Hello folks,    Quick question re the native VLAN and trunk links between switches.  I'm just mocking up some stuff in the lab where I've changed the default vlan to something different.    I then setup a trunk, allow all of my data vlans using the switchport trunk allow vlan <range> command.   However I don't include the native VLAN in that list.   All of this seems to work (Spanning tree looks like it converges and behaves as normal) but I guess the question is 'should' I be tagging that VLAN?    Any issues with not doing so that I should know about? Any gotchas? ... View more

Hi folks,    I have version 4.4 of the AnyConnect client installed on an OSX Yosemite Macbook.  It fails to connect to our SSL VPN stating login error (Even  thought the username and password combo used works on a Windows client machine) any ideas why this might be?    ASA reports:   %ASA-6-113004: AAA user authentication Successful : server = 10.34.1.201 : user = ssl-test %ASA-6-113013: AAA unable to complete the request Error : reason = Invalid password : user = ssl-test   We use DUO two factor authentication.  This all works great through the Windows client.  Not sure what the OSX client is doing different here.   Any ideas? ... View more

Hi guys, Looking for a bit of advice.  I have an ASA on which I am trying to NAT through a couple of ports to a server on the LAN which are being accessed by a client machine on the internet.  This bit I can do no problem however once NAT'd and passed through to the server in question the server is seing the return address as being a publicly routable address.  As the server in question has a different route out to the internet via another provider this is obviously causing some issues. As I can't change any routing what I was hoping to do was to change the source address that the server saw to the LAN interface of the ASA which forwarded the traffic.  However for the life of me can't get the syntax quite right. Could someone assist? Details are as follows (Changed for obvious reasons) Internet IP: 4.4.4.4 Actual IP on LAN of Web Server: 192.168.1.1 LAN Interface IP: 192.168.200.1 The source could be any routable address ... Many thanks in advance, J ... View more

Hi all, Not entirely convinced that I've not missed something very simple along the way but am looking for some help. Essentially I can't ping the outside interface of my ASA from another network several hops away.  However I can ping devices on the 'inside' interface.  I am guessing this some sort of ICMP policy stopping this or perhaps just the default behaviour of the ASA but I'm not sure what I've missed.  I am running version 9.4. Topology is as follows: 192.168.1.0 - Inside 192.168.10.0 - Outside | MPLS Network | 192.168.20.0 - Remote site Access lists as follows: outside_out extended permit icmp any any object-group networksvc-ping outside_in extended permit icmp any any object-group networksvc-ping  inside_outextended permit icmp any any object-group networksvc-ping inside_in extended permit icmp any any object-group networksvc-ping  Applied to: access-group outside_in in interface Outside access-group outside_out out interface Outside access-group inside_in in interface inside access-group inside_out out interface inside Also policy-maps: policy-map icmp_policy  class icmp-class   inspect icmp policy-map global_policy  class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny     inspect sunrpc   inspect xdmcp   inspect sip     inspect netbios   inspect tftp   inspect ip-options Single default route via the inside.  Couple of statics pointing to internal networks behind the inside interface.  All inside interface IPs can be pinged.  However from the outside I cannot ping the outside interface.  Any ideas/thoughts? Can see nothing on the logs or via debug ICMP which makes me think its some sort of default behaviour that drops this traffic automatically.  No nat if configured. Thanks in advance, happy to post more config if needed. Many thanks, ... View more

Hi all, Currently experiencing a very weird problem (Which I shall raise a TAC for at some point) but was wondering if anyone could help before I do? We recently upgraded four Nexus 5548UP switches from 6.0.2 N2 to 7.0.1.N1(1a) they are two pairs both in vPC's but connected via fabricpath in a kind of mesh. HSRP was configured on each switch with priority given to switch 1 then 2 and then 3 and then 4.  This worked perfectly until we upgraded to the above version and now when switch 1 is up packets are dropped in every which way as if there is vPC/HSRP issue.  If we shutdown switch 1 and allow switch 2 to take over HSRP all is ok.  Equally if I shutdown the SVI on switch 1 and 2 and let 3 and four take over HSRP duties all is equally well.  Another thing I've noticed is that all switches are set to preempt, so in the event of a failure the topology will hopefully reset with switch 1 being the primary, 2 being the backup etc etc.  Even though switch 1 is set with a higher priority than the other three when it is turned back on it will not take the active role (You can see in the coup info being sent but its like the other switches are ignorning it). I'll post some config tomorrow but annoyingly this hasnt changed for over 2 years and is now no longer working. Anyone shed any light? Cheers, Jamie ... View more