I have a problem trying to figure out how I can connect Firepower 2130 10G to a Nexus core.   Here's the plan....   I'm thinking about using the Nexus 92108TC-EX switch in a new DC environment. The plan (to standardise on a single type) is to use a couple of these inter-linked with 2 twinax 3m 100G links as a 'core' and then connect a set of the same switches via Nx10G copper as edge switches (using VPC).   It's nice and simple as I get to use a single fixed switch type and Nx10G from access to my core is fine. Edge servers will be mostly 1G with some at 10G. All copper using existing Cat6. The 100G interlinks give me plenty of bandwidth in the core.   I have to repeat the model several times for different physically separated environments so one switch type is important.   So far so good........   But now I'd like to plug in my core Firepower 2130 firewalls at 10G. But there's no 10Gbase-T copper support on these.   So I was thinking about breaking out a QSFP28 port off each core switch to Nx10G using a relevant breakout cable - probably twinax and plugging into the firewall.   It's really unclear but it looks like I can't do a breakout on an 'uplink' port of a Nexus 93108TC-EX from other's experience. It's not allowed.   My only other option is to use the SFP version in the core (93108YC-EX) but then, if I can't use a breakout, I'd have to use this on a separate switching layer just for the firewalls (Expensive)   Any ideas for a cost-effective solution ?     ... View more

Hi,   Description: We have a portal webservice hosted by an ACE4710. It has two services (www/https) on the same IP 10.1.1.1. One is a redirect service that redirects all requests to tcp/80 on this ip to the other which is a 'standard' https proxy service. The backend servers are http only. Externally everything needs to be https. So we have an ssl proxy and Location header http to https rewrite on the https service.   The configuration below operates correctly on v5_1_2. But with a code upgrade to 5_3_1b, the Location header rewrite does not work. We've tried several different configurations and even 'ssl url location rewrite ".*". It just looks like the ACE is completely ignoring the configuration to rewrite the Location field. Reverting to the older code fixes the problem. Problem seen: Here is the problem as seen on the *client*. The 302 redirect Location header is NOT rewritten: Response headers: HTTP/1.1 302 FOUND Server: nginx Date: Fri, 20 Mar 2015 10:59:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 295 Connection: keep-alive Location: http://website.liveportal.nhs.uk/homepage/information Cache-Control: no-cache, no-store Set-Cookie: information=35a7831d-928d-4122-aef3-39ef48ac4440; Path=/; secure; HttpOnly X-Frame-Options: DENY HTTPSampleResult fields: ContentType: text/html; charset=utf-8 DataEncoding: utf-8   Config extract: 1) Set up the servers (4 normal on tcp/80 and one for a redirect) rserver host WEBSERVICE-1   ip address 192.168.1.1   conn-limit max 200000 min 160000   inservice ...and the same for the other three rserver redirect PORTAL_REDIRECT   webhost-redirection https://%h/%p 302   inservice 2) Set up the server farms serverfarm host PORTAL_LIVE   probe webping   rserver WEBSERVICE-1 80     inservice   rserver WEBSERVICE-2 80     inservice   rserver WEBSERVICE-3 80     inservice   rserver WEBSERVICE-4 80     inservice serverfarm redirect PORTAL_HTTP_REDIRECT   rserver PORTAL_REDIRECT     inservice 3) Setup the ssl proxy and a location rewrite to https for responses from the servers action-list type modify http HTTPS_LOCATION   header rewrite response Location header-value "http://(.*)" replace "https://%1" ssl-proxy service WEB_SSL_PROXY   key webportal.key   cert webportal.crt   chaingroup root-chain   ssl advanced-options SSL-SECURE-STRONG-WEB 4) Set up the L4 services class-map match-all PORTAL_HTTP   2 match virtual-address 10.1.1.1 tcp eq www class-map match-all PORTAL_SSL   2 match virtual-address 10.1.1.1 tcp eq https 5) Setup the policy maps - one for the reals servers with header rewrite for redirects policy-map type loadbalance http first-match PORTAL_HTTP   class class-default     serverfarm PORTAL_HTTP_REDIRECT policy-map type loadbalance http first-match PORTAL_SSL   class class-default     serverfarm PORTAL_LIVE     action HTTPS_LOCATION 6) Create the service policy policy-map multi-match EXTERNAL-SERVICES   class PORTAL_SSL     loadbalance vip inservice     loadbalance policy PORTAL_SSL     loadbalance vip icmp-reply     appl-parameter http advanced-options PARAM-HTTP     ssl-proxy server WEB_SSL_PROXY   class PORTAL_HTTP     loadbalance vip inservice     loadbalance policy PORTAL_HTTP     loadbalance vip icmp-reply 7) Apply to the interface interface vlan 211   description External Access   ip address x.x.x.x 255.255.255.0   alias x.x.x.x 255.255.255.0   peer ip address x.x.x.x 255.255.255.0   access-group input PERMIT-ALL   service-policy input EXTERNAL-SERVICES   no shutdown   ... View more

Hi Got some new 3750x running c3750e-universalk9-mz.150-2.SE5.bin. They have identical aaa configs to other switches running 15 code (4948e) doing LOCAL device user authentication for VTY SSH access. Relevant bits are: username xxx privilege NN secret yyy aaa new-model aaa authentication login VTY local aaa authorization config-commands aaa authorization exec VTY local aaa authorization commands 15 VTY local aaa session-id common line vty 0 4  session-timeout 10  access-class 23 in  authorization commands 15 VTY  authorization exec VTY  login authentication VTY  transport input ssh For some reason, on SSH to the device, the login banner comes up but the password: prompt takes a few seconds. At the same time some authfail logs are seen even through haven't yet had a chance to login/enter the password. Once entering the correct password, authentication is always (correctly) successfully This does not occur on the older code (12.2) or on the 4948e with 15.0 code. It is annoying as we collect audit syslogs and every login where local is used generates one or more fails before a success. Is there something obscure in 15.0+ code that changes LOCAL aaa behaviour ? ... View more

Hi, I've done quite a bit on the 5500 series WLCs where I enabled MIC-based AP authorization with the auth-list function. i.e. to associate an AP had to have a valid MIC and have its MAC present in the AP auth-list. *** This function does not seem to appear in the 3850 *** I can see that you can turn on the MIC option but there is no equivalent of the auth-list. Does this imply that we have to do AAA authorization of the AP now ? Then, does this mean that we have to use separate AAA entities for clients and APs (to avoid someone getting the AP MAC and using it as a client auth if AAA used) ? The manual is not too helpful. ... View more

Hi, I have a test setup working fine in general with IPV4/IPV6. However, I have one situation where I'd like to do what I do in IPV4 for IPV6 The situation is where an IPV4 SLA pings two IP addresses. Then there are two static routes tracking these two routes. Under certain failure conditions, the tested destinations disappear and the pings fail. The static routes disappear and a floating static on another router seen via OSPF takes over. All this works well with IPV4. I'd like to do the same in IPV6 but there is no equivalent to the ip route x.x.x.x y.y.y.y z.z.z.z track N command I have 12.4.22T and can configure the icmp echo tests fine and they go up/down correctly when the tested destination goes, but I can't configure the ipv6 static as there is no command: ipv6 route x:x:x:x::/x z:z:z:z::z track N Had a look round 15.2 code and still nothing. Anyone know if this is coming ? Or is there another way ? ... View more