Hello, Looking for some general feedback on my EEM solution. My customer has several data centres around the world. Each with two ISP connections, receiving full BGP tables. We have put up a mGRE overlay between the sites. My goal here is to create a script that will take input from the user and then modify the appropriate BGP policy in order to engineer the traffic over the appropriate tunnel.   Am I on the right track here or is there maybe a better script technology or method that could accomplish this? For example if I was doing this in python I'd likely uses the LOC variable as a hash variable to store the value for the key. Perhaps TCL makes more sense for this type of operation?   event manager applet TRAFENG event none action 000 puts " +-------------------------------------+" action 001 puts " | |" action 002 puts " | Location: |" action 003 puts " | [1] Site 1 |" action 004 puts " | [2] Site 2 |" action 005 puts " | [3] Site 3 |" action 006 puts " | [4] Site 4 |" action 007 puts " | [6] Site 5 |" action 008 puts " | [7] Site 6 |" action 009 puts " | [8] Site 7 |" action 010 puts " | |" action 011 puts " +-------------------------------------+" action 012 get LOC action 013 puts " +-------------------------------------+" action 014 puts " | |" action 016 puts " | Preferred ISP: |" action 017 if $LOC eq 6 action 018 puts " | [1] Telstra & Level3 |" action 019 puts " | [2] NTT & GTT |" action 020 else action 021 puts " | [1] CenturyLink (Level3) |" action 022 puts " | [2] GTT |" action 023 end action 024 puts " | |" action 025 puts " +-------------------------------------+" action 026 get ISP action 027 puts "" action 028 if $LOC eq 1 action 029 if $ISP eq 1 action 030 syslog msg "Site 1 primary: CenturyLink (Level3)" action 031 cli command "config t" action 032 cli command "router bgp 65505" action 033 cli command "neighbor 172.16.30.1 shutdown" action 034 cli command "address-family ipv4" action 035 cli command "no neighbor 172.16.30.1 inherit peer-policy iBGP_WORSE" action 036 cli command "neighbor 172.16.30.1 inherit peer-policy iBGP_BETTER" action 037 cli command "no neighbor 172.16.30.1 shutdown" action 038 cli command "end" action 039 elseif $IDP eq 2 action 040 syslog msg "Site 1 primary: GTT" action 040 cli command "config t" action 041 cli command "router bgp 65505" action 042 cli command "neighbor 172.16.30.1 shutdown" action 043 cli command "address-family ipv4" action 044 cli command "no neighbor 172.16.30.1 inherit peer-policy iBGP_BETTER" action 045 cli command "neighbor 172.16.30.1 inherit peer-policy iBGP_WORSE" action 046 cli command "no neighbor 172.16.30.1 shutdown" action 047 cli command "end" action 048 end action 049 end   ... View more

Hello, We are looking to deploy a Citrix VDI solution within my organization. I'm trying to convince my systems guys to forgo the Citrix Secure Access Gateway in favour of our ASA. I have been able to setup the Clientless SSL VPN using the portal bookmarks so that you can SSO into the Citrix Web Interface then launch apps or your desktop. I have also been successful in setting up the ASA to act as a proxy for Citrix Mobile clients. What I'm not clear on is whether I can use the Ctirix Receiver (workstation version) to access the resources directly - like the mobile client does. This would mean the Receiver would conduct the login and display the resources as it natively would with Citrix WI, and Access Gateways. Thanks, Ryan ... View more

I'm trying to setup IOS SLB in directed mode on a Cat6506. We are currently using IOS SLB is dispatched mode for other services. Below is the relevent config. Please note there is no L3 interface on the 6506 for the Virtual Servers network (10.0.131.160). The gateway is an ASA which has L2 connectivity to the 6506. Also to note that the Server Farm network is within its own VRF. ip slb serverfarm ADOBE-CONNECT nat server predictor leastconns probe ADOBE access Vlan130 ! real 10.0.130.161   weight 1   inservice ! real 10.0.130.162   weight 1   no inservice ! ip slb vserver ADOBE-TCP443 virtual 10.0.131.160 tcp https serverfarm ADOBE-CONNECT sticky 60 idle 600 inservice ! ip slb vserver ADOBE-TCP80 virtual 10.0.131.160 tcp www serverfarm ADOBE-CONNECT sticky 60 idle 600 inservice ! What happens is essentially nothing as you can see below 0 connections have occured, and 0 syns. "debug ip slb all" shows absolutely nothing in regards to this VServer. ADOBE-TCP80, state = OPERATIONAL, v_index = 19, interface(s) = <any>   virtual = 10.0.131.160/32:80, TCP, service = NONE, advertise = TRUE   server farm = ADOBE-CONNECT, delay = 10, idle = 600   sticky: client ip, timer = 60, subnet = 255.255.255.255   sticky: group id = 4098 <assigned>   synguard counter = 0, synguard period = 0   conns = 0, total conns = 23, syns = 0,  syn drops = 0   standby group = None However on the 6506 when I do a SPAN on the trunk interface between the 6506 and the ASA I can see the packet TCP SYNs arriving at the 6506. Where ever they go from there..... I have no clue. This SPAN/packet capture also shows the ARP requests from the ASA for the virtual IP address, however there is never a response. ... View more

We have recently moved encryption to the Application Layer of our network, this was a business requirement for other reasons. But from the network department we see this as an opportunity to increase the scalablity and longevity of our routers. We are currently running a DMVPN network with approximately 800 spoke nodes, the majority being c871s. We would like to migrate the DMVPN to plain old mGRE, as the encryption is no longer a requirement of the Network Layer. This however doesn't seem like an easy task. I am trying to investigate the different options available to me complete this migration. For some reason I thought there was a way to make the encryption in DMVPN optional, such that I could make the hubs optional then migrate the spokes, however this is contingent on encryption being optional. If not the only way I can see accomplishing this is creating a new NHRP hub and migrating the spokes to this new hub one by one. I'm all ears if someone could validate the "optional" option, or if there is a third or fourth option. Thanks, Ryan ... View more