I have a remote site that has a 2851 currently with a single ISP and VPN site-to-site back to my HQ.  I would like to add a second ISP at the remote site for fail-over as the Internet connection at the location is somewhat unstable.  My HQ is fully redundant already with dual ISPs and eBGP.  To comply with corporate policy I tunnel all traffic back to HQ for inspection, content filtering, SSL decryption, etc.  I'd prefer to use a tunnel interface with this setup as I can do more with ACLs and security opposed to crypto-maps. Is it possible in the IOS to do the following? Establish a site-to-site tunnel using ISP1 and aggressive mode (works easier at HQ when 2 ISPs are invloved) back to HQ. If ISP1 fails detect and switch over to ISP2. Re-establish the VPN tunnel with ISP2 back to HQ. Detect ISP1 is back up and flip back. I could do this with 2 routers and HSRP but that would involve changing the way things work at HQ with the routing and I would like to avoid that if possible to not introduce more changes.  Any thoughts on how to do it would be appreciated.  Thanks in advance.   ... View more

We just aquired a company and they have a older PIX 501 running 6.3(5).  This new company is using the same IP address scheme as one of my other VPN tunnels.  To make things easier I NAT'd the tunnel to appear to my main firewall as 10.10.12.0/24 rather than 192.168.1.0/24.  The VPN is working well and I can get to all of the resources on the other end and they can get into HQ.  The problem I am running into is that I cannot SSH, HTTP, Telnet, or ping the inside interface of the PIX.  Also from the PIX, I cannot ping an HQ address using ping inside x.x.x.x.  I am assuming it is due to the NAT.  We have another aquisition with a PIX but the difference with this one is that I can do the noNAT since the IP address scheme is different than anything else we have.  I have included my config to see if there is anything I am missing. PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password ********** encrypted passwd ********** encrypted hostname pixfirewall domain-name company.com clock timezone EST -5 clock summer-time EDT recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol pptp 1723 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.1.253 SYSTEM1 name 192.168.1.222 SYSTEM2 name 192.168.1.218 SYSTEM3 name 192.168.1.221 SYSTEM4 name 208.68.91.10 Online_load_tracing name 172.16.1.230 MANAGEMENT object-group network HQ-Encrypt   network-object 10.50.1.0 255.255.255.0   network-object 172.16.0.0 255.255.240.0 object-group network NewCompany-Encrypt   network-object 10.10.12.0 255.255.255.0 access-list outside_access_in permit tcp any any eq 3389 access-list outside_access_in permit tcp any any eq pptp access-list outside_access_in permit udp any any eq isakmp access-list outside_access_in permit gre any any access-list outside_access_in permit tcp any interface outside access-list site1 permit ip 192.168.1.0 255.255.255.0 172.16.0.0 255.255.240.0 access-list site1 permit ip 192.168.1.0 255.255.255.0 10.50.1.0 255.255.255.0 access-list IPSEC-TUN permit ip 10.10.12.0 255.255.255.0 172.16.0.0 255.255.240.0 access-list IPSEC-TUN permit ip 10.10.12.0 255.255.255.0 10.50.1.0 255.255.25.0 pager lines 24 logging on logging trap notifications logging host inside SYSTEM2 mtu outside 1500 mtu inside 1500 ip address outside 216.110.239.22 255.255.255.252 ip address inside 192.168.1.254 255.255.255.0 ip verify reverse-path interface outside ip audit info action alarm ip audit attack action alarm ip local pool VPNpool 192.168.100.1-192.168.100.7 pdm location SYSTEM3 255.255.255.255 inside pdm location SYSTEM1 255.255.255.255 inside pdm location SYSTEM2 255.255.255.255 inside pdm location SYSTEM4 255.255.255.255 inside pdm location Online_load_tracing 255.255.255.255 outside pdm logging notifications 200 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface 3389 SYSTEM1 3389 netmask 255.255.255.255 0 0 static (inside,outside) tcp interface www SYSTEM4 www netmask 255.255.255.255 0 0 static (inside,outside) 10.10.12.0 access-list site1 0 0 access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 216.110.239.21 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa authentication enable console LOCAL aaa authentication http console LOCAL aaa authentication ssh console LOCAL aaa authentication telnet console LOCAL aaa authorization command LOCAL http server enable http 192.168.1.0 255.255.255.0 inside snmp-server host inside MANAGEMENT snmp-server community HQ-SNMP no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set HQ esp-aes-256 esp-sha-hmac crypto map HQ 50 ipsec-isakmp crypto map HQ 50 match address IPSEC-TUN crypto map HQ 50 set peer 1.2.3.4 crypto map HQ 50 set transform-set HQ crypto map HQ 50 set security-association lifetime seconds 3600 kilobytes 65535 crypto map HQ interface outside isakmp enable outside isakmp key ********** address 1.2.3.4 netmask 255.255.255.255 isakmp identity address isakmp policy 50 authentication pre-share isakmp policy 50 encryption aes-256 isakmp policy 50 hash sha isakmp policy 50 group 2 isakmp policy 50 lifetime 86400 telnet 192.168.1.0 255.255.255.0 inside telnet timeout 15 ssh 1.2.3.4 255.255.255.0 outside ssh 192.168.1.0 255.255.255.0 inside ssh timeout 15 management-access inside console timeout 0 dhcpd auto_config outside username support password ********** encrypted privilege 15 terminal width 80 Cryptochecksum:6b81bcad601b2ea0bcd4d9966cc8d711 ... View more

Does anyone know the proper settings with SecureCRT to dial an OOB modem?  We use Verizon managed services and although they test the modems, we want to as well.  Any setting I try in SecureCRT results in a blinking cursor but no Router> prompt.  Has anyone had luck with the TAPI option on SecureCRT? ... View more

I am working on adding some redundancy to a site.  It currently is using 2 3550-12G fiber switches for the "middle" tier to connect back the wiring closets and to core routers.  The routers are both 3825s and the closets are a mix of different Cisco 2950s and 2960s.  I am wanting to run EIGRP between the routers and 3550s which would also help routing back to the other sites.  The two 3550s have all of the VLAN definitions for the building, and here I am wanting HSRP mainly to provide default-gateway redundancy for end-user workstations if one should quit. Would this cause issues with EIGRP since both 3550s have the statement network 192.168.0.0 0.0.255.255?  Or is it smart enough to realize which one is active?  Each VLAN has an IP so for example 3550-1 VLAN 74 shows 192.168.74.2 and 3550-2 shows 192.168.74.3.  HSRP would be 192.168.74.1 between them. Is there a recommended or better way to do it? ... View more

I have 2 3550 12G switches that I use as core fiber switches.  Switch 1 is the primary for 1/2 the VLANs and Switch 2 is the primary for the others using MST with 2 instances (I am not including the default 0 instance).  I am using HSRP to provide redundancy.  So far so good.  Recently a tenant in my building would like to use their own switch for data but still needs access to a VLAN on mine for voice.  Again not a problem as I can configure a trunk port and give them what they need.  My concern is that if they try to configure STP on their switch can they take down mine.  Are there some preventions that I can put into place to help, such as root guard, that work with MST?  What happens if they too set up MST can they kill mine? Switch 1 is the root for 1/2 the vlans and Switch 2 is the backup root.  The scenario is flipped for the other 1/2. ... View more