Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About i.va
Stats
Member since
06-14-2008
161
Posts
25
Helpful
5
Solutions
05-20-2019
04:21 AM
Hi Thanks for your input guys. I forgot about EEM...will check it out! Kind Regards Ingo
... View more
05-08-2019
06:08 AM
Hi Mark Thanky for your reply. This also seems to also be the other way around: to send Syslogs as SNMP traps or informs to SNMP server. I need to send SNMP traps as Syslog messages to a Syslog server. I also found the command "logging snmp-trap", which only seems to specify the syslog severity levels sent to SNMP (https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/37e/consolidated_guide/b_37e_consolidated_3850_cg/b_37e_consolidated_3850_cg_chapter_01011110.pdf). Also tried different combinations of this configuration, but none resulted in SNMP traps showing up on my Syslog server. It would be better for the rogue detection to send messages to Syslog directly, but could not find any config for this.
... View more
05-08-2019
04:43 AM
We have a Cisco network (3850 stacks with Converged Access running v16.3.7) and a Syslog Server (Splunk). I would like to send SNMP traps as Syslog messages to our Syslog Server. Reason being, that our rogue AP detection feature only seems to send SNMP traps, and no syslog messages. I have found several guides on how to send Syslog messages as SNMP traps, but not the other way around. Is this even possible? If yes, how do I configure it? To my understanding the following commands enable logging of Syslog messages to SNMP traps: snmp-server enable traps syslog logging snmp-trap 0 7
... View more
Labels:
09-28-2016
01:21 AM
I am also missing this command on the 3850 03.06.04.E platform while using similar config as above. When debugging radius accounting, I do not see any info sent.
Sep 28 10:19:56.587 CET: RADIUS/ENCODE(00000000):Orig. component type = Invalid Sep 28 10:19:56.587 CET: RADIUS(00000000): Config NAS IP: 10.1.9.152 Sep 28 10:19:56.587 CET: RADIUS(00000000): Config NAS IPv6: :: Sep 28 10:19:56.587 CET: RADIUS(00000000): sending Sep 28 10:19:56.588 CET: RADIUS(00000000): Send Accounting-Request to 10.7.10.222:1646 id 1646/15, len 449 Sep 28 10:19:56.588 CET: RADIUS: authenticator A4 B5 14 6A 51 5E 58 A4 - FB 87 EB 9C 76 DF C6 C8 Sep 28 10:19:56.588 CET: RADIUS: Vendor, Cisco [26] 44 Sep 28 10:19:56.588 CET: RADIUS: Cisco AVpair [1] 38 "lldp-tlv= " Sep 28 10:19:56.588 CET: RADIUS: Vendor, Cisco [26] 25 Sep 28 10:19:56.588 CET: RADIUS: Cisco AVpair [1] 19 "lldp-tlv= " Sep 28 10:19:56.588 CET: RADIUS: Vendor, Cisco [26] 30 Sep 28 10:19:56.589 CET: RADIUS: Cisco AVpair [1] 24 "lldp-tlv= " Sep 28 10:19:56.589 CET: RADIUS: Vendor, Cisco [26] 28 Sep 28 10:19:56.589 CET: RADIUS: Cisco AVpair [1] 22 "lldp-tlv= " Sep 28 10:19:56.589 CET: RADIUS: Vendor, Cisco [26] 27 Sep 28 10:19:56.589 CET: RADIUS: Cisco AVpair [1] 21 "lldp-tlv= " Sep 28 10:19:56.589 CET: RADIUS: Framed-IP-Address [8] 6 10.191.1.119 Sep 28 10:19:56.589 CET: RADIUS: User-Name [1] 14 "d4785600424a" Sep 28 10:19:56.589 CET: RADIUS: Vendor, Cisco [26] 49 Sep 28 10:19:56.589 CET: RADIUS: Cisco AVpair [1] 43 "audit-session-id=0A0109980000117F07BE675A" Sep 28 10:19:56.589 CET: RADIUS: Vendor, Cisco [26] 18 Sep 28 10:19:56.589 CET: RADIUS: Cisco AVpair [1] 12 "method=mab" Sep 28 10:19:56.589 CET: RADIUS: Called-Station-Id [30] 19 "C4-14-3C-98-01-01" Sep 28 10:19:56.589 CET: RADIUS: Calling-Station-Id [31] 19 "D4-78-56-00-42-4A" Sep 28 10:19:56.589 CET: RADIUS: NAS-IP-Address [4] 6 10.1.9.152 Sep 28 10:19:56.590 CET: RADIUS: NAS-Port-Id [87] 22 "GigabitEthernet2/0/1" Sep 28 10:19:56.590 CET: RADIUS: NAS-Port-Type [61] 6 Ethernet [15] Sep 28 10:19:56.590 CET: RADIUS: NAS-Port [5] 6 50201 Sep 28 10:19:56.590 CET: RADIUS: Acct-Session-Id [44] 10 "00001598" Sep 28 10:19:56.590 CET: RADIUS: Class [25] 58 Sep 28 10:19:56.590 CET: RADIUS: 6F C1 30 18 AF 64 47 0F 8E B3 F6 52 9F 5C 1D A4 BF 0B 00 00 00 00 00 00 52 30 30 30 33 63 36 34 30 2D [o0dGR\R0003c640-] Sep 28 10:19:56.590 CET: RADIUS: 30 31 2D 35 37 65 62 37 64 30 66 00 00 00 00 00 00 00 00 00 00 00 [ 01-57eb7d0f] Sep 28 10:19:56.590 CET: RADIUS: Acct-Status-Type [40] 6 Watchdog [3] Sep 28 10:19:56.590 CET: RADIUS: Event-Timestamp [55] 6 1475050796 Sep 28 10:19:56.590 CET: RADIUS: Acct-Input-Octets [42] 6 2126 Sep 28 10:19:56.590 CET: RADIUS: Acct-Output-Octets [43] 6 9634 Sep 28 10:19:56.590 CET: RADIUS: Acct-Input-Packets [47] 6 22 Sep 28 10:19:56.590 CET: RADIUS: Acct-Output-Packets [48] 6 17 switch (config-if)# Sep 28 10:19:56.590 CET: RADIUS: Acct-Delay-Time [41] 6 0 Sep 28 10:19:56.591 CET: RADIUS(00000000): Sending a IPv4 Radius Packet Sep 28 10:19:56.591 CET: RADIUS(00000000): Started 5 sec timeout Sep 28 10:19:56.597 CET: RADIUS: Received from id 1646/15 10.7.10.222:1646, Accounting-response, len 20 Sep 28 10:19:56.598 CET: RADIUS: authenticator F3 D7 97 72 A9 6C 3C 13 - C5 43 AF ED 81 3F 26 11 switch(config-if)#
... View more
11-26-2015
05:59 AM
Have the same issue...been searching the net today, but have not found anything on this yet. :(
... View more
06-24-2014
05:20 AM
Hey, Thanks for your reply! Blocking DHCP on the DCI is a good idea...it should have the result I an looking for. The first hop will need to be the Firewall though, since we have the networks assigned to different security zones. Not the optimum regarding performance, but it will me the more secure approach. I am aware that in a failover scenario e.g. data from DC2 destined for another network in DC2 will traverse the DCI to get routed. Regards
... View more
06-20-2014
01:47 AM
Hi, I have been assigned the following challenge: a customer wants to build 2 datacenters and connect these to a L3 backbone. I have attached a (very) simplified network diagram. Challenge: The customer wants to span a L2 domain across both DCs and needs to have an Active/Active firewall. This in turn means that the traffic flow needs to be symmetric. Since both firewalls (gateways) and clients in this example are in the same stretched L2 subnet, how do I get the clients in DC1 to primarily use the FW 10.0.0.1 as default gateway, and clients in DC2 using 10.0.0.254 as default gateway. Of course clients need to use DHCP ;) Possible solution: See attached diagram. However this relies on the additional delay of the DCI to assign different default gateways to clients. e.g. a DHCP request from a client in DC 1 will get the quickest response from a DHCP server in DC1, which assigns 10.0.0.1 as default gateway. The DHCP response from DC 2 (which would assign 10.0.0.254 as deault gateway) would arrive late and ignored by the client. This does not seem like the perfect solution to me, since we are relying on many factors (e.g. delay may change due to other circumstances). Does anybody have other suggestions? Thanks in advance!
... View more
Labels:
02-03-2014
01:41 AM
I have a PI2.0 virtual appliance. How/where do I edit the abovementioned file exaclty?
... View more
12-04-2013
03:26 AM
Hi, I have set up the following in a lab: Prime Infrastructure 2.0 (2.0.0.0.294) Cisco Secure ACS 5.4.0.46.0a Windows 2003 Domain Controller för AD Authentication Goal: Admin access to network devices requires Authentication via TACACS+ to ACS (-> Active Directory). Network devices need to be managed by Prime. SSH access to Network Devices via putty and authentication against ACS/AD works just fine. Problem: During device discovery in Prime, I get a "Partial Collection Failure" with possible cause " Could not connect to device via CLI (SSH/telnet). Check device credentials and SSH/telnet reachability ". The device gets inserted into the device work center with blank SSH credentials If SSH redentials are configured manually, the device synch is successful. So basically the discovered devices need to be manually configured with SSH credentials in the device work center in order for the synch to work, which is a pain in a large environment. Troubleshooting done: - I have double-checked the credentials, and everything seems fine. - Same result with local ACS user. - Installed the latest patch pi_update_2.0-3.zip - tacacs debug on network devices shows PASS Network Device TACACS+ config: aaa new-model ! ! aaa authentication login default local aaa authentication login LOGINLIST group tacacs+ line aaa authentication enable default group tacacs+ enable aaa accounting exec default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 7 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ ! ! aaa session-id common ! tacacs-server host x.x.x.x tacacs-server directed-request tacacs-server key ************ ! line vty 0 4 password 7 ************ logging synchronous login authentication LOGINLIST length 20 width 200 transport input ssh
... View more
Labels:
11-22-2013
01:01 AM
Hi, I have a TAC case going...think we have a different problem. Thanky for the reply anyway! :-) Ingo
... View more
09-25-2013
02:15 AM
I have found an answer here: https://supportforums.cisco.com/thread/2178977 I will test to see if this works.
... View more
09-25-2013
01:48 AM
Hi...cant find anything on this in the release notes. Was this feature included in ISE 1.2 or not? I have a customer requesting this.
... View more
Created by
i.va
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-23-2013
10:41 PM
09-23-2013
10:41 PM
Yes that is correct, but I want to do MAC Filtering and redirect to ISE, and not use the local WLC Web Auth. Thats why the option is disabled. I also have this configured for WLAN ID 20, which is redirecting fine I now have a tac case open on this issue.
... View more
Created by
i.va
in Policy and Access
in Policy and Access
09-22-2013
11:17 PM
09-22-2013
11:17 PM
Hey Tarik, I know that this is possible...however if all the SSIDs are open, the user could initially connect to any SSID. When presented with the login page, the use will however be able to sucessfully log into any portal, as long as his/her credentials are correct, and the portal authentication source is the same. I can deny access at a later stage, but the user will still be able to authenticate with any SSID initially, and get presented with an authentication successful page. Regards
... View more
05-08-2019
Hi MarkThanky for your reply. This also seems to also be the other way
around: to send Syslogs as SN...
05-08-2019
We have a Cisco network (3850 stacks with Converged Access running
v16.3.7) and a Syslog Server (Spl...
09-28-2016
I am also missing this command on the 3850 03.06.04.E platform while
using similar config as above. ...
11-26-2015
Have the same issue...been searching the net today, but have not found
anything on this yet. :(
06-24-2014
Hey,Thanks for your reply! Blocking DHCP on the DCI is a good idea...it
should have the result I an ...
06-20-2014
Hi,I have been assigned the following challenge: a customer wants to
build 2 datacenters and connect...
12-04-2013
Hi,I have set up the following in a lab:Prime Infrastructure 2.0
(2.0.0.0.294)Cisco Secure ACS 5.4.0...
11-22-2013
Hi,I have a TAC case going...think we have a different problem. Thanky
for the reply anyway! :-)Ingo
09-25-2013
I have found an answer here:
https://supportforums.cisco.com/thread/2178977I will test to see if thi...
09-25-2013
Hi...cant find anything on this in the release notes. Was this feature
included in ISE 1.2 or not? I...
Created by
i.va
in Other Wireless - Mobility Subjects
09-23-2013
09-23-2013
Yes that is correct, but I want to do MAC Filtering and redirect to ISE,
and not use the local WLC W...
Public Statistics
| Date Registered | 06-14-2008 11:36 PM |
| Date Last Visited | |
| Total Messages Posted | 161 |
| Total Helpful Votes Received | 25 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 3 | |
| 3 | |
| 5 |
Helpful Votes From
