Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About ahmed.jama
Stats
Member since
08-14-2009
19
Posts
20
Helpful
1
Solution
12-07-2012
05:52 AM
Hi Reza, Thanks for the information. Do you happen to know why the output of 'show run switch-profile' omits some port-channel related configuration such as 'switchport trunk allowed vlan 30, 40', and this is displayed when 'show run int' output? Regards, Ahmed
... View more
12-05-2012
02:50 AM
version 5.2(1)N1(1) Hello, I am a bit confused by the output of 'show run' and 'show run switch-profile' that pertains to a port-channel interface configured in a switch-profile. My main gaol is to find out how can I add/remove the allowed vlans the port-channel (configured as trunk) carries. The setup is like this. I have 2 N5k in vPC domain and Etherner1/11 on both switches is configured as trunk vPC that connects to a core switch. When I issue ‘show run’ for the port-channel and physical interface I get the following output N5k1# sh run int po10 interface port-channel10 description TEST switchport mode trunk switchport trunk allowed vlan 30,40 speed 1000 vpc 10 N5k1# sh run int Ethernet 1/11 interface Ethernet1/11 description TEST switchport mode trunk switchport trunk allowed vlan 30,40 speed 1000 channel-group 10 mode active When I issue 'show run switch-profile', I get the following output N5k1# sh run switch-profile | be int interface port-channel10 description TEST switchport mode trunk speed 1000 vpc 10 interface Ethernet1/11 switchport mode trunk switchport trunk allowed vlan 30, 40 speed 1000 channel-group 10 mode active From above it seems the switch-profile configuration is missing the 'switchport trunk allowed vlan' in the port-channel interface. If want I to remove vlan 30 from the allowed vlan, should I go under the switch-profile mode and remove vlan 30 from the allowed list even though the switch-profile configuration seems to be missing this. For example: conf sync ! switch-profile TEST ! interface port-channel10 switchport trunk allowed vlan remove 30 exit ! verify ! commit ! end Could someone kindly point me into the right direction. Regards, Ahmed
... View more
Labels:
Created by
ahmed.jama
in Network Security
in Network Security
11-13-2012
05:58 AM
11-13-2012
05:58 AM
Just FYI, I opened a TAC case and this was failing because of the T38 payload in the SDP of the re-invite. As of now T38 is not supported in ASA codes. Our work around was to allow the relevant ports in ACL so that media traffic was not dropped. http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtr86607
... View more
Created by
ahmed.jama
in Network Security
in Network Security
09-09-2012
04:26 AM
09-09-2012
04:26 AM
Below is the script you can use to reproduce this. Points worth mentioning. Initial invite sets up the media between SIP Trunk and a media device ( 10.1.2.150) in the inside network, SIP signalling will be with 10.1.2.100. At this poit RTP flows freely between the SIP Trunk and the media device. If the call is fax, a re-invite will occur and this will cause the IP address to change in the SDP. The new media endpoint becomes 10.1.2.151 (This device is SIP and Media (T38) capable). For every SIP call we establish 10.1.2.150 will be used for media, we do not want to change this behaviour. ! ASA 8.3 (2) ! conf t ! interface Ethernet0/0 nameif Inside_Voice security-level 100 ip address 10.1.2.11 255.255.255.0 standby 10.1.2.12 exit ! interface Ethernet0/1 nameif Outside_SIP_Trunk security-level 0 ip address 10.1.60.254 255.255.255.0 standby 10.1.60.253 exit ! object-group network SIP_trunks network-object 1.2.3.0 255.255.255.0 exit ! object-group service SIP_service service-object tcp destination eq sip service-object udp destination eq sip exit ! object-group network SIP_inside_servers network-object host 10.1.2.100 exit ! access-list Outside_SIP_in extended permit object-group SIP_service object-group SIP_trunks object-group SIP_inside_servers ! access-group Outside_SIP_in in interface Outside_SIP_Trunk ! route Outside_SIP_Trunk 0.0.0.0 0.0.0.0 10.1.60.1 ! class-map inspection_default match default-inspection-traffic exit ! policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp inspect icmp error lass class-default set connection decrement-ttl exit ! service-policy global_policy global ! end
... View more
Created by
ahmed.jama
in Network Security
in Network Security
09-06-2012
02:33 PM
09-06-2012
02:33 PM
Outside. I have allowed SIP from the SipTrunk to my SIP device. Per the SIP RFC this should work as this normal SIP behaviour. "During the session, either Alice or Bob may decide to change the characteristics of the media session. This is accomplished by sending a re-INVITE containing a new media description. This re- INVITE references the existing dialog so that the other party knows that it is to modify an existing session instead of establishing a new session. The other party sends a 200 (OK) to accept the change. The requestor responds to the 200 (OK) with an ACK. If the other party does not accept the change, he sends an error response such as 488 (Not Acceptable Here), which also receives an ACK. However, the failure of the re-INVITE does not cause the existing call to fail - the session continues using the previously negotiated characteristics" http://www.ietf.org/rfc/rfc3261.txt Sent from Cisco Technical Support iPad App
... View more
Created by
ahmed.jama
in Network Security
in Network Security
09-06-2012
02:14 PM
09-06-2012
02:14 PM
Logs show the ASA denying the packets, endpoints/ports correspond to SIP SDP for the reinvite. Sent from Cisco Technical Support iPad App
... View more
Created by
ahmed.jama
in Network Security
in Network Security
09-06-2012
01:07 PM
09-06-2012
01:07 PM
Hi Julio, Thanks for the update. The initial invite in the SIP call is correctly setup by a SIP proxy and SIP trunk using a media device and a SIP Trunk. The SIP end points (sip proxy and sip trunk) stay the same for the entire duration of the call, a reinvite occurs to change the media end points in the SDP in order to establish T38 between a new media end point and the SIP trunk (Same SIP call). Since the ASA already had ports opened for this SIP call, isn't it just a case of updating ip addresses/ports for the new end points as this is to be expected in a SIP call. Ahmed, Sent from Cisco Technical Support iPad App
... View more
Created by
ahmed.jama
in Network Security
in Network Security
09-06-2012
03:47 AM
09-06-2012
03:47 AM
Platform: ASA 8.3(2) Hello, I have SIP devices along with SipTrunk and media endpoints. I am having issues with the ASA not dynamically opening (sip inspect enabled) UDP ports for RTP after a SIP re-invite causes the media endpoints to change within SDP. The problem as below. Initial SIP invite setups properly with ports dynamically opened between the media endpoints in the ASA Re-inivite from the SIP device causes the media endpoints to change within the SDP ASA blocks ports associated to the new media endpoints I can resolve this by allowing the ports in the ACL, but suprised this is not working as re-invites to change media endpoints is to be expected in SIP conversation. Regards, AJ
... View more
Labels:
12-29-2011
02:23 PM
Not sure if you already checked this, but ensure E1 pinouts are as follows 1 <-> 4 2 <-> 5 4 <-> 1 5 <-> 2
... View more
02-28-2011
02:43 AM
Hi Farrukhjon, I remember this question was answered in another post sometime ago. Please see the link below. https://supportforums.cisco.com/message/3290415#3290415
... View more
02-10-2011
06:44 AM
Hi Tunde, Have a look at the link below which shows an example of how to implement a failover using IP SLA and tracking object. I remember testing this a while back and it worked. http://www.inacom-sby.net/Shawn/post/2007/11/Cisco-IP-SLA-for-failover.aspx Regards, AJ
... View more
Created by
ahmed.jama
in Other Network Architecture Subjects
in Other Network Architecture Subjects
01-11-2011
05:23 AM
01-11-2011
05:23 AM
Hi Andrew, Overlapping addresses in VLSM can throw you off in real world and in the exams. To be best describe this imagine the scenario below (extracted from ICND1 book), R1------WAN---------->R2 R1------WAN---------->R3 R2 could have LAN address 172.16.4.1/23 [Usable address space: 172.16.4.1 to 172.16.5.254] R3 could have LAN address 172.16.5.1/24 [Usable address space: 172.16.5.1 to 172.16.5.254] As you can see from the highlighted addresses the IP addesses will overlap and as result will cause the routing table to become unpredictable specially R1's routing table. As for the second part of your question, the scenario asked you to use the third subnet from the 172.20.0.0/22 which was 172.20.8.0/22, the next subnet available (forth subnet) will be 172.20.12.0/22. The scenario asked you to apply the /23 prefix on this subnet, therefore 172.20.12.0/23 [Usable address space: 172.20.12.1 to 172.20.13.254] hence the 172.20.13.254 will address applied on Fa0/1 as is the last usable address. Hope this Helps AJ
... View more
12-28-2010
01:13 AM
Hi Peter, Thanks for the reply. All the study materials and best practices i have come along always used to emphasize on the need of proper OSPF design and grouping discontinous ip addresses in different areas. Since I am fairly new the cisco networking world I wanted to hear about how others actually implement their network. Is it a common practice to have discontinous IP addresses in a OSPF domain from your experience? AJ
... View more
12-28-2010
12:13 AM
Diverting from the original topic one thing that caught my eye is your OSPF design. Can you tell me why are you using discontinuous ip addresses in your Area 0?
... View more
12-23-2010
06:52 AM
Hi Walid, Any reason why you are not using the EtherSwitch module (NM-16ESW) on GNS3 as opposed to buying an actual switch for the exam? AJ
... View more
Created by
ahmed.jama
in Switching
12-07-2012
12-07-2012
Hi Reza,Thanks for the information. Do you happen to know why the output
of 'show run switch-profile...
Created by
ahmed.jama
in Switching
12-05-2012
12-05-2012
version 5.2(1)N1(1)Hello,I am a bit confused by the output of 'show run'
and 'show run switch-profil...
Created by
ahmed.jama
in Network Security
11-13-2012
11-13-2012
Just FYI, I opened a TAC case and this was failing because of the T38
payload in the SDP of the re-i...
Created by
ahmed.jama
in Network Security
09-09-2012
09-09-2012
Below is the script you can use to reproduce this. Points worth
mentioning.Initial invite sets up th...
Created by
ahmed.jama
in Network Security
09-06-2012
09-06-2012
Outside. I have allowed SIP from the SipTrunk to my SIP device. Per the
SIP RFC this should work as ...
Created by
ahmed.jama
in Network Security
09-06-2012
09-06-2012
Logs show the ASA denying the packets, endpoints/ports correspond to SIP
SDP for the reinvite.Sent f...
Created by
ahmed.jama
in Network Security
09-06-2012
09-06-2012
Hi Julio,Thanks for the update. The initial invite in the SIP call is
correctly setup by a SIP proxy...
Created by
ahmed.jama
in Network Security
09-06-2012
09-06-2012
Platform: ASA 8.3(2)Hello,I have SIP devices along with SipTrunk and
media endpoints. I am having is...
12-29-2011
Not sure if you already checked this, but ensure E1 pinouts are as
follows1 <-> 42 <-> 54 <-> 15 <->...
Created by
ahmed.jama
in Routing
02-28-2011
02-28-2011
Hi Farrukhjon,I remember this question was answered in another post
sometime ago. Please see the lin...
02-10-2011
Hi Tunde,Have a look at the link below which shows an example of how to
implement a failover using I...
Created by
ahmed.jama
in Other Network Architecture Subjects
01-11-2011
01-11-2011
Hi Andrew,Overlapping addresses in VLSM can throw you off in real world
and in the exams. To be best...
12-28-2010
Hi Peter,Thanks for the reply. All the study materials and best
practices i have come along always u...
12-28-2010
Diverting from the original topic one thing that caught my eye is your
OSPF design. Can you tell me ...
Public Statistics
| Date Registered | 08-14-2009 11:26 AM |
| Date Last Visited | 06-12-2018 05:59 PM |
| Total Messages Posted | 19 |
| Total Helpful Votes Received | 20 |
Helpful Votes Given To
.jpg "Hall of Fame Guru"){kind=icon}
