Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Eugen Bitca
01-23-2019
Stats
Member since
07-15-2010
52
Posts
0
Helpful
0
Solutions
10-27-2018
10:06 PM
Hello,
DRC-FW3/DRCFW-3(config)# cluster exec show version | i Version DRCFW-3(LOCAL):******************************************************* Cisco Adaptive Security Appliance Software Version 9.8(3)14 Firepower Extensible Operating System Version 2.2(2.107) Device Manager Version 7.7(1)151 Baseboard Management Controller (revision 0x1) Firmware Version: 2.4 DRCFW-4:************************************************************** Cisco Adaptive Security Appliance Software Version 9.8(3)14 Firepower Extensible Operating System Version 2.2(2.107) Device Manager Version 7.7(1)151 Baseboard Management Controller (revision 0x1) Firmware Version: 2.4 DRC-FW3/DRCFW-3(config)# DRC-FW3/DRCFW-3(config)# sh arp-inspection interface arp-inspection miss ---------------------------------------------------- mgmt disabled - outside124 disabled - inside324 disabled - DRC-FW3/DRCFW-3(config)# sh arp outside124 10.44.32.2 188b.9da8.407f 207 //SVI on Core-S3 outside124 10.44.32.3 188b.9da8.3f7f 6080 //SVI on COre-S4 inside324 10.44.32.201 00c0.b7ff.0899 515 //Testing Host cluster 10.150.255.18 188b.9d1a.f650 10838 DRC-FW3/DRCFW-3(config)# show mac-address-table interface mac address type Age(min) bridge-group ---------------------------------------------------------------------------------------------------- outside124 188b.9da8.3f7f dynamic 4 1 outside124 188b.9da8.407f dynamic 5 1 inside324 00c0.b7ff.0899 dynamic 3 1 DRC-FW3/DRCFW-3(config)#
Thank you
... View more
10-27-2018
10:25 AM
Hello,
Cluster Transparent Mode (2 units), only 1-2 flows to the same destination host are successful, all others fail.
If I remove a unit from cluster (anyone), everything is OK.
When I add a unit to the cluster, cluster is OK and healthy, but only 1-2 connections are OK.
Logs on firewall show a lot of connection with unknown destination:
Oct 27 2018 19:45:03 DRC-FW3 : %ASA-6-302023: Teardown stub TCP connection for inside324:10.44.32.201/80 to unknown:172.22.4.230/50814 duration 0:00:00 forwarded bytes 0 Forwarding or redirect flow removed to create director or backup flow
Also from asp show command I have a lot of: "Destination MAC L2 Lookup Failed"
What might be the problem with the cluster?
Thank you
... View more
- Tags:
- Cluster-Transparent
Labels:
10-08-2018
03:29 AM
MacSec EtherType 0x88e5 is transmitted over EoMPLS network.
So, between 2 MacSec Ports I configured a small test EoMPLS network, and inside MPLS, SPAN sessions shows encrypted traffic.
... View more
Created by
Eugen Bitca
in Security Documents
in Security Documents
10-05-2018
06:50 AM
10-05-2018
06:50 AM
Hello,
I have a similar issue.
Manually URL are dropping but categories are not.
Thanks
... View more
09-17-2018
05:44 AM
Hello,
I have macsec (manual mode) between 4500-x and Cat6500 Sup2.
How can I verifiy if MACSEC do realy encrypt traffic, SPAN session shows traffic unencrypted.
Configuration on both sides:
interface GigabitEthernet1/1 switchport mode trunk switchport nonegotiate mtu 9198 cts manual no propagate sgt sap pmk 0000000000000000000000000000000000000000000000000000000000ABC123 mode-list gcm-encrypt storm-control broadcast level 2.00
Thank you
... View more
Labels:
08-07-2017
10:25 PM
Hi,
ASA cluster with cross connects to vPC work great, but to VSS on 4500x not very well.
To remove cross connects and test I will not be able because I converted 4500X back to standalone.
I found a link where Cisco do not recommend using this switch for data EtherChannels in Spanned EtherChannel mode due to asymmetric load-balancing(https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#pgfId-137822), so I will not convert them to VSS.
How can ASA Cluster (transparent mode) have links to both Core Switches Core-S3 and Core-S4?
How do you think the following configuration is a good one(file attached)?
ASA-Cluster
! interface Port-channel2.124 vlan 124 nameif inside124 bridge-group 1 security-level 100 ! interface Port-channel1.324 vlan 324 nameif outside324 bridge-group 1 security-level 0 ! interface Port-channel5.524 vlan 524 nameif outside524 bridge-group 1 security-level 0 ---------------------------------------------------- Core-S3 ! interface Port-channel3 switchport switchport trunk allowed vlan 124 switchport mode trunk switchport vlan mapping 324 124 ! --------------------------------------------------- Core-S4 ! interface Port-channel4 switchport switchport trunk allowed vlan 124 switchport mode trunk switchport vlan mapping 524 124
Thanks
... View more
08-07-2017
07:09 AM
7) SSO and nonstop forwarding (NSF) must be configured on each switch.
Do I need to have NSF configured before converting to VSS?
Thanks
... View more
08-07-2017
05:02 AM
Hello,
A typical Data Center ASA cluster with vPC and VSS(file attached)
All interfaces and port-channels are up, vPC, VSS, Cluster all OK.
1. From Core-S1 Vlan 200 I can reach Vlan 200 on Servers LAN 2. From Core-S1 Vlan 200 I can reach ip 10.44.124.1 (Vlan124 on Core-S4) 3. From Core-S1 some traffic to Vlan 124 are ok and some not 4. From Core-S4 Vlan 124 some traffic to Vlan 124 are ok and some not 5. If I disable Te1/1/10 and Te1/2/7, vlan 124 is reachable from Core-S1 6. If I enable Te1/1/10 and Te1/2/7 and disable Te2/1/10 and Te2/2/7, some traffic to vlan 124 are ok and some not. 7. If I move trunk from Core-S1 to Core-S4 with interfaces Te2/1/10 and Te2/2/7 disabled, vlan 124 is reachable. Do I need special configuration for L3 routing on VSS?
Thank you
... View more
Labels:
07-04-2016
06:53 AM
Hello,
I have the same problem, only the FirePower Status bar is presented.
Everything is configured, i can ping asa and sfr, i can ssh to sfr.
Java 7u51 and two version of ASDM, 7,2 and 7.5.
What else can be checked to have firepower button under Configuration?
I found:
platform (ASA 5500-x other than 5506/08/16) sfr module version 5.3.x does not support ASDM-based management
Thanks a lot
... View more
03-27-2014
02:43 AM
Hello, Howo to have dual line Cisco Phone to be registered each line per different server? Thanks.
... View more
Labels:
09-18-2013
01:40 AM
Hi there! It is possible to translate one public IP to an inside Host1, and if the Host1 is unvailable (let's say ping fails from ASA) to translate the same public IP to an inside Host2 ? Cisco ASA5510 v8.2 Thanks
... View more
Labels:
02-17-2013
02:25 AM
Hello, Thank you for the answer. I was thinking about EIGRP timers, but the configuration I have is a hub and spoke (DMVPN) and each spoke has two 2 diferent links to Hub routers, for each connection a separate EIGRP instance. So, if primary connection goes down, I want the backup route to be installed and remain active in routing table for at least 30 seconds even the primary connection comes up. I was thinking to track the line protocol of primary Tunnel interface, and when the interface goes down to have event manager shutdown the primary eigrp instance, and to activate only when the line protocol is UP for 30 seconds. Thanks
... View more
02-16-2013
03:58 AM
Hi, How to have EIGRP route being install in routing table only when line protocol on an interface is UP for more 30 seconds? Thanks
... View more
Labels:
Created by
Eugen Bitca
in IP Telephony and Phones
in IP Telephony and Phones
08-13-2012
02:22 AM
08-13-2012
02:22 AM
Hello, Please help to create a voice translation rule that will prefix 9 to any longer 5 digits. 12345 -> 9123435 123456 -> 9123456 1234 -> 1234 Thanks
... View more
Labels:
Created by
Eugen Bitca
in Firewalls
10-27-2018
10-27-2018
Hello, DRC-FW3/DRCFW-3(config)# cluster exec show version | i
VersionDRCFW-3(LOCAL):****************...
Created by
Eugen Bitca
in Firewalls
10-27-2018
10-27-2018
Hello, Cluster Transparent Mode (2 units), only 1-2 flows to the same
destination host are successfu...
10-08-2018
MacSec EtherType 0x88e5 is transmitted over EoMPLS network. So, between
2 MacSec Ports I configured ...
09-17-2018
Hello, I have macsec (manual mode) between 4500-x and Cat6500 Sup2. How
can I verifiy if MACSEC do r...
08-07-2017
Hi, ASA cluster with cross connects to vPC work great, but to VSS on
4500x not very well. To remove ...
08-07-2017
7) SSO and nonstop forwarding (NSF) must be configured on each switch.
Do I need to have NSF configu...
08-07-2017
Hello, A typical Data Center ASA cluster with vPC and VSS(file attached)
All interfaces and port-cha...
02-09-2017
Hello, How to verify if network traffic is checked by IPS rules. I have
set p a rule to inspect teln...
07-04-2016
Hello, I have the same problem, only the FirePower Status bar is
presented. Everything is configured...
03-27-2014
Hello,Howo to have dual line Cisco Phone to be registered each line per
different server? Thanks.
09-18-2013
Hi there!It is possible to translate one public IP to an inside Host1,
and if the Host1 is unvailabl...
02-17-2013
Hello,Thank you for the answer.I was thinking about EIGRP timers, but
the configuration I have is a ...
Public Statistics
| Date Registered | 07-15-2010 05:08 AM |
| Date Last Visited | 01-23-2019 12:05 AM |
| Total Messages Posted | 52 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 5 | |
| 7 | |
| 4 | |
| 3 |
.jpg "Hall of Fame Cisco Employee"){kind=icon}
.jpg "VIP Mentor"){kind=icon}
