Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About r.heitmann
Online
r.heitmann
Member since
05-21-2004
Beginner
Created by
r.heitmann
in UCS Director Documents
in UCS Director Documents
05-02-2019
05:54 AM
05-02-2019
05:54 AM
call this from cloupia-script would be a great solution to avoid having to encode https/basic-auth-stuff in javascript within a custom task. Might be off-topic, but any other "elegant" solution to call a set of rest-api-calls with dynamically generated urls/parameters?
... View more
04-02-2019
12:46 AM
"clis" seems to be without broad device-support... should _this_ really be the way to go if you don't want do write script for every device-type? * try the "clis"-command * if not successful, fall back to "exec"-command which is supported in every device if {[catch {set showversion [clis {show version}]} e] } {
if {[catch {set showversion [exec {show version}]} e] } {
puts "ERR: Show Version - $e"
break
}
} puts $showversion
... View more
Created by
r.heitmann
in Network Management
in Network Management
02-05-2019
12:16 AM
02-05-2019
12:16 AM
scenario
all your "ntp server" time-sources are using the same "upstream" time-source ".ACTS."
all ntp-servers provide almost the same level of accuracy
your router as ntp-client nevertheless is choosing the best time-source
reason for the log-output
this "best time-source" seems to slightly change from time to time
eg. network-latency between router and ntp-server increases/decreases...
the router selects a better (but still almost identical) time-source and generates the log-output shown
solution
configure one ntp-server to be preferred
ntp server 206.246.122.250 prefer
ntp server 24.56.178.140
ntp server 64.113.32.5
=> this should pin your router permanently to server 206.246.122.250.
=> the logging should be gone
... View more
Created by
r.heitmann
in Physical and Virtual Network Elements
in Physical and Virtual Network Elements
01-30-2019
03:32 AM
01-30-2019
03:32 AM
the feature was announced quite some time ago.
#show virtual-service Virtual Service Global State and Virtualization Limits: Infrastructure version : 1.7 Total virtual services installed : 0 Total virtual services activated : 0 Machine types supported : LXC Machine types disabled : KVM
#show ver | inc IOS XE Cisco IOS XE Software, Version 16.09.02
#show platform | inc RP R0 ASR1000-RP2 ok, active 1w6d R1 ASR1000-RP2 ok, standby 1w6d
#show file systems | inc hard 78704144384 70655479808 disk rw harddisk: 78704144384 71805636608 disk rw stby-harddisk:
Hardware/Software-Requirerments should be met.
(=> according to the "FAQ regarding Service-Containers:
Cisco IOS XE Open Service Containers)
Any idea how to enable the ability to run KVM-Containers?
... View more
Labels:
01-08-2019
01:04 AM
this is eleven years old, i know - since the accepted solution is not 100% correct anymore, i'd like to add
* using a HSRP-IP as Tunnel-Source at a DMVPN-Hub works at least in IOS-XE 16.9 as a charm
My setup provides a backup-vpn-solution which has to be first as simple as possible and it should provide some level of redundancy within this backup-hubs - dual-dmvpn-hub-setup [usually prefererred] would add an unnecessary level of complexity.
interface GigabitEthernet0/0/0
ip address 172.16.0.3 255.255.255.248
ip mtu 1456
standby 0 ip 172.16.0.2
standby 0 priority 252
standby 0 preempt
service-policy output PM_SHAPE_300
interface Tunnel0
ip address 172.17.0.1 255.255.248.0
no ip redirects
ip mtu 1500
ip nhrp network-id 1
ip ospf network broadcast
ip ospf flood-reduction
ip ospf 1 area 0
nhrp map group DSL50 service-policy output PM50
cdp enable
tunnel source 172.16.0.2
tunnel mode gre multipoint
tunnel key 1
end
... View more
Created by
r.heitmann
in VPN and AnyConnect
in VPN and AnyConnect
08-28-2018
10:32 AM
08-28-2018
10:32 AM
looking at your ssh-server
* using "DEBUG"-LogLevel
admin@ubuntu:~/.ssh$ cat /etc/ssh/sshd_config | egrep "Level"
#LogLevel VERBOSE
LogLevel DEBUG
you'll notice:
admin@ubuntu:~/.ssh$ tail -f /var/log/auth.log Aug 28 17:63:92 ubuntu sshd[3218]: Connection closed by authenticating user admin <router-ip> port #nnn [preauth]
so the router (ssh-client) drops the session as the server wants to see some authentication-credentials.
... View more
08-08-2018
12:46 AM
i know this thread is years old...
* just as an update
a) ASA Release 9.9 - still no allowas-in
https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/general/asa-99-general-config/route-bgp.html
b) BGP intelligence must be placed somewhere else, for example as-override:
https://community.cisco.com/t5/service-providers-documents/bgp-pe-ce-routing-protocol-overview-in-mpls-vpns-part-ii/ta-p/3143007#toc-hId--765071651
... View more
07-12-2018
01:19 AM
at least the
tcp *:22... LISTEN ...SSHd
is missing at 16.8(1)
the "show ip ports all" command displays the listining BGP-Ports, but only established SSH-Ports...
... View more
05-30-2018
05:16 AM
since i've been looking right now for an very-small MPLS-capable-router, which the ISR1111 might be...
asking about port-security
* no hint to this feature in the IOS-XE-Configuration-Guides
* the Feature-Navigator (www.cisco.com/go/fn) => search by feature
...this tool is very often useful but sometimes it's database is not complete
=> shows no ISR-Router with "port-security" enabled (screenshot attached).
Zone-Based-Firewall might be an (maybe overengineered) solution!?
... View more
05-30-2018
04:46 AM
just as an addon:
Works fine with
a) static-GRE-Tunnels
b) dynamic-GRE-Tunnels(FlexVPN) - even FlexVPN Site-to-Site Shortcuts!
RTR-95#show cdp neigh
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
D - Remote, C - CVTA, M - Two-port Mac Relay
Device ID Local Intrfce Holdtme Capability Platform Port ID
RTR-11 Tunnel4011 154 R I ASR1009-X Virtual-Access3 ***FlexVPN Spoke-to-Hub***
RTR-91 Gig 0/0/0 179 R I ASR1002-H Gig 0/0/1
RTR-17 Virtual-Access1 176 R S I ISR4221/K Virtual-Access1 ***Shortcut: Spoke-to-Spoke***
... View more
Created by
r.heitmann
in Unified Computing System Discussions
in Unified Computing System Discussions
05-29-2018
09:45 AM
05-29-2018
09:45 AM
is this not just a link to an Promotional-Bundle - which might be EOSale but not the Blade-Server-Module itself!?
this should be the current list of EOSed server-hardware:
https://www.cisco.com/c/en/us/support/servers-unified-computing/ucs-b200-m4-blade-server/model.html#End-of-LifeandEnd-of-SaleNotices
B200 M2 where EOS at March 1, 2013
B200 M3 where EOS at December 31, 2016.
There are usually 6 months between an EOS-announcement and the EOS-date, so i'd assume you have more than 6 months left to order M4-blades since there is no M4-EOS-announcement published.
Correct me if i've missed something.
... View more
05-24-2018
10:34 AM
great, thank you!
I've attached a working configuration:
!
! Production-Routing
! * all Clients (192.168.116.0/24) get SRC-NATed
! * Internet-Access via 53.0.0.2 (static default-route in global-route-table missing)
!
interface GigabitEthernet1
ip address 53.0.0.1 255.255.255.0 secondary
ip address 192.168.116.105 255.255.255.0
no ip redirects
ip nat inside
ip policy route-map RM_PBR_NAT
!
!
interface vasileft1
ip address 1.1.1.1 255.255.255.252
ip nat outside
no keepalive
!
ip access-list extended ACL_PBR
permit ip any host 53.53.53.53
permit ip 192.168.116.0 0.0.0.255 any
!
! PBR pushes specified traffic from vasileft to right
!
route-map RM_PBR_NAT permit 10
match ip address ACL_PBR
set interface vasileft1
!
!
ip nat pool POOL 53.53.53.53 53.53.53.53 netmask 255.255.255.252
!
ip access-list standard ACL_NAT
permit 192.168.116.0 0.0.0.255
!
ip nat inside source list ACL_NAT pool POOL overload
!
! VRF to push traffic back from vasiright to left
!
!
vrf definition VASINAT
!
address-family ipv4
exit-address-family
!
!
interface vasiright1
vrf forwarding VASINAT
ip address 1.1.1.2 255.255.255.252
no keepalive
!
ip route vrf VASINAT 0.0.0.0 0.0.0.0 vasiright1
!
... View more
05-16-2018
12:49 PM
the NAT-Hairpinning-Stuff has been solved for years and is well documented - for IOS-Routers.
... today almost everybody uses IOS XE
The elegant Solution? NVI? Impossible.
NVI is gone in IOS-XE
The good-old Solution? route-map to Loopback? Broken.
route-map with "set interface loopback" is not allowed since "loopback isn't treated as point-to-point-interface"
messing around with /30 on Loopack and "set ip next-hop" to the foreign ip at the loopback-network doesn't work at least at release IOS-XE 16.8.1
...
it seems, both methods to implement NAT-on-a-Stick are not available with current hardware.
Any idea?
[disclaimer: Any problem which has "nat-on-a-stick" as the only solution, is the wrong problem ;-)]
Cheers,
//Ron
... View more
Labels:
05-15-2018
12:28 PM
Hi Peter,
today almost everybody uses IOS XE
NVI is gone in IOS-XE
route-map with "set interface loopback" is not allowed since "loopback isn't treated as point-to-point-interface"
[messing around with /30 on Loopack and "set ip next-hop" to the foreign ip don't work at least at release 16.8.1]
So it seems, both methods to implement NAT-on-a-Stick are not available at current hardware!?
Cheers,
//Ron
... View more
Created by
r.heitmann
in VPN and AnyConnect
in VPN and AnyConnect
03-20-2018
10:46 PM
03-20-2018
10:46 PM
Do the shortcuts come up? Does it work without NAT? Which release do you use?
... View more
Created by
r.heitmann
in UCS Director Documents
05-02-2019 05:54 AM
05-02-2019 05:54 AM
call this from cloupia-script would be a great solution to avoid having
to encode https/basic-auth-s...
04-02-2019 12:46 AM
"clis" seems to be without broad device-support... should _this_ really
be the way to go if you don'...
Created by
r.heitmann
in Network Management
02-05-2019 12:16 AM
02-05-2019 12:16 AM
scenario all your "ntp server" time-sources are using the same
"upstream" time-source ".ACTS." all n...
Created by
r.heitmann
in Physical and Virtual Network Elements
01-30-2019 03:32 AM
01-30-2019 03:32 AM
the feature was announced quite some time ago. #show
virtual-serviceVirtual Service Global State and...
01-08-2019 01:04 AM
this is eleven years old, i know - since the accepted solution is not
100% correct anymore, i'd like...
Created by
r.heitmann
in VPN and AnyConnect
08-28-2018 10:32 AM
08-28-2018 10:32 AM
looking at your ssh-server * using "DEBUG"-LogLevel admin@ubuntu:~/.ssh$
cat /etc/ssh/sshd_config | ...
08-08-2018 12:46 AM
i know this thread is years old... * just as an update a) ASA Release
9.9 - still no allowas-in
http...
07-12-2018 01:19 AM
at least the tcp *:22... LISTEN ...SSHd is missing at 16.8(1) the "show
ip ports all" command displa...
05-30-2018 05:16 AM
since i've been looking right now for an very-small MPLS-capable-router,
which the ISR1111 might be....
05-30-2018 04:46 AM
just as an addon: Works fine with a) static-GRE-Tunnels b)
dynamic-GRE-Tunnels(FlexVPN) - even FlexV...
Created by
r.heitmann
in Unified Computing System Discussions
05-29-2018 09:45 AM
05-29-2018 09:45 AM
is this not just a link to an Promotional-Bundle - which might be EOSale
but not the Blade-Server-Mo...
05-24-2018 10:34 AM
great, thank you! I've attached a working configuration: ! !
Production-Routing ! * all Clients (192...
05-16-2018 12:49 PM
the NAT-Hairpinning-Stuff has been solved for years and is well
documented - for IOS-Routers. ... to...
05-15-2018 12:28 PM
Hi Peter, today almost everybody uses IOS XE NVI is gone in IOS-XE
route-map with "set interface loo...
Created by
r.heitmann
in VPN and AnyConnect
03-20-2018 10:46 PM
03-20-2018 10:46 PM
Do the shortcuts come up? Does it work without NAT? Which release do you
use?
Public Statistics
| Date Registered | 05-21-2004 05:17 AM |
| Date Last Visited | 06-21-2019 03:08 AM |
| Total Messages Posted | 40 |
| Total Helpful Votes Received | 18 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
