We have a DMVPN environment in which EIGRP neighbors are flapping. We first addressed this by adding 'ip eigrp bandwidth-percent 75' so that queued up packets would get out. This helped with that case, but flapping is still occuring. We next found out that about half of the remotes did not have 'eigrp stub connected' configured, so we did that yesterday, problem continues. DIgging in some more today, I ran 'debug eigrp packet hello' on a remote. I observed that the arrival timestamps of EIGRP hello's from the hub router were not at the default 5 seconds or close to it. More like 8-14 seconds. Sometimes I would see a bunch of debugged hellos in the log with nearly the same timestamp, but off by a few thousandths of a second. These don't necesarily precede an EIGRP reset, but on another stable DMVPN environment, the Hellos are quite consistent at 5 seconds, and there are no bu ... View more

Weirdest thing. Two 2960x connected via L2 port channel. 4 members of vlan 32, 2 on each of the two switches. Three of the four can ping each other. The last device can resolve the correct MACs for the others, but no pings work to the other three devices. We tried moving the faulty device to another port, no luck. Late tiday, a peer suggested a different port in a different ASIC group. Will try tomorrow. Any other suggestions would be huge! ... View more

We have deployed the feature where an object is created, and the firewall checks DNS every minute for the IP of that public host. Example ! object network www.sears.com  fqdn www.sears.com object-group network internet  network-object object www.sears.com ! access-list test1 permit tcp any object-group internet eq 80 ! This works well for a static site. However, if the target site does redirects to other sites for content, the process fails, as those redirected sites are not allowed outbound by the access-list.   I wonder if there is a feature or configuration on the firewall that would enable inspection of the connections for redirects, and then allow those connections?       ... View more

We need to run BGP with a third party (their requirement), so that we will dynamically lose their routes over a link if some component fails. From what I have seen, it is necessary to configure router bgp NN in the system context, then in the admin context; and finally in the specific context where it is needed. I may be wrong on needing it in the admin context, that just happened to be the example that I found online. At any rate, having configured the protocol, I notice that the neighbor never goes Active, always remaining in Idle mode. Further checking indicates that the firewall is not listening on tcp/179 for BGP: FW26-multiple/fw26tsnfw3/act# show asp table socket Protocol   Socket    State      Local Address                                Foreign Address TCP        00031008  LISTEN     10.41.11.36:22                               0.0.0.0:*          Here is the config in the actual fw context where it is needed (this is lab set up): ! router bgp 26  bgp router-id 10.1.1.1  address-family ipv4 unicast   neighbor 10.41.78.11 remote-as 11   neighbor 10.41.78.11 activate   neighbor 10.41.78.11 prefix-list routesfromxxx in   no auto-summary   no synchronization  exit-address-family ! FW26-multiple/fw26tsnfw3/act# I wonder if I am missing some magic configuration to turn this on? ... View more

Anyone know what level of access a user might have if they get mapped to the root, All Groups? ... View more

We are seeing syslog events that indicate some data packets are being discarded due to having more fragments than the default value of 24 on the ASA. There is a global command that allows this to be changed to 1-8200. I wonder if increasing this value has any immediate impact on the data traversing the firewall? ... View more

I would like to be sure that our internet facing routers, and their interfaces, are as secure as possible. Searching the web has not yielded as much information as I had hoped. Please respond with your suggestions and tips. Thank you in advance.  ... View more

We currently have two Dmvpn headend routers at the same location per region. We need to add a backup headend device that is in a different city. I plan to add a third nhrp/nhs configuration to all remote sites. However, I'd like that third tunnel to stay down until both of the primary nhs peers go away. Looked at priorities and that appears to work, but in my lab I could only have one primary tunnel configured. So I wonder if setting the two primary tunnels at priority 1, and the new third tunnel at priority 5, would achieve this goal. ... View more

Under the NERC CIP program, we must identify all open services on our ASA firewalls. By open services, I mean anything that the firewall might accept and terminate an IP connection for. This would not apply to connections through the firewall. Since the firewall cannot be effectively scanned with a port scanner, we have resorted to searching for the presence of commands that are known to enable services. At this time, I believe our approach is weak, and does not capture all services, or needlessly searches for config text that does not actually enable a service. I am hoping to assemble a list of all services that an ASA can offer and the commands that enable those services. Your suggestions would be great.  ... View more

This is an odd case that I have seen before, but not recalling the fix. We have GRE tunnel that runs across an AT&T MPLS cloud. RIP routing works across the tunnel and we can ping the far end of the tunnel. However, we cannot ping or access IPs in the subnet learned via RIP across te tunnel. Far end routing is as it should be, default route back across the tunnel. I was able to get this to work by adding an outbound ACL on the Cisco 2811 tunnel interface; shown here: interface Tunnel9120  description xxxxxxxxxxxxxx  ip address 10.123.59.122 255.255.255.252   ip access-group findout out  qos pre-classify  tunnel source 10.123.63.252  tunnel destination 10.123.62.3 end xxxxxxxxxx-wan2#sal findout Extended IP access list findout     1 permit icmp any host 10.123.6.182 log (6116 matches)     10 permit ip any any log (24583 matches) Removal of the 'findout' access-list, or the line 1 above with out the log keyword will cause these connections to fail....appreciate your suggestions.   ... View more

I have a monitor session process set up to forward data from 4 ports to a single output port. I am surprised to see that on the output port, the rate of output drops is steadily increasing:   Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 153449   Queueing strategy: fifo   Output queue: 0/40 (size/max)   30 second input rate 0 bits/sec, 0 packets/sec   30 second output rate 59,733,000 bits/sec, 7698 packets/sec       <I added the commas, nice view I think. The output drops are being blamed for another applications failure to adequately monitor the combined output of the four ports. I do not see how at 60Mbps, this interface should be dropping so much traffic. THanks in advance for any suggestions! ... View more

We are in a business that is subjected to NERC guidelines and processes for management of networks. As such, we have to document and approve all tcp/udp ports and services on devices. Those that are not needed should be disabled, those that are needed must be approved. While working with the 3560X switch, I did a TCP scan and found that ports, 21, 22, and 23 were open. 22 and 23 not a surprise but 21 was. I telnetted to port 21 on the device and got this result: xxxxxxxxxxx-con1#telnet ohxxxx-sw1 21 Trying ohxxxxxx-sw1.bbbbbb.com (10.246.21.241, 21)... Open 220-FTP Server (user 'innnnnnn') 220 USER ftpuser 331-Password: 331 1mages 500-Syntax error -- unknown command 500 I don't know the exact commands to interact with the system, but needless to say, the 3560X let me log in to port 21, for an FTP session. I have been unsuccessful in finding anything on cisco.com yet, but if any one knows how to disable this feature, I would appreciate hearing it !! ... View more