Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About rsmith
Stats
Member since
04-15-2004
172
Posts
50
Helpful
11
Solutions
Created by
rsmith
in Network Security
in Network Security
07-12-2019
09:19 AM
07-12-2019
09:19 AM
Thank you, but as we "Trust" the partner network, we already allow all ICMP from their networks back through our firewall. The issue isn't return traffic, but the ASA responding FOR the Remote servers. (It shows valid Response and the "END Server" DNS resolution and IP on the Firewall Traceroute hop (second hop, not the 5th/6th hop where the Server actually resides!)). I need to find how to make the firewall NOT proxy the end-response traceroute destination...
... View more
Created by
rsmith
in Network Security
in Network Security
07-12-2019
09:04 AM
07-12-2019
09:04 AM
I was running a TraceRoute to a remote server that goes through our new ASA5516x Firewalls, via a Private link to our Partner site, I know it is at least 5 hops in to reach this server, as we just migrated from our older 55xx EOL Firewalls, and could reach these servers. However, it appears that our ASA5516 is acting as a Proxy for the server, so I cannot "see" into the Partner network to assure the path is valid. What configuration option do I need to change to stop the ASA5516 from responding for the remote servers/sites? Z:\>tracert xxxx.xxxx.xx.site Tracing route to xxxx.xxxx.xx.site [xx.xx.xx.37] over a maximum of 30 hops: 1 1 ms <1 ms <1 ms 1xx.x.x.1 <-- Core Router 2 <1 ms <1 ms <1 ms xxxx.xxxx.xx.site [xx.xx.xx.37] <--ASA5516 firewall 3 * * * Request timed out. <--same response to 30 hops 4 ^C Z:\>
... View more
- Tags:
- 5516
- proxy
- traceroute
01-04-2018
09:41 AM
I have the 4 Routers set up with HSRP, and VPN on the Virtual IP, but it does NOT transfer the VPN state when the routers fail over. Below the question is the (cleaned) configuration I currently have:
1: Per this document below, one caveat states "Stateful Failover for IPsec is not supported on platforms running Cisco IOS-XE software."
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/15-mt/sec-vpn-availability-15-mt-book/sec-state-fail-ipsec.html
2: Per this document (OLD, 2012), states "VPN Availability Configuration Guide, Cisco IOS XE Release 3S"
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/xe-3s/sec-vpn-availability-xe-3s-book/sec-vpn-ha-enhance.html
3: and a 3rd document (2005, not linked) states to use "ssp", which is not an option on these 43xx routers...
So, what am I missing for full Stateful failover for the VPN crypto tunnels?... (peer IP address for the G0/0/1 is x.x.255.69)
4331-Test# crypto keyring clets_ring pre-shared-key address x.x.255.65 key (key) crypto isakmp policy 10 encr aes authentication pre-share group 2 lifetime 28800 crypto isakmp profile clets keyring clets_ring match identity address x.x.255.65 255.255.255.255 local-address x.x.255.70 crypto ipsec transform-set aesset esp-aes esp-sha-hmac mode tunnel crypto map aesmap 10 ipsec-isakmp set peer x.x.255.65 set transform-set aesset set isakmp-profile clets match address acl_VPN ip access-list extended acl_VPN permit ip x.x.101.0 0.0.0.255 x.x.30.0 0.0.0.255 permit ip x.x.101.0 0.0.0.255 x.x.167.0 0.0.0.255 permit ip x.x.101.0 0.0.0.255 x.x.34.0 0.0.0.255 permit ip x.x.101.0 0.0.0.255 x.x.212.0 0.0.0.255
4331-Test# interface GigabitEthernet0/0/1 description RemoteRedundant ip address x.x.255.68 255.255.255.224 no ip redirects no ip unreachables no ip proxy-arp ip pim sparse-dense-mode standby 200 ip x.x.255.70 standby 200 priority 90 standby 200 preempt standby 200 authentication Test standby 200 name VPNTEST negotiation auto crypto map aesmap redundancy VPNTEST
The OTHER end also utilizes VRF's, but I don't think that configuration is relevant to the issue I am having...
Russ
... View more
10-06-2017
02:03 PM
Thank you!.. I did not know about the profile and local address piece. Below is my conceptual configurations, I know there is extraneous (probably conflicting) configuration information, and very likely some missing pieces still. I am hoping for some peer review and feedback before it gets tested, as one end is "semi-production", do not want to disrupt services:
(RTR1).1 - - .4(RTR3) \ / (VIP).3----.6(VIP) / \ (RTR2).2 - - .5(RTR4)
RTR1: crypto isakmp profile RTR1 vrf Outside keyring Outside_ring match identity address x.x.x.6 255.255.255.255 local-address x.x.x.3 crypto map aesmap 10 ipsec-isakmp set peer x.x.x.6 set transform-set aesset match address Encrypt crypto isakmp policy 10 encr aes authentication pre-share group 2 lifetime 28800 crypto ipsec transform-set aesset esp-aes esp-sha-hmac mode tunnel
interface GigabitEthernet0/0/0 description Outside vrf forwarding Outside ip address x.x.x.1 255.255.255.0 standby 255 ip x.x.x.3 standby 255 priority 120 standby 255 authentication auth1 standby 255 track 1 decrement 15 crypto map aesmap
ip access-list extended Encrypt permit ip a.a.a.0 0.0.0.255 b.b.b.0 0.0.0.255
RTR2: crypto isakmp profile RTR2 vrf Outside keyring Outside_ring match identity address x.x.x.6 255.255.255.255 local-address x.x.x.3 crypto map aesmap 10 ipsec-isakmp set peer x.x.x.6 set transform-set aesset match address Encrypt crypto isakmp policy 10 encr aes authentication pre-share group 2 lifetime 28800 crypto ipsec transform-set aesset esp-aes esp-sha-hmac mode tunnel
interface GigabitEthernet0/0/0 description Outside vrf forwarding Outside ip address x.x.x.2 255.255.255.0 standby 255 ip x.x.x.3 standby 255 priority 120 standby 255 authentication auth1 standby 255 track 1 decrement 15 crypto map aesmap
ip access-list extended Encrypt permit ip a.a.a.0 0.0.0.255 b.b.b.0 0.0.0.255
RTR3: crypto isakmp profile RTR3 vrf Outside keyring Outside_ring match identity address x.x.x.3 255.255.255.255 local-address x.x.x.6 crypto map aesmap 10 ipsec-isakmp set peer x.x.x.3 set transform-set aesset match address Encrypt crypto isakmp policy 10 encr aes authentication pre-share group 2 lifetime 28800 crypto ipsec transform-set aesset esp-aes esp-sha-hmac mode tunnel
interface GigabitEthernet0/0/0 description Outside vrf forwarding Outside ip address x.x.x.4 255.255.255.0 standby 255 ip x.x.x.6 standby 255 priority 110 standby 255 authentication auth1 standby 255 track 1 decrement 15 crypto map aesmap
ip access-list extended Encrypt permit ip b.b.b.0 0.0.0.255 a.a.a.0 0.0.0.255
RTR4: crypto isakmp profile RTR2 vrf Outside keyring Outside_ring match identity address x.x.x.3 255.255.255.255 local-address x.x.x.6 crypto map aesmap 10 ipsec-isakmp set peer x.x.x.3 set transform-set aesset match address Encrypt crypto isakmp policy 10 encr aes authentication pre-share group 2 lifetime 28800 crypto ipsec transform-set aesset esp-aes esp-sha-hmac mode tunnel
interface GigabitEthernet0/0/0 description Outside vrf forwarding Outside ip address x.x.x.5 255.255.255.0 standby 255 ip x.x.x.6 standby 255 priority 110 standby 255 authentication auth1 standby 255 track 1 decrement 15 crypto map aesmap
ip access-list extended Encrypt permit ip b.b.b.0 0.0.0.255 a.a.a.0 0.0.0.255
... View more
10-05-2017
04:30 PM
Found main issue was with the HP Comware 5900, software revision installed has multicast bugs. Added work-around, fixed some Firewall configuration issues, and all multicast is now working through the Routers.
... View more
10-05-2017
04:28 PM
I have seen configuration examples for a single router VPN redundancy to a pair of routers, but what if you have a pair of routers at each end? I am hoping to achieve full VPN failover redundancy for any device failure.
Is it as simple as adding the "default" and secondary peers on all 4 routers?
(IE,with Routers 1 and 2 at core end, Routers 3 and 4 at Remote end):
1 to 3 default, 1 to 4 secondary. 3 to 1 default, 3 to 2 secondary
2 to 4 default, 2 to 3 secondary. 4 to 2 default, 4 to 1 secondary
Also, If implementing VRRP/HSRP(on BOTH ends), does this all go out the window, and how would full redundancy be achieved in this scenario?
To further muddle this question, the Core side Routers have VRF configuration and two separate OSPF processes set to area 0 (per VRF).
... View more
Labels:
09-27-2017
09:52 AM
Further update: Stage 1 still the same (35-40 seconds to populate the "announce") Stage 3: If selected repeatedly (after acknowledge of WMP error message, keeping the WMP window open), eventually it will "CATCH" the stream and start playing... It appears the path is there, but possibly a timing issue or a forced "leave" going on? (for both stages) What other commands, at which locations, may resolve this?
... View more
09-27-2017
08:27 AM
Thank you for this information.. Slight update and responses to your list: 1: Yes, the Routers do have routes back to the Multicast source (OSPF, and default route) 2: The "sho ip pim nei" (and "dis pim nei" on the 5900) shown below. Note the "uplink" (VLAN y) mode only shows "G" 3: I added some "rp" information on the 5900 and 4351 (using the "Uplink" network VLAN y address on the 5900). It helped, but still not working as expected. I will explain the software process, note the repeated "sho ip igmp groups" has the "226.xxx.xxx.62" appear, but then has an "expires = now", then disappears. VBrick/StreamPlayer multicast process: 1: StreamPlayer software starts on Client, multicast join request goes out ("Announce") using the 224.x.x.254 multicast IP. 2: VBrick sends response with available "streams" to select, populates the StreamPlayer software with these "programs"(This stage is now working, albeit VERY SLOW to load) 3: Client selects a "program" (double-click on program name), this opens Windows Media Player with a special "StreamPlayer" codec, which sends a join request to the VBrick (the 226.x.x.62 address). At this point, the WMP should play the stream, but gets a generic failure error instead. It should also be noted that in step 1, in our "normal" multicast client end networks, it usually takes between 2-5 seconds to populate the "program" in the software. On this new link, it is taking over 30 seconds minimum to do the same. (38 seconds last test) HP 5900: (ADDED, under "pim") static-rp 172.y.y.1 (Neighbor) dis pim nei Neighbor Interface Uptime Expires DR-Priority Mode 172.y.y.6 VlanY 00:15:49 00:01:41 1 Cisco4351: (ADDED) ip pim rp-address 172.y.y.1 sho ip pim nei PIM Neighbor Table Mode: B - Bidir Capable, DR - Designated Router, N - Default DR Priority, P - Proxy Capable, S - State Refresh Capable, G - GenID Capable, L - DR Load-balancing Capable Neighbor Interface Uptime/Expires Ver DR Address Prio/Mode 172.a.a.68 GigabitEthernet0/0/0 05:21:39/00:01:27 v2 1 / DR S P G 172.y.y.1 GigabitEthernet0/0/1 00:15:36/00:01:41 v2 1 / G 4331-BnyShf#sho ip igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter Group Accounted 239.xxx.xxx.250 GigabitEthernet0/0/0 08:40:05 00:02:16 172.xxx.xxx.50 224.xxx.xxx.254 GigabitEthernet0/0/0 00:17:42 00:02:19 172.xxx.xxx.50 232.xxx.xxx.233 GigabitEthernet0/0/0 08:40:18 00:02:21 172.xxx.xxx.50 224.xxx.xxx.40 GigabitEthernet0/0/0 08:40:46 00:02:19 172.xxx.xxx.1 4331-BnyShf#sho ip igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter Group Accounted 239.xxx.xxx.250 GigabitEthernet0/0/0 08:40:14 00:02:08 172.xxx.xxx.50 224.xxx.xxx.254 GigabitEthernet0/0/0 00:17:50 00:02:11 172.xxx.xxx.50 232.xxx.xxx.233 GigabitEthernet0/0/0 08:40:27 00:02:13 172.xxx.xxx.50 226.xxx.xxx.62 GigabitEthernet0/0/0 00:00:01 00:02:59 172.xxx.xxx.50 <-- stream appears 224.xxx.xxx.40 GigabitEthernet0/0/0 08:40:55 00:02:10 172.xxx.xxx.1 4331-BnyShf#sho ip igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter Group Accounted 239.xxx.xxx.250 GigabitEthernet0/0/0 08:40:19 00:02:02 172.xxx.xxx.50 224.xxx.xxx.254 GigabitEthernet0/0/0 00:17:56 00:02:05 172.xxx.xxx.50 232.xxx.xxx.233 GigabitEthernet0/0/0 08:40:33 00:02:07 172.xxx.xxx.50 226.xxx.xxx.62 GigabitEthernet0/0/0 00:00:06 00:00:00 172.xxx.xxx.50 <--expires timer drops from 3 minutes to zero! 224.xxx.xxx.40 GigabitEthernet0/0/0 08:41:00 00:02:05 172.xxx.xxx.1 4331-BnyShf#sho ip igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter Group Accounted 239.xxx.xxx.250 GigabitEthernet0/0/0 08:40:20 00:02:02 172.xxx.xxx.50 224.xxx.xxx.254 GigabitEthernet0/0/0 00:17:56 00:02:05 172.xxx.xxx.50 232.xxx.xxx.233 GigabitEthernet0/0/0 08:40:33 00:02:07 172.xxx.xxx.50 226.xxx.xxx.62 GigabitEthernet0/0/0 00:00:07 now 172.xxx.xxx.50 <-- Stream "ends" 224.xxx.xxx.40 GigabitEthernet0/0/0 08:41:00 00:02:04 172.xxx.xxx.1 4331-BnyShf#sho ip igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter Group Accounted 239.xxx.xxx.250 GigabitEthernet0/0/0 08:40:20 00:02:01 172.xxx.xxx.50 224.xxx.xxx.254 GigabitEthernet0/0/0 00:17:57 00:02:04 172.xxx.xxx.50 232.xxx.xxx.233 GigabitEthernet0/0/0 08:40:34 00:02:06 172.xxx.xxx.50 224.xxx.xxx.40 GigabitEthernet0/0/0 08:41:01 00:02:04 172.xxx.xxx.1
... View more
09-26-2017
12:36 PM
New 4351/4331 Routers, configuring simple Multicast as currently running on other model routers.(pim sparse-dense-mode) Stream to destination works when the Router source Gigabit port is placed directly on the MCast Source network, but fails when placed on the other side of our HP ComWare 5900 Routing switch. We have other routers (mostly 2811) running Multicast across the 5900 with no issues. Attached JPG of the layout, with basic MCast configuration lines. Very limited Multicast knowledge, so want to keep this as simple as possible.
... View more
Labels:
12-12-2012
08:49 AM
Thanks for the Reply. I don't think it is actually as easy as simple DNS rewrite, mainly due to the vendor "Issues" when they originally set this up. Because they did not get the DNS name to resolve correctly, they took the "short-cut", and they are using the NAT IP address in the URL, NOT a DNS name. This is why I am working with them to FIX the DNS issue and start utilizing a DNS name, so that I CAN do an internal DNS record to the physical IP of the Image Server. So far, No response from them... So, that said, is there any simple, elegant way to redirect the traffic internally, using ONLY the IP address information that is embedded in the URL?
... View more
12-11-2012
10:34 AM
Thanks for the response. This is a private network, so no public DNS servers. I will push the vendor to see if they can reference by their Internal DNS (I believe they had issues with this for some reason). If they can fix that, we can write our own internal DNS to fix this. I will update when I hear back from them. (And Johnson says hello back)
... View more
12-10-2012
04:46 PM
One follow-up question to the above: There are two certificates showing for the user at this time (just started deploying these devices). Both show the same Username, but the Certificate Serial Numbers are 0x2 and 0x3. Is there ANY way to determine WHICH device holds which of these Serial Numbers? (Other than Revoking one and seeing who starts screaming?)
... View more
12-10-2012
10:21 AM
We have a situation where we host an Image Server locally, but the Application Server that serves up the Images is at a Remote Vendor site that we access through a 2811 Router using NAT. The Image Server has a NAT address on the Vendor DMZ network, and access to allow traffic inbound for the Images. All our Internal clients use a PAT address on the Vendor DMZ network. When our clients run the Application (Web HTTP) and request an Image from our Local server, it returns a "page cannot be displayed" error in the browser. If we remove the NAT address from the URL, and put in the local Image Server IP, the images come up correctly. I know where the issue lies, but not really how to resolve it. Since the URL contains the NAT address for the Image Server, our Clients request is routed back into the Vendors network. Our 2811 Router sees the destination as locally connected, and drops the traffic as spoofed. (I believe). We cannot change the Application Server, or remove the NAT, since this Application is used by other remote agencies to access these Images. What options do we have to redirect this URL to the Image Server. We do NOT have a Proxy server, and I don't believe the 2811 Router can do NAT Hairpinning... I have attached a .jpg of the connectivity for review. Russ
... View more
Labels:
12-10-2012
09:04 AM
Hi Marvin, I have two quick questions: 1: I have the Certificate set up as you outlined above, with ONE User account. I had 10 devices use this account/OTP to load the certificate on their remote devices.(These all have a similar funtion). If one of these devices gets lost, and I revoke the certificate, will the other 9 devices be revoked also, and need to re-enroll with another certificate? 2: I have created 10 NEW user accounts, they are not in use yet. Is there any way, other than revoking the original certificate, to have the clients get a new certificate with one of these unique user accounts? Thanks! Russ
... View more
11-19-2012
08:03 AM
Thanks for Posting, I had the same issue and this helped track it down quickly. (ours went from 1 hour this weekend to 30 minutes this morning, to every 4 minutes in the last hour!) I just set these messages to "Informational" so I don't get any more alerts on this. Kind of getting tired of these "cosmetic" bugs every time we upgrade, (CPU utilization at 1000%+ was a cute one!)
... View more
Created by
rsmith
in Network Security
07-12-2019
07-12-2019
Thank you, but as we "Trust" the partner network, we already allow all
ICMP from their networks back...
Created by
rsmith
in Network Security
07-12-2019
07-12-2019
I was running a TraceRoute to a remote server that goes through our new
ASA5516x Firewalls, via a Pr...
01-04-2018
I have the 4 Routers set up with HSRP, and VPN on the Virtual IP, but it
does NOT transfer the VPN s...
10-06-2017
Thank you!.. I did not know about the profile and local address piece.
Below is my conceptual config...
10-05-2017
Found main issue was with the HP Comware 5900, software revision
installed has multicast bugs. Added...
10-05-2017
I have seen configuration examples for a single router VPN redundancy to
a pair of routers, but what...
09-27-2017
Further update:Stage 1 still the same (35-40 seconds to populate the
"announce")Stage 3: If selected...
09-27-2017
Thank you for this information.. Slight update and responses to your
list:1: Yes, the Routers do hav...
09-26-2017
New 4351/4331 Routers, configuring simple Multicast as currently running
on other model routers.(pim...
12-12-2012
Thanks for the Reply. I don't think it is actually as easy as simple DNS
rewrite, mainly due to the ...
12-11-2012
Thanks for the response. This is a private network, so no public DNS
servers. I will push the vendor...
12-10-2012
One follow-up question to the above:There are two certificates showing
for the user at this time (ju...
12-10-2012
We have a situation where we host an Image Server locally, but the
Application Server that serves up...
12-10-2012
Hi Marvin, I have two quick questions:1: I have the Certificate set up
as you outlined above, with O...
Public Statistics
| Date Registered | 04-15-2004 11:36 AM |
| Date Last Visited | 07-19-2019 09:20 AM |
| Total Messages Posted | 172 |
| Total Helpful Votes Received | 50 |
Helpful Votes Given To
.jpg "Hall of Fame Cisco Employee"){kind=icon}
Helpful Votes From
