Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jlizzio
12-18-2018
Stats
Member since
03-19-2007
31
Posts
10
Helpful
0
Solutions
12-14-2018
05:04 PM
Hi HTH,
Sorry I didn't reply sooner. I thought I had notifications turned on but apparently I didn't.
So my original config did end up working, which is perfect as I only want to authenticate based on a single trust point. The weird thing is all I did to get it working was reboot the device.
Thanks for the explanation of the shared keyword at the end of the tunnel protection.
-John
... View more
11-28-2018
05:00 PM
Hi Everyone,
We are working on a phase 3 DMVPN and we are going to use certs issued from our own CA via a cisco router for authentication.
We’d like to be able to authenticate via the domain acme.local. So any host with acme.local that has a valid certificated issued by our cisco CA should pass (i.e. west.acme.local)
My question for everyone is what is needed under the isakmp profile for this to work? Snippets of our non working config below:
crypto isakmp profile AMCE-LOCAL-DMVPN
ca trust-point ACME-LOCAL
match identity host domain acme.local
If I add the match identity with FQDN to both sides it work, but that isn’t going to scale real well.
Also I’m a little confused on the ipsec tunnel protection under the interface. Is the “shared” option needed since it’s an mGRE interface?
Thanks,
-John
... View more
Labels:
05-03-2018
06:07 PM
Hi Chrihussey,
K values... you study them, know them and wonder when will I use them. Well, today was that day.
So what I did was increase the delay on R1 for the interface where the MPLS routes are learned from. It works and so far I haven't seen anything negative associated with it.
Thanks to you, cofee and all the others who are helping provide solutions.
-J
... View more
05-02-2018
05:24 PM
Hi Cofee,
Thanks for your suggestions. I should probably clarify a couple of things.
The Spoke router is redistributing the default route. It is not learned. There is an SLA monitoring Internet reachability. If the SLA fails, the route is removed and the one learned from the MPLS should be used.
The distance option with the ACL changes all learned routes and not the redistributed ones.
Maybe there is a better way to accomplish redundancy for Internet?
Thanks,
-J
... View more
05-02-2018
11:29 AM
Yes, sorry if I didn't make that clear. There is a default originate coming across through the MPLS that R2 is advertising. The spoke is advertising the default route based on an SLA. If the SLA fails then the MPLS route will pick up. Note - the SLA needs to be on the spoke as there are more than one ISP.
Static is an option but not one I'm real excited about.
In BGP this is a slam dunk with the ability to match on a prefix. With EIGRP it doesn't seem like there is a way to prefix match and modify the AD based on the match although it seems like there should be.
... View more
05-02-2018
10:09 AM
Hi Everyone,
I’m trying to come up with a solution for redundancy to our MPLS network and DMVPN seems like the obvious choice. Everything around DMVPN is working. My issue is a routing one.
I need to be able to adjust the AD of the default route being advertised to R1 from SPOKE using EIGRP. I don’t want to affect any other routes other than the default. Seems like such a simple thing to do. Maybe I’ve just been staring at this thing to long.
If I could change the AD for prefix 0.0.0.0/0 to 10 this will give us a preferred path to the Internet out our local ISP and a backup over the MPLS.
Much thanks,
-J
... View more
Labels:
12-26-2017
01:59 PM
Hi Everyone,
Got an interesting one that I'm hoping the community might be able to help with.
I'd like to be able to take TACACS requests to an ISE instance and if the username starts with "abc." proxy those requests to another ISE server while servicing all other authentication requests locally. Is this possible?
Thanks,
-John
... View more
Labels:
04-18-2017
06:26 PM
It makes me nervous as well.
I could build a tunnel between the two companies using a virtual interface and tie both ends of the tunnel to area zero, however I really don't like the idea of adding company B to my area zero as I don't have full control of their infrastructure. Maybe the best thing to do is run separate OSPF processes and redistribute.
... View more
04-17-2017
12:41 PM
Hi Everyone,
I have a question that I cannot seem to find the answer to in any documentation.
We acquired a company that is running OSPF as their IGP. We too are running OSPF.
Both companies are obviously using area 0 so the question is how to best connect these two entities together. I know I can use another routing protocol and redistribute but ideally I'd like to stay with OSPF. So could I have Company A AREA 0 - COMPANY A AREA 300 - connect to Company B AREA 0 and not have any issues?
I created a lab within Maestro and didn't have any problems but I wanted to see what the communities thoughts were.
Thanks,
-JL
... View more
- Tags:
- ospf
Labels:
01-10-2012
10:58 AM
TAC reviewed our logs and determined that something was corrupt due to the upgrade process from 5.2 to 5.3. I rebuilt the VM as 5.3 and it joined the domain without issue. -John
... View more
12-14-2011
01:28 PM
Hello, I have two ACS 5.3 servers setup as primary and secondary. The Primary is joined to the domain and works without issue. The secondary server shows as connectivity status:disconnected under the AD configuration. If I test the connection using the username and passwords credentials it is successful. On the command line when I run the show app status acs command the adclient process results in execution failed. Any thoughts? Thanks, -John
... View more
Labels:
11-20-2010
11:38 PM
Thanks for the replies. Actual it will work in 8.2 but it's much easier in 8.3. Here is what I did in 8.2. Create and acl for the servers dmz ip and the internal network - access-list dmz_nat extended permit ip host 10.10.12.10 10.10.0.0 255.255.0.0 Now you tie the two ip addresses (real and public) to the static static (dmz,inside) 10.10.12.10 access-list dmz_nat static (dmz,inside) 12.12.12.10 access-list dmz_nat I was able to connect to either IP address from the internal networks to the dmz without issue. It's a little messy but atleast it's a solution as eliminating a internal name server from a billion dollar a year company isn't. I didn't create the mess I just inherated it -John
... View more
11-19-2010
07:07 AM
I wish we had a single DNS. Unfortunately I inherted quite a mess. We have internal and external DNS both serving our FQDN (*.acme.com). For the life of me I cannot come up with one good reason why someone would do this but it's here and it's not going away. I though I came up with a work around but the 3750's that act as the L3 on the inside do not support NAT so now I'm really in a bind. -John
... View more
11-18-2010
09:31 PM
I imagine this solution is out there but after browsing posts for an hour I can't come up with it. Below is my network and were using an ASA 5550 8.2.3. outside 12.12.12.0/24 dmz 10.10.12.0/24 inside 10.10.0.0/24 static (dmz,outside) 12.12.12.10 10.10.12.10 What I need to be able to do is from the inside access a server on the DMZ via both the 10.10.12.10 address as well as the 12.12.12.10 IP. I can get either or to work but cannot get them both to function at the same time. Ideally it would be even better if when you connected to the 10.10.12.10 ip address it returned the 12.12.12.10, but that's not a 100% necessary. This scenerio works like a champ on the PIX and 6.3.5 code via the static (dmz,inside) 12.12.12.10 10.10.12.10 dns command. Any help would greatly be appreciated. -John
... View more
Labels:
03-01-2010
05:21 PM
Thanks for your response. It maybe legacy technology but tell that to all big telcos that still use it everywhere. -John
... View more
12-14-2018
Hi HTH, Sorry I didn't reply sooner. I thought I had notifications
turned on but apparently I didn't...
11-28-2018
Hi Everyone, We are working on a phase 3 DMVPN and we are going to use
certs issued from our own CA ...
05-03-2018
Hi Chrihussey, K values... you study them, know them and wonder when
will I use them. Well, today wa...
05-02-2018
Hi Cofee, Thanks for your suggestions. I should probably clarify a
couple of things. The Spoke route...
05-02-2018
Yes, sorry if I didn't make that clear. There is a default originate
coming across through the MPLS ...
05-02-2018
Hi Everyone, I’m trying to come up with a solution for redundancy to our
MPLS network and DMVPN seem...
12-26-2017
Hi Everyone, Got an interesting one that I'm hoping the community might
be able to help with. I'd li...
04-18-2017
It makes me nervous as well. I could build a tunnel between the two
companies using a virtual interf...
04-17-2017
Hi Everyone, I have a question that I cannot seem to find the answer to
in any documentation. We acq...
01-10-2012
TAC reviewed our logs and determined that something was corrupt due to
the upgrade process from 5.2 ...
12-14-2011
Hello,I have two ACS 5.3 servers setup as primary and secondary. The
Primary is joined to the domain...
11-20-2010
Thanks for the replies.Actual it will work in 8.2 but it's much easier
in 8.3.Here is what I did in ...
11-19-2010
I wish we had a single DNS. Unfortunately I inherted quite a mess.We
have internal and external DNS ...
11-18-2010
I imagine this solution is out there but after browsing posts for an
hour I can't come up with it.Be...
Public Statistics
| Date Registered | 03-19-2007 03:29 PM |
| Date Last Visited | 12-18-2018 06:29 PM |
| Total Messages Posted | 31 |
| Total Helpful Votes Received | 10 |
.jpg "VIP Advocate"){kind=icon}
