Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jsmall123
01-09-2019
Stats
Member since
09-25-2006
26
Posts
13
Helpful
1
Solution
05-06-2014
08:52 AM
Hi Éric and Andrew, I have noticed that there are incompatibilities between IPsec VPNs using different platforms. For example, I don't believe an IPv6 IPsec tunnel can be established between an ASA and an IOS Router. Ideally I'd like to see the following all supported: ASAv4v4 <--> IOSv4v4 - Works (IPv4 outer and inner tunnels) ASAv6v6 <--> IOSv6v6 - Don't believe works (IPv6 outer and inner tunnels) ASAv4v6 <--> IOSv4v6 - Don't believe works (IPv4 outer and IPv6 inner tunnels) - See CSCtu09251 ASAv4DS <--> IOSv4DS - Don't believe works (IPv4 outer and IPv4+IPv6 [Dual Stack] inner tunnels) - is this supported by the current RFCs? Or can you only have a single address family for the inner tunnel? ASAv6v4 <--> IOSv6v4 - Don't believe works (IPv6 outer and IPv4 inner tunnels) - See CSCtu09251 ASAv6DS <--> IOSv6DS - Don't believe works (IPv6 outer and IPv4+IPv6 [Dual Stack] inner tunnels) - is this supported by the current RFCs? Or can you only have a single address family for the inner tunnel? Perhaps the best place to start is to define the problem. Do the current IPsec/IKE RFCs support interoperability: v4v4 <--> v4v4 - supported v6v6 <--> v6v6 - believe supported, agree? v4v6 <--> v4v6 - supported? v6v4 <--> v6v4 - supported? v4DS <--> v4DS - supported? v6DS <--> v6DS - supported? The next step is what makes sense for Cisco to support. Perhaps starting with the above combinations and FLEX VPN on IOS with the ASA? Very interested in your thoughts on this, --Jim
... View more
05-06-2014
06:57 AM
Hi Éric and Andrew, Thanks for this opportunity and looking forward to seeing your latest presentations at Live. With the publication of RFC 7112, do you see IOS (Routers/Switches)/IOS-XE/ASA/NX-OS adding an option to allow enforcement? Perhaps an option at the Interface or VLAN level (like RA Guard) which drops any IPv6 packet where the entire header chain isn't present? This seems like a great and simple way to make sure there are no loop holes with RA Guard/DHCPv6 Snooping/etc. I know no commitments/timelines can be offered. Hoping you can comment on interest and your perceived urgency. Another question I wanted to ask is what do you think of taking the tools from Mr. Gont and Mr. Heuse and incorporating them into standard product tests? For example - with IOS/ASA my thought is that any of the various RA Flood type attacks shouldn't spike the CPU. Looking at Linux, I believe this is possible. Has this been considered? Finally - there are many fantastic security options available in Cisco products for IPv6 already. However, any thoughts as to some tuning guidance? NDP for example offers many knobs for its various facets but would be great to see a discussion of the pros/cons of various approaches. The FHS wiki (http://docwiki.cisco.com/wiki/FHS) and your Live talks for example are fantastic. More resources - especially detailed write ups/whitepapers would be welcome. Best regards and thanks again, --Jim
... View more
02-13-2014
12:46 PM
For the Cisco Cloud E-mail Security Solution - does it support both inbound and outbound IPv6? Are there any limitations? I know the IronPort E-mail Security Appliances supports IPv6 - but specifically interested in the cloud service. Thanks, --Jim
... View more
Labels:
10-02-2013
08:22 AM
I have a 5505 setup in my home office. It generally works well but I noticed when I upgraded it to 9.1.2.8 it would stop passing traffic after a few days. I figured this was just the interim release blues and waited until 9.1.3 came out. However, with 9.1.3 the problem is even worse. I'm actually not exactly sure what's going on. Here's what I've noticed: I get a lot of DNS connections with the "h" flag (H.225 traffic) set. This seems like it might have some relation to the problem: UDP outside 216.218.130.2:53 inside 192.168.234.146:50705, idle 0:00:18, bytes 534, flags h (...) I also get these in 9.1.2 (which works fine), but far fewer. When traffic stops passing on my ASA, I notice that I have tons of these connections in 9.1.3. When traffic stops passing, the ASA itself can no longer get to the Internet. I can't ping my Comcast router (actually in my office, L2 adjacent to ASA). I also have some SLA probes going to the Internet which fail. If I do a clear conn all, then everything starts working again for a while. The BTF (dynamic-filter) feature seems to make it worse. If I remove it (remove dynamic-filter-snoop part) then it takes a lot longer before it stops passing traffic: policy-map global_policy class inspection_default inspect dns dns-ipm dynamic-filter-snoop What's really strange, is even if I remove all service-policy commands, I still get connections with the "h" flag. I don't believe that should be possible so perhaps a bug? Ideas?
... View more
Labels:
03-27-2013
08:42 PM
Ideal world - use standard M-EUI-64 for link-local addresses and then use a FHRP like HSRP for the static address. That way your routers are all dynamic, but the address humans use for the default gateway can be something like fe80::VLAN#:1 or whatever makes sense for you. That said, I would try to stick with using RAs for your default gateway. The only exceptions should be infrastructure devices that either don't run or aren't configured with a routing protocol such as load balancers and firewalls.
... View more
03-27-2013
08:38 PM
For customers just hosting a single server, why don't you use a routed port? You can then do SLAAC or DHCPv6. The customer can use those or elect to use a static address from the /64. Since this is directly connected you don't need additional routing. You can summarize the /64s when you advertise routes to neighboring devices. For customers that want their own router/firewall use a /64 for the link from your 7k to their CPE. Then assign them a /64 or /60 or whatever you arrange. For that I would use a static route to the CPE again making sure to summarize. For a small setup like your describing I wouldn't use an IGP. This doesn't fit with the customer type you're describing. My impression of DHCP-PD is its more targeted for residential/SMB customers and not hosting environments. --Jim
... View more
03-24-2013
10:33 AM
It's a good question. I don't see anything directly equivalent to that. However, you could try just using part of a /64. So let's say your network prefix is 2001:db8:1:2::/64. You only want to allocate from the top half of it. So you could try something like this: ipv6 dhcp pool Testv6-1 address prefix 2001:db8:2:3:8000::/80 Since the actual prefix length used comes from the router RA I belive this would work. Of course you'd have to test it with your gear with your version of IOS and with the operating systems you want to support. --Jim
... View more
03-19-2013
04:40 PM
The only problematic one is for ACE. For that you need at least A5_1_0 to have IPv6 support, but I would go with the latest A5.2.2 or A5.2.1. For the ASA I would strongly recommend 9.0.2 or 9.1.1.4. 9.0 added tremendous IPv6 capabilities including NAT66, NAT64/46, and IPv4/IPv6 are now managed with a unified policy which makes things easier. AnyConnect also has full IPv6 support. However, if you can't upgrade 8.3 has some support. For the IPS I would go with the latest even though it doesn't really give you additional IPv6 capabilities - 7.1.7E4. As with the ASA, 7.0.2 supports IPv6 but it's old and has lots of issues.
... View more
Created by
jsmall123
in Networking Documents
in Networking Documents
02-07-2013
06:03 PM
02-07-2013
06:03 PM
"An anycast address is essentially a unicast address assigned to multiple devices with a host ID = 0000:0000:0000:0000." I believe this should be: "An anycast address is essentially a unicast address assigned to multiple interfaces and/or devices. One example of an anycast address is the Subnet-Router anycast address which has a host ID of 0 (0000:0000:0000:0000)." Please reference RFC 4291 written by the legendary Steve Deering of none other than Cisco Systems. :-) --Jim
... View more
01-04-2013
08:43 PM
Hi Vikrant, Looks like its not supported even in the latest version (15.0(2)) - see here: http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/15.0_2_se/configuration/guide/swhsrp.html#wp1093570 From the link: If you configure HSRP for IPv4 and HSRP for IPv6 at the same time the switch will throw the following error: %FHRP group not consistent with already configured groups on the switch stack - virtual MAC reservation failed Work around: Configure either HSRP for IPv4 or HSRP for IPv6 on the switch. I'm not sure if this is a hardware or software limitation. If I find out I'll post it here. --Jim
... View more
08-21-2012
05:43 AM
Hi Andrew - are you telling me Wikipedia is not infallible? :-) So I agree that stateless DHCPv6 should generally suffice. However, RDNSS support would be nice. Some good use cases: 1) The Internet Of Things - In the embedded market, full DHCPv6 support would be harder - RDNSS would be much more appealing 2) Labs/Test environments - Anything to facilitate the rapid deployment of test/lab networks would be a boon. While DHCP/DHCPv6 isn't hard to setup, using RAs is brain dead and the ability to add a simple option to include DNS would be fantastic. 3) SOHO - Again, for simple environments this would be a plus. Also, when our Refridgerators and Coffee Makers join the network I would think RDNSS would be easier than stateless DHCPv6. Did you have a chance to see how the Internet of Things will hook us up: http://blogs.cisco.com/news/the-internet-of-things-infographic/ Please let me know what you think and if I may say, great job with Happy Eyeballs. I was very pleased to find out this is implemented in Windows 8 and Server 2012. --Jim
... View more
06-07-2012
09:45 AM
According to Wikipedia, IOS supports RDNSS or the abillity to configure IPv6 DNS Server(s) via RA (RFC 6106): http://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_operating_systems However, I can't figure out how to set this up. Can someone provide an example of this or point me to the appropriate document? Thanks, --Jim
... View more
Labels:
Created by
jsmall123
in VPN and AnyConnect
in VPN and AnyConnect
09-25-2006
11:47 AM
09-25-2006
11:47 AM
I have noticed the following behavior with the Cisco VPN Client (4.x). Conditions - Start a Remote Access Client IPSec Tunnel to a Cisco Firewall (PIX/ASA 6.x/7.x) The Cisco Firewall is the perimeter firewall for a company network and has a public IP. It is also serving as a VPN Headend. The Client is coming from a remote network using private IP addressing. There are two cases to this: Case 1 - Client is attached to a router/firewall that does NAT. The router/firewall has a public IP on the Internet. The client is directly behind the router/firewall on a single, flat network (typically 192.168.1.0/24). In this situation, the client can VPN to the remote PIX/ASA/Cisco firewall even without NAT-Traversal enabled and everything works fine. Case 2 - Now if we take a similar situation - client is on a private network behind a router/firewall that is on the Internet with a public IP. However, now the client has one or more routers between itself and the router/firewall with the public IP. In this case, the client can initiate a VPN connection to the remote PIX/ASA/Cisco firewall and successfully authenticate. However, the client will be unable to pass traffic to the networks behind the firewall. If we enable NAT-Traversal, the problems go away and everything works great. (Requires 6.3+ for PIX/ASA). My question is, why does Case 1 work? Shouldn't they both fail without NAT-T enabled? I run into this all the time and tell my clients. They do it and see that it works but they always want to know why and I'm not sure! Any explanations would be greatly appreciated. Thanks, --Jim
... View more
Labels:
05-06-2014
Hi Éric and Andrew,I have noticed that there are incompatibilities
between IPsec VPNs using differen...
05-06-2014
Hi Éric and Andrew,Thanks for this opportunity and looking forward to
seeing your latest presentatio...
02-13-2014
For the Cisco Cloud E-mail Security Solution - does it support both
inbound and outbound IPv6? Are t...
10-02-2013
I have a 5505 setup in my home office. It generally works well but I
noticed when I upgraded it to 9...
03-27-2013
Ideal world - use standard M-EUI-64 for link-local addresses and then
use a FHRP like HSRP for the s...
03-24-2013
It's a good question. I don't see anything directly equivalent to that.
However, you could try just ...
03-19-2013
The only problematic one is for ACE. For that you need at least A5_1_0
to have IPv6 support, but I w...
02-07-2013
"An anycast address is essentially a unicast address assigned to
multiple devices with a host ID = 0...
01-04-2013
Hi Vikrant,Looks like its not supported even in the latest version
(15.0(2)) - see
here:http://www.c...
08-21-2012
Hi Andrew - are you telling me Wikipedia is not infallible? :-) So I
agree that stateless DHCPv6 sho...
06-07-2012
According to Wikipedia, IOS supports RDNSS or the abillity to configure
IPv6 DNS Server(s) via RA (R...
Public Statistics
| Date Registered | 09-25-2006 11:36 AM |
| Date Last Visited | 01-09-2019 12:05 AM |
| Total Messages Posted | 26 |
| Total Helpful Votes Received | 13 |
