Hello, 2 nights ago I activated the policy the deviate the traffic from the inside interface to the cx-module.   After that the netflow exportations of this ASA become to have the source and destination with 0.0.0.0.   I'm still investigating it.     Relevant infos -------------- - The service policy that sends the traffic to CX is applied on inside interface. - CX module version -> 9.3.1.1 (112) - ASA version -> asa922-4-smp-k8.bin Any suggestions? ... View more

We have 5 costumers that filter their e-mails in our IronPort. Everything is OK, Ironport and senderbase are beautiful! But we are having some problems with bandwidth control. Today the MX of their domain is the same ip address of IronPort, and we are only able to control bandwidth by IP address. The solution that we used is a shared bandwidth limitation for this propose. But we and the costumer don't like very much of that. So we are looking for a way to force IronPort use different sources for each domain. With that I can control the bandwith based on IP address. Another, and better, solution would be something like VRF on routers world, or Context in ASA world. Something like a virtual mini-ironport to each costumer. Each one with their on Vlan, their on default gateway, rules and every thing else. Any suggestion? ... View more

I'm attaching a representation, simplified, of my scenario. I also attached the representative configuration of the two routers in question. Site-A is our major site (the are actually almost two sites. Different Buildings, but interconnected with Dark-Fiber). Site-X,Y,Z are the border sites of a big mesh with almost 30 sites and more the 40 Point-To-Point Links. Everything works fine thank to EIGRP. (Oh god, how this is better the any other alternate routing protocol) On Site-A, by redundancy reasons, we have two 3560-E doing Core Routing. (I was dreaming with VSS, but our money was a little short) I Use HSRP to provide First Hope Redundancy, and EIGRP to solve the routing to the radio mesh. In HSRP I use a track, based on the status of a stub LoopBack, to decrement the priority of HSRP. With this(shuting and no-shuting this loopback on each router) I can define which one is the Active box. It works fine... My problem becomes when I set the secondary box as Active. (Task that I need to do eventually, to maintenance and things like that) The problem is that I used the command "offset" on EIGRP to define which of those 3560 would be the prefered by the routers on sites X, Y, and Z. And when the 3560-3 is the active, traffic goes from him(3560-3) to mesh, but remains coming from mesh to standby box(3560-2). I was looking for some alternative using a route-map or something like that. But I couldn't find anything. My only alternative until now is to set a pair of EMM based on syslog message of track 1 state changing. Track 1 goes up -> Change the "off-set" to 25 Track 1 goes down -> Change the "off-set" to 50 But I really don't like this kind of solution. I prefer something already inside of the configuration. Does anybody has a suggestion? Edited by: Douglas Fernando Fischer -> First time -> Adjusting translations mistakes. Edited by: Douglas Fernando Fischer -> Second time -> Attaching Config files with the implemented solution. ... View more

Example: ! interface FastEthernet 0/0 ip address 10.0.0.2 255.255.255.0 standby 1 ip 10.0.0.1 standby 1 preempt standby 1 priority 150 ! interface Loopback 99 ip address 10.99.0.1 ! What I want is that: - when HSRP(or could be with VRRP) status of interface FastEthernet 0/0 is active, then interface Loopback is in "no shutdown". - when HSRP status of interface FastEthernet 0/0 is stantdby(or something else), then interface Loopback is in "shutdown". I thought that it can be mid with embedded event manager, or some cyclical TCL script. But how? Somebody has any suggestion? ... View more

A new costumer is implementing hybrid telephony(IP + Legacy TDM PBX). One of their requisites is to record all external calls, including those that comes and goes to extensions on legacy PBX. (see diagram 1) To record calls that goes to IP-phones its piece of cake. As the call that comes from POTS is "transformed" in RTP(Voip), We can use SPAN or Built-In-Bridge resources and use any of the many VOIP recorders that are available on the market(including some open sources solutions like oreka). But to record Calls that goes to Legacy PBX extensions, the things starts to become more complicated. As it is not converted on RTP, and goes directly from the PSTN E1-port to the PBX E1-port, is not possible to use VOIP recorders. What demands a dedicated hardware solution to record those calls. We were analysing, and if the E1 that are connected were connected to a different voice gateway, the calls would need to be transformed on RTP(Voip) to comes from one voice gateway and goes to the other voice gateway. (see diagram 2) The problem in this case is th cost of the two routers(obviously). The question: There is any solution like VRF to DialPeers? The idea would be isolate one of the E1-ports of the routers and one of the Ethernet-Interfaces of the router(like a different device), and then force the calls between those E1s flows over IP coming from one Ethernet to the other(With that, capture those RTP packets wolud be easy). ... View more

I still haven't found some bibliographic reference for this concept, but I divide routing em two types: Gross(on Brazilian Portuguese I say "bruto") Is the type of routing usually assigned to Catalyst Switches L3(6500, 3750, 3560, etc...). Used to InterVlan routing, with very high performance and doesn't look to almost nothing else  the destination IP address. I happens on the backplane of the equipment not been limited to the throughput of an interface. Refined Is the type of routing usually assigned to ISR(GI or GII) or ASA. Used on traffics that demands more advanced features, like Statefull Inspection, LLQ QoS, nbar, netflow, but does not offer such a big throughput as an L3 switch. To it be routed needs to pass over some interface, been limited to that max throughput of that interface(10/100/Giga/TenGiga or sum of interfaces(LACP) . I would use Basic(Gross) and Advanced(Refined), but "basic" and "advanced" are terms already used by Cisco to defined feature sets. Maybe I'm daydreaming... But I'm not sure if that those terms are correct to defined what I want to define, or even if already exists the correct expressions for that. Any suggestions? ... View more

Recently we implemented VRF-Lite I our struture. In that job we also implemented RouteLeaking Between Coustumer VRFs, and our VRF(where we provide some services as Backup, Monitoring, NFS/iSCSI), etc, etc, etc... We control those route-leaking with route-maps(there are many examples in this forum). It is working fine, and does no consume so much resource of our cores as we were expecting. But what we would like to do is to filter the traffic passing from one VRF to another VRF. Lets imagine that those VRF would be different phisical routers. Wolud exist common interface between then. And wolud be possible to aply ACLs on those Interfaces. What we want to do is something like that, but inside the same router, between the VRFs. I tried to search some solution to that(google, cisco, supportforum), but I think that I'm not using the correct terms on the search. I was looking the possible commands related to that and a found: Possibility A This is the VRF of our costumer, and my undestanding of that command is that any traffic leaked via from this VRF via BGP would be sourced from an specific loopback and there we would aply the ACLs that we  need. Am I right? core-siteA(config)#ip vrf costumer-a core-siteA(config-vrf)#? VPN Routing/Forwarding instance configuration commands:   bgp              Commands pertaining to BGP   default          Set a command to its defaults   description      VRF specific description   exit             Exit from VRF configuration mode   export           VRF export   import           VRF import   inter-as-hybrid  Inter AS hybrid mode   maximum          Set a limit   mdt              Backbone Multicast Distribution Tree   no               Negate a command or set its defaults   protection       Configure local repair   rd               Specify Route Distinguisher   route-target     Specify Target VPN Extended Communities   snmp             Modify snmp parameters   vpn              Configure VPN ID as specified in rfc2685 core-siteA(config-vrf)#bgp ?   next-hop  Next-hop for the routes of a VRF in the backbone core-siteA(config-vrf)#bgp next-hop ?   Loopback  Loopback interface core-siteA(config-vrf)#bgp next-hop loopback ?   <0-2147483647>  Loopback interface number core-siteA(config-vrf)# bgp next-hop loopback 0 ?   <cr> Possibility B This would be the route-map used on reoute leaking, and the Idea  in this case is force the traffic that goes to our-company VRF to pass  for an specific Loopback and there we would aply the ACLs that we need. But my doubt is if this SET can be used on a route-leaking route-map !?! core-siteA(config)#route-map VRF_COSTUMER-A_TO_OUR-COMPANY permit 10 core-siteA(config-route-map)#set ?   as-path           Prepend string for a BGP AS-path attribute   automatic-tag     Automatically compute TAG value   clns              OSI summary address   comm-list         set BGP community list (for deletion)   community         BGP community attribute   dampening         Set BGP route flap dampening parameters   default           Set default information   extcomm-list      Set BGP/VPN extended community list (for deletion)   extcommunity      BGP extended community attribute   global            Set to global routing table   interface         Output interface   ip                IP specific information   ipv6              IPv6 specific information   level             Where to import route   local-preference  BGP local preference path attribute   metric            Metric value for destination routing protocol   metric-type       Type of metric for destination routing protocol   mpls-label        Set MPLS label for prefix   origin            BGP origin code   tag               Tag value for destination routing protocol   traffic-index     BGP traffic classification number for accounting   vrf               Define VRF name   weight            BGP weight for routing table core-siteA(config-route-map)#set ip ?          address     Specify IP address   default     Set default information   df          Set DF bit   global      global routing table   next-hop    Next hop address   precedence  Set precedence field   qos-group   Set QOS Group ID   tos         Set type of service field   vrf         VRF name core-siteA(config-route-map)#set ip vrf ?   WORD  VRF name core-siteA(config-route-map)#set ip vrf our-company ?   next-hop  Next hop address core-siteA(config-route-map)#set ip vrf our-company next-hop ?   A.B.C.D  IP address of next hop core-siteA(config-route-map)# set ip vrf our-company next-hop 10.10.10.10 ?   A.B.C.D  IP address of next hop   <cr> Could any one make some correction or suggestion? ... View more

Hello, We are creating a new infrastructure in our DC. It involves Border, Firewall, Core, Lan Access... AND DNS solution. So, to reduce the complexity and by security questions, I created a simulated Scenario that express my doubt. The ideas in here are: Avoid double NAT on stations accessing internal servers Distribute the DNS entries on their own DNS-Server-Costumer. Simplify the managing of our Authoritative DNS-Servers, not needing to filter the source of the request to define the reply. So, to the practice! Please follow the my logic on the attached drawing. First - Internal Stations reaching internal servers using internal DNS Very Simple! ASA does Nothing! Lets say station 192.168.10.65 need to access www.costumer-a.com. The station is configured to consult internal DNS(192.168.10.10). The Internal DNS reply with 192.168.10.20. Station talks directly to Server And every thing is blue... P.S.: This works also to customer b. Second - External Client(Internet) reaching internal servers(by NAT) Here comes my doubts. Lets say an internet station 200.201.202.203 need to access www.costumer-a.com. It will make a DNS consult by www.costumer-a.com to the DNS that is configured over there. DNS World Hierarchy will deliver this consult to aour DNS server(172.30.100.10) Our DNS will make a consult of "www.costumer-a.com" to 172.30.10.10 This consult will reach the internal DNS-Server(192.168.10.10) The Internal DNS reply with 192.168.10.20 to our DNS-Server When this reply passes across ASA, it will Re-Write the answer to Nated IP 172.30.10.20 Will it??? Even been the inverse of the usual? And if the communication between our DNS-Server and our Costumer DNS-Server, instead of been a simple consult it occurs as a DNS TCP? Will ASA rewrite this answer? If the consult that Internet Station made were "system.costumer-a.com", considering that it doesn't has a Static NAT(It goes out by a overload NAT), What will Happen? Our DNS-server will receive this answer and will reply it to the original consult The Internet station will receive the DNS Reply with public IP of the server. The Internet station will connect to the public IP, that will be Nated. And every thing is blue... Third - Internal Client, misconfigured, using external DNS(8.8.8.8 for example) Almost as the second situation, but will occours two ReWrites. Lets say the station 192.168.10.75 need to access www.costumer-a.com. It will make a DNS consult by www.costumer-a.com to the DNS that is forced, 8.8.8.8(google) DNS World Hierarchy will deliver this consult to aour DNS server(172.30.100.10) Our DNS will make a consult of "www.costumer-a.com" to 172.30.10.10 This consult will reach the internal DNS-Server(192.168.10.10) The Internal DNS reply with 192.168.10.20 to our DNS-Server When this reply passes across ASA, it will Re-Write the answer to Nated IP 172.30.10.20 This is the First ReWrite Our DNS-server will receive this answer and will reply it to 8.8.8.8 Google DNS-Server will receive it and reply 172.30.10.20 to the internal station. When this reply passes acros ASA(again), it will Re-Write the answer to Nated IP 192.168.10.20 This is the Second ReWrite The internal station will receive the DNS Reply with internal IP address of the server. The internal station will talk directly to the server. And every thing is blue... Will this really happend or there is some more issues that We are not considering? ... View more

If you go to http://cisco.com/go/fn Do a search by feature Filter "VTP" Selecto "VTP (Virtual Trunking Protocol) Version 2" Click Continue button On Release/Plataform tree choose Plataform Chose IOS Chose ME3400 Will be presented many IOS Version that supostly supported. As you can see in attached image. But on pratice, when you go to CLI, the commands are not there: cfw-3400#show v? version  vlan  vmps  vrf vrrp     cfw-3400#conf t Enter configuration commands, one per line.  End with CNTL/Z. cfw-3400(config)#v? vlan  vmps  vrf  cfw-3400(config)#end cfw-3400#sh ver | in image file System image file is "flash:/me340x-metroipaccessk9-mz.122-58.SE2/me340x-metroipaccessk9-mz.122-58.SE2.bin" cfw-3400# What is wrong? FN? My config missing something? ... View more