Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About aeryilmaz
aeryilmaz
Beginner
I have more than 10 years experience in the IT industry. Over this time I have worked as both a UNIX administrator and Network Engineer. I most enjoy working on the Cisco ASA.
Recent Badges
Stats
Member since
10-07-2004
34
Posts
0
Helpful
0
Solutions
12-23-2013
11:02 AM
Hi all - thanks for your replies! They were much appreciated! I did another factory reset on the AP, this time using the "hard reset" option from the controller. After the reset, the AP re-joined and I am now able to specificy the correct country code. Thanks again!
... View more
12-20-2013
07:34 AM
Country of origin is US And, it was working prior to the factory reset. I should've mentioned that it is from the WLC that I am trying to change the Country Code.
... View more
12-20-2013
06:39 AM
After a factory refresh on a 3602i, I am no longer able to set the Country to "US" It is defaulting to "AU" and when I try changing it I get the error that reads "error in setting country code." Any thougths on where to start with this? The AP was purchased in the US and had previously operated under that country code. It's only after the factory refresh that this became an issue. Version is 7.4.100.60
... View more
- Tags:
- access-point
Labels:
04-10-2013
08:33 AM
That has not been a problem in the past. I have ran active/standby pairs where just 1 side had an IP.
... View more
04-10-2013
07:54 AM
Hi all, I have an Interface that is up/up but "show fail" reports "no link" Any ideas on what the cause may be? I am seeing input errors on the switch port this interface is connected to. Tried swapping the cable, but no change. I may have a hardware problem but curious if anyone has specific insight as to why I would see "no link" from "show fail" PIX515E-01/pri/act# sh fail Failover On Cable status: Normal Failover unit Primary Failover LAN Interface: N/A - Serial-based failover enabled Unit Poll frequency 15 seconds, holdtime 45 seconds Interface Poll frequency 5 seconds, holdtime 25 seconds Interface Policy 1 Monitored Interfaces 3 of 250 maximum Version: Ours 7.2(3), Mate 7.2(3) Last Failover at: 00:24:54 EDT Jul 6 2012 This host: Primary - Active Active time: 32270310 (sec) Interface outside (xxxxxxxx): Normal Interface core (xxxxxxxxx): Normal Interface testing (172.20.81.30): No Link (Not-Monitored) Other host: Secondary - Standby Ready Active time: 0 (sec) Interface outside (xxxxxxxxx): Normal Interface core (xxxxxxxxxxxxx): Normal Interface testing (0.0.0.0): No Link (Not-Monitored) PIX515E-01/pri/act# sh int eth3 Interface Ethernet3 "testing", is up, line protocol is up Hardware is i82559, BW 100 Mbps Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 000d.8810.1585, MTU 1500 IP address 172.20.81.30, subnet mask 255.255.255.0 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 L2 decode drops 91 packets output, 6074 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max packets): hardware (0/0) software (0/0) output queue (curr/max packets): hardware (0/1) software (0/1) Traffic Statistics for "testing": 0 packets input, 0 bytes 79 packets output, 2572 bytes 0 packets dropped 1 minute input rate 0 pkts/sec, 0 bytes/sec 1 minute output rate 0 pkts/sec, 0 bytes/sec 1 minute drop rate, 0 pkts/sec 5 minute input rate 0 pkts/sec, 0 bytes/sec 5 minute output rate 0 pkts/sec, 0 bytes/sec 5 minute drop rate, 0 pkts/sec
... View more
Labels:
10-29-2012
09:21 AM
Hi All, I'm using the default tunnel-group and group-policy for my general user community. I want to apply a filter for that group, and have a special use case for another group that bypasses the filter. My goal: for people hitting the "RAS_Engineering" group policy, I want to bypass the filter applied to "DfltGrpPolicy" Is there a way for me to configure the group-policy so that it doesn't pick up the default settings? Here's what I have (some output omitted to reduce lines): # sh vpn-session detail svc filter name amy.eryilmaz Session Type: SVC Detailed Username : amy.eryilmaz Index : 13568 Assigned IP : my.vpn.assigned.ip Public IP : my.pub.lic.ip .... Group Policy : RAS_Engineering Tunnel Group : DefaultWEBVPNGroup ... Clientless Tunnels: 1 SSL-Tunnel Tunnels: 1 Clientless: Tunnel ID : 13568.1 Public IP : my.pub.lic.ip ... Auth Mode : userPassword Idle Time Out: 30 Minutes Idle TO Left : 29 Minutes Client Type : Web Browser Client Ver : AnyConnect Windows 2.5.3046 Bytes Tx : 11456 Bytes Rx : 3986 SSL-Tunnel: Tunnel ID : 13568.2 Assigned IP : my.vpn.assigned.ip Public IP : my.pub.lic.ip .... Client Type : SSL VPN Client Client Ver : Cisco AnyConnect VPN Agent for Windows 2.5.3046 .... Filter Name : default-vpn-filter ----------------------------------------------------------- group-policy DfltGrpPolicy attributes wins-server value xx.xx.xx.xx dns-server value xx.xx.xx.xx dhcp-network-scope xx.xx.xx.xx vpn-filter value default-vpn-filter vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn default-domain value mydomain.com webvpn svc ask none default svc group-policy RAS_Engineering internal group-policy RAS_Engineering attributes wins-server value xx.xx.xx.xx dns-server value xx.xx.xx.xx dhcp-network-scope xx.xx.xx.xx vpn-tunnel-protocol l2tp-ipsec svc webvpn svc ask none default svc ----------------------------------------------------------------- # sh run all tunnel-group DefaultWEBVPNGroup tunnel-group DefaultWEBVPNGroup type remote-access tunnel-group DefaultWEBVPNGroup general-attributes no address-pool no ipv6-address-pool authentication-server-group my_radius secondary-authentication-server-group none no accounting-server-group default-group-policy DfltGrpPolicy dhcp-server xx.xx.xx.xx no strip-realm no password-management no override-account-disable no strip-group no authorization-required username-from-certificate CN OU secondary-username-from-certificate CN OU authentication-attr-from-server primary authenticated-session-username primary tunnel-group DefaultWEBVPNGroup webvpn-attributes customization myCustom authentication aaa no override-svc-download no radius-reject-message no proxy-auth sdi no pre-fill-username ssl-client no pre-fill-username clientless no secondary-pre-fill-username ssl-client no secondary-pre-fill-username clientless dns-group DefaultDNS no without-csd tunnel-group DefaultWEBVPNGroup ipsec-attributes no pre-shared-key peer-id-validate req no chain no trust-point isakmp keepalive threshold 300 retry 2 no radius-sdi-xauth isakmp ikev1-user-authentication xauth
... View more
Labels:
06-08-2012
06:04 AM
Is interface congestion due to limitations by the ASIC or caused by what's connected on the other end? Given the 3560x is wire-speed, is it still possible to over subscribe the ASICs? Based on some reading outside of this forum, I understand that there are very small interface buffers on the 3560x - perhaps that is the cause. Could anyone clarify for me?
... View more
06-07-2012
07:33 AM
Hi all, I've read through some of the discussions here regarding the 3560x ASICs, but still not clear on the architecture. I see 3 port-asics on the 3560x. What is the job of these ASICs? Also, what is the total throughput of the 3560x series? I'm researching interface output drops that correlate with drops that I see on the corresponding asic. I also have a lot of buffer misses in the public and interface buffer pools. #sh platform port-asic stats drop asic 1 Port-asic Port Drop Statistics - Summary ======================================== RxQueue Drop Statistics Slice0 RxQueue 0 Drop Stats Slice0: 0 RxQueue 1 Drop Stats Slice0: 0 RxQueue 2 Drop Stats Slice0: 0 RxQueue 3 Drop Stats Slice0: 0 RxQueue Drop Statistics Slice1 RxQueue 0 Drop Stats Slice1: 0 RxQueue 1 Drop Stats Slice1: 0 RxQueue 2 Drop Stats Slice1: 0 RxQueue 3 Drop Stats Slice1: 0 Port 0 TxQueue Drop Stats: 3712363 Port 1 TxQueue Drop Stats: 0 Port 2 TxQueue Drop Stats: 97030 Port 3 TxQueue Drop Stats: 1450621 Port 4 TxQueue Drop Stats: 3834 Port 5 TxQueue Drop Stats: 210196 Port 6 TxQueue Drop Stats: 0 Port 7 TxQueue Drop Stats: 0 Port 8 TxQueue Drop Stats: 1 Port 9 TxQueue Drop Stats: 0 Port 10 TxQueue Drop Stats: 5294 Port 11 TxQueue Drop Stats: 875 Port 12 TxQueue Drop Stats: 0 Port 13 TxQueue Drop Stats: 4191 Port 14 TxQueue Drop Stats: 0 Port 15 TxQueue Drop Stats: 1025 Thanks in advance!
... View more
Labels:
10-31-2011
08:46 AM
I have not yet got to the bottom of this. I ran captures watching traffic from my BigiP and did not see duplicate sequence numbers. So, the alerts appear to be cosmetic, but I have not yet proved that. Are you running F5 LTMs as well? Those load balancers have a "one-connect" feature that I suspect may be related.
... View more
09-29-2011
01:35 PM
I opened a TAC and got the answer to my question: "When an access-list line has the log argument, it is expected that this
message ID might be triggered because of a nonsynchronized packet reaching
the adaptive security appliance and being evaluated by the access list. For
example, if an ACK packet is received on the adaptive security appliance
(for which no TCP connection exists in the connection table), the adaptive
security appliance might generate message 106100, indicating that the packet
was permitted; however, the packet is later correctly dropped because of no
matching connection." In my case, the client side is sending in a FIN, the server replies and the ASA tearsdown the connection. It then processes the reply packet against the ACL and since the connection is torndown, the ACL hit is logged.
... View more
09-28-2011
11:21 AM
Thanks, Varun. Changing the logging interval did not make a difference. Not sure if I was clear in my question... I see the source and destination IPs (I did not show the real IPs in the logs above). But, I do not understand why I see ACL hits for replies to TCP traffic that originated from the outside and is currently in an Established state. In my logs I see source ports http and https, and those packets are replies to HTTP/HTTPS connections. I shouldn't need an ACE to permit TCP reply packets, so I'm puzzled as to why I see the hits on the access-list. Thanks.
... View more
09-28-2011
08:32 AM
Hi all, Running ASA 5520 8.2(1) I have an interface ACL applied, with a catch all at the end for logging traffic that does not match my specific rules. access-list dmz-in extended permit ip DMZ-NET 255.255.255.0 any log informational interval 300 I see logs showing that reply packets are hitting that ACL rule. I am confused as to why an established connection, that originated from the Internet, would log hits on an ACL applied to the DMZ interface. Could someone help me to understand what I am seeing? Thanks in advance! Example log entries. %ASA-6-106100: access-list dmz-in permitted tcp dmz/10.10.100.50(80) -> outside/pu.bl.ic.ip(38219) hit-cnt 1 300-second interval [0xc6c51367, 0x0] %ASA-6-106100: access-list dmz-in permitted tcp dmz/10.10.100.55(443) -> outside/pu.bl.ic.ip(54251) hit-cnt 1 first hit [0xc6c51367, 0x0]
... View more
Labels:
09-01-2011
02:48 PM
Hi all, This is one that's come up in the Community before, but none seem to fit my scenario. I'm getting these errors at regular intervals. The source IPs are from my pair of F5 BigIP LTMs that are directly connected off the DMZ interface. Sep 01 2011 17:32:04: %ASA-4-419002: Duplicate TCP SYN from dmz:172.250.50.9/57400 to inside:172.250.10.86/80 with different initial sequence number Sep 01 2011 17:32:43: %ASA-4-419002: Duplicate TCP SYN from dmz:172.250.50.8/46246 to inside:172.250.30.21/25 with different initial sequence number I am seeing input errors on the switch port connecting the ASA DMZ interface: 764 input errors, 1 CRC, 0 frame, 0 overrun, 0 ignored I am running EIGRP on the ASA: router eigrp 10 network 172.250.50.0 255.255.254.0 network 172.250.0.0 255.255.0.0 Any troubleshooting suggestions? Thanks!
... View more
Labels:
12-23-2013
Hi all - thanks for your replies! They were much appreciated!I did
another factory reset on the AP, ...
12-20-2013
Country of origin is USAnd, it was working prior to the factory reset.I
should've mentioned that it ...
12-20-2013
After a factory refresh on a 3602i, I am no longer able to set the
Country to "US"It is defaulting t...
04-10-2013
That has not been a problem in the past.I have ran active/standby pairs
where just 1 side had an IP.
04-10-2013
Hi all,I have an Interface that is up/up but "show fail" reports "no
link"Any ideas on what the caus...
10-29-2012
Hi All,I'm using the default tunnel-group and group-policy for my
general user community. I want to ...
06-08-2012
Is interface congestion due to limitations by the ASIC or caused by
what's connected on the other en...
06-07-2012
Hi all,I've read through some of the discussions here regarding the
3560x ASICs, but still not clear...
10-31-2011
I have not yet got to the bottom of this. I ran captures watching
traffic from my BigiP and did not ...
09-29-2011
I opened a TAC and got the answer to my question:"When an access-list
line has the log argument, it ...
09-28-2011
Thanks, Varun. Changing the logging interval did not make a difference.
Not sure if I was clear in m...
09-28-2011
Hi all,Running ASA 5520 8.2(1)I have an interface ACL applied, with a
catch all at the end for loggi...
Public Statistics
| Date Registered | 10-07-2004 05:05 AM |
| Date Last Visited | 10-09-2017 12:55 PM |
| Total Messages Posted | 34 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 2 | |
| 4 | |
| 3 | |
| 4 | |
| 7 |
.jpg "VIP Expert"){kind=icon}
.jpg "Hall of Fame Mentor"){kind=icon}
