 vr899 0x00 1 Te0/1/0.85
This part at least works. The next test is to see if I dedicate a VRF for a NAT containing a pair of VASI interfaces if something similar can be done.
... View more
Created by
Ian Underwood
in Switching
in Switching
04-20-2018
01:27 PM
04-20-2018
01:27 PM
Here is an interesting scenario for consideration:
I have an enterprise, "A", which intends to form a VPN to share data with remote partner, "B". Both A and B are using network space that overlaps, and for reasons beyond my control, the partner is not able to perform any translation.
A is using an ASR-1001-HX at its headend and is terminating a number of VPNs today through different providers successfully. This, however, is the first link which requires any kind of translation.
The network which overlaps is 172.30.0.0 /24. The intent is to use some CGN space to perform double translation. 100.96.2.0/28 is what the remote partner should see. 100.96.1.4/30 is what the enterprise will see.
Here's what has been done that is about 3/4 working:
Interface VASILeft800 is created on the global table.
Interface VASIRight800 is created on a dedicated IVRF for this customer (TEST-IVRF).
The exterior interface, Te0/1/0 is configured for "ip nat inside"
The interior interface, VASI800 is configured for "ip nat outside"
The NAT positions are deliberately reversed, because it makes it possible for me to overload on the NAT outbound if necessary.
The encryption domain is 100.96.2.0/28 to 172.30.0.0 /34.
Loopback800 in TEST-IVRF is configured for 100.96.2.0/32. This loopback is pingable by the remote site.
NAT: ip nat outside source static 10.40.100.56 100.96.2.1 vrf TEST-IVRF ip nat inside source static 172.30.0.100 100.96.1.4 vrf TEST-IVRF
TEST-IVRF has a default route to VASILeft.
100.96.1.4/30 has a static route to VASIRight.
Here is where it gets weird. From the host at 10.40.100.56, I can start pings to 10.96.1.4.
PING 100.96.1.4 (100.96.1.4) 56(84) bytes of data.
^C
--- 100.96.1.4 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms
The remote host shows the pings come in:
16:18:50.185517 IP 100.96.2.1 > 172.30.0.100: ICMP echo request, id 31911, seq 1, length 64
16:18:50.185543 IP 172.30.0.100 > 100.96.2.1: ICMP echo reply, id 31911, seq 1, length 64
16:18:51.185195 IP 100.96.2.1 > 172.30.0.100: ICMP echo request, id 31911, seq 2, length 64
16:18:51.185213 IP 172.30.0.100 > 100.96.2.1: ICMP echo reply, id 31911, seq 2, length 64
16:18:52.185425 IP 100.96.2.1 > 172.30.0.100: ICMP echo request, id 31911, seq 3, length 64
16:18:52.185450 IP 172.30.0.100 > 100.96.2.1: ICMP echo reply, id 31911, seq 3, length 64
But, in netflow, it shows the return traffic never gets translated back:
IPV4 SRC ADDR IPV4 DST ADDR INTF INPUT IP TOS IP PROT intf output
=============== =============== ==================== ====== ======= ====================
172.30.0.100 100.96.2.1 Te0/1/0.85 0x00 1 vr899
172.30.0.100 100.96.2.1 vl899 0x00 1 Null
10.40.100.56 100.96.1.4 Te0/1/2.51 0x00 1 vl899
10.40.100.56 100.96.1.4 vr899 0x00 1 Te0/1/0.85
But the table is good and the logs show the translations being created / destroyed:
Apr 20 16:20:30.488 EDT: %IOSXE-6-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:072 TS:00001226747561746586 %NAT-6-LOG_TRANSLATION: Created Translation ICMP 172.30.0.100:1021 100.96.1.4:1021 100.96.2.1:1021 10.40.100.56:1021 9
...
Apr 20 16:25:49.984 EDT: %IOSXE-6-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:141 TS:00001227067073551404 %NAT-6-LOG_TRANSLATION: Deleted Translation ICMP 172.30.0.100:1021 100.96.1.4:1021 100.96.2.1:1021 10.40.100.56:1021 9
I have no idea why the traffic that comes in does not get translated after it's decrypted. Once this is figured out, then I have a solution where I can handle translation for any given chaos on the IVRF all by itself.
Does anyone have any ideas?
... View more
Labels:
Created by
Ian Underwood
in VPN and AnyConnect
in VPN and AnyConnect
11-07-2017
09:26 AM
11-07-2017
09:26 AM
VTI sounds nice, except I don't have administrative control of the remote endpoints and there is a wide spread of expertise between the remote vendors and partners.
My current thought is to shrink the network I'm using and create separate /29s on additional subinterfaces and apply the crypto maps and redundancy groups that way. It just aggravates me because instead of using one additional IP, I have to use 8. (or 3 if I were to use an additional router.)
... View more
Created by
Ian Underwood
in VPN and AnyConnect
in VPN and AnyConnect
11-06-2017
12:36 PM
11-06-2017
12:36 PM
The chief requirement is redundancy in an event of a failure.
The separate addressing is to support multiple business units, leaving the capability to move the tunnels to another router pair without having to go through and renumber all the remote endpoints. That's why I want to use multiple redundancy groups and crypto maps.
... View more
Created by
Ian Underwood
in VPN and AnyConnect
in VPN and AnyConnect
11-03-2017
12:22 PM
11-03-2017
12:22 PM
Here's an interesting problem.
I am attempting to land multiple L2L IPSec tunnels on an ASR-1001-HX, but with multiple endpoint addresses on my side. At first glance, this looks like it should be doable with multiple HSRP redundancy groups. However, it seems like I can only apply a single crypto map onto a given interface.
Here's what my interface configuration looks like (IPs changed, of course):
interface TenGigabitEthernet0/1/0
no ip address
load-interval 30
!
interface TenGigabitEthernet0/1/0.95
description EXTERNAL
encapsulation dot1Q 95
vrf forwarding EXTERNAL
ip address 192.0.1.68 255.255.255.224
ip access-group ACL-EXTERNAL-IN in
standby version 2
standby 2 ip 192.0.1.70
standby 2 priority 150
standby 2 preempt delay minimum 15 reload 120
standby 2 name STBY-VPNA
standby 2 track 1 decrement 60
standby 2 track 2 decrement 60
standby 3 ip 192.0.1.71
standby 3 priority 150
standby 3 preempt delay minimum 15 reload 120
standby 3 name STBY-VPNB
standby 3 track 1 decrement 60
standby 3 track 3 decrement 60
standby 4 ip 192.0.1.72
standby 4 priority 150
standby 4 preempt delay minimum 15 reload 120
standby 4 name STBY-VPNC
standby 4 track 1 decrement 60
standby 4 track 4 decrement 60
crypto map CRYPTO-VPNB redundancy STBY-VPNB
end
So it looks like it's not possible to add multiple crypto maps, even with different redundancy groups.
My best guess is that the only way I'm going to be able to achieve the separation I am looking for is to carve out multiple /29s and run a single VPN on each, which is a huge waste of resources. However, I figured the community would be the best place to run this by.
... View more
- Tags:
- l2l
Labels:
10-19-2017
07:11 AM
Jon,
The suggestion to use an address range not related to the local inside subnet was the correct answer. I routed an unused subnet on the inside network to the router.
I combed through the lab environment this morning, and noticed I fat-fingered a route on the external side of the lab, which I fixed. Rookie mistake, and easy to overlook. Of course, the traffic would have never returned.
The final relevant snips of the config look like this:
GW1#sh run | i nat
ip nat outside
ip nat inside
ip nat translation timeout 180
ip nat pool POOL 192.168.225.130 192.168.225.135 prefix-length 26
ip nat inside source static tcp 10.36.100.1 23 interface FastEthernet0/0 2323
ip nat outside source list ACL-OUTSIDE pool POOL add-route
GW1#sh access-list ACL-OUTSIDE
Extended IP access list ACL-OUTSIDE
10 deny ip 10.0.0.0 0.255.255.255 any
20 deny ip 172.0.0.0 0.31.255.255 any
30 deny ip 192.168.0.0 0.0.255.255 any (4 matches)
40 permit ip any any (4 matches)
GW1#
One thing I found interesting after this was verified was that if I tried to reconnect to the source host, it still build a translation table, but it only chnage the outside local/outside global, and not the inside global:
GW1#sh ip nat trans | i 4.2.2.1
--- --- --- 192.168.225.130 4.2.2.1
tcp 192.0.2.14:2323 10.36.100.1:23 192.168.225.130:35200 4.2.2.1:35200
tcp 192.168.225.1:17922 192.168.225.1:17922 192.168.225.130:23 4.2.2.1:23
GW1#
But this is fine, since I don't want reverse traffic anyway.
In any case ... thank you so much for the guidance, and that made a huge difference!
... View more
10-18-2017
01:45 PM
Jon,
I even tried to simply this a little bit, by specifying a static inside and a static outside as a 1:1, hoping for anything. I used a separate network on the inside and made sure it was routed to the inside interface.
The telnet sessions source from a loopback interfaces on another virtual router which comes in on the outside.
GW1#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
--- --- --- 192.168.225.128 4.2.2.1
--- 192.0.2.13 10.36.100.1 --- ---
GW1#sh run | i nat
ip nat outside
ip nat inside
ip nat inside source static 10.36.100.1 192.0.2.13
ip nat outside source static network 4.2.2.1 192.168.225.128 /32
GW1#
It almost looks like the packets aren't hitting NAT processing on the way back via inside. I sent one ping only to keep the chatter down:
GW1#
*Oct 18 20:21:09.519: NAT: Existing entry found in the global tree,updating it to point to the latest node passed
*Oct 18 20:21:09.519: NAT*: o: icmp (4.2.2.1, 7) -> (192.0.2.13, 7) [27]
*Oct 18 20:21:09.519: NAT*: o: icmp (4.2.2.1, 7) -> (192.0.2.13, 7) [27]
*Oct 18 20:21:09.523: NAT*: s=4.2.2.1->192.168.225.128, d=192.0.2.13 [27]
*Oct 18 20:21:09.523: NAT*: s=192.168.225.128, d=192.0.2.13->10.36.100.1 [27]
*Oct 18 20:21:09.551: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128, len 100, input feature, Common Flow Table(5), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.555: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128, len 100, input feature, Stateful Inspection(7), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.559: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128, len 100, input feature, Virtual Fragment Reassembly(37), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.559: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128, len 100, input feature, Access List(44), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.563: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128, len 100, input feature, Virtual Fragment Reassembly After IPSec Decryption(54), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.563: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128, len 100, input feature, NAT Outside(86), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.563: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128, len 100, input feature, MCI Check(101), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.563: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128 (FastEthernet0/0), len 100, output feature, Post-routing NAT Outside(25), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.567: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128 (FastEthernet0/0), len 100, output feature, Common Flow Table(28), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.567: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128 (FastEthernet0/0), len 100, output feature, Stateful Inspection(29), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.567: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128 (FastEthernet0/0), len 100, output feature, NAT ALG proxy(61), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Oct 18 20:21:09.567: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128 (FastEthernet0/0), g=192.0.2.9, len 100, forward
*Oct 18 20:21:09.571: IP: s=10.36.100.1 (FastEthernet1/0), d=192.168.225.128 (FastEthernet0/0), len 100, sending full packet
The internal host appears to process the packet as expected:
*Oct 13 00:02:26.181: IP: s=192.168.225.128 (FastEthernet1/0), d=10.36.100.1, len 100, rcvd 4
*Oct 13 00:02:26.185: IP: s=192.168.225.128 (FastEthernet1/0), d=10.36.100.1, len 100, stop process pak for forus packet
*Oct 13 00:02:26.189: IP: s=10.36.100.1 (local), d=192.168.225.128 (FastEthernet1/0), len 100, sending
*Oct 13 00:02:26.189: IP: s=10.36.100.1 (local), d=192.168.225.128 (FastEthernet1/0), len 100, sending full packet
The translations show themselves being built:
GW1#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
--- --- --- 192.168.225.128 4.2.2.1
icmp 192.0.2.13:8 10.36.100.1:8 192.168.225.128:8 4.2.2.1:8
icmp 192.0.2.13:9 10.36.100.1:9 192.168.225.128:9 4.2.2.1:9
--- 192.0.2.13 10.36.100.1 --- ---
GW1#
... View more
10-18-2017
08:28 AM
I've got a weird scenario where I need to do a port-forward in NAT, as well as a source address translation at the same time. Let me explain.
I have a secondary ISP coming into a data center facility and I have been asked to come up with a configuration that would allow a port forward to an arbitrary system within the network, and have all that traffic appear from and return through this router.
ISP2 --- Fa0/0 (192.0.2.2 - nat out) / Fa0/1 (192.168.225.10 nat in) --- Inside networks --- Host (10.36.100.1)
The first part is easy, as I can use a port forward:
ip nat inside source static tcp 10.36.100.1 23 interface FastEthernet0/0 2323
What Doesn't Work
The second part I have not been able to figure out using one router.
I have added a small address pool and an outside source list:
ip access-list extended ACL-OUTSIDE
deny ip 10.0.0.0 0.255.255.255 any
deny ip 172.0.0.0 0.31.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
permit ip any any
!
ip nat pool POOL 192.168.225.11 192.168.225.15 prefix-length 26
ip nat outside source list ACL-OUTSIDE pool POOL
On the inside host, I've got an IP packet debug that seems to show the double-nat is working there:
*Oct 12 21:00:38.970: IP: s=192.168.225.11 (FastEthernet1/0), d=10.36.100.1, len 44, rcvd 4
*Oct 12 21:00:38.970: IP: s=192.168.225.11 (FastEthernet1/0), d=10.36.100.1, len 44, stop process pak for forus packet
*Oct 12 21:00:38.982: IP: s=10.36.100.1 (local), d=192.168.225.11 (FastEthernet1/0), len 44, sending
*Oct 12 21:00:38.990: IP: s=10.36.100.1 (local), d=192.168.225.11 (FastEthernet1/0), len 44, sending full packet
The translation seems to build:
GW1#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
--- --- --- 192.168.225.11 4.2.2.1
tcp 192.0.2.14:2323 10.36.100.1:23 192.168.225.11:37521 4.2.2.1:37521
tcp 192.0.2.14:2323 10.36.100.1:23 --- ---
However, I don't get return traffic on the nat outside interface. All the routing is correct.
The same behavior persists, even when I specifiy a static outside address without using a pool.
What Does Work
I did find that I can achieve the same ends if I place two routers back to back like so:
outside -- (fa0/0 nat out) R1 (fa0/1 nat in) -- (fa0/1 nat in) R2 (fa1/0 nat out) -- inside
Then I keep the same port forward on R1:
ip nat inside source static tcp 10.36.100.1 23 interface FastEthernet0/0 2323
And then I do an overload on R2:
ip access-list extended ANY permit ip any any ! ip nat inside source list ANY interface FastEthernet1/0 overload
The scenario is labbed with ISO 15.2(4)M11, if it makes any difference.
... View more
Labels:
06-07-2017
11:00 AM
I wanted to kick the tires on this old thread because somewhere in my travels, I needed to extract some similar information. I ended up writing and using a TCL script to pull some general information, and figured it would be good for the folks looking here.
Here's natstat.tcl, which I put in the main directory on the router (flash: at the time)
::cisco::eem::event_register_timer cron name timer_natstat cron_entry "* * * * *"
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
## Extract Statistics
# set natStat [ exec "show ip nat statistics" ]
if [catch {cli_open} result] {
puts stderr $result
exit 1
} else {
array set cli1 $result
}
if [catch {cli_exec $cli1(fd) "show ip nat statistics"} result] {
error $result $errorInfo
} else {
set natStat $result
}
if [catch {cli_close $cli1(fd) $cli1(tty_id)} result] {
puts stderr $result
exit 1
}
## Process Output
set natMsg ""
# Pull out number of active translations, if we have it.
if [ regexp -all {active translations} $natStat ] {
set natActive [ regexp -inline {active translations: ([0-9]+)} $natStat ]
set natActive [ regexp -inline {[0-9]+} $natActive ]
append natMsg "Active: $natActive "
}
# Pull out number of peak translations, if we have it.
if [ regexp -all {Peak translations} $natStat ] {
set natPeak [ regexp -inline {Peak translations: ([0-9]+)} $natStat ]
set natPeak [ regexp -inline {[0-9]+} $natPeak ]
append natMsg "Peak: $natPeak "
}
# Pull out the number of expired translations, if we have it.
if [ regexp -all {Expired translations} $natStat ] {
set natExpired [ regexp -inline {Expired translations: ([0-9]+)} $natStat ]
set natExpired [ regexp -inline {[0-9]+} $natExpired ]
# Load context variable natCvar. Set to 0 if this hasn't been set.
if { [catch {context_retrieve CONTEXT_NATEXP natCvar} result] } {
set natLastExpired 0
} else {
set natLastExpired $result
}
# Return the number of translations expired in the last interval.
# Append an asterisk for an incomplete interval.
if [ expr $natLastExpired <= $natExpired ] {
append natMsg "Interval Expired: " [expr $natExpired - $natLastExpired ]
} else {
append natMsg "Interval Expired: $natExpired*"
}
# Save context variable natCvar. We'll use this to calculate the difference next time the script is run.
set natCvar $natExpired
catch {context_save CONTEXT_NATEXP natCvar}
}
## Send to syslog!
action_syslog priority info msg $natMsg
And enable it as such:
configure terminal
!
event manager directory user policy "flash:/"
event manager directory user library "flash:/"
event manager policy natstat.tcl
!
end
... View more
06-07-2017
10:52 AM
Two questions ... are you using a Tunnel1 interface, and what does the interface for Dialer1 look like?
... View more
06-07-2017
10:35 AM
I'm curious as well, especially since I already have a pair.
Unfortunately, it looks like they support a rather meager 64 tunnels. I'm not sure if that's for IKE sessions or IPSec SAs, but I am assuming the latter.
Here's my source for the tunnel limit:
http://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/sec_vpn/sec-ipsec-xe-3s-book-920/overview_of_ipsec.html
... View more
10-22-2013
07:26 AM
I'm having some difficulty with the EXPRESSION-MIB. I am attempting to set up an expression as part of a TCL script that I'd like to run periodically, but I can't seem to be able to make this work, so I have to be missing something simple. For my environment I am running a Cisco 1861 w/ 15.1(4)M6, ADVENTERPRISE-K9. SNMP is configured on my device as such: snmp-server group NMS v3 auth write SNMP_VIEW access 90 snmp-server group NMS v3 priv write SNMP_VIEW access 90 snmp-server group SNMP_RO v3 auth read SNMP_VIEW access 80 snmp-server group SNMP_RO v3 priv read SNMP_VIEW access 80 snmp-server view READ_ONLY iso included snmp-server view SNMP_VIEW iso included snmp-server community writeme RW 90 snmp-server community readme RO 80 snmp-server community TCL_WRITE RW 99 snmp-server manager #sh access-list 99 Standard IP access list 99 10 permit 172.31.254.1 (90 matches) 30 permit 192.168.16.8 (100 matches) 20 permit 127.0.0.1 (120 matches) For grins, I am using the example from this page: http://www.cisco.com/en/US/tech/tk648/tk362/technologies_configuration_example09186a008023267a.shtml If I convert just the first line from the first expression example, I get a NO_CREATION_ERROR. This is what it looks like: edr1(tcl)#$ 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 -i 6 {<snmp error type='tcl_snmp_processing_error' value='11' text='NO_CREATION_ERROR: 1.' />} lcsrma1-edr1(tcl)#SrDoSnmp: received set pdu CheckMIBView: OID is in MIB view. FindObjectClassCore: findObject failed do_sets: can't find object make_error_pdu: Variable does not exist, and the agent cannot create it. edr1(tcl)#' If I used the SNMP commands enabled w/ snmp-server manager: edr1#snmp set v2c 172.31.254.1 TCL_WRITE oid 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 6 SNMP Response: reqid 151, errstat 11, erridx 1 ciscoExperiment.22.1.2.3.1.3.101.49.101.120.112 = 6 lcsrma1-edr1# process_mgmt_req_int: UDP packet being de-queued SrDoSnmp: received set pdu CheckMIBView: OID is in MIB view. FindObjectClassCore: findObject failed do_sets: can't find object make_error_pdu: Variable does not exist, and the agent cannot create it. edr1# And finally, from one of my FreeBSD systems: [boxen]# snmpset -v 2c -c TCL_WRITE 192.168.16.1 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 6 Error in packet. Reason: noCreation (That table does not support row creation or that object can not ever be created) Failed object: SNMPv2-SMI::enterprises.9.10.22.1.2.3.1.3.101.49.101.120.112 Even running the script here fails to set the MIB, despite correct configuration. https://supportforums.cisco.com/docs/DOC-19587 I figure I have to be missing something as far as using this feature goes. ++I;
... View more
Labels:
10-02-2019
Here is an interesting scenario:I have a set of IPTV multicast sources
on an SVI (172.28.40.0/24), a...
10-09-2018
I can use the MAC OUI for detection, but it wasn't among the things I
was looking to do, especially ...
10-08-2018
My organization is deploying some new 9407 switches for campus access,
and one feature I've been loo...
Created by
Ian Underwood
in Switching
07-24-2018
07-24-2018
After some rethinking, I managed to get this routing scenario working.
My suspicion why this was not...
Created by
Ian Underwood
in Switching
04-20-2018
04-20-2018
Here is an interesting scenario for consideration: I have an enterprise,
"A", which intends to form ...
11-07-2017
VTI sounds nice, except I don't have administrative control of the
remote endpoints and there is a w...
11-06-2017
The chief requirement is redundancy in an event of a failure. The
separate addressing is to support ...
11-03-2017
Here's an interesting problem. I am attempting to land multiple L2L
IPSec tunnels on an ASR-1001-HX,...
10-19-2017
Jon, The suggestion to use an address range not related to the local
inside subnet was the correct a...
10-18-2017
Jon, I even tried to simply this a little bit, by specifying a static
inside and a static outside as...
10-18-2017
I've got a weird scenario where I need to do a port-forward in NAT, as
well as a source address tran...
06-07-2017
I wanted to kick the tires on this old thread because somewhere in my
travels, I needed to extract s...
06-07-2017
Two questions ... are you using a Tunnel1 interface, and what does the
interface for Dialer1 look li...
06-07-2017
I'm curious as well, especially since I already have a pair.
Unfortunately, it looks like they suppo...
Public Statistics
| Date Registered | 08-09-2012 05:30 AM |
| Date Last Visited | 10-04-2019 03:08 PM |
| Total Messages Posted | 17 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Cisco Employee"){kind=icon}
