Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About silvakizir
09-18-2019
Stats
Member since
08-02-2016
116
Posts
35
Helpful
4
Solutions
Created by
silvakizir
in IP Telephony and Phones
in IP Telephony and Phones
07-08-2019
01:25 AM
07-08-2019
01:25 AM
The ATA did register after placing the new Firmware to both the MAC addresses of the same ATA in "Phone Load Name". Searching with the DN under Device=>Phone I saw and upgrade only one device. Searching with the MAC address I found the 2 devices of the same ATA and updated both successfully.
... View more
Created by
silvakizir
in IP Telephony and Phones
in IP Telephony and Phones
06-19-2019
12:11 AM
06-19-2019
12:11 AM
The firmware is uploaded in all the servers and all the TFTPs are restarted. As it seems in the picture the ATA takes the new firmware but it does not register to CUCM.
... View more
Created by
silvakizir
in IP Telephony and Phones
in IP Telephony and Phones
06-18-2019
06:46 AM
06-18-2019
06:46 AM
Hi. We have CUCM 11.5.1.15900-18 and ATA 190 with Firmware ATA190.1-2-2-003. When we try to upgrade a specific ATA 190 with Firmware ATA190.1-2-2-003_SR1-1 by placing it to the "Phone Load Name" the ATA upgrades as we see bellow in the Web Gui but it stops registering to CUCM. In order to make it register again we need to remove the Phone Load Name and restart the ATA. Why can't we register the ATA with the new Firmware??
... View more
01-16-2019
06:52 AM
Unfortunately we don't have a Firewall for the time being so this is the only thing we can do. If you can provide us your opinion by agreeing or not with Georg Pauwen please go ahead. Or if you have something else to add... Thank you!
... View more
01-16-2019
06:50 AM
Georg Pauwen thank you. This router is used only for Web browsing without restrictions and for remote access to internal devices through Site to Site VPN. If you think there are any additional ACLs that we can put in order to protect the inbound attacks please tell me.
... View more
01-15-2019
01:03 PM
Hi my friend. This is my configuration. ********************************************************************************************************* version 15.5 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ip dhcp pool DATA network 10.0.145.0 255.255.255.0 default-router 10.0.145.1 dns-server 8.8.8.8 ! ip name-server 8.8.8.8 ! controller VDSL 0 no cdp run ! crypto isakmp policy 1 encr aes 256 hash sha256 authentication pre-share group 14 ! crypto isakmp key xxxxxx address 70.70.70.70 ! crypto ipsec transform-set TSET esp-3des esp-sha-hmac mode tunnel ! crypto map CMAP 10 ipsec-isakmp set peer 70.70.70.70 set transform-set TSET match address VPN-TRAFFIC ! ! interface Ethernet0.835 encapsulation dot1Q 835 pppoe enable group global pppoe-client dial-pool-number 1 ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Vlan1 ip address 10.0.145.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Dialer1 description ***VDSL Connection*** ip address negotiated no ip proxy-arp ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication pap chap callin ppp chap hostname xxxxxx ppp chap password 0 xxxxxx ppp pap sent-username xxxxxxx password 0 xxxxxx no cdp enable crypto map CMAP ! ! ! ip nat inside source list NAT-TRAFFIC interface Dialer1 overload ip route 0.0.0.0 0.0.0.0 Dialer1 ! ip access-list extended NAT-TRAFFIC deny ip 10.0.145.0 0.0.0.255 10.0.100.0.0 0.0.0.255 permit ip 10.0.145.0 0.0.0.255 any deny ip any any ip access-list extended VPN-TRAFFIC permit ip 10.0.145.0 0.0.0.255 10.0.100.0 0.0.0.255 deny ip any any ! ! ! line con 0 logging synchronous login local no modem enable line aux 0 line vty 0 4 logging synchronous login local transport input ssh ********************************************************************************************************* So you are saying that with the bellow access-list 101 you wrote I will be OK? access-list 101 deny ip 0.0.0.0 0.255.255.255 any log <=0.0.0.0/8 Is this right?? access-list 101 deny ip 127.0.0.0 0.255.255.255 any log <=127.0.0.0/8 access-list 101 deny ip 172.16.0.0 0.15.255.255 any log <=172.16.0.0/12 access-list 101 deny ip 192.168.0.0 0.0.255.255 any log <=192.168.0.0/8 access-list 101 deny ip 224.0.0.0 15.255.255.255 any log <=224.0.0.0/4 access-list 101 deny ip host 255.255.255.255 any log access-list 101 permit ip any any What about subnet 10.0.0.0/8 ?? If I want to deny also Pings to my public IP ?? Is there anything else that I should put in the ACL 101 ?? I don't have a firewall in front of my router so it must be a little bit strict and work as a kind of a firewall. Thank you in advance!!
... View more
Created by
silvakizir
in Other Service Provider Subjects
in Other Service Provider Subjects
11-07-2018
12:42 PM
11-07-2018
12:42 PM
Hi all,
I have a Cisco 886 Router where I have a connection to the Internet through the vdsl port and site site to site vpn with other branches Vlan 1 with internal IPs and everything is working fine.
Before I connect the Cisco Router directly to the RJ-11 cable from the provider I had the ISPs Router which gave me Internet and the analogue phones were connected directly to the Router.
Now in order for the analogue Phones to work the provider told me to connect the Fast Ethernet of the Cisco Router to the Ethernet of the ISPs Router like this and configure it as PPPoE Passthrough.
Internet <===> Cisco Router VDSL Interface <===> Fast Ethernet of Cisco Router <===> Ethernet of ISPs Router <===> Analogue Phones on RJ-11 ports of ISPs Router
Can someone help me with the configuration without breaking the site to site vpn and continue having the Fast Ethernet of the Cisco Router work as expected?
... View more
Labels:
Created by
silvakizir
in VPN and AnyConnect
in VPN and AnyConnect
11-02-2018
09:51 AM
11-02-2018
09:51 AM
Any help please....
... View more
Created by
silvakizir
in VPN and AnyConnect
in VPN and AnyConnect
11-01-2018
02:42 AM
11-01-2018
02:42 AM
Unfortunately we can't change the subnet from 192.168.X.X/24 to 10.X.X.X/24 at the Branch Offices.
I do not have a problem of doing NAT but I don't want to destroy the Site to Site vpns between the Branch Offices.
Bellow are the configs of the 2 Branch Offices.
Begin Branch Office 1
**************************************************************************************************************************
crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group vpnusers key ΧΧΧΧΧΧΧΧ pool SDM_POOL_1 acl 121 netmask 255.255.255.0 crypto isakmp profile sdm-ike-profile-1 match identity group vpnusers client authentication list sdm_vpn_xauth_ml_1 isakmp authorization list sdm_vpn_group_ml_1 client configuration address respond virtual-template 1 ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac mode tunnel ! crypto ipsec profile SDM_Profile1 set transform-set ESP-3DES-SHA set isakmp-profile sdm-ike-profile-1 ! interface Tunnel0 ip address 172.20.20.1 255.255.255.252 tunnel source 29.29.29.29 tunnel destination 164.164.164.164 tunnel key ΧΧΧΧΧΧΧΧ ! interface Tunnel1 ip address 172.20.20.5 255.255.255.252 tunnel source 29.29.29.29 tunnel destination 250.250.250.250 tunnel key ΧΧΧΧΧΧΧΧ ! interface Tunnel2 ip address 172.20.20.13 255.255.255.252 tunnel source 29.29.29.29 tunnel destination 231.231.231.231 tunnel key ΧΧΧΧΧΧΧΧ ! interface Virtual-Template1 type tunnel ip unnumbered Vlan1 tunnel mode ipsec ipv4 tunnel protection ipsec profile SDM_Profile1 ! interface Vlan1 ip address 192.168.0.253 255.255.255.0 ip nat inside ip virtual-reassembly in ! interface Dialer0 ip address negotiated ip access-group 120 in ip mtu 1492 ip nat outside ip inspect cbac out ip virtual-reassembly in encapsulation ppp ip tcp adjust-mss 1360 dialer pool 1 dialer-group 1 ppp authentication pap callin ppp pap sent-username XXXXXXXX password XXXXXXXXX ! ip local pool SDM_POOL_1 10.0.0.1 10.0.0.5 ip forward-protocol nd ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ip route 0.0.0.0 0.0.0.0 192.168.0.254 50 ip route 192.168.2.0 255.255.255.0 Tunnel1 ip route 192.168.9.0 255.255.255.0 Tunnel2 ip route 192.168.10.0 255.255.255.0 Tunnel0 ! dialer-list 1 protocol ip permit ! access-list 100 permit ip 192.168.0.0 0.0.0.255 any access-list 120 remark ** Firewall Access List *** access-list 120 permit udp any any eq domain access-list 120 permit udp any eq domain any access-list 120 permit gre host 164.164.164.164 host 29.29.29.29 access-list 120 permit gre host 250.250.250.250 host 29.29.29.29 access-list 120 permit gre host 231.231.231.231 host 29.29.29.29 access-list 120 permit esp any host 29.29.29.29 access-list 120 permit udp any host 29.29.29.29 eq isakmp access-list 120 permit udp any host 29.29.29.29 eq non500-isakmp access-list 120 permit icmp any any access-list 121 permit ip 192.168.0.0 0.0.0.255 10.0.0.0 0.0.0.255
***************************************************************************************************************************
End Branch Office 1
I would like to see this site as 10.0.140.0/24 from the Central Office
Begin Branch Office 2
***************************************************************************************************************************
crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group vpnusers key XXXXXXXX pool SDM_POOL_1 acl 121 netmask 255.255.255.0 crypto isakmp profile sdm-ike-profile-1 match identity group vpnusers client authentication list sdm_vpn_xauth_ml_1 isakmp authorization list sdm_vpn_group_ml_1 client configuration address respond virtual-template 1 ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto ipsec profile SDM_Profile1 set transform-set ESP-3DES-SHA set isakmp-profile sdm-ike-profile-1 ! interface Tunnel0 ip address 172.20.20.6 255.255.255.252 tunnel source 250.250.250.250 tunnel destination 29.29.29.29 tunnel key XXXXXXXXX ! interface Tunnel1 ip address 172.20.20.10 255.255.255.252 tunnel source 250.250.250.250 tunnel destination 164.164.164.164 tunnel key XXXXXXXXX ! interface Tunnel2 ip address 172.20.20.21 255.255.255.252 tunnel source 250.250.250.250 tunnel destination 231.231.231.231 tunnel key XXXXXXXXX ! interface Virtual-Template1 type tunnel ip unnumbered Vlan1 tunnel mode ipsec ipv4 tunnel protection ipsec profile SDM_Profile1 ! interface Vlan1 ip address 192.168.2.254 255.255.255.0 ip nat inside ip virtual-reassembly ! interface Dialer1 ip address negotiated ip access-group 120 in ip nat outside ip inspect cbac out ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication pap callin ppp pap sent-username XXXXXXX password XXXXXXXX ! ip local pool SDM_POOL_1 10.2.2.2 10.2.2.5 ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Dialer1 ip route 192.168.0.0 255.255.255.0 Tunnel0 ip route 192.168.10.0 255.255.255.0 Tunnel1 ip nat inside source list 1 interface Dialer1 overload ! access-list 1 permit 192.168.2.0 0.0.0.255 access-list 120 permit gre host 29.29.29.29 host 250.250.250.250 access-list 120 remark ** Firewall Access List *** access-list 120 permit udp any any eq domain access-list 120 permit udp any eq domain any access-list 120 permit gre host 164.164.164.164 host 250.250.250.250 access-list 120 permit gre host 231.231.231.231 host 250.250.250.250 access-list 120 permit esp any host 250.250.250.250 access-list 120 permit udp any host 250.250.250.250 eq isakmp access-list 120 permit udp any host 250.250.250.250 eq non500-isakmp access-list 120 permit icmp any any access-list 120 permit gre host 225.225.225.225 host 250.250.250.250 access-list 121 permit ip 192.168.2.0 0.0.0.255 10.2.2.0 0.0.0.255 dialer-list 1 protocol ip permit
***************************************************************************************************************************
End Branch Office 2
I would like to see this site as 10.0.141.0/24 from the Central Office
... View more
Created by
silvakizir
in VPN and AnyConnect
in VPN and AnyConnect
10-31-2018
01:49 PM
10-31-2018
01:49 PM
Hi guys.
We have an ASA in Central office and is connected using site to site VPNs with the Branch Offices where we have Cisco 800 Series Routers.
We have 3 specific branch offices which are connected with each other using Site to Site VPNs and now we want to connect each and every single one of them with the Central Office without destroying the connections between them.
So far every Branch office has only one Subnet like 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24 and so on.
The problem is that the 3 specific Branch Offices have subnets 192.168.100.0/24. 192.168.101.0/24, 192.168.102.0/24 and we need to change the way we see the subnets from Central Offices as if they have Subnets 10.0.100.0/24, 10.0.101.0/24, 10.0.102.0/24
Is there a way to do that and instead of doing a ping to a pc that has 192.168.100.100 do a ping to the same PC in 10.0.100.100?
Unfortunately we can't change the subnets in the Branch Offices.
I believe the solution to my problem is NAT but I'm afraid of destroying the connections between them and no matter how methods I found and tried I did not succeed.
... View more
- Tags:
- site to site VPN
Labels:
10-20-2018
01:02 PM
Hi all.
I am not very good at security and I would like your help.
I have a Cisco 800 series router with a dialer (vdsl) and for this example it has let's say an IP: 60.60.60.60.
I have only one subnet (VLAN) for the lan and they only need surfing to the net.
I also have a simple site to site vpn with "crypto ipsec" and "crypto isakmp" with another site that has Cisco Router and/or Cisco ASA.
Can someone please type a recommended access-list that I can put in the dialer for ingress traffic in order to secure the network without blocking the site to site vpn???
... View more
Labels:
07-17-2018
04:04 AM
Thank you Nipun.
I will inform you with the process of this if any.
... View more
07-13-2018
07:02 AM
My friend the IOS you suggested have many bugs.
They may be good in order for the BRI to work but they create other problems with the RAM or the CPU of the 4331 router.
Is there a way to have the card work with the suggested 16.6.4 Everest or the 16.3.6 Denali IOS.
Can we do something in the card?
... View more
07-04-2018
02:19 AM
My friend you are absolutely right.
I upgraded to version 16.7.2 and I made a successful call.
Unfortunately with this version I had the message "%PLATFORM-4-ELEMENT_WARNING: R0/0: smand: RP/0: Used Memory value 89% exceeds warning level 88%" which is the bug CSCvf59313
I upgraded to version 16.8.1 and I also made a successful call.
In this version I had the message " %HMAN_CPU-3-PAGE_FAULT_HIGH: R0/0: hman: CPU Usage due to Memory Pressure (64) exceeds threshold (50) on BINOS_FRU_RP".
I believe I will leave the version 16.8.1
Cisco should mark this as a bug.
Thank you so much my friend!!
... View more
07-03-2018
12:05 AM
The output is the bellow.
Router#show platform software subslot 0/2 module firmware DSPware Version 46.2.3, built on Dec 11 2017:13:16:18 from kctsai-DSPWARE_46_2_3 NGIO Version ngio@v166_throttle/5 TDMSW registers (fpga ver = 0x10300, 2+0 analog ports) TDMSW64_ENBL_63_32=0x00000000, TDMSW64_ENBL_31_00=0x00000000 TDMSW64_RATE_63_48=0x55aaaa55, TDMSW64_RATE_47_32=0x55555555 TDMSW64_RATE_31_16=0x00000000, TDMSW64_RATE_15_00=0x00000000 TDMSW64_CTL=0x00000000, NGVMTDM_CTL=0x00000006 FPGA misc_ctrl = 0x00 FPGA tdm_pll_cntl = 0x00 FPGA tdm_pll_status = 0x02
I have to inform you that I've tried 3 different NIM-2BRi NT/TE cards in 3 different 4331 Routers with multiple IOS with the same exact results.
Let's focus though in finding the problem as I believe is the same in all my tests.
Thank you in advance.
... View more
Created by
silvakizir
in Unified Communications Infrastructure
07-08-2019
07-08-2019
Hi. We have integrated open LDAP with CUCM and all users came from LDAP
to CUCM successfully apart f...
Created by
silvakizir
in IP Telephony and Phones
07-08-2019
07-08-2019
The ATA did register after placing the new Firmware to both the MAC
addresses of the same ATA in "Ph...
Created by
silvakizir
in IP Telephony and Phones
06-19-2019
06-19-2019
The firmware is uploaded in all the servers and all the TFTPs are
restarted.As it seems in the pictu...
Created by
silvakizir
in IP Telephony and Phones
06-18-2019
06-18-2019
Hi.We have CUCM 11.5.1.15900-18 and ATA 190 with Firmware
ATA190.1-2-2-003.When we try to upgrade a ...
01-16-2019
Unfortunately we don't have a Firewall for the time being so this is the
only thing we can do.If you...
01-16-2019
Georg Pauwen thank you.This router is used only for Web browsing without
restrictions and for remote...
01-15-2019
Hi my friend. This is my
configuration.*************************************************************...
Created by
silvakizir
in Other Service Provider Subjects
11-07-2018
11-07-2018
Hi all, I have a Cisco 886 Router where I have a connection to the
Internet through the vdsl port an...
Created by
silvakizir
in VPN and AnyConnect
11-01-2018
11-01-2018
Unfortunately we can't change the subnet from 192.168.X.X/24 to
10.X.X.X/24 at the Branch Offices. I...
Created by
silvakizir
in VPN and AnyConnect
10-31-2018
10-31-2018
Hi guys. We have an ASA in Central office and is connected using site to
site VPNs with the Branch O...
10-20-2018
Hi all. I am not very good at security and I would like your help. I
have a Cisco 800 series router ...
07-13-2018
My friend the IOS you suggested have many bugs. They may be good in
order for the BRI to work but th...
Public Statistics
| Date Registered | 08-02-2016 01:32 AM |
| Date Last Visited | 09-18-2019 01:01 AM |
| Total Messages Posted | 116 |
| Total Helpful Votes Received | 35 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
Anonymous
| 5 |
| 5 | |
| 5 | |
| 10 | |
| 18 |
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
