Hello, Does anybody know if I can initiate AnyConnect VPN session using SRV instead of an IP address or FQDN? Thanks in advance. Remy ... View more

Hi, I have a one chassis Catalyst 6504-E with 2 x SUP-720-10G working in SSO mode. My understanding was that the supervisor WAN interfaces are only configurable on the active supervisor and they are replicated to the standby supervisor. It looks like I can configure all the WAN interfaces on both supervisors independently. Can it be done that WAN interfaces are configured only on the active supervisor and their configuration is a mirror to the WAN interfaces on the standby supervisor? The requirement here is that I have 2 carriers (running BGP with same ASN to both of them) and one carrier is active and the second carrier is my backup. So only one WAN interface should be active at a time (the one on the active sup). So to speak the active carrier would be connected to the active supervisor and the backup carrier should be connected to the standby supervisor. Can it be achieved this way? Thanks for any clues and suggestions. Remy ... View more

Hello, I'm observing a strange behavior on the router while VPNed with ASA. I have a simple site-to-site VPN between a router 1921 (remote site) behind NAT and with dynamic public IP address on the modem and 2 ASA5525's in Active-Active configuration (main site). On the router I have some IP SLA services to keep the tunnel up and also to verify reachability to the servers on the main site. Every 57min or so the IP SLA timeout and come up after 5sec (I have frequency set to 5sec on each IP SLA). Below I paste the syslog messages for the tracking. Until here this behavior I guess is normal since the the router and ASA negotiate new SAs hence new tunnel 180sec right before the old SAs expire (I have the SA lifetime set to 3600 seconds and 4608000 kilobytes on both sites). The new tunnel is up and the IP SLAs are in OK state. What is strange that sometimes, here it can take 1, 2 days or even more the IP SLAs timeout and never come up even if the SAs renegotiate well. The new tunnel is up on both sites, there is communication from the main site to the remote site but the remote site cannot communicate with the main site, IP SLAs stay in Timeout state.   The only remedy for that is if I go to the ASA and "clear crypto isakmp sa". When the new SAs are negociated then the IP SLAs come up and the communication from the remote site to the main site is restored.   What could be causing this issue? Something to do the public IP address change on the modem in the remote site? If so how can I fix it?   Thank you for any suggestions. Regards, Remy       *Oct  2 11:23:20: %TRACK-6-STATE: 11 ip sla 11 reachability Up -> Down *Oct  2 11:23:20: %TRACK-6-STATE: 12 ip sla 12 reachability Up -> Down *Oct  2 11:23:20: %TRACK-6-STATE: 13 ip sla 13 reachability Up -> Down *Oct  2 11:23:20: %TRACK-6-STATE: 14 ip sla 14 reachability Up -> Down *Oct  2 11:23:25: %TRACK-6-STATE: 11 ip sla 11 reachability Down -> Up *Oct  2 11:23:25: %TRACK-6-STATE: 12 ip sla 12 reachability Down -> Up *Oct  2 11:23:25: %TRACK-6-STATE: 13 ip sla 13 reachability Down -> Up *Oct  2 11:23:25: %TRACK-6-STATE: 14 ip sla 14 reachability Down -> Up *Oct  2 12:20:20: %TRACK-6-STATE: 11 ip sla 11 reachability Up -> Down *Oct  2 12:20:20: %TRACK-6-STATE: 12 ip sla 12 reachability Up -> Down *Oct  2 12:20:20: %TRACK-6-STATE: 13 ip sla 13 reachability Up -> Down *Oct  2 12:20:20: %TRACK-6-STATE: 14 ip sla 14 reachability Up -> Down *Oct  2 12:20:25: %TRACK-6-STATE: 11 ip sla 11 reachability Down -> Up *Oct  2 12:20:25: %TRACK-6-STATE: 12 ip sla 12 reachability Down -> Up *Oct  2 12:20:25: %TRACK-6-STATE: 13 ip sla 13 reachability Down -> Up *Oct  2 12:20:25: %TRACK-6-STATE: 14 ip sla 14 reachability Down -> Up *Oct  2 13:16:50: %TRACK-6-STATE: 11 ip sla 11 reachability Up -> Down *Oct  2 13:16:50: %TRACK-6-STATE: 12 ip sla 12 reachability Up -> Down *Oct  2 13:16:50: %TRACK-6-STATE: 13 ip sla 13 reachability Up -> Down *Oct  2 13:16:50: %TRACK-6-STATE: 14 ip sla 14 reachability Up -> Down *Oct  2 13:17:25: %TRACK-6-STATE: 11 ip sla 11 reachability Down -> Up *Oct  2 13:17:25: %TRACK-6-STATE: 12 ip sla 12 reachability Down -> Up *Oct  2 13:17:25: %TRACK-6-STATE: 13 ip sla 13 reachability Down -> Up *Oct  2 13:17:25: %TRACK-6-STATE: 14 ip sla 14 reachability Down -> Up ... View more

Hello everybody,   While preparing a test bed for a customer before implementing PfRv3 solution I stumbled upon quite odd behavior of the border routers when an TCA is generated after simulating an impairment on the WAN network.   At the moment I have one DC site with 2 BRs on ISR4331 and MC running on CSR1000v. The remote sites with routers 1921 and 2911, 2 WAN connections each. The 2 WAN connections are configured as INET1 and INET2. For the testing purposes and in normal WAN conditions I send the EF traffic over INET1 (DMVPN Tunnel1011)  and CS3 with CS2 over INET2 (DMVPN Tunnel1012). Routing protocol is EIGRP. The PfRv3 domain is configured as IWAN and applied to "TRANSIT" VRF in HUB location and "LAN" VRF in branch location. To a apply a WAN network impairment I use WAN Bridge.   Here is the test bed network topology I used in my lab:       So I make a phone call between the main site (DC) and the branch site (I tried initiating the traffic in either site) and also have PING running on both site to generate CS2 traffic. I can observe the correct channels and correct traffic classes on the HUB MC and the Branch MC with the correct exits. Now when I apply the delay of 600ms (using WAN Bridge) only for the INET1 transport in the branch site) so I affect the EF traffic only. Within the 4 seconds (as per HUB MC configuration) the branch MC receives the TCA from the HUB BR1 that there is one-way-delay higher as per policy on the INET1 path (DMVPN Tuneel1011) to the branch and the branch MC instructs the branch BR to route the EF traffic to the main site over the INET2 path which corresponds to Tunnel1012 of the DMVPN. The HUB MC does not receive any notification from the branch BR, or should it receive the notification from hub BR? What I noticed is that the HUB BRs route the EF traffic as there were normal conditions that being said the BR1 keeps sending the EF traffic over INET1 (Primary Channel Tunnel1011) and BR2 keeps redirecting the EF traffic over Tunnel0 to BR1 (Its Primary Channel). This way the EF traffic (say from the main site to the branch site) enters BR1 (which is also DMVPN HUB router for Tunnel1011) and travels over INET1 (Tunnel1011) then enters BR on branch site but as per PfRv3 policy path change notification on branch BR the EF traffic returns over INET2 (Tunnel1012) into the HUB BR2 and then redirected back to BR1 over Tunnel0, thus I get asymmetric routing. Same happens when I affect the INET2 transport on the branch site and the CS2 and CS3 traffic are routed over INET1, same asymmetric routing happens.   When I shut down the branch BR router interface whether it is one that corresponds to INET1 or INET2 transport network this time the HUB MC received unreachable notification from the HUB BR and the EF or CS2 traffic is routed in a correct way, HUB BR1 not longer routes the EF traffic over INET1 but redirects it over Tunnel0 to BR2 and INET2 (Tunnel1012) to the branch site.   I attach the routers relevant configs and also the PfR outputs like route overrides, channels, traffic-classes and also TCA syslog messages generated.   Why is this happening? Why the HUB MC does not receive any TCAs when there is high delay on the network? Does it depend on the PfRv3 policy configured on the HUB MC? Say for EF traffic there are 3 conditions to be met like delay, packet loss or jitter (if I remember correctly) but I guess only one condition needs to be met (high delay) because the branch MC does receive the TCA notifications from the HUB BR.   On HUB BRs and MC I'm running Everest 16.6.4 and also tried Fuji 16.9.1. On branch 1921 and 2911 I'm running 15.7.3(M3).   Thank you in advance for any comments and clues.   Regards, Remy ... View more

Hello,   Anybody could help me please with a TCL script for Catalyst 3850? What I'm trying to achieve is based on IP SLA tracking syslog message the TCL script would run and SSH into ASA, and run local EEM on ASA to change NAT configuration or just execute remote commands on ASA. I cannot do that from ASA so I thought I could run it from the switch.   Thanks in advance. Regards, Remi ... View more

Hi there, I am having some issues with traceroute over IPSec VPN IKEv2 between 2 ASAs. When traceroute from a host behind any of the 2 ASAs towards the Internet everything works fine but when tried to trace route from a host behind ASA in site A to a host  behind ASA in site the trace does not work.    What am missing?   Thank in advance.   Regards, Remy ... View more