Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About johnsmunoz
08-08-2018
Stats
Member since
03-06-2017
16
Posts
5
Helpful
0
Solutions
08-06-2018
06:36 AM
Over the weekend we got an alert that one of our stacks when to half. The break appeared to be between switch 5 & 7. The cable didn't appear to be loose or damaged but I replaced it anyway. Made sure it was tight and snug. I'm still showing that the connection is down. Is there anything special that needs to be done prior to the link coming back up?
Stack-1#show switch Switch/Stack Mac Address : c464.13f8.2000 H/W Current Switch# Role Mac Address Priority Version State ---------------------------------------------------------- 1 Member 70ca.9b02.0880 1 1 Ready 2 Member 0007.7db4.3b80 1 1 Ready 3 Member f0f7.550b.bd00 10 1 Ready *4 Master c464.13f8.2000 10 1 Ready 5 Member f0f7.553c.db80 1 1 Ready 6 Member ccef.4823.3a80 1 1 Ready 7 Member 1cdf.0f4f.4b80 2 1 Ready
Stack-1#show switch detail Switch/Stack Mac Address : c464.13f8.2000 H/W Current Switch# Role Mac Address Priority Version State ---------------------------------------------------------- 1 Member 70ca.9b02.0880 1 1 Ready 2 Member 0007.7db4.3b80 1 1 Ready 3 Member f0f7.550b.bd00 10 1 Ready *4 Master c464.13f8.2000 10 1 Ready 5 Member f0f7.553c.db80 1 1 Ready 6 Member ccef.4823.3a80 1 1 Ready 7 Member 1cdf.0f4f.4b80 2 1 Ready
Stack Port Status Neighbors Switch# Port 1 Port 2 Port 1 Port 2 -------------------------------------------------------- 1 Ok Ok 3 2 2 Ok Ok 1 4 3 Ok Ok 5 1 4 Ok Ok 2 6 5 Down Ok None 3 6 Ok Ok 4 7 7 Ok Down 6 None
Stack-1#show switch stack-ring speed
Stack Ring Speed : 16G Stack Ring Configuration: Half Stack Ring Protocol : StackWisePlus
Switch Ports Model SW Version SW Image ------ ----- ----- ---------- ---------- 1 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M 2 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M 3 54 WS-C3750X-48 12.2(58)SE2 C3750E-UNIVERSALK9-M * 4 54 WS-C3750X-48 12.2(58)SE2 C3750E-UNIVERSALK9-M 5 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M 6 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M 7 54 WS-C3750X-48P 12.2(58)SE2 C3750E-UNIVERSALK9-M
... View more
Labels:
06-21-2018
12:04 PM
Thanks Georg,
With that command NAT is working now. but... I'm back at the original problem of having the SSH, HTTPS, TELNET port exposed to the public on the ip of the outside interface, x.x.56.146
Is there a different way to designate which interface can reach those services? I really just want them exposed to the inside and mgmt port.
... View more
06-21-2018
11:09 AM
Thanks Georg,
I added that line but still can't seam to get outside.
... View more
06-21-2018
10:29 AM
I'm having a hard time getting NAT setup. I have my DIA coming in on G0/0/2. The ISP is providing me two IP blocks, XX.XXX.56.144/29 and XX.YYY.67.0/27
All my devices are hung off G0/0/1 and the DMZ devices are off G0/0/1.400
I'm trying to use the ACL, DMZ-PERMIT to restrict what traffic hits the DMZ devices and prevent outside traffic from being able to reach my ASR via SSH, HTTPS etc.
With this configuration that appears to be working BUT with
"ip access-group DMZ-PERMIT in"
in use, my NAT no longer works. Devices in the 10.40.0.x range are not able to get out on the internet. I can't even ping outside from the ASR. If remove that ACL from the interface then NAT works again, but all my devices are fully exposed.
Any guidance on what I'm doing wrong?
interface GigabitEthernet0/0/1 ip address 10.40.0.1 255.255.255.0 ip nat inside negotiation auto ! interface GigabitEthernet0/0/1.400 encapsulation dot1Q 400 ip address XX.YYY.67.1 255.255.255.224
! interface GigabitEthernet0/0/2 description COGENT DIA ip address XX.XXX.56.146 255.255.255.248 ip nat outside ip access-group DMZ-PERMIT in no negotiation auto ! ip nat pool COGENT-POOL XX.XXX.56.147 XX.XXX.56.151 netmask 255.255.255.248 ip nat inside source list 100 pool COGENT-POOL overload ! ip route 0.0.0.0 0.0.0.0 XX.XXX.56.145 ! ip access-list extended DMZ-PERMIT permit tcp any host XX.YYY.67.3 eq ftp deny ip any host XX.XXX.56.146 permit tcp any host XX.YYY.67.3 range 5810 5890 permit tcp any host XX.YYY.67.4 eq 443 permit udp any host XX.YYY.67.4 eq 1194 ! access-list 100 permit ip 10.40.0.0 0.0.0.255 any
... View more
Labels:
06-20-2018
08:25 AM
I'm using an ASR-1001x ( Cisco IOS XE Software, Version 03.16.02.S) at our COLO
with 2 Microsoft Express Route circuits using BGP
2 10G Wavelength links to our headquarters
1 Layer 2 VPLS circuit for our remote locations
1 1G DIA internet circuit
Everything is working great but the DIA. I'm able to use it as a DMZ gateway but not as an internet gateway for our headquarters (assuming I need to setup NAT). I'm fairly new to the ASR family and usually use ASA's as gateways. I'm half tempted to one of our ASA5555x's out there but I'd like to just have a single router out there.
Looking for your suggestions.. what would be the best way to do this?
I'm guessing I may get more security by using the ASA as the gateway? I'd probably have to add a SFP module to it since the 5555 only has copper on it.
... View more
Labels:
06-18-2018
07:00 AM
I have an ASR that I'm using to connecting our ExpressRoutes and 10G links back to our headquarters. I'd like to add our DIA as well but I'm having a hard time finding out how to setup security on this device. (ie, block SSH, SNMP, HTTPS from the DIA interface, etc) Some reading indicates that I should be able to use ZONES on it but the commands are unrecognized on my unit. Do I need an upgrade to be able to use ZONES? Is there a different way I should be implementing security on this device?
EQX-DA2-ASR#show rom-monitor r0
System Bootstrap, Version 15.4(2r)S, RELEASE SOFTWARE (fc1)
Copyright (c) 1994-2014 by cisco Systems, Inc.
EQX-DA2-ASR#show platform
Chassis type: ASR1001-X
Slot Type State Insert time (ago)
--------- ------------------- --------------------- -----------------
0 ASR1001-X ok 1d04h
0/0 BUILT-IN-2T+6X1GE ok 1d04h
R0 ASR1001-X ok, active 1d04h
F0 ASR1001-X ok, active 1d04h
P0 ASR1001-X-PWR-AC ok 1d04h
P1 ASR1001-X-PWR-AC ok 1d04h
P2 ASR1001-X-FANTRAY ok 1d04h
Slot CPLD Version Firmware Version
--------- ------------------- ---------------------------------------
0 14041015 15.4(2r)S
R0 14041015 15.4(2r)S
F0 14041015 15.4(2r)S
... View more
Labels:
Created by
johnsmunoz
in Other Network Architecture Subjects
in Other Network Architecture Subjects
05-27-2018
08:46 PM
05-27-2018
08:46 PM
You probably have a flow monitor setup somewhere with a line
record MY-RECORD
try doing a
NO record MY-RECORD
add then do a
collect interface output
and then re-enable the flow record. at least that's what worked for me.
... View more
05-23-2018
06:27 PM
BGP/OSPF novice here. ICND 1 and 2 only went over the basics.
I'm using Microsoft's Azure ExpressRoute with private peering on an ASR1001X with XE 3.16.02.S
show bgp does show my remote routes in Azure. How do I publish these into my internal OSPF routes so that everyone else knows how to get into the azure private space?
I'm able to see all the other OSPF routes in my network on this ASR so I know I'm a member of OSPF, I just can't figure out how to advertise my azure routes to the rest of my network.
10.0.0.16/32 is the primary network
10.0.0.20/32 is the secondary
172.30.0.0/16 is the remote azure ip space
10.40.0.11 is the ASR
EQX-DA2-ASR#show ip route
Gateway of last resort is 10.40.0.1 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 10.40.0.1 10.0.0.0/8 is variably subnetted, 29 subnets, 6 masks O 10.0.0.0/30 [110/3] via 10.40.0.1, 01:48:33, GigabitEthernet0/0/1 . . . C 10.0.0.16/30 is directly connected, GigabitEthernet0/0/3.1 L 10.0.0.17/32 is directly connected, GigabitEthernet0/0/3.1 C 10.0.0.20/30 is directly connected, GigabitEthernet0/0/4.1 L 10.0.0.21/32 is directly connected, GigabitEthernet0/0/4.1 B 172.30.0.0/16 [20/0] via 10.0.0.18, 2d19h
show bgp BGP table version is 3, local router ID is 10.40.0.11
Network Next Hop Metric LocPrf Weight Path *> 10.40.0.0/24 0.0.0.0 0 32768 i * 172.30.0.0 10.0.0.22 0 12076 i *> 10.0.0.18 0 12076 i
show run . . .
! interface GigabitEthernet0/0/1 ip address 10.40.0.11 255.255.255.0 ip ospf 1 area 0 negotiation auto ! interface GigabitEthernet0/0/3 description DA1-CX-PRI-01 no ip address negotiation auto ! interface GigabitEthernet0/0/3.1 description ExpressRoute Primary encapsulation dot1Q 1000 ip address 10.0.0.17 255.255.255.252 ! interface GigabitEthernet0/0/4 description DA1-CX-SEC-01 no ip address negotiation auto ! interface GigabitEthernet0/0/4.1 description ExpressRoute Secondary encapsulation dot1Q 1001 ip address 10.0.0.21 255.255.255.252 ! router ospf 1 router-id 10.40.0.11 network 172.30.0.0 0.0.255.255 area 0 ! router bgp 64512 bgp log-neighbor-changes neighbor 10.0.0.18 remote-as 12076 neighbor 10.0.0.22 remote-as 12076 ! address-family ipv4 network 10.0.0.30 mask 255.255.255.255 network 10.40.0.0 mask 255.255.255.0 neighbor 10.0.0.18 activate neighbor 10.0.0.22 activate exit-address-family !
... View more
Labels:
04-02-2018
07:33 AM
Is it possible to use multiple uplink modules in a C3750X Stack. I currently have a C3KX-NM-10G in Switch 1. I need to add some additional 10G ports.
Am I able to just insert another C3KX-NM-10G into switch 2, 3, 4 etc?
Can only one uplink module be used per stack?
Do the uplink modules have to be in certain stack members?
... View more
Labels:
Created by
johnsmunoz
in VPN and AnyConnect
in VPN and AnyConnect
05-02-2017
09:43 AM
05-02-2017
09:43 AM
I'd like to be able to give different users access to different subnets either by an ACL or by putting them into particular address pools based on their LDAP membership. Is this possible? most of the documentation i've been able to to find is just to give access or deny access to the VPN itself.
... View more
Labels:
03-24-2017
02:42 PM
Thanks Jon,
That makes sense. 10.39.0.0 is the network on the other side of the VPN tunnel through the ASA. Not a local network attached to an interface. Would it still be possible to use OSPF to point traffic intended for that network?
... View more
03-24-2017
10:14 AM
I have an ASA that is solely being used to attach to AZURE's VPN
If i attach to the inside network and use 10.0.0.13 as the gateway i can get onto the vpn network. I'm trying to add this to our core network but the OSPF routes are not being showing up in the ospf database. Not sure what I'm missing to get the ASA's routes to be advertised.
interface GigabitEthernet0/0 nameif outside security-level 0 ip address 12.156.x.1 255.255.255.224 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.0.0.13 255.255.255.252 ospf cost 10
object-group network AZURE-NET description Azure Virtual Network network-object 10.39.0.0 255.255.0.0 object-group network ONPREM-NET description OnPrem Network network-object 10.0.0.12 255.255.255.252 access-list AZURE-VPN-ACL extended permit ip object-group ONPREM-NET object-group AZURE-NET
nat (inside,outside) source static ONPREM-NET ONPREM-NET destination static AZURE-NET AZURE-NET
router ospf 1000 router-id 10.0.0.13 network 10.0.0.12 255.255.255.252 area 0 network 10.39.0.0 255.255.0.0 area 0 area 0 range 10.0.0.12 255.255.255.252 area 0 range 10.39.0.0 255.255.0.0 log-adj-changes
From the ASA:
show ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
10.10.0.1 1 FULL/DR 0:00:32 10.0.0.14 inside
From the neighbor router:
6301-CORESWX-1# show ip ospf neighbor
OSPF Neighbor Information
Router ID Pri IP Address NbIfState State QLen Events Status
--------------- --- --------------- --------- -------- ----- ------ ------
10.10.0.2 128 10.0.0.1 DR FULL 0 7 None
10.0.0.13 1 10.0.0.13 BDR FULL 0 6 None
ciscoasa# show ospf database
OSPF Router with ID (10.0.0.13) (Process ID 1000)
Router Link States (Area 0)
Link ID ADV Router Age Seq# Checksum Link count
10.0.0.13 10.0.0.13 325 0x80000042 0x5635 1
10.10.0.1 10.10.0.1 1020 0x80000205 0x8dbc 4
10.10.0.2 10.10.0.2 371 0x8000013a 0xa3eb 2
Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
10.0.0.1 10.10.0.2 333 0x80000064 0x236a
10.0.0.14 10.10.0.1 541 0x80000046 0x 995
Summary Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
10.10.25.0 10.10.0.2 783 0x80000067 0x 191
10.10.26.0 10.10.0.2 2921 0x80000066 0xf79a
10.80.69.0 10.10.0.2 2771 0x80000066 0xd14f
10.227.114.0 10.10.0.2 2283 0x80000066 0xf8e6
12.156.x.2 10.10.0.2 2621 0x80000066 0x737c
172.32.0.0 10.10.0.2 72 0x80000067 0xc42f
Type-5 AS External Link States
Link ID ADV Router Age Seq# Checksum Tag
0.0.0.0 10.10.0.1 1682 0x800000a6 0xe5fc 0
10.10.0.1 10.10.0.1 1502 0x800001e4 0xe4b4 0
10.10.2.0 10.10.0.1 1502 0x800001e4 0xd8bf 0
10.255.96.0 10.10.0.1 1262 0x800001e4 0x202b 0
ciscoasa# show route
Gateway of last resort is 12.156.x.3 to network 0.0.0.0
O IA 172.32.0.0 255.255.254.0 [110/12] via 10.0.0.14, 2:57:28, inside
O E2 10.10.0.1 255.255.255.255 [110/10] via 10.0.0.14, 2:57:28, inside
O E2 10.10.2.0 255.255.255.0 [110/10] via 10.0.0.14, 2:57:28, inside
O 10.10.0.2 255.255.255.255 [110/11] via 10.0.0.14, 2:57:28, inside
C 10.0.0.12 255.255.255.252 is directly connected, inside
O 10.10.10.0 255.255.255.0 [110/11] via 10.0.0.14, 2:57:28, inside
O 10.0.0.0 255.255.255.252 [110/11] via 10.0.0.14, 2:57:28, inside
O 10.10.11.0 255.255.255.0 [110/11] via 10.0.0.14, 2:57:28, inside
O IA 10.10.25.0 255.255.255.0 [110/12] via 10.0.0.14, 2:57:28, inside
O IA 10.10.26.0 255.255.255.0 [110/12] via 10.0.0.14, 2:57:28, inside
O IA 10.80.69.0 255.255.255.0 [110/12] via 10.0.0.14, 2:57:28, inside
O E2 10.255.96.0 255.255.248.0 [110/10] via 10.0.0.14, 2:57:28, inside
O IA 10.227.114.0 255.255.255.128 [110/12] via 10.0.0.14, 2:57:28, inside
C 12.156.x.2 255.255.255.224 is directly connected, outside
S* 0.0.0.0 0.0.0.0 [1/0] via 12.156.39.33, outside
... View more
Labels:
03-18-2017
07:25 PM
Thanks for all your help. I've got both side connected to the vpn tunnel now.
From the azure site I'm able to ping our on-premise computers but I can't to the reverse.
on the 10.39.0.0 ASAv I'm able to ping 10.33.40.10 but from the remote 10.33.0.0 asa I can't ping that same IP.
I'm not seeing any failures on either log.
Routes are currently 0.0.0.0 0.0.0.0 "next hop" outside
I'm so close to being done with this project, I'm just not sure where I'm going wrong.
attached are excerpts from the current configs on both systems
... View more
Created by
johnsmunoz
in VPN and AnyConnect
in VPN and AnyConnect
03-17-2017
07:57 PM
03-17-2017
07:57 PM
I have two ASA's setup.
One 5520 on our premises and one ASAv in Azure
On-premise inside range is 10.33.0.0/16 outside ip 12.x.x.x
Azure range is 10.39.0.0/16 outside ip 13.x.x.x
I'm able to establish a VPN session between the two units
but if I try and ping an on-premise IP from azure I'm getting this error on the on-premise ASA
Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 0.0.0.0/0.0.0.0/0/0 local proxy 10.33.0.0/255.255.0.0/0/0 on interface outside
QM FSM error (P2 struct &0x6f0e1ab0, mess id 0xbf9f4d96)!
Removing peer from correlator table failed, no match!
On the Azure ASAv I have this access list
access-list management_cryptomap_1 extended permit ip any object 10.33.0.0
On the on-premises ASA I have this access list
access-list outside_cryptomap extended permit ip any object 10.39.0.0
I'm at a loss what at what I'm doing wrong. Could someone point me in the error of my ways?
... View more
Labels:
Created by
johnsmunoz
in Switching
08-06-2018
08-06-2018
Over the weekend we got an alert that one of our stacks when to half.
The break appeared to be betwe...
06-21-2018
Thanks Georg, With that command NAT is working now. but... I'm back at
the original problem of havin...
06-21-2018
I'm having a hard time getting NAT setup. I have my DIA coming in on
G0/0/2. The ISP is providing me...
06-20-2018
I'm using an ASR-1001x (Cisco IOS XE Software, Version 03.16.02.S) at
our COLO with 2 Microsoft Expr...
06-18-2018
I have an ASR that I'm using to connecting our ExpressRoutes and 10G
links back to our headquarters....
05-27-2018
You probably have a flow monitor setup somewhere with a line record
MY-RECORD try doing a NO record ...
Created by
johnsmunoz
in Routing
05-23-2018
05-23-2018
BGP/OSPF novice here. ICND 1 and 2 only went over the basics. I'm using
Microsoft's Azure ExpressRou...
04-02-2018
Is it possible to use multiple uplink modules in a C3750X Stack. I
currently have a C3KX-NM-10G in S...
Created by
johnsmunoz
in VPN and AnyConnect
05-02-2017
05-02-2017
I'd like to be able to give different users access to different subnets
either by an ACL or by putti...
03-24-2017
Thanks Jon, That makes sense. 10.39.0.0 is the network on the other side
of the VPN tunnel through t...
03-24-2017
I have an ASA that is solely being used to attach to AZURE's VPN If i
attach to the inside network a...
03-18-2017
Thanks for all your help. I've got both side connected to the vpn tunnel
now. From the azure site I'...
Created by
johnsmunoz
in VPN and AnyConnect
03-17-2017
03-17-2017
I have two ASA's setup. One 5520 on our premises and one ASAv in Azure
On-premise inside range is 10...
Public Statistics
| Date Registered | 03-06-2017 02:33 PM |
| Date Last Visited | 08-08-2018 12:02 AM |
| Total Messages Posted | 16 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "VIP Advisor"){kind=icon}
