Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About DejanMilicevic
Stats
Member since
12-23-2009
28
Posts
0
Helpful
0
Solutions
Created by
DejanMilicevic
in IP Telephony and Phones
in IP Telephony and Phones
11-13-2012
12:28 PM
11-13-2012
12:28 PM
Hi Jonathan . Thanks for the explanation. The problem is that the company management wants stable CUCM version so we got 8.5 image from the seller to try in our lab till the equipment arrive. So the in that case I need licenses for cluster right? and what is difference between physical and VMware environment. Can I use demo licenses for all Cisco phones in both cases or not?
... View more
Created by
DejanMilicevic
in IP Telephony and Phones
in IP Telephony and Phones
11-13-2012
12:46 AM
11-13-2012
12:46 AM
We are getting into a new project implementing CUCM 8.5 cluster with a large number of phones? The phones we are considering are 7965,7962,7942 and 6921. We will have few SIP trunks. I was thinking to try everything in the lab environment and I have few questions if someone can help. So I was planning to use VMware for two CUCM 8.5 in the cluster and attach a few Cisco phones mentioned above and create SIP trunk to some GSM gateway and another IP PBX. I read somewhere that CUCM 8.5 comes with 150 demo licenses (need to be activated after installation). What does it means? Can I attach any Cisco phone? What do I need voice router if the SIP trunks are on the same codec? If I use two physical servers to configure cluster are there also demo licenses or just in the VMware environment? And in general what are the licensing methods in the 8.X CUCM? Thanks in advance.
... View more
Labels:
Created by
DejanMilicevic
in IP Telephony and Phones
in IP Telephony and Phones
11-09-2012
03:29 AM
11-09-2012
03:29 AM
We have CUCM 8.5 in our lab (without Cisco Router as gateway) with few Cisco phones and our production IP PBX is IP Office 500 R7. I tried to configure SIP trunk between CUCM and IP Office using guide on https://devconnect.avaya.com/public/download/interop/CUCM8IPO7SIPtk.pdf . Calls from Avaya IP Office to CUCM are working fine, but in other direction we got busy tone on Cisco phone. Any idea what is the problem. I tried everything without luck. Thanks.
... View more
Labels:
Created by
DejanMilicevic
in IP Telephony and Phones
in IP Telephony and Phones
03-15-2012
07:11 AM
03-15-2012
07:11 AM
How to hide caller ID for extensions when they are making outgoing call so that called person gets private number o display for example? Can this be done on CME or the provider has to do this? Can it be done for all extension and also only for certain extension? Thanks
... View more
Labels:
Created by
DejanMilicevic
in Switching
in Switching
09-21-2010
02:38 PM
09-21-2010
02:38 PM
Thanks Scott.
... View more
Created by
DejanMilicevic
in Switching
in Switching
09-20-2010
02:02 PM
09-20-2010
02:02 PM
At the moment the situation on one segment (others are similar) is like in figure until we get all Gigabit switches. So, the spanning tree blocked Gi 0/2 on third switch and that's ok. Now if I want to set priority so that VLANs 10,20 go only through upper link, and 30,40,50,60 only through lower link, how to do that, with port priority or path cost, or with both. This is VLAN Load Balancing Between Trunks Using the Spanning-Tree Protocol Port Priority found on http://www.cisco.com/en/US/tech/tk389/t ... e96a.shtml. The example is for redundant links between two switches, so we can create port priority for certain VLANs and there is any waste. How can use this method in my case? Thanks...
... View more
09-19-2010
08:39 AM
The picture shows part of a network consisting of Cisco 3750 L3 switch that routes between VLANs and a number of physically separate segments with 2960 switches. They are connected with trunk's and redundant optical links to the L3 switch. L3 is a VTP server and the other switches are in client mode and L3 is the root bridge. Switch addresses are in VLAN 1 and L3 is their default gateway. Spanning tree mode on the switches is pvst and ports are in switchport mode access or trunk mode. The request is to insert the new 2960 gigabit switches which enables access to the servers with gigabit link, that would use only its trunk with VLANs 1,150 and 160, and all other VLANs to use one of its redundant links. Does topology in picture allows such a thing? How Spanning tree selects which redundant link to use and which to block and does it have any impact if I do create topology like on picture. Will the third link be blocked regardless that carries the other VLANs, so I'll end up having only one link? Another possibility is that the two gigabit links that go to the new 2960 4-SFPA put in the ether channel, and I have 2 gigabits, but with the change so that upper link and lower ether channel carries all VLANs and to assign QoS for prioritizing vlan 150 and 160 (if it is possible to assign a Gigabit?). How do I set the switch in the ether channel to be root port, and not the top gigabit link (I want this link in blocked state)? Do I have to leave STP mode in pvst or to change to the rapid-pvst and do I need something to change on the access ports or trunk ports for fast convergence (faster connections on ports)-enable Portfast level Switch? Thanks...
... View more
Labels:
Created by
DejanMilicevic
in Firewalls
in Firewalls
09-08-2010
12:45 PM
09-08-2010
12:45 PM
ASA config is below and bandwith limit is 512/512 kbit/s. With any combination using policy on outside/inside interface and input/output (single or both) it doesn't work? Any suggestions? ASA Version 8.2(2) ! hostname ASAfirewall enable password jbzGGb3hW4EV5FGM encrypted passwd 2KFQnbNIdI.2KYOU encrypted names name 10.1.101.0 LAN description VlanPC name 10.1.100.0 Switches description Switches name 10.1.103.0 WirelessPrivate description WirelesusersPrivate dns-guard ! interface Ethernet0/0 no nameif no security-level no ip address ! interface Ethernet0/0.1 vlan 51 nameif outside security-level 0 ip address 94.247.XXX.XXX 255.255.255.252 ! interface Ethernet0/1 no nameif no security-level no ip address ! interface Ethernet0/1.1 vlan 110 nameif inside security-level 100 ip address 10.1.1.1 255.255.255.252 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 management-only ! banner exec * WARNING * banner exec IF YOU ARE NOT AUTHORISED TO ACCESS THIS SYSTEM EXIT IMMEDIATELY! boot system disk0:/asa822-k8.bin ftp mode passive clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup outside dns domain-lookup inside dns domain-lookup management same-security-traffic permit inter-interface same-security-traffic permit intra-interface object-group network Lan description VLAN PC object-group network NETWORK_OBJ_192.168.100.0_25 object-group network PCtoNetGroup object-group network Net access-list 101 extended permit icmp any any echo access-list 101 extended permit icmp any any unreachable access-list 101 extended permit icmp any any time-exceeded access-list 101 extended permit icmp any any source-quench access-list 101 extended permit icmp any any access-list clinical_splitTunnelAcl standard permit LAN 255.255.255.0 access-list NetAccess extended permit ip host 10.1.101.5 any access-list NetAccess extended permit ip host 10.1.101.30 any access-list NetAccess extended permit ip WirelessPrivate 255.255.255.0 any access-list NetAccess extended deny ip any any access-list VPNclinical_splitTunnelAcl standard permit LAN 255.255.255.0 access-list VPNclinical_splitTunnelAcl standard permit Switches 255.255.255.0 access-list VPNclinical_splitTunnelAcl_1 standard permit LAN 255.255.255.0 access-list VPNclinical_splitTunnelAcl_2 standard permit LAN 255.255.255.0 access-list VPNclinical_splitTunnelAcl_5 standard permit LAN 255.255.255.0 access-list VPNclinical_splitTunnelAcl_3 standard permit LAN 255.255.255.0 access-list VPNclinical_splitTunnelAcl_4 standard permit LAN 255.255.255.0 access-list inside_nat0_outbound extended permit ip LAN 255.255.255.0 192.168.100.0 255.255.255.128 access-list inside_nat0_outbound extended permit ip Switches 255.255.255.0 192.168.100.0 255.255.255.128 access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.252 192.168.100.0 255.255.255.128 access-list rate-limit-wireless extended permit ip WirelessPrivate 255.255.255.0 interface outside pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 mtu management 1500 ip local pool VPNpool 192.168.100.1-192.168.100.100 mask 255.255.255.0 icmp unreachable rate-limit 1 burst-size 1 icmp permit any outside icmp permit any inside asdm image disk0:/asdm-631.bin no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 LAN 255.255.255.0 nat (inside) 1 WirelessPrivate 255.255.255.0 access-group 101 in interface outside access-group NetAccess in interface inside route outside 0.0.0.0 0.0.0.0 94.247.XXX.XXX 1 route inside Switches 255.255.255.0 10.1.1.2 1 route inside LAN 255.255.255.0 10.1.1.2 1 route inside WirelessPrivate 255.255.255.0 10.1.1.2 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy http server enable http 0.0.0.0 0.0.0.0 outside http LAN 255.255.255.0 inside http 192.168.1.0 255.255.255.0 management no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set RA-TS esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map DYN_MAP 10 set transform-set RA-TS crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto isakmp identity hostname crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet 0.0.0.0 0.0.0.0 outside telnet LAN 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 192.168.1.2-192.168.1.254 management dhcpd enable management ! threat-detection basic-threat threat-detection statistics host threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn enable outside group-policy DfltGrpPolicy attributes vpn-idle-timeout none group-policy VPNclinical internal group-policy VPNclinical attributes vpn-tunnel-protocol IPSec split-tunnel-policy tunnelspecified split-tunnel-network-list value VPNclinical_splitTunnelAcl group-policy VPNclients internal group-policy VPNclients attributes vpn-tunnel-protocol webvpn webvpn url-list none username xxxx password DyDq4NEbqGjfIfWL encrypted privilege 15 username yyyy password GQ6EDJEzerx065iq encrypted privilege 15 username zzzz password KCW0Chtpty2A/5kt encrypted username wwww password APYksyyt89fKLVDC encrypted privilege 15 tunnel-group VPNclinical type remote-access tunnel-group VPNclinical general-attributes address-pool VPNpool default-group-policy VPNclinical tunnel-group VPNclinical ipsec-attributes pre-shared-key ***** tunnel-group VPNclients type remote-access tunnel-group VPNclients general-attributes default-group-policy VPNclients ! class-map rate-limit match access-list rate-limit-wireless class-map inspection_default match default-inspection-traffic ! ! policy-map global_policy class inspection_default inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect icmp inspect ip-options policy-map limit-policy class rate-limit police input 512000 96000 police output 512000 96000 ! service-policy global_policy global service-policy limit-policy interface inside prompt hostname context call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/odd ... DCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:06dee49ed404601c3f296eeb8c691bb2 : end asdm image disk0:/asdm-631.bin asdm location LAN 255.255.255.0 inside asdm location Switches 255.255.255.0 inside asdm location WirelessPrivate 255.255.255.0 inside no asdm history enable
... View more
Created by
DejanMilicevic
in Firewalls
in Firewalls
09-07-2010
06:24 AM
09-07-2010
06:24 AM
We have internet bandwidth 4/4 Mbps on outside interface. To inside interface are coming few internal network. How to limit internet bandwith usage for let's say 10.1.103.0/24 network to use 100/100 kbps. We tried as shown below but without luck. If we create subinterfaces for each vlan, we can apply policy on interfaces and that's working, but now we must do that ont few internal networks coming to ASA on inside interface. Are we apply traffic shaping (limit the flow of traffic) or traffic policing (traffic that exceeds the speed limit on the interface is dropped) and what about burst size? What is policing output and input? Why isn't this working? name 10.1.103.0 WirelessPrivate description WirelesusersPrivate access-list rate-limit-wireless extended permit ip WirelessPrivate 255.255.255.0 interface outside class-map rate-limit match access-list rate-limit-wireless policy-map limit-policy class rate-limit police output 100000 8000 police input 100000 8000 service-policy limit-policy interface outside
... View more
Labels:
Created by
DejanMilicevic
in Firewalls
in Firewalls
09-06-2010
12:14 PM
09-06-2010
12:14 PM
After sh run boot I noticed that 8.2 and 8.3 versions are both there for booting. With no boot system disk0:/8.3 I removed it. ASA is still working without any problem.I hope that there won't be any problems. Thanks again.
... View more
Created by
DejanMilicevic
in Firewalls
in Firewalls
09-04-2010
03:28 PM
09-04-2010
03:28 PM
Thanks for quick answers. I will go tomorrow on site and grab sh run and other info to discuss. Tips for 8.3 version: The NAT is different, network objects with network ranges are great thing,...BUT I found that this version has higher security because we couldn't ping outside interface, vpn didn't work, etc. (we permited everything, icmp on policy, acl on outside interface...). When we downgrade on 8.2(2) version ASA erased NAT and some acl with network object (ranges), and after configuring with old way everything worked like a charm till above problem. I am new to ASA and maybe I just didn't write the right line, but I think that 8.2 version is stable for working.
... View more
Created by
DejanMilicevic
in Firewalls
in Firewalls
09-04-2010
03:08 PM
09-04-2010
03:08 PM
What's the command for removing old image (no boot image or ...I tried that but it isn't accepted by ASA). What will happen if I remove all images from disk and leave just 8.2 version. The problem is that I can go tomorrow on the site to take sh run and config. But I belive you are right for not removing old image from booting. What I shoud do?
... View more
09-04-2010
12:54 PM
We have ASA 5510 running 8.2(2) image on asdm-631. When we upgraded from ver 7 to 8.3 we used command ASA5510# rename asa706-k8.bin asa706-k8.old. After upgrade to 8.3 version and asdm-6.3 we didn't accomplished to ping outside interface, make vpn to work, although we permitted everything. So we decided to downgrade to 8.2(2) version with same asdm-6.3 and after few modifications (vpn,NAT,access lists) everything worked fine. But just one day :-(. The problem is that ASA booted old 706-k8.bin version and asdm-5.0. The whole room is on UPS and I don't think it's a power failure? Cant it reboot by it self for some reason? We used command boot system disk0:/asa8.2−k8.bin , asdm image disk0:/asdm−6.3.bin and wr to write to memory. And the same problem after rebooting happend when there was 8.3 version. After power failure maybe or just by it self ASA booted old images? What will happen if we erase all images and asdm and leave just 8.2 and 6.3 version. I don't know what to do?Any suggestions?
... View more
Labels:
Created by
DejanMilicevic
in Firewalls
in Firewalls
08-31-2010
10:57 PM
08-31-2010
10:57 PM
Thanks for the advices, I will try. The above link is down.
... View more
Created by
DejanMilicevic
in Firewalls
in Firewalls
08-31-2010
02:31 PM
08-31-2010
02:31 PM
We have L3 3750 (InterVlan Routing) with created vlans on it without any restriction between. ASA 5510 is connected on one trunk port on L3 switch with Eth 0/1.1, 01.2,.. subinterfaces for each vlans (for policy rules for limiting bandwith). On Eth 0/2.1 is outside interface with static address e.g. 88.88.88.90 on vlan 50, def route is 88.88.88.89. Static NAT with network-object for each network.We use 8.8.8.8 google DNS. Problem: All natted network can go to the Internet and thats ok. But when we do tracert from any Internet enabled host it goes only to its gateway (vlan ip) and stops. We cant ping our outside interface 88.88.88.90 from inside networks. And also we cant ping public address from any home PCs-other ISP address 88.88.88.89 we are pinging without any problems. What's the issue here? What about def route from L3 swith - we don't need any right? How we can connect to ASA from outside (https,vpn) for management? We created remote vpn, but nothing happens. We permited all traffic to outside intraface, permited icmp,... all permited on in LAN interface, there are no restrictions. Any help?
... View more
Labels:
Created by
DejanMilicevic
in IP Telephony and Phones
11-13-2012
11-13-2012
Hi Jonathan. Thanks for the explanation. The problem is that the company
management wants stable CUC...
Created by
DejanMilicevic
in IP Telephony and Phones
11-13-2012
11-13-2012
We are getting into a new project implementing CUCM 8.5 cluster with a
large number of phones? The p...
Created by
DejanMilicevic
in IP Telephony and Phones
11-09-2012
11-09-2012
We have CUCM 8.5 in our lab (without Cisco Router as gateway) with few
Cisco phones and our producti...
Created by
DejanMilicevic
in TelePresence and Video Infrastructure
09-17-2012
09-17-2012
So if I want two SX20 boxes to see each other I need the above port
forwarding and configuration in ...
Created by
DejanMilicevic
in TelePresence and Video Infrastructure
09-17-2012
09-17-2012
I dont know abot the version. Today I will be at customer site. Please
if you can provide the additi...
09-17-2012
Hi,The customers bought SX20 package with multisite option and they want
to work as stand-alone devi...
Created by
DejanMilicevic
in IP Telephony and Phones
03-15-2012
03-15-2012
How to hide caller ID for extensions when they are making outgoing call
so that called person gets p...
09-20-2010
At the moment the situation on one segment (others are similar) is like
in figure until we get all G...
09-19-2010
/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table
Normal"; mso-tstyle-rowband-size...
09-08-2010
ASA config is below and bandwith limit is 512/512 kbit/s. With any
combination using policy on outsi...
09-07-2010
We have internet bandwidth 4/4 Mbps on outside interface. To inside
interface are coming few interna...
09-06-2010
After sh run boot I noticed that 8.2 and 8.3 versions are both there for
booting. With no boot syste...
09-04-2010
Thanks for quick answers. I will go tomorrow on site and grab sh run and
other info to discuss.Tips ...
Public Statistics
| Date Registered | 12-23-2009 12:47 PM |
| Date Last Visited | 08-18-2017 03:55 AM |
| Total Messages Posted | 28 |
