Hello Cisco community,   I have a question regarding NAT-T with IPsec. I read that if you want to use IPsec with ESP and NAT, the router needs to add an additional UDP header with port 4500 to the packet since ESP doesn't have any ports by itself. My question is if that "problem" could be rectified by using tunnel mode. Wouldn't the new IP-Header provide a new port or does it just change the IP-Address?   Thank you for clarification. ... View more

Hello community,   is there a way to change the phone model of an existing phone button template? I know there is the feature safe feature for newer phones However I am curious for the completeness sake. I couldn't find anything related to it in BAT. Thank you in advance. ... View more

Hello Cisco Community,   I am currently configuring trustpoints on a ISR router. The hierarchy looks like that: root --> subca --> router certificate. I will create 2 trustpoints where the 1st will reference the root-ca and the 2nd one the subca and router certificate.   I am aware of the fact, that the chain of trust needs to be established. I check several configurations and some mentioned the command chain-validation none (for the Root-CA); chain-validation "name of upper trustpoint e.g. subca".   The question is, whether the command chain-validation ... needs to configured in order to setup a clean configuration on the router.   Any feedback is appreciated. ... View more

Hello Cisco community,   As I was building the chain of trust on a router, I realized that there are two commands that seem to do the same. In order to add the intermediary certificate to a trustpoint I normally would use the command: crypto pki authenticate subca After that I would add the router certificate to that trustpoint with the following command: crypto pki import subca certificate    Here are my questions:   1:   Could I use the command crypto pki authenticate subca to import the router certificate or does the router do something different with the crypto pki import subca certificate?   2:   It seems like common practice to create a separate trustpoint for the root certificate and create another one for the subca and the router certificate. What's the idea behind that.   Any input is appreciated. Thank you. ... View more

Hi community,   I just configured a scrypt type 9 password and wanted to use it for my console login. It seems like the ISR 4331 cannot process this password. Is this a known limitation or might it be a bug.   Thank you in advance.   Best regards   Thomas ... View more