Hello, As we all know sometimes Cisco documentation can be a little ambiguous and or vague in defining technical feature principals and this applies no less to the definition given to the ASA same security level feature. I have been searching and searching to get a detailed answer but have failed miserably.  I am unfortunately not in a position to lab this and depend on the information available. I would be most grateful to receive a definitive description of the inter-interface feature to understand the following concepts: When the same security-level inter-interface feature is disabled , and some interfaces have the same security level set, does the explicit ACL apply and anything permitted gets parsed and sent on?  Or is the same-level inter-interface command a pre-requisite to allow the ASA to process traffic destined to an interface of the same securite level regardless if an ACL is present in config? When the same security-level inter-interface is enabled and an inbound ACL is applied, is the ACL bypassed completely so any traffic is permitted ignoring an ACL?  Or does an ACL get processed before the security-level inter-interface is checked? Does anyone know of a link to a best practise and/or design document that explains this in great detail? Does anyone know of a link that describes the processing architecture of the Cisco ASA that covers this feature? Many thanks in advance for any help provided. Best regards. ... View more

Hello, I am looking for definitive confirmation that the Nexus 5500 series do not support WCCPv2. Does anyone know if it is not supported on 5500 series switches regardless of NX-OS version or if certain minimum NX-OS versions will support it?   Regards     ... View more

Hello, I am being tasked with a project to implement Cisco ASA 5585X firewalls with multiple contexts to be managed using a new CSM 4.6.x server.  Then I need to migrate FWSMs contexts, rules and NAT that are currently managed on a CSM version 3.3.1 (SP1) to the new ASA setup in order to decommission the FWSMs. Is there a migration process/method/document or set of tools that will allow me to migrate the access policies, NAT, interfaces and all other objects currently held on the CSM 3.3.1 to the new CSM 4.6.x version? Or is it not possible and I simply have to begin from scratch building out everything, object by object, rule by rule?   Thanks in advance for any assistance. ... View more

Hello, This is my first time working with the X genertaion of firewalls.  I note from an output of show interface ip brief I get an additional 4 interfaces along with the gigabitethernet interfaces, namely:   Internal-Control0/0        127.0.1.1       YES unset  up                    up Internal-Data0/0           unassigned      YES unset  up                    up Internal-Data0/1           unassigned      YES unset  down              down Internal-Data0/2           unassigned      YES unset  up                    up I am struggling to find any documentation as to what these interfaces are and what exactly it is they do and kindly ask if anyone has knowledge, a link or a white paper or architectural document to explain this for me.   Regards     ... View more

Hello, We are running a simple VC traffic marking setup across multiple IOS routers of mixed hardware 2921, 2801, 3925 and 3945s. Our aim was to simply mark packets from a particular VC source at each site and set the dscp to af31, for the ISP routers to then apply the relevant conditioning and prioritizing out on to the WAN. However, we have come across an issue on one of the 3925 routers that seems to show packets hiiting the ACL but not getting marked: RTR_US1#clear count           show policy-map int g0/1 GigabitEthernet0/1 Service-policy output: ppq queue stats for all priority classes: Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 2450/1743260 Class-map: video-conf (match-any) 2450 packets, 1743260 bytes 30 second offered rate 329000 bps, drop rate 0000 bps Match: access-group 131 2450 packets, 1743260 bytes 30 second rate 329000 bps QoS Set dscp af31 Packets marked 0 Priority: 3072 kbps, burst bytes 76800, b/w exceed drops: 0 Class-map: class-default (match-any) 9585 packets, 5127166 bytes 30 second offered rate 969000 bps, drop rate 0000 bps Match: any queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 9585/5127482 Our other 3925 at another site with a similar configuration works fine: Rtr_UK1#show policy-map int gi0/1 GigabitEthernet0/1 Service-policy output: ppq queue stats for all priority classes: Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 22223/15705754 Class-map: video-conf (match-any) 22223 packets, 15705754 bytes 30 second offered rate 974000 bps, drop rate 0 bps Match: access-group 131 22223 packets, 15705754 bytes 30 second rate 974000 bps QoS Set dscp af31 Packets marked 22223 Priority: 3072 kbps, burst bytes 76800, b/w exceed drops: 0 Class-map: class-default (match-any) 62248 packets, 10682892 bytes 30 second offered rate 751000 bps, drop rate 0 bps Match: any queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 62248/10685230 The configuration is identical with the exception of the source host defined in the ACL.  The router at fault is configured with the following: ! class-map match-any video-conf match access-group 131 ! policy-map ppq class video-conf   set dscp af31   priority 3072 ! access-list 131 permit ip host 10.234.200.41 any ! interface GigabitEthernet0/1 description OUTSIDE to CE Router 801 ip address 192.xx.xx.xx 255.255.255.252 no ip unreachables no ip proxy-arp ip flow monitor NETFLOW1 input ip flow monitor NETFLOW1 output ip flow ingress no ip mfib forwarding input no ip mfib forwarding output ip ospf hello-interval 1 load-interval 30 duplex full speed 100 no cdp enable crypto map getvpn-map service-policy output ppq ! The configuration for the working 3925 is as follows: ! class-map match-any video-conf match access-group 131 ! policy-map ppq class video-conf   set dscp af31   priority 3072 ! access-list 131 permit ip host 10.82.40.20 any ! interface GigabitEthernet0/1 description L3 to CE Router 1 ip address 10.xx.xx.xx 255.255.248 no ip redirects no ip unreachables no ip proxy-arp no ip mfib forwarding input no ip mfib forwarding output ip flow monitor NETFLOW1 input ip flow monitor NETFLOW1 output ip flow ingress ip tcp adjust-mss 1360 ip ospf hello-interval 1 load-interval 30 duplex full speed 100 no cdp enable crypto map getvpn-map service-policy output ppq ! Any assistance in helping to understand why this is happening on a particualr device is appreciated. Regards ... View more

Hello, I am looking to understand of there is any configuration method that will prevent fallback to a primary link when it restores after failure and stay on the secondary OSPF neighbor.  Something akin to the non-preempt method of HSRP for LAN services. We have dual routers that connect over OSPF to an ISP pair of routers.  At present it is a standard OSPF configuration of relevant participating interfaces with a redistribute of our statics to the ISP. The ISP then takes the OSPF updates and redistributes them into their BGP process and the BGP routes learnt from the WAN into the OSPF process to us. We want to be able to gain some control of fall back should the ISPs primary link fail so as service stays on the secondary router/links until we are ready to restore to primary manually.   ISP Rtr1   ---------------- ISP Rtr2      |                                 |                 |                                 |      |                                 |      |            (OSPF)          |      |                                 |      |                                 | Our Rtr1                     Our Rtr 2      |                                 |      |                                 |      |                                 | ------------------ LAN -------------------- Would appreciate any thoughs or suggestions. Regards ... View more

Hello, we have a number of different routers installed providing a GETVPN topology.  We have a pair of 3925 routers at our HQ that seemed to fail on their GETVPN capability. In fact it is safe to say that GETVPN tends to fail/freeze more often than we would like on our WAN. A check of the key server with command show gdoi ks members showed the failed routers still in the table, so we cleared them out manually, still no joy.  We then cleared out the ISAKMP SA table, still no joy.  We then rebooted on of the routers and we saw the registration to the KS and the KS acknowledge it as a member and phase 2 was established, ACLS pushed etc and this router could encrypt permitted traffic once more. So we decided as we need to get an RCA for the issue we worked on the secondary which was still failing to register.  We could see MAC and ARP details of connected devices but no IP reachability nor OSPF peers, even though in the ARP table.  (Our fail close ACL allows ESP etc and OSPF) We again tried manually resetting the gdoi process but no activity could be seen other than a periodic log output of the router trying to register.  (The key server did not see these registration requests).  We checked the L2 switches in between and no errors could be found.  We then removed the crypto map and OSPF and L3 reachability was restored.  As soon as we reapplied the crypto map the traffic again ceased. I am certain a reboot will restore the router but I would appreciate any subject matter experts to advise what may be causing these symptoms and any fixes or configuration gotchas.  I have scoured the bug toolkit for 15.2.4(M2) but no GETVPN or crypto messages are shown, even an extended search over a year old. Can any one help explain or deduce why traffic halts with a GETVP Member until it is rebooted? Thanks in advance.            ... View more

Hello, I have a pair of Cisco Nexus 7000 switches in a VPC configuration with several Nexus 5000 switches attached.  The config has about 50 or so VLANs each with a /24 subnet address assigned.  These SVIs include HSRP etc and are all a member of the same VRF.  Unfortunatelu I am not able to advise/confirm if the issue is on the last vlans and svis configured as I am not aware of the history/chronology of the configurations applied. The issue I have is that one of the Nexus 7000s seems to take some time providing output or even freezing until I issue a Ctrl+C when issuing simple commands such as "show ip arp vlan 123 vrf abc123" or "show mac address-table dynamic vlan 1234".  This seems to affect only some but not all vlans or all SVIs in the VRF.  This behaviour is the same whether accessing the cli via a console, SSH and/or telnet session. A check of CPU and mem reveals little utilisation to cause any concern and will begin a bug toolkit hunt for version 6.01.I just wondered if there is any experience here that may be able to help me diagnose and troubleshoot this problem. Any useful advice is appreciated. Regards ... View more

Hi, Working with Nexus 7k with NX-OS 6.0(1) code.  There are no ACLs for L2/L3 traffic nor port security in this scenario.  I have two (2) VDCs running and on one VDC when I issue the show mac address-table command with the dynamic, interface command options I get no results, the table freezes at the following: Legend:         * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC         age - seconds since last seen,+ - primary entry using vPC Peer-Link    VLAN     MAC Address      Type      age     Secure NTFY Ports/SWID.SSID.LID ---------+-----------------+--------+---------+------+----+------------------ I have to issue a Ctrl+C to break out of this. On the other VDC this does not seem to be an issue and I get a table of output. When issuing a clear mac address-table dynamic,  the prompt also freezes until a Ctrl+C is issued. Any ideas are greatly apprciated. ... View more

Hi, I have taken over a config where VLAN 1 has multiple secondary addresses, six (6) in total.  Interface ip helper-address and global ip dhcp smart-relay is configured but I am not seeing the gateway address being changed to the secondary sub-interfaces in packets captured on a sniffer, after three failed attempts using the primary IP address.  Three of the secondary interfaces are the users DHCP subnets. Is there an additional required option that must be configured to allow the smart relay agent to use and send the source IP from all of the remaining secondary interfaces that are required and not just the primary? Also when using a show ip route dhcp command, there is no output. Any advice on the more advanced options or reasons as to why only the primary source IP on VLAN 1 seems to be beng used despite the ip dhcp smart-relay being configured/enabled is appreciated. Regards ... View more

Can anyone advise the best way to allow non-load-balanced IP traffic through a Cisco ACE?  The ACE must load-balance for some traffic but act as a router for all other traffic. Regards ... View more