Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About AdmShatan
08-18-2017
Stats
Member since
06-15-2011
18
Posts
0
Helpful
0
Solutions
08-10-2012
05:31 PM
Faxes to the DID's that have the service cca_onramp don't work. The UC picks up the call, and sends negotiation tones, but we can't receive.
... View more
08-10-2012
05:23 PM
Paolo: T1 0/3/0 is up. Applique type is Channelized T1 Cablelength is long gain36 0db No alarms detected. alarm-trigger is not set Soaking time: 3, Clearance time: 10 AIS State:Clear LOS State:Clear LOF State:Clear Version info Firmware: 20100222, FPGA: 13, spm_count = 0 Framing is ESF, Line Code is B8ZS, Clock Source is Line. CRC Threshold is 320. Reported from firmware is 320. Data in current interval (490 seconds elapsed): 0 Line Code Violations, 0 Path Code Violations 0 Slip Secs, 0 Fr Loss Secs, 0 Line Err Secs, 0 Degraded Mins 0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 0 Unavail Secs Total Data (last 24 hours) 136 Line Code Violations, 3 Path Code Violations, 5 Slip Secs, 0 Fr Loss Secs, 1 Line Err Secs, 1 Degraded Mins, 6 Errored Secs, 1 Bursty Err Secs, 0 Severely Err Secs, 12797 Unavail Secs
... View more
08-10-2012
05:10 PM
I have set up fax to email on my UC560, though recently switched vendors for our telephony service. I thought it was going to be a straigh pri-pri switch, but it was not. I'm being asked to set my system to receive at 9600bps. Is there a way to do that in the UC500 series? I had previously set up my uc560 to do fax to email, sample config here with one of the did dial peers: ! fax receive called-subscriber $d$ fax interface-type fax-mail mta send server 10.1.10.1 port 25 mta send with-subject both mta send mail-from hostname 10.1.10.2 mta send mail-from username $s$ mta receive aliases 10.1.10.2 mta receive maximum-recipients 7 ! application service cca_fax_detection flash:/applications/faxmail/app_fax_detect.2.1.2.2.tcl param fax-dtmf 2 param mode listen-first param voice-dtmf 1 param prompt flash:/applications/faxmail/en_listen_first.au ! service cca_offramp flash:/applications/faxmail/app_faxmail_offramp.2.0.1.1.tcl ! service cca_onramp flash:/applications/faxmail/app_faxmail_onramp.2.0.1.3.tcl ! ! ! dial-peer voice 3016 pots description 5017_T37 translation-profile incoming 5017_T37_Called_21 service cca_onramp incoming called-number 5017 direct-inward-dial port 0/3/0:23 ! ! voice translation-profile 5017_T37_Called_21 translate called 21 ! ! voice translation-rule 21 rule 1 /5017/ /208/ !
... View more
Labels:
Created by
AdmShatan
in VPN and AnyConnect
in VPN and AnyConnect
07-31-2012
02:18 PM
07-31-2012
02:18 PM
That, or find out the subset of addresses you need to hit at company A and B. For example: Company A you need to get to servers at 192.168.1.1-20 Company B you need to get to servers at 192.168.1.100-105 That way, you can subnet the protected space down, and traffic can travel over the apporpriate vpn. This only works if the subspaces don't overlap.
... View more
Created by
AdmShatan
in VPN and AnyConnect
in VPN and AnyConnect
07-31-2012
02:15 PM
07-31-2012
02:15 PM
Gregory, The work you did to make the scheme work for Company C is the same work that company B needs to do, or, you can change your space, and reconfigure all your tunnels.
... View more
Created by
AdmShatan
in VPN and AnyConnect
in VPN and AnyConnect
07-31-2012
11:47 AM
07-31-2012
11:47 AM
K. Natarajan has a good plan there. I've had to do this boh ways, and I can tell you that PAT or Policy NAT will work. We have a vender that we VPN to, to submit orders to. Since they already had a client with our IP scheme, we implemented a policy NAT. We only had a few machines that accessed those orders, so we created a policy NAT that translated those address for a group of addresses to send them. They in turn sent back to the NAT addresses, which our ASA translated back to the original machines.
... View more
Created by
AdmShatan
in VPN and AnyConnect
in VPN and AnyConnect
07-31-2012
11:26 AM
07-31-2012
11:26 AM
I've got a question here that I don't know the answer to off hand. I've got a remote site that is a small office. There are no servers(Active Directory) at that site, though there is a local file store. The site has a l2l tunnel back to HQ, where they get active directory services. Is there any way to have a remote access VPN authenticate against the remote LDAP server group through the VPN? I can make an LDAP server group, but when I assign an interface, that's where I get stuck. It's obviously not on the inside interface, as the servers don't reside in that subnet. If I choose the outside interface, the ASA will look for the private IP on that side, and not find it because it doesn't seem to send that off to the remote site. Is there something that can be configured so the ASA recognizes that it needs to send it through the VPN ?
... View more
Labels:
07-23-2012
08:43 AM
joshking1, You may be able to get the traffic to pass by using the SLA's to control the behaviour. Try assiging routes that also track the LAN IP's across the apporpriate interface, and force traffice to pass along that interface. I will be attempting this shortly as well.
... View more
06-04-2012
01:00 PM
Devavrat, It was, to an extent. What I learned was that I can use TCP-State-Bypass to use the ASA to do some asynchronous routing, thought it may not be the best use. What I did was set up the ASA as the default gateway, and configured SLA's on the ASA to monitor link state. WHen that link failed to the internet, I had the ASA divert traffic to the MPLS provider router. State bypass come in to play because the ASA does not get to see the TCP packets increment sequentially. Basically, when traffic comes out the MPLS provider router, it goes straight to the client, and the ASA doesn't get to see the full flow. State Bypass just tells the ASA to ignore TCP states for whatever policy you create(class-maps to policy-maps, etc.) I didn't much like this idea however, and after validating that it worked, embarked on changing the structure to be a bit different. I plugged the internet into the ASA as normal, but I also created another interface that connected to the MPLS provider router. This way, the provider was not local to our LAN, but I could bypass(no pun intended) using the TCP-State-Bypass command. So my LAN sits behond my ASA, and I have a seperate interface for MPLS and Internet. Since my employer doesn't like to spend money, that's where i sit right now. I believe a much better solution would have been to purchase a router, and set that as the default gateway. Then I could have done routing on a router, and left the ASA to do its' job, to be a firewall.
... View more
05-12-2012
07:24 AM
Just want to help answer my posts. I found the answer for this. What's happening is that the ASA see's the TCP traffic going there, but the router sends it straight to the host on the return, therefore, the ASA doesn't see the correct tcp sequence, and kills the connection. I worked around this using a feature called TCP-State-Bypass. You can find more details on it using this doc: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.pdf Just want to make sure for those googling, that there is an answer.
... View more
05-11-2012
02:47 PM
Short story, for a remote access VPN, i'm trying to auth against an ldap server on the outside of my branch office. The branch office has an ASA 5505 sec plus. The LDAAP server is in a data center behind a 5520, though it is statically nated to an external IP address. When I try and test auth against my ldap server though, I get an error saying that the ldap server id not respond. however, I can see a tcp reset on the asa, and have captured some packets: TCP reset: Teardown TCP connection xxx for outside ldap.ldap.ldap.ldap/389 to identity:asa.asa.asa.asa/2807 duration 0:00:21 bytes 286 TCP Reset-I Packet Capture: show cap capout 12 packets captured 1: 13:00:11.836214 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: S 2552064091:2552064091(0) win 8192 <mss 1380,sackOK,nop,nop,nop,nop,timestamp 539401482 263829745> 2: 13:00:11.853532 802.1Q vlan#2 P0 LDAP.LDAP.LDAP.LDAP.389 > ASA.ASA.ASA.ASA.2807: S 830582830:830582830(0) ack 2552064092 win 8192 <mss 1380,sackOK,timestamp 263895589 539401482> 3: 13:00:11.853624 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: . ack 830582831 win 8192 <nop,nop,timestamp 539401499 263895589> 4: 13:00:11.853776 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: P 2552064092:2552064237(145) ack 830582831 win 8192 <nop,nop,timestamp 539401500 263895589> 5: 13:00:11.877853 802.1Q vlan#2 P0 LDAP.LDAP.LDAP.LDAP.389 > ASA.ASA.ASA.ASA.2807: P 830582831:830583323(492) ack 2552064237 win 64296 <nop,nop,timestamp 263895591 539401500> 6: 13:00:11.877914 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: . ack 830583323 win 8192 <nop,nop,timestamp 539401524 263895591> 7: 13:00:11.878311 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: P 2552064237:2552064304(67) ack 830583323 win 8192 <nop,nop,timestamp 539401524 263895591> 8: 13:00:11.999109 802.1Q vlan#2 P0 LDAP.LDAP.LDAP.LDAP.389 > ASA.ASA.ASA.ASA.2807: P 830583323:830583433(110) ack 2552064304 win 64229 <nop,nop,timestamp 263895603 539401524> 9: 13:00:11.999185 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: . ack 830583433 win 8192 <nop,nop,timestamp 539401645 263895603> 10: 13:00:11.999444 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: P 2552064304:2552064311(7) ack 830583433 win 8192 <nop,nop,timestamp 539401645 263895603> 11: 13:00:11.999551 802.1Q vlan#2 P0 ASA.ASA.ASA.ASA.2807 > LDAP.LDAP.LDAP.LDAP.389: FP 2552064311:2552064311(0) ack 830583433 win 8192 <nop,nop,timestamp 539401645 263895603> 12: 13:00:12.019103 802.1Q vlan#2 P0 LDAP.LDAP.LDAP.LDAP.389 > ASA.ASA.ASA.ASA.2807: R 830583433:830583433(0) ack 2552064311 win 0 12 packets shown I know I'm querying over 389, I can switch to secure after I get this working(initially tried secure, but same results). The asa.asa.asa.asa address is the external IP of the branch office 5505. Can someone help tell me what I'm looking at?
... View more
Labels:
02-13-2012
12:27 PM
So, I'm fairly new to all of this. But I'm looking to introduce an outside internet connection to each of our sites. What I would like to do, is set up site to site VPNs as standard communications, and have our MPLS backbone be a failover route. What we have is a four site topology. Site A is our main datacenter. It contains a 5510 Sec plus appliance. We have MPLS provided to us, with an outside internet drain as well. Sites, B, C, and D, are currently routed to site A via MPLS. All traffice travels throughSite A for Internet. What I'd like to do is place 5505's at B, C, and D. I would like to create IPSec VPN tunnels to protect the networks. Using IP SLA's, I would like to test the connection, and remove the route if it fails(I've done this before, so I'm okay on that). What I have a question on, is how do I set up routing for the networks? The site to site VPN would try and send it out the VPN connection, no? And if so, how do I change the routes on the 5510? Currently, I have static routes pointing to the MPLS router for Sites B, C, and D. Are those going to mess with the VPN connections?
... View more
Labels:
01-20-2012
01:17 PM
I should note that the ASA's have no access-lists configured for any interface, just the defaults. The only access lists configure are the outside_acces_in lists for NAT and firewall purposes. I have even gone through and added ip any any rules on all interfaces with no luck.
... View more
01-20-2012
01:15 PM
I have a simple network pictured above. The Firewalls are ASA5505's. I have it setup just like the picture. THe left ASA has an ISP and is the default gateway of the 10.10.4.0 net. The right ASA is the default gatewy for the 172.16.7.0 net, and has a seperate ISP connection. I wanted to connect the networks(I had the oppurtunity), so I created a new interface on the right ASA and gave it an IP on the 10.10.4.0 net. I created the same-sec intra and inter commands, and created a static route statment on the left ASA. The switches are dumb(No layer 2 or layer 3 configs) I can ping across, anhy host to any host. Both ways, no questions asked. I cannot get any other service to work, no RDP, no CIFS, SAMBA, HTTP, no nothing. I have no idea what I may be missing.
... View more
Labels:
10-27-2011
11:46 AM
I'm familiar with using IP SLA to track routes, and inject or remove routes based on the tracked object. This question is in regards to icmpecho and multiple targets. Is it possible for me to set up an sla with multiple icmp targets, and if so, what would it look like? Would I create two sla's and try to attach them to a single track, or can I set up two targets in a single sla? Or is there some other way?
... View more
Labels:
08-10-2012
Faxes to the DID's that have the service cca_onramp don't work. The UC
picks up the call, and sends ...
08-10-2012
Paolo:T1 0/3/0 is up. Applique type is Channelized T1 Cablelength is
long gain36 0db No alarms detec...
08-10-2012
I have set up fax to email on my UC560, though recently switched vendors
for our telephony service. ...
Created by
AdmShatan
in VPN and AnyConnect
07-31-2012
07-31-2012
That, or find out the subset of addresses you need to hit at company A
and B. For example:Company A ...
Created by
AdmShatan
in VPN and AnyConnect
07-31-2012
07-31-2012
Gregory, The work you did to make the scheme work for Company C is the
same work that company B need...
Created by
AdmShatan
in VPN and AnyConnect
07-31-2012
07-31-2012
K. Natarajan has a good plan there. I've had to do this boh ways, and I
can tell you that PAT or Pol...
07-31-2012
I've got a question here that I don't know the answer to off hand.I've
got a remote site that is a s...
07-23-2012
joshking1, You may be able to get the traffic to pass by using the SLA's
to control the behaviour. T...
06-04-2012
Devavrat, It was, to an extent. What I learned was that I can use
TCP-State-Bypass to use the ASA to...
05-12-2012
Just want to help answer my posts. I found the answer for this. What's
happening is that the ASA see...
05-11-2012
Short story, for a remote access VPN, i'm trying to auth against an ldap
server on the outside of my...
02-13-2012
So, I'm fairly new to all of this. But I'm looking to introduce an
outside internet connection to ea...
01-20-2012
I should note that the ASA's have no access-lists configured for any
interface, just the defaults. T...
01-20-2012
I have a simple network pictured above. The Firewalls are ASA5505's.I
have it setup just like the pi...
Public Statistics
| Date Registered | 06-15-2011 08:16 AM |
| Date Last Visited | 08-18-2017 03:54 AM |
| Total Messages Posted | 18 |
