Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About lliska
Stats
Member since
12-08-2004
82
Posts
20
Helpful
1
Solution
07-16-2014
04:53 AM
Excellent, this works! I tried before to make router itself a DNS server, and added record: ip host _sip._udp.cucm.company.org 10.0.0.1 (hostname is obvious from "debug domain" output), but I did not specify it in correct SRV format, so it was not working. Thank you very much, you saved our lives (at least 1 second for every call we make :-) Lubomir
... View more
07-11-2014
08:16 AM
Yes, our session target points to a DNS name. We need it because it uses sip-ua (registration) and authenticates with the provider with every call request; we were not able to get it working with IP address as a session target.
... View more
07-11-2014
07:19 AM
Hi, we had similar problem, the CUBE waited 9 seconds before INVITE was forwarded on outside leg. It was caused by DNS (default DNS timeout is 3 sec, default retry is 2, what means 3x3=9 seconds). Workaroud was to set DNS timers to minimal values: ip domain retry 0 ip domain timeout 1 But the question is, why CUBE tries to use DNS server, when we have domain lookup set to OFF, and why it does not directly use manualy configured record. With the workaround we decreased the delay to 1 second (better than 9 :-), but if we could avoid also this unnecessary 1 second, it would be nice. Thanks, Lubomir
... View more
04-11-2014
06:44 AM
Hi Kanwal, thanks, we opened a TAC case, and it is a bug CSCtg00135. Unfortunately, this bug is hidden in the database so I could not find it. Thank you for your help. L
... View more
04-09-2014
12:57 PM
Hi Kanwal, unfortunately, it did not help. The behavior is the same after we applied "purpose-check disabled". Do you have any other suggestions? One mistake on my side, it is ACE4710 with A5(2.1), not ACE30, I do not know if it plays the role, but sorry for the confusion anyway. Thanks, Lubomir
... View more
04-09-2014
09:22 AM
Hi Kanwal, before I started this discussion, I had searched in the Bug toolkit, but have not found any similar behavior. Maybe you can find it in the internal database. Our version is A5(2.1e). Thanks, L.
... View more
04-09-2014
08:45 AM
Hi Kanwal, thanks for the reply. I described the real behavior. We played with the authgroups, re-applied config under ssl-proxy service and this is what we got. I have read the docs, it says we can specify up to 10 certificates (order is not important), but this does not work and I do not know, if they all must be a part od 1 chain, or it is a bug, or we understood it incorrectly and this will never work. Thank you, L.
... View more
Created by
lliska
in Application Networking
in Application Networking
04-09-2014
08:18 AM
04-09-2014
08:18 AM
Hello,
our client is using ACE30 SSL termination with client authentication.
Customer is changing the authentication method from "certificates from CertAuthority No.1" to "certificates from CertAuthority No.2".
The change must be smooth, will take a time, old certificates are still valid, but some users already use new certificates.
The certificates issuing authorities are completly different.
Q: Is it possible to include certificates of both issuing CA in one authgroup?
It seems the ACE accepts only the first certificate in the group (order matters), if "OLD" is first, ACE correctly authenticates only users with certs issued by OLD CA. Other users (with NEW certificate) are not allowed to access the service.
Similarly, if "NEW" cert is on the first place in authgroup, ACE authenticates only users with certs issued by NEW CA. The users with OLD cert are disallowed.
Thanks,
Lubomir
... View more
- Tags:
- ACE authgroup
Labels:
Created by
lliska
in IP Telephony and Phones
in IP Telephony and Phones
11-09-2013
12:39 PM
11-09-2013
12:39 PM
Hi Konstantinos, thanks for the reply, but this is not the case. To make the question clear: we have 2 interfaces on the router, Gi0/0 is LAN interface, Gi0/1 is WAN interface. We must use Gi0/1 for communication between router and SIP voice provider, because Gi0/1 has publicly routable IP address. Thats why we already have bind command in the config, specifying the Gi0/1 interface. On the other side, we must use Gi0/0 for communication between router and internal SIP users, which access the network via IPSec VPN. If the router instruct the users to use the outside interface (inherited from "bind all source-interface Gi0/1"), they start to send the packets outside of the split VPN tunnel, which does not work (security policy). Thanks, L.
... View more
Created by
lliska
in Application Networking
in Application Networking
02-07-2013
06:29 AM
02-07-2013
06:29 AM
Hi Jim, server people asked us to only allow access to: www.host.com/public/ > We should block (redirect to /public) requests to all other url, for example: www.host.com/devel/ > www.host.com/test1/ > and others, which may not be known now. Regards, Lubomir
... View more
Created by
lliska
in Application Networking
in Application Networking
02-07-2013
05:48 AM
02-07-2013
05:48 AM
Jim, I thought there was a way to write an url match statement, that would exclude my correct URL. In the documentation (http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_1_0/configuration/slb/guide/classlb.html#wp1313278) there is an option to exclude a character: [^charset] Do not match any character in the range If there would be a way to exclude the whole string (= the exact sequence of more characters), this whould be what I need. But I can not find the correct way to configure it, and maybe this is not possible at all. Thank you very much for your answers. L.
... View more
Created by
lliska
in Application Networking
in Application Networking
02-06-2013
12:27 AM
02-06-2013
12:27 AM
Hi Jim, thanks for your reply. Normaly, your advice would be fine, but I also need to insert client certificate fields to the packets destined to rservers (end to end SSL), and action lists with SSL header inserts are only allowed in class-default. So the correct URL must be processed in this class. Best wishes, Lubomir
... View more
Created by
lliska
in Application Networking
in Application Networking
02-05-2013
09:23 AM
02-05-2013
09:23 AM
Hi, is it possible to construct the L7 HTTP class-map expression to match all URLs except one? I have 1 correct url, for example: /correcturl.* and want to redirect requests to all other possible URLs to this one, without the need to list them all in "possitive match" statements. I tried variations of: match http url /^(correcturl).* with no luck. Thanks, Lubomir
... View more
Labels:
12-11-2012
05:34 AM
It is not possible to use CIPC, the customer uses Smartphones with various SIP clients... Any other advice? Thank you, L.
... View more
Created by
lliska
in IP Telephony and Phones
in IP Telephony and Phones
12-11-2012
05:31 AM
12-11-2012
05:31 AM
Yes, it is a bug (CSCuc58367). Thanks, Lubomir
... View more
07-16-2014
Excellent, this works!I tried before to make router itself a DNS server,
and added record:ip host _s...
07-11-2014
Yes, our session target points to a DNS name. We need it because it uses
sip-ua (registration) and a...
07-11-2014
Hi,we had similar problem, the CUBE waited 9 seconds before INVITE was
forwarded on outside leg. It ...
04-11-2014
Hi Kanwal,thanks, we opened a TAC case, and it is a bug CSCtg00135.
Unfortunately, this bug is hidde...
04-09-2014
Hi Kanwal,unfortunately, it did not help. The behavior is the same after
we applied "purpose-check d...
04-09-2014
Hi Kanwal,before I started this discussion, I had searched in the Bug
toolkit, but have not found an...
04-09-2014
Hi Kanwal,thanks for the reply. I described the real behavior. We played
with the authgroups, re-app...
04-09-2014
Hello, our client is using ACE30 SSL termination with client
authentication. Customer is changing th...
11-09-2013
Hi Konstantinos,thanks for the reply, but this is not the case. To make
the question clear: we have ...
02-07-2013
Hi Jim,server people asked us to only allow access
to:www.host.com/public/>We should block (redirect...
02-07-2013
Jim,I thought there was a way to write an url match statement, that
would exclude my correct URL. In...
02-06-2013
Hi Jim,thanks for your reply. Normaly, your advice would be fine, but I
also need to insert client c...
02-05-2013
Hi,is it possible to construct the L7 HTTP class-map expression to match
all URLs except one?I have ...
12-11-2012
It is not possible to use CIPC, the customer uses Smartphones with
various SIP clients...Any other a...
Public Statistics
| Date Registered | 12-08-2004 04:27 AM |
| Date Last Visited | 12-28-2018 05:00 AM |
| Total Messages Posted | 82 |
| Total Helpful Votes Received | 20 |
Helpful Votes Given To
Helpful Votes From
