Can the Cisco solutions like the AIR-AP1852 with a 5520 WLC be configured to bridge wireless traffic at the AP - i.e., not tunnel all traffic to the WLC? If not, why not? What is the benefit one way vs. the other? Thanks! ... View more

ASA 5505 with 9.2(4) I am unable to get past the service object-group in an ACE. (the object group contains only 1 element now, but may be expanded, hence a "group of 1"). Notice below that the inline help doesn't offer anything other than <cr> after specifying the service-object. If I forge ahead and enter the rest of a valid line, it gives an error and does not accept it. There are no other ACE's in the ACL yet, this is to be the first ACE. If I specify "...permit tcp..." I can use network-object groups. object-group service objgrp_svc_httpspecial tcp port-object eq 8080 access-list acl_some_acl extended permit  objgrp_svc_ httpspecial  ? configure mode commands/options: <cr> myasa(config)# ... View more

I have a 2960x configured as a cluster command switch. I've manually added another switch as a member. On the *new* member, the "management IP" of the cluster is not the management VLAN, but the lowest value IP on the commander switch. More Info: COMMANDER: int vlan 1200 desc MANAGEMENT ip address 10.0.20.1 255.255.255.0 int vlan 1000 desc GW TO EDGE ip address 10.0.0.1 255.255.255.252 int vlan 4000 desc PUBLIC/GUEST ip address 172.16.0.1 255.255.0.0 vlan 1000 is *excluded* from the trunk port to the member. vlan 1000 is not defined on the member. add member from commander: cluster member 3 mac c800.xxxx.b200 vlan 1200 pass xxxx   MEMBER: int vlan 1200 desc MANAGEMENT ip address 10.0.20.13 255.255.255.0 ip default-gateway 10.0.20.1 show cluster Member switch for cluster "clst-core01" Member number: 3 Management IP address: 10.0.0.1 Command switch mac address: f078.1612.a580   From the member switch (10.0.20.13), it is a routed hop to 10.0.0.1. How is the 10.0.0.1 address showing on the member? Is that passed over the command channel? Is there any problem with the lowest IP and the base MAC for the cluster commander?   Side rant: It'd be nice if the doc for adding cluster members would mention - hey, you need to use the base MAC (or bia MAC), not the MAC of the management vlan, or even the MAC of the vlan showing as the "management IP" of the cluster!!! It was only after stumbling around and finding "show cluster candidate", and then digging further to find the matching MAC address, which is only displayed in "sh ver" - and even then not in the xxxx.yyyy.zzzz format so a "sh ver | in xxxx.yyyy.zzz" returns nothing!!! </rant> ... View more

Wondering if there's a way to log SLA or Track changes. I'm already using the syslog message 622001 already, but that only logs tracked routes, not the track or SLA itself. For example, I want to SLA/Track an item, but not necessarily tie a route to the track.   I've got several routes tied to tracks (and SLA's). I've have an "incident" where the syslog "removed track route x.x.x.x", then "added tracked route x.x.x.x" I'm looking to see logs for the SLA monitor itself (ping fails, status changes, etc.) Logging 622001 seems an indirect way around getting the info.   If I am forced to use routes tied to tracks, can I put a route with a really high metric that is never in the active route table?  Or would I have to do something kludgey like putting a /32 route to a non-existent, private IP (something not anywhere in my network)? Thanks in advance. ... View more

Hope this makes sense, please bear with me on the description...  I have an ASA 5510 with 2 ISP links (wan1 and wan2). I have different crypto-maps applied to each: wan1 has tunnels to remote branch inside lan's (also behind ASA 5505's at the remote branches) wan2 has a tunnel to Branch2 but the traffic is destined for the DMZ on that ASA, not the inside LAN. That is to say, crypto map map_wan1 has a peer for Branch2, but the match address is the inside lan, and map_wan2 has a peer to the same Branch2 public IP, but the match address is for the DMZ subnet. The reason for a separate tunnel on wan2 to branch2's dmz is the performance difference between the 2 ISP's. Now I need to failover from wan1 to wan2 if ISP1 goes down (an sla monitor - that's no problem). The "problem" is in having a map entry in map_wan2 with an identical configuration to its counterpart in map_wan1, but the tunnel should be built on wan1 most of the time, and only fail to wan2 if wan1 is offline. There is no need for the tunnel currently on wan2 to branch2/dmz to fail over if ISP2 is down. A pseudo-code example (SLA is configured and working on wan1/ISP1) route wan1 0.0.0.0 0.0.0.0 <wan1-gw> 1 track 1 route wan2 0.0.0.0 0.0.0.0 <wan2-gw> 2 ! ! note: a static route via wan2 for map_wan2 even when wan1 is default route ! route wan2 <branch2>/32 <wan2-gw> route wan2 10.0.0.0/24 <wan2-gw> access-list acl_branch2_lan permit ip 192.168.1.0/24 192.168.2.0/24 access-list acl_branch3_lan permit ip 192.168.1.0/24 192.168.3.0/24 access-list acl_branch2_DMZ permit ip 192.168.1.0/24 10.0.0.0/24 crypto map map_wan1 10 set peer <branch2> crypto map map_wan1 10 match address acl_branch2_lan crypto map map_wan1 20 set peer <branch3> crypto map map_wan1 20 match address acl_branch3_lan crypto map map_wan1 interface wan1 ! note: sequence #10 already exists and works crypto map map_wan2 10 set peer <branch2> crypto map map_wan2 10 match address acl_branch2_DMZ ! ! Can I add a "duplicate" of the peer/acl from map_wan1 to this map crypto map map_wan2 50 set peer <branch2> crypto map map_wan2 50 match address acl_branch2_lan crypto map map_wan2 60 set peer <branch3> crypto map map_wan2 60 match address acl_branch3_lan crypto map map_wan2 interface wan2 ... View more

I am getting input and CRC errors on the WAN interface of my Cisco router. I have tried several Cisco routers - (3) 1841's, and now a 2801. I've  replaced all cabling.  The Internet connection (cable) has been changed  from coax (30x5 - replaced the modem 3 times as well), to fiber at  50x50. We've worked with ISP and changed speed/duplex to different values - both auto and "locked" to matching values. Any  possibility the 10/100 interfaces on the 1841/2801 are having issues  with the Gbe links on all sides?  The inside interface is connected to  either a Gbe switch, or to the Gbe port on the Barracuda and does not  report input errors. Additionally, with 50x50 service, and a  single laptop connected to the inside interface of the 1841/2801, I can  only pull about 20x50.  If I bypass the Cisco and connect directly to  the ISP gear, I can pull the full bandwidth (50x50). One last nugget of information - this interface (fa0/1) is connected to the cable ISP, but we are using BGP and a GRE tunnel to route IP space from ISP #2, which is also connected to this router with a T1 WIC.  No NAT'ing is performed on this router - ALL  IP's are public IP's. The current configuration is: - Cisco ME3400 fiber switch from the ISP - copper patch cable directly to the 2801 - both devices set to auto speed/duplex - int s0/0/0 - T1 to ISP #2 - int fa0/0 - "inside" ... View more

Greetings. I have: 2811 running CME 8.5 (IOS 15.1(3)T3) Lync 2013 Most desk endpoints are Cisco phones (7940's, 7960's). 2811 has FXO ports for POTS connection to PSTN I'm using Lync for desktop/soft clients. I can dial to the Cisco phones.  I CAN'T dial from a Cisco phone to a Lync client yet either (different problem, I think) I am unable to dial from a Lync client "through" the CME to PSTN. Any suggestions on what the dial-peer needs to look like on the Cisco? Are there any guides on a simple config similar to this? Thanks! ... View more