Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About paul.matthews
Stats
Member since
06-24-2002
638
Posts
278
Helpful
33
Solutions
09-30-2016
01:30 AM
I have
policy-map type inspect PolInsideOut class type inspect ClassManagementOutDNS inspect class type inspect ClassManagementOutWebproxies inspect class type inspect ClassReturnTrafficOut inspect class class-default drop log
policy-map type inspect PolOutsideIn class type inspect ClassMediaAgentBackupCommcell inspect class type inspect ClassWebConsoleManagementCommcell inspect class type inspect ClassWebConsoleManagementReport inspect class type inspect ClassWebConsoleManagementProxy inspect class type inspect ClassReturnTrafficIn inspect
class class-default drop log
where the classes define traffic, for example:
ip access-list extended WebConsoleManagementCommcell permit tcp any host 172.16.45.4 eq www permit tcp any host 172.16.45.4 eq 443
class-map type inspect match-any ClassWebConsoleManagementCommcell match access-group name WebConsoleManagementCommcell
... View more
Created by
paul.matthews
in Firewalls
in Firewalls
09-29-2016
01:36 AM
09-29-2016
01:36 AM
OK Guys, I am new to firewalling but need to get one up and running, I actually have a pair, but am trying to just get it working on one to then copy. I am using three zones - inside, outside and self. Self seems to be OK.
I need to permit some access in through the firewall, and some out. As a consequence I have two zone pairs.
When I try to do it I see return traffic being dropped, so obviously I need to somehow permit that. Is it simply a case of reversing the ACLs (I have a worry about that) and adding them to the opposite zone pair? is there some easy option I have missed in my hurry? I mentioned the concern. One outbound rule is from a server on any port to the internet on any port. Obviously that reversed is going to open the server up to everything.
Thanks,
Paul.
... View more
Labels:
08-01-2014
03:55 AM
I have a colleague trying to upgrade a pair of ACE appliances. The upgrade has been succesfull for the same file downloaded from CCO on other appliances, but when they try the reboot to perform the upgrade, it reports a CRC error, so they abort the upgrade. They have noticed that the copied files on the ACE are different sizes - copying the same file from the same server results in different file sizes, so it looks like the issue is either the copy, or the local writing of the file. Has anyone seen similar? Thanks.
... View more
Labels:
03-28-2013
10:53 AM
Guys, has anyone seen this before? Configuring QoS I use names ACLs, but when I show the class map, it refers to a number rather than name: conf t ip access-list extended QoS-CGP permit tcp any any eq 2598 ip access-list extended QoS-MOVI-Data permit tcp any range 21000 21900 any permit tcp any any range 21000 21900 ! Class Maps Class-map match-any QoS-AF41 Match acce name QoS-MOVI-Data Class-map match-any QoS-AF31 Match acce name QoS-CGP sh run | beg ss-ma class-map match-any QoS-AF41 match access-group name 825372979 class-map match-any QoS-AF31 match access-group name 825372979 It is on a 2960 running a rather old IOS - 12.2(25)SEE4 Thanks, Paul.
... View more
Labels:
05-20-2012
04:45 AM
With HSRP you will always need N+1 addresses - two routers, three addresses. VRRP allows you to use one less, but even then you would need a /29 to fit both of your addresses plus the ISP router. Paul.
... View more
05-18-2012
09:55 AM
I am having a little problem with 2950s and rspan. I wuld like to replace them with something a little newer, but that's not going to happen! Basically I need to have two rspan sessions running. Both are ultimately to a 3750, I have: 3750-4506-2950A-2950B I have two rspan VLANs - 777 and 778. I have two separate sources, one on 2950A and one on 2950B The first 2950 rspan session (sourced at 2950A) is fine. The second is proving rather troublesome. I am not seeing the traffic I expect to see. What I am seeing could be in line with the unused port type visibility - lots of broad/multicast, some unicast. Nothing from the device I am interested in. Is there any restriction on either 4500/SUPV or 2950 carrying more than one RSPAN VLAN? When I remove the monitor source, traffic drops to zero out of the destination interface. sh mon sess all Session 1 --------- Type : Remote Source Session Source Ports : Both : Fa0/38 Reflector Port : Fa0/31 Dest RSPAN VLAN : 778 sh int status Fa0/31 reflector monitoring 2 a-full a-100 10/100BaseTX Thanks for any ideas, Paul.
... View more
Labels:
Created by
paul.matthews
in Switching
in Switching
04-03-2012
07:41 AM
04-03-2012
07:41 AM
You need to get a wireshark trace from one of the failing PCs. Torsten's description matches what I see in the traces. That makes it look like as the client is offered an address and tries to ARP it something responds. It is indeed suspicious that it happens with the provider's router in place. With this information you perhaps need to ask them do they have any secondary addresses, or are they providing DHCP in any way. An interesting test may be to shut down your DHCP server, and see is something can get an IP address.
... View more
Created by
paul.matthews
in Switching
in Switching
03-29-2012
12:36 AM
03-29-2012
12:36 AM
Spanning tree is in use pretty much the world over with no ill effect on DHCP. The server is providing an address, so exhaustion unlikely. The client is declining the offer. I would want to see a trace from the PC itself, and I would be tempted to disable IPv6 on it as a test.
... View more
Created by
paul.matthews
in Switching
in Switching
03-28-2012
08:25 AM
03-28-2012
08:25 AM
My german is non existent. so I am not sure what the headings are, but the value in the Eindeitige ID fiels is the IP address mentioned in the client IP field. With that frames 9052 and 8436 look relevant - they are DCHP declines for some of those addresses. Superficially it looks OK. The DHCP specific sequence is: 8351 - discover (client) 8371 - Offer (server) 8375 - request (client) 8376 - Ack (server) 8436 - decline (would expect inform) (client) I can't see an obvious reason for the decline. Looking at the fuller trace, there is some activity on IPv6 from that PC before the decline.Before the decline we also see the PC arp for the address it has been offered, but see no response at the server. It joins 224.0.0.252 - Link-local Multicast Name Resolution (LLMNR) address, and tries similar on IPv6. I'd try a wireshark from that PC (Melanie-PC) as we would not necessarily expect to see responses to those from the server.
... View more
Created by
paul.matthews
in Switching
in Switching
03-28-2012
07:06 AM
03-28-2012
07:06 AM
I have had a quick skim of the traces, and nothing obviously jumps out.The addresses you are posting do look a little odd - where exactly are they being reported? They look a little short ec:80:10:ac - I cannot fit those as MAC addresses in any of the common notation formats. What I note about them though is they may well be IP addresses. ec:80:10:ac if we decode the hex to decimal we get 236.128.16.172 Spin it round and we have an IP address in your network - 172.16.128.236 Looking specifically at the DCHP in your traces, there does not look t be anything obviously amiss. We need to see what exactly is complaining, and what the details of the report are. Paul.
... View more
03-28-2012
06:30 AM
Guys, I am hoping one of you can answer this easily! When you use sh int summary, for fields like RXPS, what time period is that for? Is it the load-interval period (default 5 mins) or is it average load since last clearing of counters? Interface IHQ IQD OHQ OQD RXBS RXPS TXBS TXPS TRTL ------------------------------------------------------------------------- * Vlan2 1 3725 0 0 649582000 175355 631791000 170048 237 Thanks, Paul.
... View more
Labels:
Created by
paul.matthews
in Application Networking
in Application Networking
01-05-2012
05:20 AM
01-05-2012
05:20 AM
Does the ACE licencing change with 5.1? The part no ACE-4710-0.5-K9 which is half gig still seems to be available, but the release note at http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA5_1_x/release/note/ACE_app_rn_A51x.html#wp644684 says: By default, the ACE supports the following features and capabilities: • Performance: 1 gigabit per second (Gbps) appliance throughput Thanks, Paul.
... View more
Labels:
Created by
paul.matthews
in Application Networking
in Application Networking
10-18-2011
05:02 AM
10-18-2011
05:02 AM
Hi Guys. I am looking at a issue with an ACE. SW is 3.0(0)A3(2.6) We have a setup where most of it appears fine. It detect the loss of rservers, probes fail, the VIP stops responding to Pings, but it still accept TCP connections, even though there is nothing behind to accept them. The question is, is this correct behaviour? and if so is there any reference I can look at to confirm? While this behaviour is inconvenient for us. I can see why it may actually be correct. Thanks, Paul.
... View more
Labels:
Created by
paul.matthews
in Switching
in Switching
05-24-2011
05:45 AM
05-24-2011
05:45 AM
Again, thanks fr tat. Looking at the details, I was expecting the source ports to be access ports, b ut it now appears they are trunks. Is there any issue with spanning a trunk port over rspan?
... View more
Created by
paul.matthews
in Switching
in Switching
05-24-2011
05:21 AM
05-24-2011
05:21 AM
Thanks for the suggestion - it was only after submitting and looking a little later I realised the omission I had mad. My concern is more on a 3750, can I span a local port into an rspan VLAN, *and* pull the rspan VLAN out to a destination on the same switch?
... View more
09-30-2016
I have policy-map type inspect PolInsideOut class type inspect
ClassManagementOutDNS inspect class t...
09-29-2016
OK Guys, I am new to firewalling but need to get one up and running, I
actually have a pair, but am ...
08-01-2014
I have a colleague trying to upgrade a pair of ACE appliances. The
upgrade has been succesfull for t...
03-28-2013
Guys, has anyone seen this before? Configuring QoS I use names ACLs, but
when I show the class map, ...
05-20-2012
With HSRP you will always need N+1 addresses - two routers, three
addresses. VRRP allows you to use ...
05-18-2012
I am having a little problem with 2950s and rspan. I wuld like to
replace them with something a litt...
Created by
paul.matthews
in Switching
04-03-2012
04-03-2012
You need to get a wireshark trace from one of the failing PCs. Torsten's
description matches what I ...
Created by
paul.matthews
in Switching
03-29-2012
03-29-2012
Spanning tree is in use pretty much the world over with no ill effect on
DHCP. The server is providi...
Created by
paul.matthews
in Switching
03-28-2012
03-28-2012
My german is non existent. so I am not sure what the headings are, but
the value in the Eindeitige I...
Created by
paul.matthews
in Switching
03-28-2012
03-28-2012
I have had a quick skim of the traces, and nothing obviously jumps
out.The addresses you are posting...
03-28-2012
Guys, I am hoping one of you can answer this easily!When you use sh int
summary, for fields like RXP...
01-05-2012
Does the ACE licencing change with 5.1?The part no ACE-4710-0.5-K9 which
is half gig still seems to ...
Created by
paul.matthews
in Application Networking
10-18-2011
10-18-2011
Hi Guys. I am looking at a issue with an ACE. SW is 3.0(0)A3(2.6)We have
a setup where most of it ap...
Created by
paul.matthews
in Switching
05-24-2011
05-24-2011
Again, thanks fr tat. Looking at the details, I was expecting the source
ports to be access ports, b...
Created by
paul.matthews
in Switching
05-24-2011
05-24-2011
Thanks for the suggestion - it was only after submitting and looking a
little later I realised the o...
Public Statistics
| Date Registered | 06-24-2002 01:16 AM |
| Date Last Visited | 07-04-2018 12:05 AM |
| Total Messages Posted | 638 |
| Total Helpful Votes Received | 278 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 4 | |
| 3 | |
| 4 | |
| 8 |
.jpg "VIP Advisor"){kind=icon}
Helpful Votes From
