Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mitchell helton
07-19-2019
Stats
Member since
10-13-2010
66
Posts
5
Helpful
2
Solutions
Created by
mitchell helton
in Wireless and Mobility
in Wireless and Mobility
04-22-2019
12:15 PM
04-22-2019
12:15 PM
In case someone else stumbles across this, I got some clarification from Cisco via their Partner Help team: I have checked internal resources. There are no plans to EoS neither for 1830 nor for 1850. The technical marketing engineer and the product managers have confirmed the information. The colleagues are going to correct the website. I am sorry about the confusion.
... View more
Created by
mitchell helton
in Wireless and Mobility
in Wireless and Mobility
04-16-2019
10:24 AM
04-16-2019
10:24 AM
Thank you for the quick reply, Scott. Do you know what the replacement for the 1852 will be? I did not see an EoL statement anywhere. Regarding the inevitable code mismatch between the 3504 and 2504. There are no *known* issues - just more of a best practice thing? Thank you!
... View more
Created by
mitchell helton
in Wireless and Mobility
in Wireless and Mobility
04-16-2019
08:57 AM
04-16-2019
08:57 AM
Good morning! First off, a quick question on the 1852i. I noticed that when comparing the AP models, the 1850 series is not listed anymore. Is this an error or is the 1852 on its way out? https://www.cisco.com/c/en/us/products/wireless/access-points/product-comparison.html We currently have a single 2504 WLC with half a dozen lightweight APs... the rest of our APs are autonomous. I would like to move the 2504 to the DMZ as a guest anchor and purchase a 3504 which would accommodate our current APs plus new ones to replace the existing autonomous APs. Am I correct in thinking I do not need to buy any new licenses for the 2504 that will become an anchor? And I only need to purchase licenses for the new 3504 to accommodate however many APs I have? What the end set up would look like is this: 3504 WLC on the internal network with roughly 15 APs (all 1852i) connecting to it, then a 2504 in the DMZ for anchoring. Any issues with this? Thanks very much!!
... View more
Labels:
Created by
mitchell helton
in Switching
in Switching
03-05-2019
10:24 AM
03-05-2019
10:24 AM
This is finally resolved. Turns out there must've been a hardware defect. After doing an RMA for the switch, RSPAN is now working as intended.
... View more
Created by
mitchell helton
in Switching
in Switching
02-01-2019
08:19 AM
02-01-2019
08:19 AM
I finally did the TAC recommended upgrade and it did not fix my issue. According to the feature navigator, this should work. I'm going to open another case w/Cisco and see if I have better luck. Any other ideas? Thanks!
... View more
Created by
mitchell helton
in Switching
in Switching
01-17-2019
12:54 PM
01-17-2019
12:54 PM
Thanks for the feedback guys. My account manager reached out to an engineer colleague of his and suggested we upgrade to the newest version of code. TAC has not been able to provide me with information showing this is an open caveat, so I have low expectations but am hoping for the best. I plan on doing the upgrade in a couple of weeks and will post back here with my findings.
Thanks!
... View more
Created by
mitchell helton
in Switching
in Switching
01-15-2019
01:48 PM
01-15-2019
01:48 PM
Thanks for the reply!
We started on 16.3.6 and upgraded to 16.3.7 due to a bug that was causing reloads when VLANs were modified. So, the RSPAN has not worked on either of those versions.
We have done packet captures and see the mirrored traffic coming into the switch, but it never egresses to the destination port. They've looked over my config numerous times and didn't see an issue. They said they tried 3 different versions of code (including the one I'm currently on) and were unable to reproduce.
... View more
Created by
mitchell helton
in Switching
in Switching
01-15-2019
06:59 AM
01-15-2019
06:59 AM
Good morning!
I have a case open w/TAC and have not made any progress. It's being escalated by our account manager due to lack of a resolution, but that's neither here nor there. I figured I'd post here in case it was something simple that we're overlooking.
Our environment consists mostly of 3750 and 2960 switches. RSPAN worked perfectly until last Summer when replacing our core (3750x) with a 3850. Since then, RSPAN traffic seems to be dropped by the 3850. I've done all sorts of troubleshooting with TAC, but so far they've been unable to tell me what the problem is. They say it works in their lab.
Are there any known issues with the 3850 platform doing RSPAN with 2960/3750? Is this a bug? Working as intended? Any thoughts? This is on a WS-C3850-48P running 16.3.7. Thanks so much!
... View more
Labels:
Created by
mitchell helton
in Policy and Access
in Policy and Access
04-24-2018
01:05 PM
04-24-2018
01:05 PM
That sounds reasonable to me. Thanks so much for the input and advice!
... View more
Created by
mitchell helton
in Policy and Access
in Policy and Access
04-23-2018
08:27 AM
04-23-2018
08:27 AM
Good morning!
I'm having a tough time wrapping my brain around something, and hope you experts can help. I also hope this isn't too vague of a question, and if it is, I can give specifics around why I'm asking.
If I'm deploying user certificates via AD/GPO, is there any value in using certificates (EAP-TLS) for user authentication? If someone captures a username/password, once they login as that user the certificate will be deployed to them any way.
Am I missing something? I had originally wanted to do EAP chaining with TLS for user and machine and now I'm wondering if using TLS for machine and MSCHAPv2 for the user makes more sense.
So, I guess my question is, what value does TLS for user authentication have within chaining as opposed to MSCHAPv2?
Thank you!
mitch
... View more
Labels:
08-09-2017
01:25 PM
Thanks so much for the advice and help!
And regarding the reliable provider bit, that's a whole 'nother can of worms. ;)
... View more
Created by
mitchell helton
in Switching
in Switching
08-09-2017
10:22 AM
08-09-2017
10:22 AM
Hey there!
We're looking to move to doing BGP with our ISPs as we host some public facing services on site. This would be multi-homed via a single local router to two ISPs.
So that's the reason we're looking to do BGP for inbound purposes.
For outbound, we're currently using floating static routes and PBR to utilize both providers. As I was thinking through the design of moving to BGP and started labbing this up, I think I like the idea of ECMP with IP SLA for outbound.
My question is, would it be an unusual or discouraged design to do BGP with our two ISPs for inbound purposes (advertise them our public IP space) but for outbound use ECMP instead of having them send us a default route?
I was reading through this (specifically the section of load sharing with a single local router and multiple ISPs), and I'm not completely opposed to the idea - in fact I'd rather use dynamic routing, but here's my concern. We've had numerous outages through one of our providers where they have a fiber cut, internal failure, etc and our interface facing them stays up. And even a few hops inside of their network is still 'up', but the traffic fails before it makes it outside of their network to the rest of the internet. During a failure like this, how would anything other than IP SLA with static routes catch this failure? I'm concerned if we used their advertised default routes we'd run the risk of being blackholed during this type of outage.
Hope this makes sense. I appreciate your help and look forward to your thoughts!
Thanks!!
mitch
... View more
Labels:
11-23-2015
05:59 AM
Believe it or not, I tried to do that but couldn't figure out how. How can I mark this as resolved? :)
... View more
Created by
mitchell helton
in Policy and Access
in Policy and Access
11-17-2015
03:31 PM
11-17-2015
03:31 PM
*SOLVED*
-After upgrading from 8.4(3) to 8.4(7)23 it started working. There must have been a bug with the version of code we were running.
Hey folks!
I'm trying to do direct authentication on a 5510 and running into some problems. It works in another area of our network with a 5505, and I have a suspicion it's SSL related, but I'm not sure. I'm hoping you experts can shed some light on this. :)
When I try to authenticate against the ASA to start the direct authentication process, I get presented with a certificate warning (expected), but when I tell it to proceed, it just keeps "spinning" and doesn't give me the login prompt - never returns a timeout or anything. Here is the relevent config:
aaa authentication listener https UNTRUSTED port 3456 redirect
aaa authentication match DIRECT_AUTH_UNTRUSTED UNTRUSTED MY-RADIUS
access-list DIRECT_AUTH_UNTRUSTED extended permit tcp object-group UNTRUSTED_SUBNET any object-group HTTP_HTTPS_TCP access-list DIRECT_AUTH_UNTRUSTED extended permit udp object-group UNTRUSTED_SUBNET object-group GOOGLE_DNS eq domain access-list DIRECT_AUTH_UNTRUSTED extended permit tcp object-group UNTRUSTED_SUBNET host 10.0.240.1 eq 3456
Here is the output of show logg. 10.0.240.65 is the interface that is listening for direct authentication attempts and .66 is the client machine trying to get access:
HQ-FW1# show logg | inc 10.0.240.65 Nov 17 2015 16:54:17: %ASA-6-302014: Teardown TCP connection 6478 for LIMITED_ACCESS:10.0.240.66/6628 to identity:10.0.240.65/3456 duration 0:57:11 bytes 902 TCP Reset-I Nov 17 2015 16:54:21: %ASA-6-302013: Built inbound TCP connection 6890 for LIMITED_ACCESS:10.0.240.66/7211 (10.0.240.66/7211) to identity:10.0.240.65/3456 (10.0.240.65/3456) Nov 17 2015 16:54:21: %ASA-6-302014: Teardown TCP connection 6890 for LIMITED_ACCESS:10.0.240.66/7211 to identity:10.0.240.65/3456 duration 0:00:00 bytes 843 TCP Reset-I Nov 17 2015 16:54:23: %ASA-6-302015: Built inbound UDP connection 6891 for LIMITED_ACCESS:10.0.240.66/68 (10.0.240.66/68) to identity:10.0.240.65/67 (10.0.240.65/67) Nov 17 2015 16:54:25: %ASA-6-302013: Built inbound TCP connection 6893 for LIMITED_ACCESS:10.0.240.66/7216 (10.0.240.66/7216) to identity:10.0.240.65/3456 (10.0.240.65/3456) Nov 17 2015 16:54:25: %ASA-6-302014: Teardown TCP connection 6893 for LIMITED_ACCESS:10.0.240.66/7216 to identity:10.0.240.65/3456 duration 0:00:00 bytes 843 TCP Reset-I Nov 17 2015 16:54:25: %ASA-6-302013: Built inbound TCP connection 6894 for LIMITED_ACCESS:10.0.240.66/7217 (10.0.240.66/7217) to identity:10.0.240.65/3456 (10.0.240.65/3456)
Here is the output of show asp table socket:
HQ-FW1# show asp table sock
Protocol Socket Local Address Foreign Address State SSL 0000869f 10.0.240.1:3456 0.0.0.0:* LISTEN SSL 0001208f 10.0.240.65:3456 0.0.0.0:* LISTEN SSL 0002087f 10.0.55.10:443 0.0.0.0:* LISTEN SSL 0002b97f 10.255.255.22:443 0.0.0.0:* LISTEN TCP 000309ef 10.0.55.10:22 0.0.0.0:* LISTEN TCP 0003f62f 10.255.255.22:22 0.0.0.0:* LISTEN SSL 000ded8f 10.0.240.249:3456 0.0.0.0:* LISTEN TCP 001a78f8 10.255.255.22:22 10.1.250.243:53275 ESTAB
For what it's worth, accessing the GUI over 443 works perfectly fine. I"m not sure what other show or debug commands would be useful, but please let me know and I can provide them.
Thanks!!!
mitch
... View more
Labels:
07-11-2019
Hey guys!Wasn't sure if this belonged in the ISE or Firewall forums...
anyway...As they subject says...
04-22-2019
In case someone else stumbles across this, I got some clarification from
Cisco via their Partner Hel...
04-16-2019
Thank you for the quick reply, Scott.Do you know what the replacement
for the 1852 will be? I did no...
04-16-2019
Good morning! First off, a quick question on the 1852i. I noticed that
when comparing the AP models,...
03-26-2019
Good afternoon, Gurus! We are in the process of deploying BYOD/Guest
access with ISE and I'm curious...
03-05-2019
Upgrading the Compliance module as well as AnyConnect has resolved the
issue for at least one of the...
Created by
mitchell helton
in Switching
03-05-2019
03-05-2019
This is finally resolved. Turns out there must've been a hardware
defect. After doing an RMA for the...
02-18-2019
Thanks for the advice. I do have a TAC case open and am waiting to hear
back. This is not the first ...
02-15-2019
Hello experts! I have 3 users (that have reported the issue at least)
that are periodically being bl...
Created by
mitchell helton
in Switching
02-01-2019
02-01-2019
I finally did the TAC recommended upgrade and it did not fix my issue.
According to the feature navi...
Created by
mitchell helton
in Switching
01-17-2019
01-17-2019
Thanks for the feedback guys. My account manager reached out to an
engineer colleague of his and sug...
Created by
mitchell helton
in Switching
01-15-2019
01-15-2019
Thanks for the reply! We started on 16.3.6 and upgraded to 16.3.7 due to
a bug that was causing relo...
Created by
mitchell helton
in Switching
01-15-2019
01-15-2019
Good morning! I have a case open w/TAC and have not made any progress.
It's being escalated by our a...
Public Statistics
| Date Registered | 10-13-2010 11:18 AM |
| Date Last Visited | 07-19-2019 06:17 AM |
| Total Messages Posted | 66 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "VIP Engager"){kind=icon}
