Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About ittechk4u1
Stats
Member since
01-14-2015
381
Posts
14
Helpful
2
Solutions
10-23-2019
05:22 AM
yes IP SLA 100 & 101 goes down when packet loss occurs on internet lines but IP SLA 55(MPLS tracking) is up most of the time.
... View more
10-22-2019
10:05 PM
Pessoa, Thank you. Are you sure that if the ping time of MPLS is above 300 then data will flow via normal forwarding on best route ? and not via MPLS ?
... View more
10-22-2019
10:04 PM
172.24.18.6 is MPLS IP in HQ(PE). 172.24.55.1 (Remore router- CPE), 172.24.55.2(Remote location - PE) we can 172.24.55.2 but its a direct connectivity and it will will be up all the time. How can we montior the HQ MPLS line from remote location MPLS fro tracking!
... View more
Created by
ittechk4u1
in Wireless Security and Network Management
in Wireless Security and Network Management
10-22-2019
05:16 AM
10-22-2019
05:16 AM
dont know much about 9800 wlc but i have seen a post about it. check it: https://goodwi.fi/index.php?/archives/7-6-weeks-with-Cisco-newest-wireless-controller,-the-Catalyst-9800.html Thanks
... View more
10-22-2019
05:02 AM
Hello Experts, I am facing issue with routing , specially with route-maps. Background: I have two ACLs , one for SAP and other for Rest traffic. SAP traffic must pass via MPLS and rest via Normal forwarding over internet VPN. Issue: Once the internet lines are having packet loss then user from the location cant even login to SAP server which is in Headquarter even though we have a route-map for SAP traffic which should traverse via MPLS , and MPLS is working fine all the time. What is causing SAP traffic to go over internet and not via MPLS. here is the config from Remote location: -------------------------------------------- hostname TESRCVPN1 ! ! ! vrf definition ISP1 rd 1:1 ! address-family ipv4 exit-address-family ! vrf definition ISP2 rd 2:2 ! address-family ipv4 exit-address-family ! ! ! skip ! ! ! ! track 55 ip sla 55 reachability ! track 100 ip sla 100 reachability ! track 101 ip sla 101 reachability ! ! crypto keyring ISP1 vrf ISP1 pre-shared-key address 0.0.0.0 0.0.0.0 key <key> crypto keyring ISP2 vrf ISP2 pre-shared-key address 0.0.0.0 0.0.0.0 key <key> ! crypto isakmp policy 20 encr aes 256 authentication pre-share ! crypto ipsec security-association replay window-size 1024 ! crypto ipsec transform-set ts_hasel_aes esp-aes esp-sha-hmac mode transport ! ! crypto ipsec profile vpn_profile_hasel_aes set transform-set ts_hasel_aes ! crypto ipsec profile vpn_profile_hasel_aes_2 set transform-set ts_hasel_aes ! ! ! ! ! ! interface Loopback0 description *** IP 10.55.0.1 *** ip address 10.55.0.1 255.255.255.255 ! ! interface Tunnel56 description *** Spoke - Primary Cloud *** bandwidth 15000 ip address 172.25.56.55 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication Test12345 ip nhrp map 172.25.56.50 116.246.31.146 ip nhrp map multicast 116.246.31.146 ip nhrp map 172.25.56.56 106.120.192.42 ip nhrp map multicast 106.120.192.42 ip nhrp network-id 1 ip nhrp holdtime 300 ip nhrp nhs 172.25.56.56 priority 1 cluster 5 ip nhrp nhs 172.25.56.50 priority 2 cluster 5 ip nhrp nhs cluster 5 max-connections 2 ip nhrp nhs fallback 5 ip tcp adjust-mss 1360 delay 3000 tunnel source GigabitEthernet0/2 tunnel mode gre multipoint tunnel key 1 tunnel path-mtu-discovery tunnel vrf ISP1 tunnel protection ipsec profile vpn_profile_hasel_aes_2 shared ! interface Tunnel156 description *** Spoke - Secondary Cloud *** bandwidth 4000 ip address 172.25.156.55 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication Test12345 ip nhrp map 172.25.156.50 211.95.31.106 ip nhrp map multicast 211.95.31.106 ip nhrp map 172.25.156.56 111.203.39.34 ip nhrp map multicast 111.203.39.34 ip nhrp network-id 2 ip nhrp holdtime 300 ip nhrp nhs 172.25.156.56 priority 1 cluster 6 ip nhrp nhs 172.25.156.50 priority 2 cluster 6 ip nhrp nhs cluster 6 max-connections 2 ip nhrp nhs fallback 5 ip tcp adjust-mss 1360 delay 3001 tunnel source GigabitEthernet0/1 tunnel mode gre multipoint tunnel key 2 tunnel path-mtu-discovery tunnel vrf ISP2 tunnel protection ipsec profile vpn_profile_hasel_aes shared ! interface Tunnel556 bandwidth 18000 ip address 10.13.98.55 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication HA18BJ56 ip nhrp map 10.13.98.4 195.243.205.105 ip nhrp map multicast 195.243.205.105 ip nhrp map 10.13.98.5 212.185.41.197 ip nhrp map multicast 212.185.41.197 ip nhrp network-id 3 ip nhrp holdtime 300 ip nhrp nhs 10.13.98.4 priority 1 cluster 1 ip nhrp nhs 10.13.98.5 priority 2 cluster 1 ip nhrp nhs cluster 1 max-connections 2 ip nhrp server-only ip tcp adjust-mss 1360 tunnel source GigabitEthernet0/1 tunnel mode gre multipoint tunnel key 3 tunnel vrf ISP2 tunnel protection ipsec profile vpn_profile_hasel_aes shared ! interface Tunnel5656 bandwidth 20000 ip address 10.13.198.55 255.255.255.0 no ip redirects ip mtu 1400 ip flow monitor NTAmonitor input ip nhrp authentication HA18BJ56 ip nhrp map 10.13.198.4 195.243.205.106 ip nhrp map multicast 195.243.205.106 ip nhrp map 10.13.198.5 212.185.41.198 ip nhrp map multicast 212.185.41.198 ip nhrp network-id 4 ip nhrp holdtime 300 ip nhrp nhs 10.13.198.4 priority 1 cluster 4 ip nhrp nhs 10.13.198.5 priority 2 cluster 4 ip nhrp nhs cluster 4 max-connections 2 ip nhrp server-only ip tcp adjust-mss 1360 tunnel source GigabitEthernet0/2 tunnel mode gre multipoint tunnel key 4 tunnel vrf ISP1 tunnel protection ipsec profile vpn_profile_hasel_aes_2 shared ! interface Embedded-Service-Engine0/0 no ip address shutdown ! interface GigabitEthernet0/0 description *** To MPLS Device 172.24.55.2 *** ip address 172.24.55.1 255.255.255.248 duplex auto speed auto no cdp enable ! interface GigabitEthernet0/1 description *** 2nd Provider, ISP2 *** vrf forwarding ISP2 ip address 61.138.187.18 255.255.255.248 ip access-group internet in no ip redirects no ip unreachables no ip proxy-arp duplex full speed 100 no cdp enable ! interface GigabitEthernet0/2 description *** 1st Provider, ISP1 *** vrf forwarding ISP1 ip address 123.172.16.170 255.255.255.248 ip access-group internet in no ip redirects no ip unreachables no ip proxy-arp duplex full speed 100 ! interface GigabitEthernet0/0/0 description *** Failover *** switchport access vlan 4 no ip address ! interface GigabitEthernet0/0/1 description *** CHCWAFS1 10.55.3.201 *** switchport access vlan 3 no ip address no cdp enable ! interface GigabitEthernet0/0/2 description *** CHNFPAN1 *** switchport access vlan 6 no ip address no cdp enable ! interface GigabitEthernet0/0/3 description *** CHNFPAN2 *** switchport access vlan 6 no ip address no cdp enable ! interface GigabitEthernet0/1/0 description *** Mngmt CHNFPAN1 10.55.6.100 *** switchport access vlan 6 no ip address no cdp enable ! interface GigabitEthernet0/1/1 description *** Mngmt CHNFPAN2 10.55.6.101 *** switchport access vlan 6 no ip address no cdp enable ! interface GigabitEthernet0/1/2 description *** Mngmt CHNFPANx Spare *** switchport access vlan 6 no ip address no cdp enable ! interface GigabitEthernet0/1/3 description *** Mngmt CHCWAFS1 10.55.3.202 *** switchport access vlan 3 no ip address ! interface Vlan1 description *** Management VLAN 1 *** no ip address shutdown ! interface Vlan3 description *** WAAS-GW 10.55.3.254 *** ip address 10.55.3.254 255.255.255.0 ! interface Vlan4 description *** failover Vlan *** ip address 10.55.4.252 255.255.255.0 standby 4 ip 10.55.4.254 standby 4 priority 110 standby 4 preempt standby 4 authentication G@t4it ! interface Vlan6 description *** Firewall Transfer VLAN *** ip address 10.55.6.254 255.255.255.0 ip mtu 1300 ip tcp adjust-mss 1260 ip policy route-map GM_SAP ! ! router eigrp 1 distribute-list prefix filter_eigrp out network 10.13.98.0 0.0.0.255 network 10.13.198.0 0.0.0.255 network 10.55.0.0 0.0.255.255 network 172.25.56.0 0.0.0.255 network 172.25.156.0 0.0.0.255 redistribute static route-map static2EIGRP passive-interface Loopback0 ! ip local policy route-map local_out ip forward-protocol nd no ip forward-protocol udp netbios-ns no ip forward-protocol udp netbios-dgm ! no ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 600 life 86400 requests 10000 ! ip tftp source-interface Vlan1 ip route 0.0.0.0 0.0.0.0 172.24.55.2 171 name MPLS_HQ ip route 10.55.0.0 255.255.0.0 10.55.6.1 ip route 160.46.87.0 255.255.255.0 10.55.6.1 name Test-BBC ip route 172.24.18.0 255.255.255.0 172.24.55.2 name MPLS_HQ ip route vrf ISP1 0.0.0.0 0.0.0.0 123.172.16.169 ip route vrf ISP2 0.0.0.0 0.0.0.0 61.138.187.17 ip ssh version 2 ! ip access-list extended GM_OTHERS permit ip 10.55.0.0 0.0.255.255 10.18.2.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.3.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.4.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.5.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.6.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.7.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.8.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.9.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.14.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.15.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.18.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.19.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.20.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.21.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.24.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.218.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.219.0 0.0.0.255 ip access-list extended GM_SAP permit ip 10.55.0.0 0.0.255.255 10.18.10.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 10.18.11.0 0.0.0.255 permit ip 10.55.0.0 0.0.255.255 host 10.18.21.58 permit ip 10.55.0.0 0.0.255.255 host 10.18.20.121 permit ip 160.46.87.0 0.0.0.255 host 10.18.21.58 permit ip 160.46.87.0 0.0.0.255 host 10.18.20.121 permit ip 10.55.0.0 0.0.255.255 host 10.18.20.80 permit ip 10.55.0.0 0.0.255.255 host 10.18.21.81 ip access-list extended ISP1 permit ip host 123.172.16.170 any ip access-list extended ISP2 permit ip host 61.138.187.18 any ip access-list extended WAAS_OPT deny tcp any any eq 8192 deny tcp any any eq 8194 remark Haselmuehl permit tcp 10.18.0.0 0.0.255.255 any permit tcp any 10.18.0.0 0.0.255.255 deny ip any any ip access-list extended internet remark Auto generated by CCP for NTP (123) 10.18.2.6 permit udp host 10.18.2.6 eq ntp host 61.138.187.18 eq ntp permit gre any any permit esp any any permit udp any eq isakmp any eq isakmp permit tcp host 62.153.226.20 any eq 22 permit tcp host 212.185.199.2 any eq 22 permit icmp host 62.153.226.20 host 61.138.187.18 echo permit icmp host 62.153.226.20 host 61.138.187.18 traceroute permit icmp host 62.153.226.20 host 123.172.16.170 echo permit icmp host 62.153.226.20 host 123.172.16.170 traceroute permit udp host 10.18.2.6 eq ntp host 123.172.16.170 eq ntp permit icmp host 212.185.41.204 host 123.172.16.170 echo permit icmp host 212.185.41.204 host 123.172.16.170 traceroute permit icmp host 195.243.205.120 host 123.172.16.170 traceroute permit icmp host 195.243.205.120 host 123.172.16.170 echo ! ! ip prefix-list filter_eigrp seq 5 deny 10.18.2.0/24 ip prefix-list filter_eigrp seq 10 permit 0.0.0.0/0 le 32 ! ip prefix-list static2EIGRP seq 5 permit 10.55.0.0/16 le 32 ip sla 55 icmp-echo 172.24.18.6 source-interface GigabitEthernet0/0 threshold 300 timeout 1000 frequency 4 ip sla schedule 55 life forever start-time now ip sla 100 icmp-echo 10.13.198.4 source-interface Tunnel5656 threshold 300 timeout 1000 frequency 4 ip sla schedule 100 life forever start-time now ip sla 101 icmp-echo 10.13.198.5 source-interface Tunnel5656 threshold 300 timeout 1000 frequency 4 ip sla schedule 101 life forever start-time now ip access-list logging interval 10 logging source-interface Loopback0 logging host 10.18.2.18 ! route-map GM_SAP permit 5 description *** Only SAP Traffic Allowed *** match ip address GM_SAP set ip next-hop verify-availability 172.24.55.2 1 track 55 ! route-map GM_SAP permit 6 description *** Only Other Traffic Allowed *** match ip address GM_OTHERS set ip next-hop verify-availability 10.13.198.4 1 track 100 set ip next-hop verify-availability 10.13.198.5 2 track 101 ! route-map GM_SAP permit 7 ! route-map local_out permit 10 match ip address ISP1 set ip next-hop 123.172.16.169 ! route-map local_out permit 20 match ip address ISP2 set ip next-hop 61.138.187.17 ! route-map static2EIGRP permit 10 match ip address prefix-list static2EIGRP ! ------------------------------------------- Thanks in advance
... View more
Labels:
Created by
ittechk4u1
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-30-2019
12:09 AM
09-30-2019
12:09 AM
Excellent. It worked now after deletion of trusted old certs. Thank a lot. you guys are awesome.
... View more
Created by
ittechk4u1
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-29-2019
11:50 PM
09-29-2019
11:50 PM
can you please tell me how can i do it ? I tried but didn't find a way... Thanks
... View more
Created by
ittechk4u1
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-29-2019
10:39 PM
09-29-2019
10:39 PM
Let me try it. Thank for suggestion.
... View more
Created by
ittechk4u1
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-25-2019
09:35 PM
09-25-2019
09:35 PM
Time is correct on both. I installed wildcard CA signed cert on ISE and SSL cert signed by CA on cisoc prime but prime showing error "Mismatched address" as certificate error. I suspect its the issue with TLSV1 handshake. Thanks
... View more
Created by
ittechk4u1
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-25-2019
09:33 PM
09-25-2019
09:33 PM
Even i guess so. I will check if i can raise a TAC case ..
... View more
Created by
ittechk4u1
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-25-2019
02:47 AM
09-25-2019
02:47 AM
Hello Experts, Earlier (Before SSL certificate installation) CPI and ISE was working together but now...I am struggling to get integrate CPI and ISE. ISE version: 2.1.0.474 CPI: 3.5.0.0.55.0 Error(s): You must correct the following error(s) before proceeding: Error: The connection to ISE with IP address "xx.xx.xx.xx" has timed out. Please check the network connectivity and the user account status on the ISE. Thanks
... View more
- Tags:
- cisco prime
Labels:
09-23-2019
01:33 AM
Active(Primary) is running form long time. Secondary : I installed it new last week to pair with Primary. How to do it via GUI ? Can you please help. Thanks
... View more
09-23-2019
12:12 AM
Yes i tried but installation not working. i am getting this error: % Unable to unbundle the package. Package may be corrupt or there is not enough disk space thanks
... View more
09-22-2019
10:42 PM
Hello experts, I want to setup two Cisco prime in HA. Primary server is installed and working. Yesterday i installed a new PI and concurred as secondary PI. Only difference between these two is : Primary has a patch 2.0 and secondary dont. Now while doing HA registration i am getting this error: Error(s): You must correct the following error(s) before proceeding: Error: High Availability Registration cannot be done. Check whether the Primary and Secondary are running with different versions of the product. i try to create a FTP user but is not working : Error : This command cannot be executed on a server in secondary HA mode Any idea why I am getting this and how can i insatlled the same patch on secondary PI? Thanks
... View more
- Tags:
- wlan
Labels:
Public Statistics
| Date Registered | 01-14-2015 10:20 AM |
| Date Last Visited | 10-22-2019 04:56 AM |
| Total Messages Posted | 381 |
| Total Helpful Votes Received | 14 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 144 | |
| 5 | |
| 15 | |
| 25 | |
| 8 |
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Expert"){kind=icon}
