Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About iceteanolemon
Stats
Member since
07-20-2009
26
Posts
0
Helpful
0
Solutions
05-12-2014
05:43 AM
I am having the same issue. I notice the switch does not respond and apply the macro faster than the system can attain connectivity to vlan1 (since the port is default) I will be searching to find a solution but for now I am forced to sticky the affected ports to guarantee they come back as same vlan. Not my idea of a solution.
... View more
08-10-2012
11:05 AM
I would like to add that I am setting a new pair of Nexus 7010's up and am having the same symptom. RPP-DCA-CR001# show vpc brief Legend: (*) - local vPC is down, forwarding via vPC peer-link vPC domain id : 1 Peer status : peer adjacency formed ok vPC keep-alive status : peer is alive Configuration consistency status : success Per-vlan consistency status : success Type-2 consistency status : failed Type-2 inconsistency reason : VTP type-2 configuration incompatible vPC role : secondary Number of vPCs configured : 1 Peer Gateway : Enabled Peer gateway excluded VLANs : - Dual-active excluded VLANs : - Graceful Consistency Check : Enabled Auto-recovery status : Enabled (timeout = 240 seconds) vPC Peer-link status --------------------------------------------------------------------- id Port Status Active vlans -- ---- ------ -------------------------------------------------- 1 Po1 up 1,437 vPC status ---------------------------------------------------------------------- id Port Status Consistency Reason Active vlans -- ---- ------ ----------- ------ ------------ 37 Po37 up success success 1,437 RPP-DCA-CR001# show vpc consistency-parameters global Legend: Type 1 : vPC will be suspended in case of mismatch Name Type Local Value Peer Value ------------- ---- ---------------------- ----------------------- STP Mode 1 Rapid-PVST Rapid-PVST STP Disabled 1 None None STP MST Region Name 1 "" "" STP MST Region Revision 1 0 0 STP MST Region Instance to 1 VLAN Mapping STP Loopguard 1 Enabled Enabled STP Bridge Assurance 1 Enabled Enabled STP Port Type, Edge 1 Normal, Disabled, Normal, Disabled, BPDUFilter, Edge BPDUGuard Enabled Enabled STP MST Simulate PVST 1 Enabled Enabled VTP domain 2 royalVTP royalVTP VTP version 2 2 2 VTP mode 2 Server Server VTP password 2 RoyalVTP9988 RoyalVTP9988 VTP pruning status 2 Enabled Enabled Interface-vlan admin up 2 1,437 1,437 Interface-vlan routing 2 1,437 1,437 capability Allowed VLANs - 1,437 1,437 Local suspended VLANs - - - RPP-DCB-CR001# show vpc consistency-parameters global Legend: Type 1 : vPC will be suspended in case of mismatch Name Type Local Value Peer Value ------------- ---- ---------------------- ----------------------- STP Mode 1 Rapid-PVST Rapid-PVST STP Disabled 1 None None STP MST Region Name 1 "" "" STP MST Region Revision 1 0 0 STP MST Region Instance to 1 VLAN Mapping STP Loopguard 1 Enabled Enabled STP Bridge Assurance 1 Enabled Enabled STP Port Type, Edge 1 Normal, Disabled, Normal, Disabled, BPDUFilter, Edge BPDUGuard Enabled Enabled STP MST Simulate PVST 1 Enabled Enabled VTP domain 2 royalVTP royalVTP VTP version 2 2 2 VTP mode 2 Server Server VTP password 2 RoyalVTP9988 RoyalVTP9988 VTP pruning status 2 Enabled Enabled Interface-vlan admin up 2 1,437 1,437 Interface-vlan routing 2 1,437 1,437 capability Allowed VLANs - 1,437 1,437 Local suspended VLANs - - - RPP-DCB-CR001# show vpc brief Legend: (*) - local vPC is down, forwarding via vPC peer-link vPC domain id : 1 Peer status : peer adjacency formed ok vPC keep-alive status : peer is alive Configuration consistency status : success Per-vlan consistency status : success Type-2 consistency status : failed Type-2 inconsistency reason : VTP type-2 configuration incompatible vPC role : primary Number of vPCs configured : 1 Peer Gateway : Enabled Peer gateway excluded VLANs : - Dual-active excluded VLANs : - Graceful Consistency Check : Enabled Auto-recovery status : Enabled (timeout = 240 seconds) vPC Peer-link status --------------------------------------------------------------------- id Port Status Active vlans -- ---- ------ -------------------------------------------------- 1 Po1 up 1,437 vPC status ---------------------------------------------------------------------- id Port Status Consistency Reason Active vlans -- ---- ------ ----------- ------ ------------ 37 Po37 down* success success - Both cores are running same versions of code .... Software BIOS: version 3.22.0 kickstart: version 6.0(3) system: version 6.0(3) Software BIOS: version 3.22.0 kickstart: version 6.0(3) system: version 6.0(3)
... View more
Created by
iceteanolemon
in Network Access Control
in Network Access Control
05-31-2012
07:57 AM
05-31-2012
07:57 AM
I noticed it about three minutes after posting!! Thanks for the reply, as always you guys are awesome!
... View more
Created by
iceteanolemon
in Network Access Control
in Network Access Control
05-30-2012
03:35 PM
05-30-2012
03:35 PM
I am having a similar issue. I have an ASA running 8.4(2) and I enabled accounting as well. I can see that the ASA is sending the accounting packets to the server but the server logs dont show anything. ASA# aaa accounting command server-group aaa accounting enable console server-group aaa accounting ssh console server-group aaa accounting serial console server-group Server Group: server-group Server Protocol: tacacs+ Server Address: xxx.xxx.xxx.xxx Server port: 49 Server status: ACTIVE, Last transaction at 15:33:03 PDT Wed May 30 2012 Number of pending requests 0 Average round trip time 15ms Number of authentication requests 8100 Number of authorization requests 8247 Number of accounting requests 25 Number of retransmissions 0 Number of accepts 16028 Number of rejects 325 Number of challenges 27 Number of malformed responses 0 Number of bad authenticators 0 Number of timeouts 19 Number of unrecognized responses 0 Release 4.2(1) Build 15 Patch 8 Server Group: server-group Server Protocol: tacacs+ Server Address: xxx.xxx.xxx.xxx Server port: 49 Server status: ACTIVE, Last transaction at 15:33:03 PDT Wed May 30 2012 Number of pending requests 0 Average round trip time 15ms Number of authentication requests 8100 Number of authorization requests 8247 Number of accounting requests 25 Number of retransmissions 0 Number of accepts 16028 Number of rejects 325 Number of challenges 27 Number of malformed responses 0 Number of bad authenticators 0 Number of timeouts 19 Number of unrecognized responses 0 ACS4.2 doesnt show me anything in the logs. Version: Release 4.2(1) Build 15 Patch 8
... View more
05-23-2012
08:25 PM
now te question.... I have other groups i already use the "deny" to deny these accounts user access to the wireless environment as a client but i would also like to deny the administrative access to the other systems. This would not be possible as I cannot have the deny and permit enabled at the same time!
... View more
05-23-2012
08:10 PM
You did it. I am happy it works but how come it was such a pain to get to this point? Why is the setting inverted? This is really bad. I am P.O.C. ing ISE so I will have bigger fish to fry but wow this one stumped me.
... View more
05-23-2012
08:00 PM
OK well I did what you wanted and I changed the NAR setting from "deny" to "Permit" and it blocked the account from access. I then tested the account to another device which is not in the NAR and it blocked that one too! So the result now is if I place a device in the NAR under Deny, it wont deny it or anything. If I place a device in the NAR and switch the setting to "permit" then It blocks everything. It definitely does stuff but not what I want it to do.
... View more
05-23-2012
07:34 PM
This is the area where I claimed a test firewall that I want to block administrative access to. “CBP-1A-FW001” The group config I am in at the moment is “Network Engineering” Here is the authentication that is being marked “successful” even though the user is categorized into the correct group and the group has the NAR configured. notice the no filters activated. I am sure I am missing something but I just guess I may not understand it to be working as I expect.
... View more
05-23-2012
05:12 PM
I read that a few times today, just dont seem to get the traction to see whats wrong with my config though.
... View more
05-23-2012
04:55 PM
I have configured "denied calling point" for both ip and cli with no luck. Right now I am just putting one device in there but i plan on putting a device group in when i can test it in a working condition. The type of authentication is for configuration access to the device. I am trying to block aministration access to the device/device group for a particular user group using NAR.
... View more
Created by
iceteanolemon
in Network Access Control
in Network Access Control
05-23-2012
03:07 PM
05-23-2012
03:07 PM
I have a problem implementing a NAR for a specific device group. I am running Cisco ACS 4.2 and it works fine for all the other stuff I do but this issue is perplexing me a bit. I have a device group with Juniper devices in it and I authenticate using RADIUS (Juniper) as the radius setting. I have a Administration user group set up. I placed a NAR into the group "Per Group Defined Network Access Restrictions" specific to the device group with * for port and address I placed this group into both the Define IP-Based as well as the Define CLI/DNIS-based section. No matter what I do I keep getting authenticated. When I go to the passed authentications page I see my login and the group-name is identified correctly and the network device group is identified correctly too. The filter says "no filters activated". So how can I get this NAR to kick in? I would like to restrict one device group from a ACS user group. Thanks for any information you can provide!
... View more
Labels:
05-23-2012
03:06 PM
I have a problem implementing a NAR for a specific device group. I am running Cisco ACS 4.2 and it works fine for all the other stuff I do but this issue is perplexing me a bit. I have a device group with Juniper devices in it and I authenticate using RADIUS (Juniper) as the radius setting. I have a Administration user group set up. I placed a NAR into the group "Per Group Defined Network Access Restrictions" specific to the device group with * for port and address I placed this group into both the Define IP-Based as well as the Define CLI/DNIS-based section. No matter what I do I keep getting authenticated. When I go to the passed authentications page I see my login and the group-name is identified correctly and the network device group is identified correctly too. The filter says "no filters activated". So how can I get this NAR to kick in? I would like to restrict one device group from a ACS user group. Thanks for any information you can provide!
... View more
Labels:
04-13-2011
02:48 PM
Hi all, I am making a post to get info on a specific issue I have with my 4507 with a sup 7-e installed. I have built a few Sup6 4507 and 4510's without issues like this so when this one came along it left me scratching my head a little. The issue has to do with powering the Modules in the 1 and 2 slots on the chassis. I have tried setting the power to redundant and combined with the same results. Upon boot with power supplies ON, all the modules will boot up as expected in normal operation. When I cut the power on the PSU then the Sup starts shutting down the modules. It shuts down the Slot1 and Slot2. When I bring power back on then I expec tthe modules to come back alive. They dont though, they stay off. Only when I issue a "no hw-module module 1 power" then issue a "hw-module module 1 power" will the modules come back online. I "think" this is something wrong with the Sup engine but I am known to be wrong on many occasions about many things routing and in life. I also have a beef with the mgmt interface located on the Sup card itself. It doesnt work. Now if this power issue is something wrong with the Sup cards themselves I will be alarmed and looking for other issues in the operating system as well. If this is just a configuration fix or something I am overlooking then thats the greatest news I can expect. If anyone has a fix or insight on this I would very much appreciate your feedback. Thanks, Ben Chassis: 4507R+E PSU:4200ACV Slot1: WS-X4624-SFP-E Slot2:WS-X4624-SFP-E Slot3:WS-X45-SUP7-E Slot4:WS-X45-SUP7-E Slot5-7: Empty Heres the show power from the unit... CR228#show power Power Fan Inline Supply Model No Type Status Sensor Status ------ ---------------- --------- ----------- ------- ------- PS1 PWR-C45-4200ACV AC 4200W good good good PS1-1 110V good PS1-2 110V good PS2 PWR-C45-4200ACV AC 4200W bad/off good bad/off PS2-1 off PS2-2 off Power supplies needed by system : 1 Power supplies currently available : 1 Power Summary Maximum (in Watts) Used Available ---------------------- ---- --------- System Power (12V) 640 1360 Inline Power (-50V) 0 1420 Backplane Power (3.3V) 40 40 ---------------------- ---- --------- Total 680 (not to exceed Total Maximum Available = 2100) Power Measurement Inline Power (-50V) (in Watts) (+/- 50Watts) ------------------ ------------------- PS1 0 PS2 0 ------------------ ------------------- Total 0
... View more
Labels:
10-31-2010
02:56 AM
I am doing smart install with 12.2.55.... You look like you dont have the actual tar file in your flash but instead are sharing the already extracted and installed image directory. I had to place the unextracted tar in my flash and then share it with tftp-server command just like you did with the client_cfg... Your error msg looks like its telling the story. I dont understand all the different port numbers we have for the client_cfg yet :/ My client config file looks like this W230#more flash:client_cfg.txt ! version 12.2 ! enable password cisco ! username cisco ! do telnet 10.10.10.1 58238 ! end !
... View more
05-12-2014
I am having the same issue. I notice the switch does not respond and
apply the macro faster than the...
08-10-2012
I would like to add that I am setting a new pair of Nexus 7010's up and
am having the same symptom.R...
Created by
iceteanolemon
in Network Access Control
05-31-2012
05-31-2012
I noticed it about three minutes after posting!! Thanks for the reply,
as always you guys are awesom...
Created by
iceteanolemon
in Network Access Control
05-30-2012
05-30-2012
I am having a similar issue.I have an ASA running 8.4(2) and I enabled
accounting as well. I can see...
05-23-2012
now te question.... I have other groups i already use the "deny" to deny
these accounts user access ...
05-23-2012
You did it.I am happy it works but how come it was such a pain to get to
this point?Why is the setti...
05-23-2012
OK well I did what you wanted and I changed the NAR setting from "deny"
to "Permit" and it blocked t...
05-23-2012
This is the area where I claimed a test firewall that I want to block
administrative access to. “CBP...
05-23-2012
I read that a few times today, just dont seem to get the traction to see
whats wrong with my config ...
05-23-2012
I have configured "denied calling point" for both ip and cli with no
luck.Right now I am just puttin...
05-23-2012
I have a problem implementing a NAR for a specific device group. I am
running Cisco ACS 4.2 and it w...
05-23-2012
I have a problem implementing a NAR for a specific device group. I am
running Cisco ACS 4.2 and it w...
04-13-2011
Hi all,I am making a post to get info on a specific issue I have with my
4507 with a sup 7-e install...
Public Statistics
| Date Registered | 07-20-2009 09:10 AM |
| Date Last Visited | 05-15-2019 12:03 AM |
| Total Messages Posted | 26 |
