hello , can anybody explain me what those logs mean ? 000014:  03:27:57.443: End->Password:UHOhphphIUH786BHL/89Y9PU9989/ 000015:  03:27:57.447: End->Password:IUGiuhIUHIUoijocRxu7987GVCfccctfty thanks ... View more

HI All, i am trying to configure certificate based authentication for anyconnect on ios router, but did not found any good documentation for this, every document that i have found on "cert based auth" just referes to ASA not to ios router. ... View more

hi all, I have following setup (A)------3925<---ipsec-->rv120w-----(B) problem is 1) when pinging from A to rv120 public ip with 1430 bytes pings are ok, if increasing size packets loss begins 2) when pinging from A to B with 1322 bytes pings are ok, as soon as i am increasing the size packet loss begins. i am capturing packets on rv120w lan side, and i see all the icmp packets from A-to->B and also B-to->A, this means that packets from A are reaching B , but responses from B are lost at some point.   wan interface on rv120w is pppoe , have tried different mtu options on it , without success. ... View more

HI All, i am assigning access list on vlan interface (in) direction , i am not getting matchs on first  record of acl but only on second . Extended IP access list test 10 deny ip any host 192.168.1.5 19 permit icmp any any log (142 matches) %SEC-6-IPACCESSLOGDP: list test permitted icmp 172.16.100.116 -> 192.168.1.5 (8/0), 1 packet ... View more

HI All, i am expiriencing following issue on switch , vlan interface and physical interface (that is serving for this vlan ) have different input/output counters, there is only one physical interface in this vlan . sh int vlan 64 30 second input rate 9000 bits/sec, 9 packets/sec 30 second output rate 0 bits/sec, 0 packets/sec sh int g0/9 30 second input rate 4412000 bits/sec, 924 packets/sec 30 second output rate 4006000 bits/sec, 689 packets/sec sh vlan 64   TEST_NET                       active    Gi0/9 ... View more

in test sample below everithing works correctly as expected  , but problem is that if i change route-map dst   "set ip next-hop 200.0.0.2 "  to "set interface fastethernet 1/0" than i am loosing conection to 222.222.222.222. reason that i want to change route-map statement is that in reality one of my link is pppoe,  so i dont exactely know what will be the gateway next time router will take new ip. i have two options more prefered 1) leave defaulgt gateway assigned on pppoe and write PBR for second link for which i have gateway ip less prefered   2) call provider and ask what can be the potential gateways , so that i can put all of them in  "set ip next-hop verify-availibility x.x.x.x track xxx" command. will be thankful, if  someone can offer me better option. interface FastEthernet0/0 description LAN ip address 10.0.0.1 255.255.255.0 ip nat inside ip policy route-map dst ! interface FastEthernet0/1 description isp1 ip address 100.0.0.1 255.255.255.0 ip nat outside !        interface FastEthernet1/0 description isp2 ip address 200.0.0.1 255.255.255.0 ip nat outside ip route 0.0.0.0 0.0.0.0 100.0.0.2 !              ip nat inside source route-map isp1 interface FastEthernet0/1 overload ip nat inside source route-map isp2 interface FastEthernet1/0 overload !        ip access-list extended dst permit ip 10.0.0.0 0.0.0.255 host 222.222.222.222 ip access-list extended nat permit ip 10.0.0.0 0.0.0.255 any !          route-map isp2 permit 10 match ip address nat match interface FastEthernet1/0 !        route-map isp1 permit 10 match ip address nat match interface FastEthernet0/1 !        route-map dst permit 10 match ip address dst set ip next-hop 200.0.0.2 ... View more

in test sample below everithing works correctly as expected  , but problem is that if i change route-map dst   "set ip next-hop 200.0.0.2 "  to "set interface fastethernet 1/0" than i am loosing conection to 222.222.222.222. reason that i want to change route-map statement is that in reality one of my link is pppoe,  so i dont exactely know what will be the gateway next time router will take new ip. i have two options more prefered 1) leave defaulgt gateway assigned on pppoe and write PBR for second link for which i have gateway ip less prefered   2) call provider and ask what can be the potential gateways , so that i can put all of them in  "set ip next-hop verify-availibility x.x.x.x track xxx" command. will be thankful, if  someone can offer me better option. interface FastEthernet0/0 description LAN ip address 10.0.0.1 255.255.255.0 ip nat inside ip policy route-map dst ! interface FastEthernet0/1 description isp1 ip address 100.0.0.1 255.255.255.0 ip nat outside !         interface FastEthernet1/0 description isp2 ip address 200.0.0.1 255.255.255.0 ip nat outside ip route 0.0.0.0 0.0.0.0 100.0.0.2 !               ip nat inside source route-map isp1 interface FastEthernet0/1 overload ip nat inside source route-map isp2 interface FastEthernet1/0 overload !         ip access-list extended dst permit ip 10.0.0.0 0.0.0.255 host 222.222.222.222 ip access-list extended nat permit ip 10.0.0.0 0.0.0.255 any !           route-map isp2 permit 10 match ip address nat match interface FastEthernet1/0 !         route-map isp1 permit 10 match ip address nat match interface FastEthernet0/1 !         route-map dst permit 10 match ip address dst set ip next-hop 200.0.0.2 ... View more

aaa new-model aaa authentication login default local username aaa password aaa username bbb password bbb user aaa should have ssh and telnet access. user bbb  is only used for vpn authentication, i dont want him to access router via ssh or telnet ,even in user exec mode. i also can not  apply access-class on vty lines because i am loging in device from different places ,and dont know exact ranges of ip address to create access-list radius and tacacs is not option for me what can be done in order to restrict user bbb from ssh and telnet access ? ... View more