Dear All, Our user was found that they got slow network connection when try to upload/download file through a Metro ethernet to another office, the upload/download traffic was keeping 30~60kbps even though the ME is only using 15Mbps bandwidth (we have 25M bandwidth), I had tried to sum. the total interface bandwidth which connected to the same switch and found it's around 62 mbps, reference the link below: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps5528/product_data_sheet09186a00801f3d7d.html The 32 Gbps forwarding bandwidth doesn't means the total throughput for the Switch? I make confuse for the performance for the table, anyone can help to provide a link to check the switch performance? I had found the link below which show difference mode switch performance: http://wiki.nesevo.com/index.php/Switch_Performance_Matrix is it correct? Thanks! ... View more

Dear All, I would like to use the cisco router 3640 (with T1 card) and cisco 2621 (with 2 x FXS card) to simulate the network & pstn environment to test the modem pass through, here is the detail connection: Analog Phone (Ext: 451660) <--> [FXS] Cisco Router 2621 <---- LAN ----> Router 3640 [T1] <--> [T1] PBX (Panasonic) <--> Analog Phone (Ext: 454820, Modem) The dial-peer on the router 2621 & 3640 is working as I can call in/out from PBX analog phone, and I was success to connect the PC (with modem port, and use the hyperterminal, atdt454820) from Outside PC (with modem port, Ext: 451660). But I was fail to dial-out from PBX analog phone (454820) to 451660. From Cisco router 2600: dial-peer voice 45166 voip destination-pattern 45166. modem passthrough nse codec g711ulaw redundancy session target ipv4:192.168.0.60 (Router 3640) From Cisco router 3640 dial-peer voice 454820 voip destination-pattern 454820 modem passthrough nse codec g711ulaw redundancy session target ipv4:192.168.0.44 (Router 2600) Here is the link I try to follow to do: http://www.cisco.com/en/US/docs/ios/12_1t/12_1t3/feature/guide/dtmodptr.html I would like to know if there is any miss-configure or how can I troubleshoot (to find out the cause) which I cannot connect from PBX' PC. Thanks! ... View more

Some of our PIX (which the problem was not happen in only one PIX) recently found a problem. In our network environment, the client pc can get reply from pix interface and access the outside internet without any block, but it was found that when the pix get problem, the client was failed to get response from the pix and failed to access the internet also. Here is the log for the debug arp when: Success to ping and access internet: arp-in: rqst for me from 192.168.13.100 for 192.168.13.15, on inside arp-set: added arp inside 192.168.13.100 0001.9621.ca00 and updating NPs at 1087579650 arp-in: generating reply from 192.168.13.15 0003.6bf6.7980 to 192.168.13.100 0001.9621.ca00 arp-in: request at inside from 192.168.13.100 0001.9621.ca00 for 192.168.13.15 0000.0000.0000 Fail to ping and access internet: arp-send: arp request built from 192.168.13.15 0003.6bf6.7980 for 192.168.13.100 at 1087826770 arp-in: response at inside from 192.168.13.100 0001.9621.ca00 for 192.168.13.15 0003.6bf6.7980 arp-set: added arp inside 192.168.13.100 0001.9621.ca00 and updating NPs at 1087826770 arp-in: resp from 192.168.13.100 for 192.168.13.15 on inside at 1087826770 arp-send: sending all saved block to inside 192.168.13.100 at 1087826770 The problem was solved when I reboot the PIX and there is not any change for the configuration. ... View more

Dear All, I have a problem when configure site to site between the ASA 5505 (with security base license) and PIX 515E (UR license) The network should be somethings like: Remote site network(10.2.3.0)<-->ASA5505<-->Internet<-->PIX515E<-->Local segment (192.168.10.0) <-->Layer3 switch<--> other 3 segment (192.168.2x.0) I tried to created a l2l vpn between ASA 5505 and PIX515E, the ASA 5505 local segment (10.2.3.0) and PIX515E local segment (192.168.10.0) can talk to each other success (try ping, vnc, remote desktop), but I fail to connect the segment which behind the PIX515E's layer 3 switch. The pix already had routing for the segment behind the L3 switch and the L3 switch's default gateway was pointed to PIX515E. And I already add the reverse routing in the ASA5505. I am not sure why it fail to communicate the ASA local segment to the segment behind the L3 switch. Here is the partial configure for the ASA and PIX: For ASA 5505 configure access-list no-nat extended permit ip 10.2.3.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list no-nat extended permit ip 10.2.3.0 255.255.255.0 192.168.20.0 255.255.255.0 ... access-list vpn extended permit ip 10.2.3.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list vpn extended permit ip 10.2.3.0 255.255.255.0 192.168.20.0 255.255.255.0 ... nat (inside) 0 access-list no-nat crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto map outside_map 1 match address vpn crypto map outside_map 1 set peer 172.16.1.2 crypto map outside_map 1 set transform-set ESP-DES-SHA crypto map outside_map 1 reverse route crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 2 authentication pre-share encryption des hash sha group 2 lifetime 86400 tunnel-group 172.16.1.2 type ipsec-l2l tunnel-group 172.16.1.2 ipsec-attributes pre-shared-key internet For PIX515E configure access-list no-nat extended permit ip 192.168.10.0 255.255.255.0 10.2.3.0 255.255.255.0 access-list no-nat extended permit ip 192.168.20.0 255.255.255.0 10.2.3.0 255.255.255.0 ... access-list vpn extended permit ip 192.168.10.0 255.255.255.0 10.2.3.0 255.255.255.0 access-list vpn extended permit ip 192.168.20.0 255.255.255.0 10.2.3.0 255.255.255.0 ... nat (inside) 0 access-list no-nat route inside 192.168.20.0 255.255.255.0 192.168.10.10 ... crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto map outside_map 1 match address vpn crypto map outside_map 1 set peer 172.16.1.1 crypto map outside_map 1 set transform-set ESP-DES-SHA crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 2 authentication pre-share encryption des hash sha group 2 lifetime 86400 tunnel-group 172.16.1.1 type ipsec-l2l tunnel-group 172.16.1.1 ipsec-attributes pre-shared-key internet Thanks! ... View more

I would like to form a vpn between cisco pix 515 and watchguard 1250e. For some of the reason, I would like to route port 80, 443 services via watchguard to access the internet. I have success to make a zero route to route all traffic via watchguard to access the internet. But I get a problem when I modify the access list to cover only the port 80 and 443. for the detail configuration: pix 515: External IP: 10.2.3.240 Internal IP: 192.168.0.254 VPN access-list: access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 172.18.0.0 255.255.255.0 access-list no-nat extended permit tcp 192.168.0.0 255.255.255.0 any eq 80 access-list no-nat extended permit tcp 192.168.0.0 255.255.255.0 any eq 443 access-list outside_20_crypto permit ip 192.168.0.0 255.255.255.0 172.18.0.0 255.255.255.0 access-list outside_20_crypto extended permit tcp 192.168.0.0 255.255.255.0 any eq 80 access-list outside_20_crypto extended permit tcp 192.168.0.0 255.255.255.0 any eq 443 nat (inside) 0 access-list no-nat Watchguard 1250e External IP: 10.2.3.239 Internal IP: 172.18.0.254 NAT: local: 0.0.0.0/0 Remote: 192.168.0.0/24 For the log, it is found that the connection from inside (Pix) to outside (Internet) is not doing the NAT. I would like to ask whether anyone have the same problem or not, thanks! ... View more