Hello team, I have an issue trying to optimize, if possible. I have a critical service which I need to improve. This is the scenario.   I have a subnet which I receive from an iBGP neighbor. It is a public ip address I can reach from a private circuit from a ISP. We can reach those remote servers via internet too. The goal is to reach those public servers using MPLS (received from iBGP), but to create an ip sla to monitor the link (not just directly connected interface but the whole path), and change the route to internet (my default route) if we detect some packet loss or timeouts. I have been reading some documents and posts but I am not sure how to get this to work. I guess it can be done with icmp jitter or udp jitter, but maybe it´s easier to deploy an icmp echo to test this. My idea is to configure a static route pointing to my perimetral FW associated to a track which ckecks packet loss (e.g 15-30%), but couldn't find a good explanation about this. If the private link recovers this should be preferred.     Any other idea will be appreciated.   Thanks in advance. ... View more

Hello community, I am trying to deploy an easy configuration on a few devices (they are 4k, that's my problem). We hace a Cisco Prime Infraestructure running 3.4 I hope we can make it using a customized template.   I need to deploy just a command to configure switches from a site to use the router from that site as ntp server. I mean, I have a switch with ip address 10.69.23.145. I want to set the command ntp server 10.69.23.254 prefer. Each site has a different subnet, obvious, but the last octect (ip address router) is always the last. It should be something like get the switch ip address, change the last octect and use it as a variable value.   Can this be done? I hope there is no need to make it manually   Thanks in advance.   ... View more

Hello team, I'm trying to deny a traffic from outside to inside. I have the multicast source directly connected to the router. The pc which receives the flow is on a LAN which is reached via inside zone. I only have two zones, inside and outside.   I can't see the flow in audit trail. How can I deny multicast traffic from certain sources or to limited destinations? I don't even know if this should be on the out-to-self or in out-to-in rules, I tried a few configurations but always works. I haven't configured it to be permitted but the traffic is flowing. This traffic is crossing the router with no problems.   Trying to do the same at in-to-out direction, I only could deny this traffic by denying pim and igmp traffic between the router with the source and the router with the destination. What do I need is to deny traffic but only to certain multicast directions. Is that possible?    This is the extract from the config:   parameter-map type inspect PM-MY-PM-VALUES  audit-trail on  max-incomplete low 800  one-minute low 300  udp idle-time 75  icmp idle-time 90  dns-timeout 60  tcp idle-time 90  tcp finwait-time 5  tcp synwait-time 3  tcp max-incomplete host 500 block-time 10  sessions maximum 200  log dropped-packets   class-map type inspect match-any CM-OUT2IN  match protocol icmp  match protocol sip  match access-group name ACL-OUT2IN policy-map type inspect PM-OUT2IN  class type inspect CM-OUT2IN   inspect PM-MY-PM-VALUES  class class-default   drop log zone-pair security ZP-OUT2IN source EXTERNAL-ZONE destination INTERNAL-ZONE  service-policy type inspect PM-OUT2IN ip access-list extended ACL-OUT2IN  permit icmp any any     ... View more

Hello community, I am trying to inspect some traffic and I am facing some troubles. 1.- Traffic is being sent using multicast. Does Firepower inspect that flow? It seems that it does but I can't show it as an event. UDP RED_TRANS_1  239.3.31.20:4021 ESPINA  10.3.31.20:46237, idle 0:00:00, bytes 2683898, flags X 2.- The traffic uses Asterix protocol but Firepower doesn't recognize that application. I think I can inspect that traffic checking the ports which uses (in an access control rule) and applying an IPS rule. May I create a new application? 3.-I created a new rule, where I want to check the first two bytes which should be a known value. This is how I created: If first byte value is 34 in decimal, should I put in "content" that value in HEX or in decimal? ... View more

Hello Community I am trying to implement what should be an easy configuration, but I am facing some problems. I just need to mark some packets from the hosts connected to my system. I have some C2960XR running 15.2(4)E6. working as layer 3 devices. I copy relevant config: mls qos ! ! class-map match-any CLASS_CRITICAL_DATA_IN match access-group name ACL_CRITICAL_DATA match ip dscp af31 class-map match-any CLASS_VOICE_RTP_IN match ip dscp ef match access-group name ACL_VOICE_RTP class-map match-any CLASS_VOICE_SIGNALING_IN match ip dscp af41 match access-group name ACL_VOICE_SIGNALING class-map match-any CLASS_NETWORK-MGMT_IN match access-group name ACL_NETWORK-MGMT match ip dscp cs2 class-map match-any CLASS_NETWORK-CTRL_IN match access-group name ACL_NETWORK-CTRL match ip dscp cs6 ! policy-map MARK_INPUT class CLASS_NETWORK-CTRL_IN set ip dscp cs6 class CLASS_VOICE_RTP_IN set ip dscp ef class CLASS_VOICE_SIGNALING_IN set ip dscp af41 class CLASS_CRITICAL_DATA_IN set ip dscp af31 class CLASS_NETWORK-MGMT_IN set ip dscp cs2 class class-default set ip dscp default !   The problem is that when I apply policy-map to the interface, I don't see errors but really it doesn't get it: SW-RED-ISO10(config)# SW-RED-ISO10(config)#interface Vlan20 SW-RED-ISO10(config-if)# SW-RED-ISO10(config-if)#service-policy input MARK_INPUT SW-RED-ISO10(config-if)# SW-RED-ISO10(config-if)#do sh run int vlan 20 Building configuration... Current configuration : 101 bytes ! interface Vlan20 description VCS_LAN ip address 10.3.20.1 255.255.255.0 ip pim sparse-mode end     SW-RED-ISO10(config)# SW-RED-ISO10(config)#interface GigabitEthernet1/0/37 SW-RED-ISO10(config-if)# SW-RED-ISO10(config-if)#service-policy input MARK_INPUT SW-RED-ISO10(config-if)# SW-RED-ISO10(config-if)#do sh run interface GigabitEthernet1/0/37 Building configuration... Current configuration : 171 bytes ! interface GigabitEthernet1/0/37 description VCS CWP 2 Eth0 switchport access vlan 20 switchport mode access speed 100 duplex full spanning-tree portfast edge end   SW-RED-ISO10#sho mls qos interface GigabitEthernet1/0/37 GigabitEthernet1/0/37 trust state: not trusted trust mode: not trusted trust enabled flag: ena COS override: dis default COS: 0 DSCP Mutation Map: Default DSCP Mutation Map Trust device: none qos mode: port-based   Does anybody could help me? Should I apply policy to virtual interfaces (interface vlan) or to physical interfaces?   Thanks for your help ... View more