Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About chad patterson
04-03-2019
chad patterson
Member since
07-08-2011
Beginner
Created by
chad patterson
in Security Analytics and Management
in Security Analytics and Management
04-02-2019
03:35 PM
04-02-2019
03:35 PM
I am interested in getting all of my Cisco routers and Switches (with IOS <= 12.2) to use Azure MFA for SSH login. I do not want to use ASA or ISE or anything else like that. I would like to just authenticate them against a RADIUS or TACACS+ server, which will in turn authenticate against AD, for which I have enabled MFA via Azure AD. I expect to receive MFA prompts on my phone, then successfully login to the switch. Does it require any extra configuration on the Cisco switch, other than authenticating against RADIUS/TACACS+? Do you have to configure NPS as a RADIUS proxy? Is this possible without ISE? I would be grateful if anybody could share the details of their experiences with MFA on SSH to Cisco routers/switches. Thanks *I know I can use Google Authenticator and Azure MFA for Linux SSH, but it requires a client module.
... View more
Labels:
Created by
chad patterson
in Security Analytics and Management
in Security Analytics and Management
03-13-2019
04:05 PM
03-13-2019
04:05 PM
Ths document says that you can:
https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/212178-Configuring-SSH-with-x509-authentication.html
also
Public Key Infrastructure Configuration Guide, Cisco IOS Release 15MT
... View more
02-20-2019
07:42 PM
Be careful. I ran into a timer issue today while trying to secure my OSPF implementation with MD5 auth.
https://learningnetwork.cisco.com/message/714297#714297
... View more
Created by
chad patterson
in Switching
in Switching
01-24-2019
03:58 PM
01-24-2019
03:58 PM
It looks like you are seeing the expected behavior. The switches are not counting the unconfigured HSRP groups, the switches are counting the multiple interfaces that the groups are configured on.
So since you have other routers in the same network with interfaces in the same collision domain and in the same group as the affected router, you have reached your 32 group limit and cannot configure anymore HSRP instances.
Referenced from here
You can configure up to 32 instances of HSRP groups.
If you configure the same HSRP group number on multiple interfaces, the switch counts each interface as one instance:
For example, if you configure HSRP group 0 on VLAN 1 and on port 1, the switch counts this as two instances.
... View more
01-11-2019
03:27 PM
@Richard Burts wrote:
In answering a question like this we should recognize that sometimes we are precise about terminology and sometimes we are sloppy and blur distinctions about terms such as vlan and whether it is layer 2 or layer 3.
Hence I posted that this is Cisco canon, and then I used a reference from Cisco to show where I retrieved the canonical terminology. Since it is Cisco that we all get our certifications from, there is no ambiguity here; there are definitely Layer 2 and Layer 3 VLAN interfaces.
... View more
01-11-2019
11:22 AM
There actually are l2 VLANs and L3 VLANs, according to Cisco canon. So your answer was correct.
referenced from here:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/l3_int.pdf
... View more
12-14-2018
03:02 PM
From that same document, those are the recommend values for IP SLAs UDP jitter operation . But for all other IP SLA the recommended value does not take value of N into account, and it is simply:
( frequency seconds ) > ( timeout milliseconds ) > ( threshold milliseconds )
Same resource:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipsla/command/sla-cr-book/sla_s2.html#wp3249187301
Consider the following guidelines before configuring the frequency (IP SLA), timeout (IP SLA), and threshold (IP SLA) commands. For the IP SLAs UDP jitter operation, the following guidelines are recommended:
( frequency seconds ) > (( timeout milliseconds ) + N)
( timeout milliseconds ) > ( threshold milliseconds )
where N = ( num-packets number-of-packets ) * ( interval interpacket-interval ). If you are running Cisco IOS IP SLAs Engine 3.0, use the num-packets command and the interval (params) commands to configure the values that define N. Otherwise, use the udp-jitter command to configure the num-packets number-of-packets and interval interpacket-interval values.
For all other IP SLAs operations, the following configuration guideline is recommended:
( frequency seconds ) > ( timeout milliseconds ) > ( threshold milliseconds )
... View more
Created by
chad patterson
in Routing
in Routing
09-27-2018
03:45 PM
09-27-2018
03:45 PM
Two things:
1. It's because you're not redistributing BGP int RIP.
router rip
redistribute bgp 23 metric 5
2. You're trying to redistribute iBGP into RIP. You can only distribute eBGP into RIP, unless you use a special override command:
router bgp 23 bgp redistribute-internal
... View more
Created by
chad patterson
in Switching
in Switching
09-20-2018
10:59 AM
09-20-2018
10:59 AM
Found one on the webs, and it seems to work. Even though it has all the private-vlan commands built in, it doesn't seem to recognize the tags.
Great suggestion, thanks.
... View more
Created by
chad patterson
in Switching
in Switching
09-18-2018
01:09 PM
09-18-2018
01:09 PM
I would do that, however I need to simulate a switch that doesn't recognize pvlan tags.
... View more
Created by
chad patterson
in Switching
in Switching
09-18-2018
11:28 AM
09-18-2018
11:28 AM
I am trying to connect an IOSvL2 switch to a unmanaged switch with two connections, to intentionally create a loop. VIRL will not allow this, as it throws the error;
Duplicate connection from node "iosvl2-5" to network(s) "unmanagedswitch-1": problem of VIRL file at line 643.
How can I force VIRL to allow me to do this?
... View more
Labels:
Created by
chad patterson
in Switching
in Switching
09-18-2018
10:29 AM
09-18-2018
10:29 AM
I found the answer to the problem.
I was running this simulation in VIRL, and when I changed the Switch#2 to an unmanaged switch, then it worked as expected. So it seems that as long as the switch recognizes PVLAN tagging, then this is not possible.
... View more
Created by
chad patterson
in Switching
in Switching
09-14-2018
01:25 PM
09-14-2018
01:25 PM
I found out the cause of the issue. I was using the vlan interfaces on the switches to ping each other. After setting the vlan to a primary private vlan, I then had to map that to the vlan interfaces on the switches:
... View more
Created by
chad patterson
in Switching
in Switching
09-14-2018
11:19 AM
09-14-2018
11:19 AM
In a VIRL simulation I have two IOSvL2 switches connected together. Each switch has a VLAN 101 interface, and the ports they are connected to each other on are access ports. If I change the VLAN 101 to primary private, they lose the ability to connect to each other using access ports. This makes no sense to me.
I was under the impression that primary VLAN of a private VLAN would behave the same as a regular VLAN. But that is not what is going on.
When both switches are configured with the config of switch1, they can ping each other. When I modify the VLAN 101 on switch2, and make no other changes anywhere else, they can no longer communicate. Can somebody please explain why this is happening?
design config
... View more
Labels:
Created by
chad patterson
in Security Analytics and Management
04-02-2019 03:35 PM
04-02-2019 03:35 PM
I am interested in getting all of my Cisco routers and Switches (with
IOS <= 12.2) to use Azure MFA ...
Created by
chad patterson
in Identity Services Engine (ISE)
04-02-2019 03:19 PM
04-02-2019 03:19 PM
I am also interested in getting all of my Cisco routers and Switches
(with IOS <= 12.2) to use Azure...
Created by
chad patterson
in Security Analytics and Management
03-13-2019 04:05 PM
03-13-2019 04:05 PM
Ths document says that you can:
https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell...
02-20-2019 07:42 PM
Be careful. I ran into a timer issue today while trying to secure my
OSPF implementation with MD5 au...
Created by
chad patterson
in Switching
01-24-2019 03:58 PM
01-24-2019 03:58 PM
It looks like you are seeing the expected behavior. The switches are not
counting the unconfigured H...
01-11-2019 03:27 PM
@Richard Burts wrote: In answering a question like this we should
recognize that sometimes we are pr...
01-11-2019 11:22 AM
There actually are l2 VLANs and L3 VLANs, according to Cisco canon. So
your answer was correct. refe...
12-14-2018 03:02 PM
From that same document, those are the recommend values for IP SLAs UDP
jitter operation. But for al...
Created by
chad patterson
in TelePresence and Video Infrastructure
12-12-2018 05:15 PM
12-12-2018 05:15 PM
Call-Routed Mode requires all the TCP signaling to route through the
Gatekeeper, including RAS, Q.93...
Created by
chad patterson
in Routing
09-27-2018 03:45 PM
09-27-2018 03:45 PM
Two things: 1. It's because you're not redistributing BGP int RIP.
router rip redistribute bgp 23 me...
Created by
chad patterson
in Switching
09-20-2018 10:59 AM
09-20-2018 10:59 AM
Found one on the webs, and it seems to work. Even though it has all the
private-vlan commands built ...
Created by
chad patterson
in Switching
09-18-2018 01:09 PM
09-18-2018 01:09 PM
I would do that, however I need to simulate a switch that doesn't
recognize pvlan tags.
Created by
chad patterson
in Switching
09-18-2018 11:28 AM
09-18-2018 11:28 AM
I am trying to connect an IOSvL2 switch to a unmanaged switch with two
connections, to intentionally...
Created by
chad patterson
in Switching
09-18-2018 10:29 AM
09-18-2018 10:29 AM
I found the answer to the problem. I was running this simulation in
VIRL, and when I changed the Swi...
Public Statistics
| Date Registered | 07-08-2011 01:44 AM |
| Date Last Visited | 04-03-2019 12:31 PM |
| Total Messages Posted | 75 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
