Hi, I have a problem with dmvpn, when some spokes are coming from one nat pool. There is a network, that is protected with one firewall, that isn't under our management. As a result, all spokes use the same outgoing ip. With first conection all is ok, all others can't establish connection.  Have anybody some idea, how to resolve this problem? BR, Ugis ... View more

Hi! In IOS XE 3.13.3S SNMP Tunnel.mib OIDs doesn't work. In Cisco web sites i didn't find any useful answer. Looks like mast be. Do anyone knows something about it? To what version can I up/downgrade to get it work? BR, Ugis Ducmanis  ... View more

Hi, Our client have SCE 8000 and about 20 static subscribers. Each of them have about one or two IP prefixes. Changes in these prefixes are made once per two or three months. Primary  target is to shape each of them with his per subscriber limit.  Secondary target is to send data to rrd server. Third (optional) is to show sometimes the type of traffic, used by subscriber. Now, as from documantation, I installed SM and CM servers, and SCA BB on management workstation.    Main problem is that time to time clients network operators trying to insert subscriber name with whitespaces underscores and so on. As a result, SM is  interrupting sync with SCE with error and don't allow to connect to SM with SCA BB Subscriber management tool.  Therefore I have some questions. Is it possible to make this all to work without this SM server and to insert SM->Package mapping automatically without it?  If I will do it by command line, will it be saved after rebooting of SCE?   Is it possible to make working CM without and to get per subscriber graphics? Is it possible to make it all looking human friendly?   BR, Ugis ... View more

Hi, Client replaced a switch from 3750 to 35850 and got problems with port-security. %PORT_SECURITY-2-PSECURE_VIOLATION That is more interesting: Security Violation Count   : 0 It's not increased. WS-C3850-48T       03.03.01SE port config on old 3750: interface GigabitEthernet1/0/3   switchport access vlan 500   switchport mode access   switchport port-security maximum 2   switchport port-security   switchport port-security aging time 2   switchport port-security violation restrict   switchport port-security aging type inactivity   no mdix auto   spanning-tree portfast   spanning-tree bpduguard enable port config on 3850: interface GigabitEthernet1/0/3 switchport access vlan 500 switchport mode access switchport port-security maximum 10 switchport port-security switchport port-security aging time 2 switchport port-security violation restrict switchport port-security aging type inactivity  no mdix auto  spanning-tree portfast  spanning-tree bpduguard enable sh mac addr sec Port Security              : Enabled Port Status                : Secure-up Violation Mode             : Restrict Aging Time                 : 2 mins Aging Type                 : Inactivity SecureStatic Address Aging : Disabled Maximum MAC Addresses      : 10 Total MAC Addresses        : 1 Configured MAC Addresses   : 0 Sticky MAC Addresses       : 0 Last Source Address:Vlan   : 28d2.4408.437c:500 Security Violation Count   : 0 sho mac address-table secure interface GigabitEthernet1/0/3          Mac Address Table ------------------------------------------- Vlan    Mac Address       Type        Ports ----    -----------       --------    ----- 500    28d2.4408.437c    STATIC      Gi1/0/3 Total Mac Addresses for this criterion: 1 But all the time it's connected I got : %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 28d2.4408.437c on port GigabitEthernet1/0/3 BR, Ugis ... View more

Hi, Had anybody experience with snmp on Nexus vrfs? I need to monitor  bgp neighbour state in vrfs. Is it possible? BR, Ugis Ducmanis ... View more

Hi, After migration from SCE1010 to SCE8000 I have a problem with global controller statistics on Cacti. Template doesn't work anymore. I can't find any information about available OIDs for such a information. Can anybody help me with it? BR, Ugis ... View more

Hi, Got a case with interesting problem. For some reasons ping packet is sent to switchcard who haven't mac entry for it. If switch haven't mac entry for destination host, it sends packet to all his ports, including routers backplane port. Of course, packet must be ignored on router, because it doesn't contain his or broadcast destination mac adress. But for some reason router is sending packet back to network with his MAC as source. It means that packet is received by router despite its other hosts destination mac address.   Is it a some bug of routers backplane ethernet controller or there is some other reason? Router has arp entry for destination that isn't expired. BR, Ugis ... View more

Hi, I need to terminate easyVPN on vrf interface, because Internet is on vrf only. On Windows client looks like password error. I didn't try to terminate EasyVPN in vrf before. Can You help me? With Best Regards, Ugis --------------------- *Dec 29 11:35:45.518: ISAKMP/xauth: reply attribute XAUTH_USER_NAME_V2 *Dec 29 11:35:45.518: ISAKMP/xauth: reply attribute XAUTH_USER_PASSWORD_V2 *Dec 29 11:35:45.519: ISAKMP:(35007):deleting node -1674984011 error FALSE reason "Done with xauth request/reply exchange" *Dec 29 11:35:45.519: ISAKMP:(35007):Input = IKE_MESG_FROM_PEER, IKE_CFG_REPLY *Dec 29 11:35:45.519: ISAKMP:(35007):Old State = IKE_XAUTH_REQ_SENT New State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT *Dec 29 11:35:45.519: ISAKMP: set new node -1291909677 to CONF_XAUTH *Dec 29 11:35:45.519: ISAKMP/xauth: request attribute XAUTH_USER_NAME_V2 *Dec 29 11:35:45.519: ISAKMP/xauth: request attribute XAUTH_USER_PASSWORD_V2 ------------------------ *Dec 29 11:35:45.519: ISAKMP:(35007): initiating peer config to 4.3.2.1. ID = 3003057619 *Dec 29 11:35:45.519: ISAKMP:(35007): sending packet to 4.3.2.1 my_port 4500 peer_port 56966 (R) CONF_XAUTH *Dec 29 11:35:45.519: ISAKMP:(35007):Sending an IKE IPv4 Packet. *Dec 29 11:35:45.520: ISAKMP:(35007):Input = IKE_MESG_FROM_AAA, IKE_AAA_START_LOGIN *Dec 29 11:35:45.520: ISAKMP:(35007):Old State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT New State = IKE_XAUTH_REQ_SENT *Dec 29 11:35:52.528: ISAKMP (35007): received packet from 4.3.2.1 dport 4500 sport 56966 inet (R) CONF_XAUTH *Dec 29 11:35:52.529: ISAKMP:(35007):processing transaction payload from 4.3.2.1. message ID = -1291909677 *Dec 29 11:35:52.529: ISAKMP: Config payload REPLY *Dec 29 11:35:52.529: ISAKMP/xauth: reply attribute XAUTH_STATUS_V2 unexpected. *Dec 29 11:35:52.529: ISAKMP:(35007):peer does not do paranoid keepalives. *Dec 29 11:35:52.529: ISAKMP:(35007):Input = IKE_MESG_FROM_PEER, IKE_CFG_REPLY *Dec 29 11:35:52.530: ISAKMP:(35007):Old State = IKE_XAUTH_REQ_SENT New State = IKE_XAUTH_REQ_SENT *Dec 29 11:35:52.530: IPSEC(key_engine): got a queue event with 1 KMI message(s) *Dec 29 11:35:52.530: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP *Dec 29 11:35:52.530: IPSEC(key_engine_delete_sas): delete all SAs shared with peer 4.3.2.1 *Dec 29 11:35:52.532: ISAKMP (35007): received packet from 4.3.2.1 dport 4500 sport 56966 inet (R) CONF_XAUTH *Dec 29 11:35:52.532: ISAKMP: set new node 1500321808 to CONF_XAUTH *Dec 29 11:35:52.533: ISAKMP:(35007): processing HASH payload. message ID = 1500321808 *Dec 29 11:35:52.533: ISAKMP:received payload type 18 *Dec 29 11:35:52.533: ISAKMP:(35007):Processing delete with reason payload *Dec 29 11:35:52.533: ISAKMP:(35007):delete doi = 0 *Dec 29 11:35:52.534: ISAKMP:(35007):delete protocol id = 1 *Dec 29 11:35:52.534: ISAKMP:(35007):delete spi_size = 16 *Dec 29 11:35:52.534: ISAKMP:(35007):delete num spis = 1 *Dec 29 11:35:52.534: ISAKMP:(35007):delete_reason = 2 *Dec 29 11:35:52.534: ISAKMP:(35007): processing DELETE_WITH_REASON payload, message ID = 1500321808, reason: DELETE_BY_USER_COMMAND *Dec 29 11:35:52.534: ISAKMP:(35007):peer does not do paranoid keepalives. *Dec 29 11:35:52.534: ISAKMP:(35007):peer does not do paranoid keepalives. *Dec 29 11:35:52.534: ISAKMP:(35007):deleting SA reason "BY user command" state (R) CONF_XAUTH (peer 4.3.2.1) *Dec 29 11:35:52.534: ISAKMP:(35007):deleting node 1500321808 error FALSE reason "Informational (in) state 1" *Dec 29 11:35:52.534: IPSEC(key_engine): got a queue event with 1 KMI message(s) crypto isakmp policy 1 encr aes 256 authentication pre-share group 2 ! crypto isakmp client configuration group ezvpngroup key xxxremote pool ezvpn netmask 255.255.255.192 crypto isakmp profile ezvpn vrf inet (tried with and without this line) match identity group ezvpngroup client authentication list ez isakmp authorization list ez client configuration address respond virtual-template 3 ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set AES256_SHA esp-aes 256 esp-sha-hmac mode tunnel ! ! ... View more