Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About TRENT WAITE
Stats
Member since
08-19-2010
31
Posts
5
Helpful
0
Solutions
09-12-2019
06:10 AM
Thank you George and Paul, you hit the nail on the head. I did forget to contact our ISPs.
... View more
09-10-2019
11:28 AM
I am doing a traceroute from my office to our data center routers. Doing a trace on the original subnet, it goes all the way through our ISP's network to our DC's network to our edge router. When doing traceroute on the new subnet (198.xx.xx.xx) it looks to die out after 3rd hop when reaching our ISP's backbone servers (il.ibone.comcast.net). My assumption is that while our routers are reporting they are advertising both subnets (new & old), only the old one is actually advertised or propagated.
... View more
09-10-2019
10:37 AM
Entering " network 198.11.11.0 mask 255.255.255.0" is accepted as in no error, but the configuration does not show the mask. This I assume because the subnet we obtained is a Class C and the mask I enter is /24. I forgot to add, I did do soft reset with "clear ip bgp xx.xx.xx.xx out".
... View more
09-10-2019
08:47 AM
Hi, we have BGP session announcing a subnet provided by one of our ISPs. Recently we obtained our own subnet to include in our BGP session with both our ISPs. Hoping someone can help me with this, I believe I have missed something simple. Each of our edge routers is connected to a different ISP, with iBGP running between them. From the outside I am unable to ping the new addresses, or running traceroute remotely finds the path of the new subnet. I have verified the new subnet was correct, but still see hours later in a ASN lookup only our original subnet advertised being shown. Running command "show ip bgp neighbor XXXXX advertised-routes" on each router shows both of our subnets correctly (I assume) Network Next Hop Metric LocPrf Weight Path *> 33.33.33.0/24 0.0.0.0 0 32768 i *> 198.11.11.0 0.0.0.0 0 32768 i I am able to access ALL devices/servers/etc that use 33.33.33.0 (original subnet) just fine. All new addresses, even these edge routers are inaccessible remotely from multiple locations. Right now the only difference is I have not added a null route to ISP #1's router. Internally everything looks like it should work (at least from my limited knowledge), externally the new subnet is not available or what appears advertised. Both routers are running IOS XE Software, Version 16.06.04. The new subnet 198.*** is a Class C provide by ARIN ISP #1 Router ISP #2 Router interface Port-channel1.100 encapsulation dot1Q 100 ip address 33.33.33.252 255.255.255.0 ! interface Port-channel1.101 encapsulation dot1Q 101 ip address 198.11.11.252 255.255.255.0 ! router bgp 2**53 bgp log-neighbor-changes network 33.33.33.0 mask 255.255.255.0 network 198.11.11.0 neighbor 10.2.2.2 remote-as 2**53 neighbor 10.2.2.2 next-hop-self neighbor 33.22.22.22 remote-as 1*4 neighbor 33.22.22.22 prefix-list ISPOUT out ! ip prefix-list ISPOUT seq 5 permit 33.33.33.0/24 ip prefix-list ISPOUT seq 6 permit 198.11.11.0/24 interface Port-channel1.100 encapsulation dot1Q 100 ip address 33.33.33.253 255.255.255.0 ! interface Port-channel1.101 encapsulation dot1Q 101 ip address 198.11.11.253 255.255.255.0 ! router bgp 2**53 bgp log-neighbor-changes network 33.33.33.0 mask 255.255.255.0 network 198.11.11.0 neighbor 10.2.2.1 remote-as 2**53 neighbor 10.2.2.1 next-hop-self neighbor 22.22.22.7 remote-as 3**4 neighbor 22.22.22.7 weight 100 neighbor 22.22.22.7 prefix-list ISPOUT out ! ip prefix-list ISPOUT seq 5 permit 33.33.33.0/24 ip prefix-list ISPOUT seq 6 permit 198.11.11.0/24 ! ip route 198.11.11.0 255.255.255.0 Null0 4451-C#show ip bgp neighbors 33.22.22.22 advertised-routes | include 33.33.33.0 *> 33.33.33.0/24 0.0.0.0 0 32768 i 4451-C#show ip bgp neighbors 33.22.22.22 advertised-routes | include 198.11.11.0 *> 198.11.11.0 0.0.0.0 0 32768 i 4331-L#show ip bgp neighbors 22.22.22.7 advertised-routes | include 33.33.33.0 *> 33.33.33.0/24 0.0.0.0 0 32768 i 4331-L#show ip bgp neighbors 22.22.22.7 advertised-routes | include 11.11.11.0 *> 11.11.11.0 0.0.0.0 0 32768 i
... View more
Labels:
Created by
TRENT WAITE
in VPN and AnyConnect
in VPN and AnyConnect
02-14-2019
09:38 PM
02-14-2019
09:38 PM
I have an existing site to site VPN using 192.168.1.0/24 subnet, with now a new customer who has the same subnet in use. At the remote is an ASA5506. I was wondering if I could create a sub-interface at 192.168.2.0/24, use that for the tunnel, and then NAT 192.168.2.0:192.168.1.0 from interface to interface. However if this would be possible, I have no idea how the NAT statement should look like. Is this possible with the ASA?
Below is the current config
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet1/2.100
vlan 100
nameif inside2
security-level 100
ip address 192.168.2.1 255.255.255.0 ! object network obj-192.168.1.15 host 192.168.1.15 object network obj-192.168.2.15 host 192.168.2.15 object network obj-10.1.2.200 host 10.1.2.200 ! nat (inside,outside) source static obj-192.168.1.15 obj-192.168.1.15 destination static obj-10.1.2.200 obj-10.1.2.200 no-proxy-arp route-lookup
I then tried the following NAT:
nat (inside,outside) source static obj-192.168.1.15 obj-192.168.2.15 destination static obj-10.1.2.200 obj-10.1.2.200 net-to-net
Then I changed the ACL from
access-list V1E extended permit ip host 192.168.1.15 host 10.1.2.200
to
access-list V1E extended permit ip host 192.168.2.15 host 10.1.2.200
... View more
Labels:
Created by
TRENT WAITE
in VPN and AnyConnect
in VPN and AnyConnect
01-16-2019
01:18 PM
01-16-2019
01:18 PM
Thanks RJI,
I took a second look and it turns out the vendor had provided a document with an example VTI config. But their example had not included the isakmp profile configuration which is what I was missing. I had instead included the old format isakmp + key + format . So I had tried to build the tunnel with only the example they provided, and of course it failed. I had only previous experience with crypto-maps, this was my first ipsec tunnel profile.
... View more
Created by
TRENT WAITE
in VPN and AnyConnect
in VPN and AnyConnect
01-16-2019
08:15 AM
01-16-2019
08:15 AM
I have 2 separate routers & tunnels I was looking to combine, but I am not familiar enough whether these are combatible to put on a single router. One uses GRE and crypto-map applied to the outside interface, the other uses crypto-ipsec profile applied to the tunnel interface.
Are these two methods compatible on a single router? In my test it failed, but I did not look too much further as I had assumed that the problem was the 1st tunnel's crypto-map applied to the outside interface would intercept traffic to tunnel 2.
Is this worth trying to find a work around, or are these two distinctly incompatible? I had assumed both would look at the source & destination to determine which policy to apply, but my test was not successful.
Tunnel #1
Tunnel #2
crypto isakmp policy 1 encr aes authentication pre-share group 2 ! crypto ipsec transform-set T1 esp-aes 256 esp-sha-hmac mode transport ! crypto isakmp key ****** address 6*.23.**.5 ! crypto map TUN0-MAP 10 ipsec-isakmp set peer 6*.23.**.5 set transform-set T1 match address 150 ! interface Tunnel0 ip address 1.1.1.2 255.255.255.252 tunnel source 10.5.1.55 tunnel destination 6*.23.**.5 ! interface FastEthernet4 ip address 10.5.1.55 255.255.255.0 crypto map TUN0-MAP ! access-list 150 permit gre host 10.5.1.55 host 6*.23.**.5
crypto isakmp policy 2 encrypt aes 256 authentication pre-share group 2 ! crypto isakmp key ****** address 2*.16.*.5 ! crypto ipsec transform-set ESP-AES-256-SHA esp-aes 256 esp-sha-hmac ! crypto ipsec profile VTI set transform-set ESP-AES-256-SHA set pfs group2 ! interface tunnel 1 ip address 2.2.2.1 255.255.255.254 tunnel mode ipsec ipv4 tunnel destination 2*.16.*.5 tunnel protection ipsec profile VTI
router bgp 2***1 neighbor 2.2.2.3 remote-as 6502 neighbor 2.2.2.3 default-originate
... View more
Labels:
01-16-2019
08:04 AM
Hi Sergey,
With my current configuration, if on R1 A or B I set the iBGP peers to use default-originate I was still getting the full routing table.
I.e. I had put
router bgp 2***1
neighbor 2.2.2.3 remote-as 6502
neighbor 2.2.2.3 default-originate
into R1 A, and I saw the table start to fill up on R2. I had not saved the config so I reloaded the router to reset it, and removed the entries on R1 A. That is when I took a step back to look into what I needed to do. In a test on different set of routers, I had used default-originate which provided the interior router with only 0.0.0.0 via bgp, but the source router only had 1 static route of 0.0.0.0 to the ISP.
My original idea was to have R1 A and R1 B send the default route to devices such as R2 via BGP so they could dynamically adjust to link/service changes with our ISPs as opposed to them currently using static route with R1 B as their default.
If I do default-originate on R1 A, would I then filter on R2 only to get the 0.0.0.0 from R1 A such as:
router bgp 2***1
bgp log-neighbor-changes
network 2.2.2.0 mask 255.255.255.0
neighbor 2.2.2.2 remote-as 2***1
neighbor 2.2.2.2 next-hop-self
neighbor 2.2.2.3 remote-as 6502
neighbor 2.2.2.3 default-originate
neighbor 3.3.3.254 remote-as 1****
neighbor 3.3.3.254 prefix-list ISP2 out
!
ip prefix-list ISP2 seq 5 permit 2.2.2.0/24
ip route 0.0.0.0 0.0.0.0 3.3.3.254
... View more
01-16-2019
06:48 AM
Hi, both my edge routers receive full table from their connected ISPs, and these route our subnet to multiple routers and firewalls at this time who are using static default route. My desire is to have both edge routers pass default via BGP. I have come up with the below scenario though have yet to test. On R2 and FW1 currently both have a static 'ip route 0.0.0.0 0.0.0.0 2.2.2.2'. I have little to no experience with BGP, so I thought it best to get some peer review before heading down to test this which could temporarily interrupt services. The intention is for interior devices such as R2 to dynamically get the default route in the event of ISP failure, but also be able to adjust the weight to alter path on need.
... View more
Labels:
01-06-2019
12:16 PM
Hi George,
Thanks for replying. I think at this point my issue is with R1 to R2 that I will need to look further into. I am able to ping from a device at 10.190.0.0 to the R1 router, but R1 to the device fails. Doing a traceroute I do see the first hop is the other end of the tunnel, but everything after that is * * *. I had initially thought that R3 was suppose to be able to only communicate with the 10.1.1.0 subnet of R2, that is not the case.
R3 is using our edge router as it's gateway, and applying a static route for 10.172.40.0 to R2 solves the remote devices being able to reach R1. As R1 contains a lot of unnecessary configuration I am going to start from scratch on Monday to include only that which is needed. Suffice to say this is not an issue or need to use NAT.
... View more
01-05-2019
02:50 PM
Below are the configs as of this morning. R1 is a test/development unit whereas R2 is presently in use for a different purpose, but was available for this testing.
Originally R1 was using EIGRP with 2x R2 routers (could call them R2A and R2B), but for this issue I changed that to only use just the one R2 router as I wanted to keep things simple as I could.
R1
R2
crypto isakmp policy 1 encr aes authentication pre-share group 5 ! crypto isakmp policy 2 encr aes authentication pre-share group 5 crypto isakmp key ******* address 38.xx.xx.xx ! crypto ipsec transform-set T1 esp-aes esp-sha-hmac mode tunnel crypto ipsec transform-set TM1 esp-aes 256 esp-sha-hmac mode transport ! crypto ipsec profile IPSEC set transform-set T1 ! crypto map VZ1 11 ipsec-isakmp set peer 38.xx.xx.xx set transform-set TM1 match address 131 ! interface Tunnel1 ip address 10.63.5.1 255.255.255.248 tunnel source 171.52.10.2 tunnel destination 38.xx.xx.xx ! interface GigabitEthernet0 ip address 171.52.10.2 255.255.255.248 ip nat outside ip virtual-reassembly in crypto map VZ1 ! interface GigabitEthernet1 ip address 10.172.40.1 255.255.255.224 ip nat inside ip virtual-reassembly in ! router eigrp 1 network 10.62.5.0 0.0.0.7 network 10.63.5.0 0.0.0.7 network 10.172.40.0 0.0.0.31 neighbor 10.63.5.2 Tunnel1 neighbor 10.62.5.2 Tunnel0 no eigrp log-neighbor-changes ! ! ip nat inside source list NAT interface GigabitEthernet0 overload ip route 0.0.0.0 0.0.0.0 171.52.10.1 ip ssh version 2 ! ip access-list standard NAT permit 10.172.40.0 0.0.255.255 ! ! route-map 10 permit 10 match ip address 110 ! route-map STATIC permit 10 match ip address 20 set metric 56 100 255 1 1500 ! access-list 20 permit 10.172.40.0 0.0.0.31 access-list 131 permit gre host 171.52.10.2 host 38.xx.xx.xx
crypto isakmp policy 1 encr aes authentication pre-share group 2 ! crypto isakmp policy 2 encr aes authentication pre-share group 5 crypto isakmp key ******* address 50.xx.xx.xx ! crypto ipsec transform-set TM1 esp-aes 256 esp-sha-hmac mode transport crypto ipsec transform-set T1 esp-aes esp-sha-hmac mode tunnel ! crypto ipsec profile IPSEC set transform-set T1 ! crypto map VZ1 11 ipsec-isakmp set peer 50.xx.xx.xx set transform-set TM1 match address 151 ! interface Tunnel1 ip address 10.63.5.2 255.255.255.248 ip nat inside ip virtual-reassembly in tunnel source 10.1.1.40 tunnel destination 50.xx.xx.xx ! interface FastEthernet4 ip address 10.1.1.40 255.255.255.0 ip nat outside ip virtual-reassembly in crypto map VZ1 ! interface FastEthernet4.100 encapsulation dot1Q 100 ip address 38.xx.xx.xx 255.255.255.0 ! router eigrp 1 network 10.1.1.0 0.0.0.255 network 10.63.5.0 0.0.0.7 network 10.80.0.0 0.0.0.255 network 38.xx.xx.0 0.0.0.255 redistribute connected route-map STATIC redistribute static route-map STATIC neighbor 10.63.5.1 Tunnel1 eigrp router-id 10.1.1.40 no eigrp log-neighbor-changes ! ip nat inside source list NAT interface FastEthernet4 overload ip nat inside source static 10.172.40.1 10.1.1.45 ip route 0.0.0.0 0.0.0.0 10.1.1.20 ip route 10.55.7.0 255.255.255.0 10.1.1.35 ip route 10.190.0.0 255.255.255.0 10.1.1.50 ! ip access-list standard NAT permit 10.172.40.0 0.0.0.255 ! route-map STATIC permit 10 match ip address 20 set metric 56 100 255 1 1500 ! access-list 20 permit 10.172.40.0 0.0.0.31 access-list 20 permit 10.80.0.0 0.0.0.255 access-list 20 permit 10.55.7.0 0.0.0.255 access-list 100 permit ip 10.172.40.0 0.0.0.255 any access-list 151 permit gre host 10.1.1.40 host 50.xx.xx.xx
... View more
01-05-2019
04:52 AM
Hi Francesco, thank you for replying. It is the device at 10.172.40.1 at R1 that needs to communicate with 10.90.0.50 behind R3 which is the router I have no access to. If I did, I would simply add a static route to 10.172.40.0 via 10.1.1.40 (R2).
In the diagram, the PC behind the FW1 is able to communicate to 10.90.0.50 because FW1 has a route to R3 and it NAT's internally to 10.1.1.112 (The PC is at 192.168.2.1). R3 is a Jasper managed router, and I have requested whether a static route could be added but have yet to hear back. If they can not do this, my remaining options are not good short of figuring out how to send to 10.90.0.50 with a source of 10.1.1.45
BTW 10.90.0.50 can ping any device on 10.1.1.0/24 subnet, but nothing else. It is my understanding (or assumption) R3 is doing VTI with dynamic routing but only advertising the one subnet, so devices on 10.90.0.0 only could ever pass traffic to 10.1.1.0.
... View more
01-04-2019
04:53 PM
I have a router (R1) that does VTI to a remote site, and that remote devices need to go through the tunnel to reach another device behind a router (R2). The 2nd router R2 I do not have access to, so I am unable to add a static route to find the remote device via R1.
So my thought was to NAT the remote device on R1 from its remote IP of 10.172.40.1 to 10.1.1.45, then R2 could communicate because it is on the same subnet as R1.
interface FastEthernet4
ip address 10.1.1.40 255.255.255.0
ip nat outside
!
interface Tunnel1
ip address 10.63.5.2 255.255.255.248
ip nat inside
tunnel source 10.1.1.40
tunnel destination 50.xx.xx.xx
!
ip nat inside source list NAT interface FastEthernet4 overload
ip nat inside source static 10.172.40.1 (remote device) 10.1.1.45
!
ip access-list standard NAT
permit 10.172.40.0 0.0.0.255
!
ip route 10.190.0.0 (remote subnet I need to reach) 255.255.255.0 10.1.1.50
In my head driving home it seemed simple enough, but in reality that has not worked. I ping another device with icmp debug on and can see the 'src' is still 10.172.40.1 and not 10.1.1.45. Since I am unable to add a static route on R2, I can not see any other way of the remote subnet communicating back unless it is on the 10.1.1.0/24 subnet.
Any ideas what I am missing or have done wrong?
... View more
Labels:
Created by
TRENT WAITE
in VPN and AnyConnect
in VPN and AnyConnect
10-18-2018
07:48 AM
10-18-2018
07:48 AM
Rahul, thanks for your reply. I did a debug platform and got the following:
ASA5525# IKEv2-PLAT-2: (1506): Decrypt success status returned via ipc 1 IKEv2-PLAT-2: (1506): Crypto map OUTSIDE_MAP seq 1 peer doesn't match map entry IKEv2-PLAT-2: (1506): Crypto map OUTSIDE_MAP seq 4 is incomplete IKEv2-PLAT-2: (1506): Crypto map OUTSIDE_MAP seq 5 peer doesn't match map entry IKEv2-PLAT-2: (1506): Crypto map OUTSIDE_MAP seq 8 is incomplete IKEv2-PLAT-2: (1506): Crypto map OUTSIDE_MAP seq 21 is incomplete IKEv2-PLAT-2: (1506): PROXY MATCH on crypto map OUTSIDE_MAP seq 22 IKEv2-PLAT-1: (1506): Rejecting child SA with the same traffic selectors as existing child SA - local protocol: 0 local selector: 10.x.x.x/0 - 10.x.x.x/65535 remote protocol: 0 remote selector: 10.xy.xy.xy/0 - 10.xy.xy.xy/65535 IKEv2-PLAT-2: (1506): Encrypt success status returned via ipc 1 IKEv2-PLAT-3: (1506): SENT PKT [CREATE_CHILD_SA] [3x.xx.xx.xx]:500->[Sxxxyyy]:500 InitSPI=0x5062c9323081e4c0 RespSPI=0x5c10eb1d17fb53dc MID=00000007 IKEv2-PLAT-2: (1506): Encrypt success status returned via ipc 1 IKEv2-PLAT-3: (1506): SENT PKT [INFORMATIONAL] [3x.xx.xx.xx]:500->[ S xxxyyy ]:500 InitSPI=0x5062c9323081e4c0 RespSPI=0x5c10eb1d17fb53dc MID=000000ad IKEv2-PLAT-2: (1506): Decrypt success status returned via ipc 1
So far this has happened twice, this second time it was up for about 9 days without issue. (IKEv2 configured lifetime is 24 hours). The above debug in bold had me somewhat confused, specifically "existing child SA". I checked isakmp and found I did have an SA. Once I cleared that (clear crypto ikev2 sa 6x.xx.xx.xx) the tunnel comes up, both IKE and IPSEC. Now however I am still not getting any traffic response from the remote end device. However debug on IKEv2 protocal no longer shows the initial failures, specifically the "Packet is missing KE payload".
So I am a few steps forward at least
... View more
Created by
TRENT WAITE
in VPN and AnyConnect
in VPN and AnyConnect
10-18-2018
04:49 AM
10-18-2018
04:49 AM
I have a site to site tunnel between an ASA5525x and the other side I believe is either Watchguard or Sonicwall, it is a device outside of our management. This has happened once before where the tunnel just fails. I am assuming that KE is key exchange, but other than that I have no idea what is the cause of this tunnel failing. I am not as familiar with debugging IKEv2 whereas IKEV1 was a little bit more understandable (for me at least) with the IKE failures. So I am wondering what are the possible causes to "Packet is missing KE payload". I have a feeling that with this failing at IKE_SA_INIT message that this could be caused by mis-match DH keys. Our first proposals is policy 1 "group 5 2", then policy 2 "group 5" and after policy 3 "group 2". While this works with 95% of our tunnels to other ASA's with exact matching proposals, since this is a non-ASA it could be the cause? If it was purely straight up mismatch of DH groups, I have seen different error message directly indicating DH group mis-match. This particular problem is not showing that in debug.
IKEv2-PROTO-2: (526): Received Packet [From 6x.xx.xx.xx:500/To 3x.xx.xx.xx:500/VRF i0:f0] (526): Initiator SPI : 2C579DFFCF37DEA1 - Responder SPI : 0000000000000000 Message id: 0 (526): IKEv2 IKE_SA_INIT Exchange RESPONSEIKEv2-PROTO-3: (526): Next payload: NOTIFY, version: 2.0 (526): Exchange type: IKE_SA_INIT, flags: RESPONDER MSG-RESPONSE (526): Message id: 0, length: 36(526): Payload contents: (526): NOTIFY(Unknown - 43)(526): Next payload: NONE, reserved: 0x0, length: 8 (526): Security protocol id: Unknown - 0, spi size: 0, type: Unknown - 0 (526): (526): Decrypted packet:(526): Data: 36 bytes IKEv2-PROTO-5: (526): SM Trace-> SA: I_SPI=2C579DFFCF37DEA1 R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: I_WAIT_INIT Event: EV_RECV_INIT IKEv2-PROTO-5: (526): Processing IKE_SA_INIT message IKEv2-PROTO-5: (526): SM Trace-> SA: I_SPI=2C579DFFCF37DEA1 R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_CHK4_NOTIFY IKEv2-PROTO-2: (526): Processing IKE_SA_INIT message IKEv2-PROTO-5: (526): SM Trace-> SA: I_SPI=2C579DFFCF37DEA1 R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_VERIFY_MSG IKEv2-PROTO-2: (526): Verify SA init message IKEv2-PROTO-1: (526): Packet is missing KE payload IKEv2-PROTO-1: (526): IKEv2-PROTO-5: (526): SM Trace-> SA: I_SPI=2C579DFFCF37DEA1 R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_FAIL IKEv2-PROTO-2: (526): Failed SA init exchange IKEv2-PROTO-1: (526): Initial exchange failed IKEv2-PROTO-1: (526): Initial exchange failed IKEv2-PROTO-5: (526): SM Trace-> SA: I_SPI=2C579DFFCF37DEA1 R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: EXIT Event: EV_ABORT IKEv2-PROTO-5: (526): SM Trace-> SA: I_SPI=2C579DFFCF37DEA1 R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: EXIT Event: EV_CHK_PENDING_ABORT IKEv2-PROTO-5: (526): SM Trace-> SA: I_SPI=2C579DFFCF37DEA1 R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: EXIT Event: EV_UPDATE_CAC_STATS IKEv2-PROTO-2: (526): Abort exchange IKEv2-PROTO-2: (526): Deleting SA
... View more
- Tags:
- asa
- ikev2
- KE Payload
Labels:
Created by
TRENT WAITE
in Routing
09-12-2019
09-12-2019
Thank you George and Paul, you hit the nail on the head. I did forget to
contact our ISPs.
Created by
TRENT WAITE
in Routing
09-10-2019
09-10-2019
I am doing a traceroute from my office to our data center routers. Doing
a trace on the original sub...
Created by
TRENT WAITE
in Routing
09-10-2019
09-10-2019
Entering "network 198.11.11.0 mask 255.255.255.0" is accepted as in no
error, but the configuration ...
Created by
TRENT WAITE
in Routing
09-10-2019
09-10-2019
Hi, we have BGP session announcing a subnet provided by one of our ISPs.
Recently we obtained our ow...
Created by
TRENT WAITE
in VPN and AnyConnect
02-14-2019
02-14-2019
I have an existing site to site VPN using 192.168.1.0/24 subnet, with
now a new customer who has the...
Created by
TRENT WAITE
in VPN and AnyConnect
01-16-2019
01-16-2019
Thanks RJI, I took a second look and it turns out the vendor had
provided a document with an example...
Created by
TRENT WAITE
in VPN and AnyConnect
01-16-2019
01-16-2019
I have 2 separate routers & tunnels I was looking to combine, but I am
not familiar enough whether t...
01-16-2019
Hi Sergey, With my current configuration, if on R1 A or B I set the iBGP
peers to use default-origin...
01-16-2019
Hi, both my edge routers receive full table from their connected ISPs,
and these route our subnet to...
Created by
TRENT WAITE
in Routing
01-06-2019
01-06-2019
Hi George, Thanks for replying. I think at this point my issue is with
R1 to R2 that I will need to ...
Created by
TRENT WAITE
in Routing
01-05-2019
01-05-2019
Below are the configs as of this morning. R1 is a test/development unit
whereas R2 is presently in u...
Created by
TRENT WAITE
in Routing
01-05-2019
01-05-2019
Hi Francesco, thank you for replying. It is the device at 10.172.40.1 at
R1 that needs to communicat...
01-04-2019
I have a router (R1) that does VTI to a remote site, and that remote
devices need to go through the ...
Created by
TRENT WAITE
in VPN and AnyConnect
10-18-2018
10-18-2018
Rahul, thanks for your reply. I did a debug platform and got the
following: ASA5525# IKEv2-PLAT-2: (...
Public Statistics
| Date Registered | 08-19-2010 03:13 PM |
| Date Last Visited | 09-17-2019 01:51 PM |
| Total Messages Posted | 31 |
| Total Helpful Votes Received | 5 |
.jpg "VIP Mentor"){kind=icon}
