I have several devices that have different IP addresses and they could change as well. This is for a test/dev lab. However, we need to plug these devices into a switch and grant them internet access and that is it. Configuring a Catalyst 3750 switch with multiple VLANs, and I know I cannot NAT in the switch (that is fine), but setting up a trunk port to a Cisco ISR router...  From here I would setup sub-interfaces on one port and provide the router as a router on a stick, correct? So these devices would just pass and get internet access. However the IP addresses will change and different devices will be plugged in. Is this an issue for the router configuration and the sub-interfaces? Will I need to know what they will be so I can provide a gateway address for each sub-interface on the router? ... View more

Replaced two old 3560's and a 2960 with a new Catalyst 3650-X and two 2960-X's. Routing seems OK for the most part, but there are some issues getting to the SAN VLAN. There is a trunk port between the core switch (3650) and the SAN switch (2960), and the routes are below, but then I started uncovering (not my network design) hairpinning in an ASA 5510 for one of the SAN subnets (172.15.20.0/24) going to the core switch IP.   So in the ASA firewall (10.10.10.3) you have: route insite 172.15.20.0/24 to 10.10.10.250 (core switch) At the core switch I have an IP default gateway defined for a 2811 router: 10.10.10.1 Then static routes are as follows: ip route 0.0.0.0 0.0.0.0 10.10.10.1 ip route 0.0.0.0 0.0.0.0 10.10.10.2 250 ip route 10.2.8.0 255.255.255.240 10.10.10.3 ip route 10.4.8.0 255.255.255.0 10.10.10.3 ip route 10.6.8.0 255.255.255.0 10.10.10.3 ip route 10.8.8.0 255.255.255.0 10.10.10.3 But also in the core switch is int vlan 2 for 172.15.20.1 Previously 172.15.20.1 could be reach from the SAN switch. But the SAN switch (again, a 2960) has no static routes, ip routing is not one, just a Trunk port back to the core, and a few VLAN 2 ports for the SAN, but an ip default gateway defined to: 10.10.10.1 (the router!) I am thinking that needs to be fixed to point to the core switch instead, but doing so didn't totally fix it. And I am thinking maybe a static route for 172.15.20.0/24 in the core switch...?  Since pinging 172.15.20.1 from the core switch goes to the ASA and back to the core and creates a bunch of ICMP errors.. ... View more

Been running into issues getting access externally to a Windows Sever 2012 FTP server. Have set it up many times in an ASA lately, and found articles saying on a 2811 to allow TCP port 20 and/or turn on inspection. Below are the main parts from the config on this 2811 which has IOS 12.4. FTP server is still not responding to an Active or Passive FTP connection...   ip inspect name CCP_LOW cuseeme ip inspect name CCP_LOW dns ip inspect name CCP_LOW ftp ip inspect name CCP_LOW h323 ip inspect name CCP_LOW sip ip inspect name CCP_LOW https ip inspect name CCP_LOW icmp ip inspect name CCP_LOW imap ip inspect name CCP_LOW pop3 ip inspect name CCP_LOW netshow ip inspect name CCP_LOW rcmd ip inspect name CCP_LOW realaudio ip inspect name CCP_LOW rtsp ip inspect name CCP_LOW sqlnet ip inspect name CCP_LOW streamworks ip inspect name CCP_LOW tftp ip inspect name CCP_LOW tcp ip inspect name CCP_LOW udp ip inspect name CCP_LOW vdolive ! ! ! ! ! interface FastEthernet0/0  description $ETH-WAN$$FW_OUTSIDE$  ip address 172.16.1.1 255.255.255.0  ip access-group 102 in  ip verify unicast reverse-path  ip nat outside  ip inspect CCP_LOW out  ip virtual-reassembly  duplex full  speed 100 ! interface FastEthernet0/1  description $ETH-LAN$$FW_INSIDE$  ip address 192.168.1.1 255.255.255.0  ip access-group 103 in  ip nat inside  ip virtual-reassembly  duplex full  speed 100 ! ip classless ip route 0.0.0.0 0.0.0.0 172.16.1.254 ! ! ip nat inside source list 2 interface FastEthernet0/0 overload ip nat inside source static tcp 192.168.1.25 25 172.16.1.2 25 extendable ip nat inside source static tcp 192.168.1.12 80 172.16.1.2 80 extendable ip nat inside source static udp 192.168.1.12 123 172.16.1.2 123 extendable ip nat inside source static tcp 192.168.1.25 443 172.16.1.2 443 extendable ip nat inside source static tcp 192.168.1.20 20 172.16.1.4 20 extendable ip nat inside source static tcp 192.168.1.20 21 172.16.1.4 21 extendable ! access-list 1 permit 192.168.1.0 0.0.0.255 access-list 2 permit 192.168.1.0 0.0.0.255 access-list 101 permit ip 192.168.1.0 0.0.0.255 any access-list 102 permit icmp any any echo-reply access-list 102 permit icmp any any time-exceeded access-list 102 permit icmp any any unreachable access-list 102 permit udp host 4.2.2.3 eq domain host 172.16.1.1 access-list 102 permit tcp any host 172.16.1.4 eq ftp access-list 102 permit tcp any host 172.16.1.2 eq 443 access-list 102 permit tcp any host 172.16.1.2 eq www access-list 102 permit tcp any host 172.16.1.2 eq smtp access-list 102 deny   ip 10.0.0.0 0.255.255.255 any access-list 102 deny   ip 192.168.0.0 0.0.255.255 any access-list 102 deny   ip 127.0.0.0 0.255.255.255 any access-list 102 deny   ip host 255.255.255.255 any access-list 102 deny   ip host 0.0.0.0 any access-list 102 deny   ip any any log access-list 103 permit icmp any any access-list 103 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq telnet access-list 103 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 22 access-list 103 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq www access-list 103 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 443 access-list 103 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq cmd access-list 103 deny   tcp any host 192.168.1.1 eq telnet access-list 103 deny   tcp any host 192.168.1.1 eq 22 access-list 103 deny   tcp any host 192.168.1.1 eq www access-list 103 deny   tcp any host 192.168.1.1 eq 443 access-list 103 deny   tcp any host 192.168.1.1 eq cmd access-list 103 deny   udp any host 192.168.1.1 eq snmp access-list 103 deny   ip host 255.255.255.255 any access-list 103 deny   ip 127.0.0.0 0.255.255.255 any access-list 103 permit ip any any   ... View more