Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Andriy Sidko
04-09-2019
Andriy Sidko
Member since
04-06-2010
Beginner
Created by
Andriy Sidko
in Other Network Architecture Subjects
in Other Network Architecture Subjects
02-13-2019
09:23 AM
02-13-2019
09:23 AM
ok. config looks like this now: gate(config)#do sh runn | s dhcp ip dhcp binding cleanup interval 300 ip dhcp excluded-address 192.168.172.1 192.168.172.17 ip dhcp excluded-address 192.168.172.31 192.168.172.37 ip dhcp excluded-address 192.168.172.39 192.168.172.49 ip dhcp excluded-address 192.168.172.56 192.168.172.255 ip dhcp ping timeout 150 ip dhcp pool sip-static-binding host 192.168.172.38 255.255.255.248 client-identifier acf2.c538.2d2c default-router 192.168.172.33 dns-server 192.168.172.2 206.248.154.22 lease infinite ip dhcp pool sippool import all network 192.168.172.32 255.255.255.248 default-router 192.168.172.33 domain-name st1.net netbios-node-type m-node dns-server 192.168.172.4 192.168.172.2 option 150 ip 192.168.172.2 lease 1 3 30 ip dhcp pool guestwifipool import all network 192.168.172.48 255.255.255.248 default-router 192.168.172.49 dns-server 8.8.8.8 8.8.4.4 lease 0 0 30 ip dhcp pool wifipool import all utilization mark high 80 log network 192.168.172.16 255.255.255.240 default-router 192.168.172.17 domain-name st1.net option 150 ip 192.168.172.2 dns-server 192.168.172.9 192.168.172.2 lease 1 3 30 ip dhcp snooping vlan 11-12 ip dhcp snooping ipv6 dhcp pool IPv6DHCP4vl11 address prefix 2001:470:B0FD:3F02::/64 lifetime 21600 21600 link-address 2001:470:B0FD:3F02::1/64 dns-server 2001:470:20::2 domain-name st1.net ip address dhcp gate(config)# +++++++++++++ where vlan interfaces looks like: +++++++++++++ gate(config)# do sh ip int brie | i lan Vlan1 unassigned YES unset administratively down down Vlan10 192.168.172.1 YES NVRAM up up Vlan11 192.168.172.17 YES NVRAM up up Vlan12 192.168.172.49 YES NVRAM up up Vlan60 192.168.172.33 YES NVRAM up up Vlan61 192.168.172.41 YES NVRAM administratively down down Vlan600 192.168.172.249 YES NVRAM up up Vlan999 unassigned YES unset down down gate(config)# +++++++++++++ i'll test tonight. Thank you.
... View more
Created by
Andriy Sidko
in Other Network Architecture Subjects
in Other Network Architecture Subjects
02-13-2019
07:54 AM
02-13-2019
07:54 AM
i took a look at post. It seems nothing related to issue I have. what do you think if I upgrade router image to latest recommended by Cisco: c890-universalk9-mz.157-3.M3.bin? Thank you.
... View more
Created by
Andriy Sidko
in Other Network Architecture Subjects
in Other Network Architecture Subjects
02-12-2019
01:16 PM
02-12-2019
01:16 PM
Hi guys. I have C891FW router acting as DHCP server for lan clients (vlan11) I put following configuration: ++++++++++++++++++ ip dhcp binding cleanup interval 300 ip dhcp excluded-address 192.168.172.1 192.168.172.18 ip dhcp excluded-address 192.168.172.0 192.168.172.17 ip dhcp excluded-address 192.168.172.31 192.168.172.255 ip dhcp ping timeout 150 ip dhcp pool wifipool import all utilization mark high 80 log network 192.168.172.16 255.255.255.240 default-router 192.168.172.17 domain-name st1.net option 150 ip 192.168.172.2 dns-server 192.168.172.9 192.168.172.2 lease 1 3 30 ip dhcp snooping vlan 11 ip dhcp snooping ++++++++++++++++++ time to time all clients (it happening different for every clients) lost/cannot renew IP assigned by DHCP (gettig self assigned 169.254.x.x) force clients manually re-obtain IP resolve issue till next time. Thank you in advance. p.s. time whenever issue is happening random. p.p.s router running IOS c800-universalk9-mz.SPA.154-3.M10.bin
... View more
- Tags:
- dhcp
Labels:
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
12-21-2018
10:10 AM
12-21-2018
10:10 AM
Hi guys. I'd like to enable 300 for n mode clients (they are not not ac compatible) at autonomous access point CAP3702e. I applied followin configuration: ++++++++++ dot11 vlan-name a81m vlan 11 dot11 ssid a81m vlan 11 authentication open eap EAP_METHODS authentication network-eap EAP_METHODS authentication key-management wpa version 2 mbssid guest-mode interface Dot11Radio0 no ip address no ip route-cache ! encryption vlan 11 mode ciphers aes-ccm ! ! encryption mode ciphers aes-ccm ! ssid a81m ! ! antenna gain 0 stbc mbssid speed basic-6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23. channel least-congested 2437 2462 station-role root no cdp enable bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding interface Dot11Radio0.11 encapsulation dot1Q 11 no ip route-cache no cdp enable bridge-group 2 bridge-group 2 subscriber-loop-control bridge-group 2 spanning-disabled bridge-group 2 block-unknown-source no bridge-group 2 source-learning no bridge-group 2 unicast-flooding interface Dot11Radio1 no ip address no ip route-cache shutdown ! encryption vlan 11 mode ciphers aes-ccm ! ssid a81m ! antenna gain 0 peakdetect dfs band 3 block stbc mbssid speed basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23. a1ss9 a2ss9 a3ss9 channel width 40-below channel dfs station-role root no cdp enable bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding interface Dot11Radio1.11 encapsulation dot1Q 11 no ip route-cache no cdp enable bridge-group 2 bridge-group 2 subscriber-loop-control bridge-group 2 spanning-disabled bridge-group 2 block-unknown-source no bridge-group 2 source-learning no bridge-group 2 unicast-flooding interface GigabitEthernet0 description -= .1q trunk to gate's gi6 - private VLAN 11 =- no ip address no ip route-cache duplex auto speed auto ! ! interface GigabitEthernet0.11 description -= private wireless subnet 192.168.172.16/28 =- encapsulation dot1Q 11 no ip route-cache bridge-group 2 no bridge-group 2 spanning-disabled no bridge-group 2 source-learning ! interface BVI1 description -= management subnet 192.168.172.0/28 =- mac-address e865.1998.2fc4 ip address 192.168.172.11 255.255.255.240 no ip route-cache ! interface BVI2 description -= private wireless subnet 192.168.172.16/28 =- mac-address 0005.4938.23c6 no ip address no ip route-cache ++++++++++ as results. whenever GN clients joined AP, successfully authenticated but getting just 150 mpbs. I tried to setup "aXssXX" parameters for interface Dot11Radio0 but there is no options to do that. Could you suggest? p.s. interface bvi1 is AP management link. Thank you.
... View more
- Tags:
- dadio0 300mbps
Created by
Andriy Sidko
in Firewalls
in Firewalls
11-07-2018
06:56 AM
11-07-2018
06:56 AM
Hello.
My router x.x.x.x utilizing CBAC time to time drops packets from y.y.y.y to x.x.x.x x.x.x.x is writes following in log file: +++++++++ Nov 7 01:01:47 gate.sta17.net 998275: Nov 7 01:01:46: %FW-6-DROP_PKT: Dropping tcp session x.x.x.x:55802 y.y.y.y:443 due to RST inside current window with ip ident 24576 tcpflags 0x5014 seq.no 2217371408 ack 3597684402 +++++++++
gate router config looks like:
+++++++++ gate(config)#do sh runn | s ip inspect ip inspect log drop-pkt ip inspect audit-trail ip inspect max-incomplete high 10000 ip inspect max-incomplete low 8900 ip inspect one-minute low 8900 ip inspect one-minute high 10000 ip inspect udp idle-time 360 ip inspect dns-timeout 20 ip inspect tcp idle-time 7200 ip inspect tcp finwait-time 32 ip inspect tcp max-incomplete host 800 block-time 0 ip inspect tcp reassembly queue length 1024 ip inspect tcp reassembly timeout 120 ip inspect tcp reassembly memory limit 512000 ip inspect tcp reassembly alarm on ip inspect name DIAL_OUT ftp alert on audit-trail off timeout 120 ip inspect name DIAL_OUT router alert on audit-trail off timeout 120 ip inspect name DIAL_OUT tcp alert on audit-trail off timeout 120 ip inspect name DIAL_OUT udp alert on audit-trail off timeout 120 ip inspect name DIAL_OUT rtsp alert on audit-trail off timeout 120 +++++++++
where interface gi8 is outside one connected to ISP:
+++++++++ gate(config)#do sh ip inspec inter Interface Configuration Interface GigabitEthernet8 Inbound inspection rule is not set Outgoing inspection rule is DIAL_OUT ftp alert is on audit-trail is off timeout 120 router alert is on audit-trail is off timeout 120 tcp alert is on audit-trail is off timeout 120 udp alert is on audit-trail is off timeout 120 rtsp alert is on audit-trail is off timeout 120 Inbound access list is DI_IN Outgoing access list is not set
gate(config)# +++++++++
Could you suggest what wrong with config above? Also please suggest how to exclude IP y.y.y.y from x.x.x.x's CBAC inspection?
Thank you.
Thank you.
... View more
- Tags:
- IOS CBAC drops
Labels:
Created by
Andriy Sidko
in VPN and AnyConnect
in VPN and AnyConnect
10-22-2018
07:27 AM
10-22-2018
07:27 AM
It's been duplicated OSPF ID key issue. This issue resolved.
... View more
Created by
Andriy Sidko
in VPN and AnyConnect
in VPN and AnyConnect
10-19-2018
08:45 AM
10-19-2018
08:45 AM
Hi guys.
I'm hitting wield issue with OSPF via DVTI VPN.
Whenever VPN established I got OSPF routing tables populated on both sides. in some different time (it looks like after VPN key renegotiation?) I see tunnel is up from both sides (HUB and spoke) but HUB routing table missed routers from spoke but still keeping them in OSPF topology table and database. So. outputs bellow:
-= HUB =-
gate(config)#do sh cry sess bri
Status: A- Active, U - Up, D - Down, I - Idle, S - Standby, N - Negotiating
K - No IKE
ivrf = (none)
Peer I/F Username Group/Phase1_id Uptime Status
192.206.151.130 Vi2 gate-test.sidko.org 02:01:30 UA
gate(config)#
gate(config)#do sh ip route ospf | e N1
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override
Gateway of last resort is 198.48.188.1 to network 0.0.0.0
172.16.0.0/16 is variably subnetted, 11 subnets, 5 masks
172.28.0.0/16 is variably subnetted, 2 subnets, 2 masks
-= there is NO routes from spoke router installed to routing table, but they existed in topology table. At the same time database output shows those routes have status "*>" best and installed to routing table!!! =-
gate(config)#
gate(config)#do sh ip ospf rou | b Area 3
gate#sh ip ospf rib
OSPF Router with ID (192.168.172.1) (Process ID 17)
Base Topology (MTID 0)
OSPF local RIB
Codes: * - Best, > - Installed in global RIB
-= ommited for briefly =-
Area 3
Intra-area Route List
*> 192.168.174.49/32, Intra, cost 1001, area 3
via 192.168.174.250, Virtual-Access2
*> 192.168.174.65/32, Intra, cost 1001, area 3
via 192.168.174.250, Virtual-Access2
* 192.168.174.249/32, Intra, cost 1, area 3, Connected
via 192.168.174.249, Loopback3
*> 192.168.174.250/32, Intra, cost 1001, area 3
via 192.168.174.250, Virtual-Access2
-= output ommited for briefly =-
running debug for OSPF didn't help. Everything looks good:
debug ip ospf packets
Oct 19 10:41:11 gate.sidko.org 471585: Oct 19 10:41:10.009: OSPF-17 PAK : rcv. v:2 t:1 l:48 rid:192.168.174.250 aid:0.0.0.3 chk:0 aut:2 keyid:2 seq:0x5BC97DD3 from Virtual-Access2
debug ip ospf adj
Oct 19 10:53:53 gate.sidko.org 472116: Oct 19 10:53:53.303: OSPF-17 ADJ Vi2: Send with youngest Key 2
Oct 19 10:54:31 gate.sidko.org 472126: Oct 19 10:54:30.952: OSPF-17 ADJ Vi2: Send with youngest Key 2
Oct 19 10:54:51 gate.sidko.org 472133: Oct 19 10:54:50.301: OSPF-17 ADJ Vi2: Send with youngest Key 2
Oct 19 10:55:10 gate.sidko.org 472137: Oct 19 10:55:09.042: OSPF-17 ADJ Vi2: Send with youngest Key 2
spoke output bellow and different. spoke routing table populated by hub subnets more than 10 hours but HUB subnets is not pingable (of course, because return path doesn’t exist at hub).
-= spoke =-
gate-test#sh ip int bri
-= committed for briefly =-
GigabitEthernet0 10.5.23.47 YES DHCP up up
Loopback2 192.168.174.250 YES NVRAM up up
Loopback3 192.168.174.49 YES NVRAM up up
Loopback4 192.168.174.65 YES NVRAM up up
NVI0 192.168.174.250 YES unset up up
Tunnel0 192.168.174.250 YES TFTP up up
gate-test#
gate-test#sh cry sess bri
Status: A- Active, U - Up, D - Down, I - Idle, S - Standby, N - Negotiating
K - No IKE
ivrf = (none)
Peer I/F Username Group/Phase1_id Uptime Status
198.48.188.59 Tu0 198.48.188.59 02:02:07 UA
gate-test#
gate-test#sh ip rou ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override
Gateway of last resort is 10.5.23.254 to network 0.0.0.0
192.168.172.0/28 is subnetted, 1 subnets
O IA 192.168.172.0 [110/1001] via 192.168.174.249, 10:57:15, Tunnel0
192.168.174.0/24 is variably subnetted, 7 subnets, 3 masks
O 192.168.174.249/32 [110/1001] via 192.168.174.249, 10:57:15, Tunnel0
gate-test#
gate-test#pin 192.168.172.2 re 3
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 192.168.172.2, timeout is 2 seconds:
...
Success rate is 0 percent (0/3)
gate-test#
After I manually reset that VPN tunnel (doesn’t matter side) everything back again (routing tables populated at both sides) and in some e time (I guess after second, third and so on... VPN negotiation. I decrease VPN renegotiation down to 3 hours for both sides and after first renegotiation OSPF always successfully installs spoke routes to hub routing table) routes disappears from HUB routing table but still present in HUB topology table.
Any thoughts?
Thank you.
... View more
Labels:
Created by
Andriy Sidko
in Switching
in Switching
10-11-2018
10:09 AM
10-11-2018
10:09 AM
disregard initial question please. I've found solution.
... View more
Created by
Andriy Sidko
in Switching
in Switching
10-11-2018
06:12 AM
10-11-2018
06:12 AM
Hi guys.
I have network like:
nexus 5k (core&distribution) -VPC53, po53 -> enterasys access switch stack#53 in vlan 53, lag.0.1 same nexus 5k (core&distribution)-VPC54 po54 ->enterasys access switch stack#53 in vlan 53, lag.0.1
switch 53 ports ge.1.47-48 are lagged to lag.0.1 and they uplinks to nexus po53, VPC53, rest of ports in access mode, vlan 53 members switch 54 ports ge.1.47-48 are lagged to lag.0.1 and they uplinks to nexus po54, VPC54, rest of ports in access mode, vlan 54 members
situation as follow:
whenever users interconnect (I believe by mistake) to neighbor desk ports one port in vlan 53 another in vlan 54, nexus detects this look at STP shutdown. As results !90 users lost access. Log file records like: ++++++++++++++++++++++++++
079949: Oct 5 15:35:35.183 EST: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 53 on Port-channel54 VLAN54. 079950: Oct 5 15:35:35.183 EST: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking Port-channel54 on VLAN0054. Inconsistent local vlan.
CAONTO1Y05-SW-01#sh spanning-tree blockedports Name Blocked Interfaces List -------------------- ------------------------------------ VLAN0054 Po54
Number of blocked ports (segments) in the system : 1 ++++++++++++++++++++++++++
So. Question.
If I enable BPDUguard at sw53&54 access ports is it help me to shutdown just one access port whenever bpdu packet hits to it? I did it many time against of interconnecting two ports at the same switch & switch stack but right now there is two stacks can reach each other via nexus.
Thank you.
... View more
Labels:
10-02-2018
11:04 AM
Hi guys.
I need to implement following scenario:
When inside computer 192.168.172.20/28 opens connection to 192.168.172.1/28 port 777/tcp (192.168.172.1 - is cisco router) connection will rewrite source to 192.168.172.1/28:1025-65535/tcp and destination to 10.5.8.7:3389/tcp
returning packets from 10.5.8.7:3389/tcp needs to rewrite source 192.168.172.1:777/tcp and destination 192.168.172.20/28
Another words for security requirements RDP to 10.5.8.7:3389/tcp can be accessible from 192.168.172.1/28 only.
Subnet 192.168.172.16/28 isn't advertised and locked (some kind of DMZ :) to 10.5.8.0/24
Could somebody suggest?
Thank you.
... View more
- Tags:
- Twice NAT
Labels:
Created by
Andriy Sidko
in VPN and AnyConnect
in VPN and AnyConnect
10-01-2018
07:06 AM
10-01-2018
07:06 AM
hi guys.
I have HUB in head office and many small offices connected via DVTI VPN (IKEV2) to HUB.
yesterday one office DVTI IKEV1 (t5.1ko.org) was decommissioned (router power off and internet line has been removed), but I still see router t5's session. Weird thing is PHASE 1 (red bellow) record exists. PHASE 2 doesn't exist (blue bellow):
HUB
+++++++++++
gate#sh cry sess bri Status: A- Active, U - Up, D - Down, I - Idle, S - Standby, N - Negotiating K - No IKE ivrf = (none) Peer I/F Username Group/Phase1_id Uptime Status a.a.a.a Vi2 t1.1ko.org 21:29:29 UA b.b.b.b Vi4 t2.1ko.org 1:24:27 UA c.c.c.c Vi8 t3.1ko.org 13:12:45 UA d.d.d.d Vi5 t4.1ko.org 0:19:36 UA
-= output ommited for briefly =-
e.e.e.e Vi10 t5.1ko.org UI
gate#
gate#sh cry ips sa pe e.e.e.e gate#
gate#sh cry isa sa det Codes: C - IKE configuration mode, D - Dead Peer Detection K - Keepalives, N - NAT-traversal T - cTCP encapsulation, X - IKE Extended Authentication psk - Preshared key, rsig - RSA signature renc - RSA encryption IPv4 Crypto ISAKMP SA
C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.
2084 x.x.x.x e.e.e.e ACTIVE aes sha psk 24 04:04:38 DN Engine-id:Conn-id = SW:40
IPv6 Crypto ISAKMP SA
gate#
+++++++++++
HUB has following configuration for peer t5.1ko.org
+++++++++++
gate#
crypto ipsec profile E.E.E.E-VPN-PROFILE description -= RA DVTI VPN E.E.E.E peer =- set security-association lifetime kilobytes 4294967295 set security-association lifetime seconds 86400 set transform-set E.E.E.E-TS-AES128 set pfs group24 set isakmp-profile E.E.E.E-IKE-PROFILE responder-only
gate#
crypto isakmp profile E.E.E.E-IKE-PROFILE keyring E.E.E.E-VPN-KEYS match identity user-fqdn t5.1ko.org keepalive 25 retry 3 virtual-template 2
+++++++++++
I've understand phase 1 is up till timer expires (red above) but why keepalive (marked blue above) doesn't trigger clear isakmp session to peers who is not responding at keepalives queries? Could somebody explain?
Thank you.
... View more
- Tags:
- VTI VPN keepalive
Labels:
Created by
Andriy Sidko
in Firewalls
in Firewalls
09-28-2018
08:15 AM
09-28-2018
08:15 AM
Thank you Joel.
commands bellow made the trick:
no access-list data_access_in extended permit tcp object data-network host 192.42.119.41 eq www log debugging
access-list data_access_in lin 1 extended permit tcp object data-network host 192.42.119.41 eq www log info
no logging trap notifications
logging trap informational
I see logs now:
Sep 28 11:10:37 10.4.4.3 10.4.4.3 %ASA-6-106100: access-list data_access_in permitted tcp data/10.244.244.30(4455) -> inside/192.42.119.41(80) hit-cnt 1 first hit [0xfd11a8a6, 0x0]
... View more
Created by
Andriy Sidko
in Firewalls
in Firewalls
09-28-2018
07:25 AM
09-28-2018
07:25 AM
i guys.
History:
I got notification from IT security team that one computer in subnet 10.244.244.0/26 has a malware on it (it's opening multiple connections to 192.42.119.41 detected by IPS as malware ). I need find out that computer private IP.
Subnet 10.244.244.0/26 PATing to public IP x.x.x.x
firewall logging looks like:
logging enable logging buffer-size 1048576 logging monitor notifications logging buffered notifications logging trap notifications logging history notifications logging from-address di@di.di logging recipient-address netops@ar.ar level emergencies logging facility 18 logging queue 0
logging device-id ipaddress inside logging host inside 172.16.63.145 logging message 304001 level informational
access-list name data_access_in assigned to interface where ip from subnet 10.244.244.0/26 is.
I added wery first ACE permitting any connections from 10.244.244.0/26 to 192.42.119.41:80/tcp
access-list data_access_in line 1 extended permit tcp object data-network host 192.42.119.41 eq www log debugging
Whenever I run test by packet-tracer:
TDI04-DI0-FW01(config)# packet-tracer input data tcp 10.244.244.30 4455 192.42.119.41 www det
ACE hits increased (red bellow):
TDI04-DI0-FW01 (config)# sh access-list data_access_in | i 192.42.119.41 access-list data_access_in line 1 extended permit tcp object data-network host 192.42.119.41 eq www log debugging interval 300 (hitcnt=2) 0xfd11a8a6 access-list data_access_in line 1 extended permit tcp 10.244.244.0 255.255.255.192 host 192.42.119.41 eq www log debugging interval 300 (hitcnt=2) 0xfd11a8a6 TDI04-DI0-FW01 (config)#
but I don't see packet registered by syslog @ 172.16.63.145 (greed above).
Syslog consists only this:
Sep 28 09:54:52 10.4.4.3 10.4.4.3 %ASA-5-111008: User 'as-admin' executed the 'packet-tracer input data tcp 10.244.244.30 4455 192.42.119.41 www detailed' command. Sep 28 09:54:52 10.4.4.3 10.4.4.3 %ASA-5-111010: User 'as-admin', running 'CLI' from IP snoopy, executed 'packet-tracer input data tcp 10.244.244.30 4455 192.42.119.41 www detailed'
Could you help me out?
Thank you.
... View more
Labels:
08-17-2018
06:50 AM
my side router is Cisco 877W + latest 3 years old image: C870-ADVIPSERVICESK9-M), Version 15.1(4)M10
other side is Ubiquiti access point. I don't know model because I don't have access to it.
still question why and (how to improve) my router shows:
Packets Output : 60117
Data Retries : 20044
so ~30% packets retransmitted.
Maybe I have setup wrong speed on wireless interface.
+++++++++++++
gate-ct672#sh dot11 ass 6e72.5161.a46c | i ates Supported Rates : 1.0 2.0 5.5 6.0 9.0 11.0 12.0 18.0 24.0 36.0 48.0 54.0 Duplicates Rcvd : 11086 Data Retries : 23818 gate-ct672# gate-ct672# gate-ct672# gate-ct672# gate-ct672#sh runn int do 0 | i speed speed 1.0 2.0 5.5 6.0 9.0 11.0 12.0 basic-18.0 24.0 36.0 48.0 54.0 gate-ct672#
+++++++++++++
What do you think?
... View more
08-16-2018
07:56 AM
Hi Leo.
sh controllers do 0 output following (sorry for long output):
++++++++++
interface Dot11Radio0 Radio ATHEROS AR5212, Base Address 0017.df12.b8c0, BBlock version 0.01, Software version 3.00.0 Serial number: FOC1028558S Number of supported simultaneous BSSID on Dot11Radio0: 4 Carrier Set: Americas (US ) Uniform Spreading Required: No Current Frequency: 2412 MHz Channel 1 Allowed Frequencies: 2412(1) 2417(2) 2422(3) 2427(4) 2432(5) 2437(6) 2442(7) 2447(8) 2452(9) 2457(10) 2462(11 Listen Frequencies: Beacon Flags: 0; Beacons are disabled; Probes are disabled Current CCK Power: 20 dBm Allowed CCK Power Levels: 3 4 5 6 7 10 13 15 17 18 20 Current OFDM Power: 17 dBm Allowed OFDM Power Levels: 3 4 5 6 7 10 13 15 17 ERP settings: short slot time. Neighbors in non-erp mode:
Current Rates: 1.0 2.0 5.5 6.0 9.0 11.0 12.0 basic-18.0 24.0 36.0 48.0 54.0 Active Rates: basic-1.0 basic-2.0 basic-5.5 basic-11.0 basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54 0 Allowed Rates: 1.0 2.0 5.5 6.0 9.0 11.0 12.0 18.0 24.0 36.0 48.0 54.0 Best Range Rates: basic-1.0 2.0 5.5 6.0 9.0 11.0 12.0 18.0 24.0 36.0 48.0 54.0 Best Throughput Rates: basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 ba ic-24.0 basic-36.0 basic-48.0 basic-54.0 Default Rates: basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 Radio Management (RM) Configuration: Regular AP RM Mode 1 Temp Setting Disabled Temp Settings: AP Tx Power 0 AP Tx Channel 0 Client Tx Power 0 Rates: Saved Settings: AP Tx Power 0 AP Tx Channel 1 Client Tx Power 0 Rates: Uplink: Done Uplink: stationary, Signal Threshold 70 dBm, Scan Time 20 seconds
MCST RSCs: [0]0x0 [1]0x0 [2]0x0 [3]0x0 [4]0x93ED3 TKIP **bleep** Stats: STA MIC-L-Errs MIC-R-Errs Replay C-Measure 0000.0000.0000 00000000 00000000 00000000 00000000 AES-CCMP **bleep** Stats: 00001122 replays discarded
QBSS Load: 0x0
Configured Local Access Class Parameters
Configured Local Access Class Parameters Background: cw-min 4 cw-max 10 fixed-slot 7 admission-control Off txop 0 BestEffort: cw-min 4 cw-max 10 fixed-slot 2 admission-control Off txop 0 Video : cw-min 3 cw-max 4 fixed-slot 1 admission-control Off txop 3008 Voice : cw-min 4 cw-max 10 fixed-slot 2 admission-control Off txop 1504 Configured Cell Access Class Parameters Background: cw-min 4 cw-max 10 fixed-slot 7 admission-control Off txop 0 BestEffort: cw-min 4 cw-max 10 fixed-slot 2 admission-control Off txop 0 Video : cw-min 3 cw-max 4 fixed-slot 2 admission-control Off txop 3008 Voice : cw-min 4 cw-max 10 fixed-slot 2 admission-control Off txop 1504 Active Access Class Parameters Background: cw-min 4 cw-max 10 fixed-slot 7 admission-control Off txop 0 BestEffort: cw-min 4 cw-max 10 fixed-slot 3 admission-control Off txop 0 Video : cw-min 3 cw-max 4 fixed-slot 2 admission-control Off txop 3008 Voice : cw-min 2 cw-max 3 fixed-slot 2 admission-control Off txop 1504 Transmit queues: Active 506 In Progress 6 ---- Active --- In-Progress --------------- Counts -------------- Cnt Quo Bas Max Cnt Quo Bas Sent Discard Fail Retry Multi Uplink 0 0 0 0 0 0 0 0 0 0 0 0 Voice 0 0 0 0 0 0 0 36162 0 2 206 125 Video 0 0 0 0 0 0 0 0 0 0 0 0 BestEf 1 18 14 18 1 18 4 20525901 22686 188 33439601273639 Multic 0 0 0 0 0 0 0 0 0 0 0 0 Backgr 0 0 0 0 0 0 0 0 0 0 0 0 BSSIDS Index Flags State Next Held Defer NonDefer Clients Tsf Dtim Txq B8C0 0 08 0 0 0 0 0 0 1 0 0 Driver TX blocks in use: 4, high water mark: 118 Driver TX blocks across reset: 0, failure hw mark: 0 PSP packet reclaim count 0 Clients: 8021x auth in prog 1 allowed 0 Client AID VLAN Status Age Tx Mode Rate Encr Key 6e72.5161.a46c 111 0 0001 0000 15/15 10-10 00B1 1EFF 0200 0-16 Client RSC 6e72.5161.a46c [1]0x8F798 Vlan BSSID Clients PSP Encr Key0 Key1 Key2 Key3 SSIDs 0n B8C0 0 0 0 214 x128 0 bssid C0 flags 0 tsfo 0 1 bssid C0 flags 0 tsfo 0 2 bssid C0 flags 0 tsfo 0 3 bssid C0 flags 0 tsfo 0 4 bssid C0 flags 0 tsfo 0 5 bssid C0 flags 0 tsfo 0
6 bssid C0 flags 0 tsfo 0 7 bssid C0 flags 0 tsfo 0 8 bssid C0 flags 0 tsfo 0 9 bssid C0 flags 0 tsfo 0 10 bssid C0 flags 0 tsfo 0 11 bssid C0 flags 0 tsfo 0 12 bssid C0 flags 0 tsfo 0 Transmitted beacon for each BSSID 0: 0 BeaconStuck count for each BSSID 0: 0
Noise Immunity level 0 Spur Immunity Level 0 Firstep Level 0 OFDM Weak Signal Detection OFF CCK Weak Signal Threshold low
Transmit Queue details: Q_ONESHOTARM_SC=0x0 Q_ONESHOTARM_CC=0x0 Q_RDYTIMESHDN=0x0 Q_TXE=0x0, Q_TXD=0x0 Queue Number = 0 ================ Q_TXDP=0x0 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x800 Q_RDYTIMECFG=0x0 Queue Number = 1 ================ Q_TXDP=0xE8C4D20 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x800 Q_RDYTIMECFG=0x0 Desc=0xE8C4D20 FirstDesc=0xE8C4D20, LastDesc=0xE8C4D20, nextPtr=0x0, StaleFlag=TRUE thisPhysPtr=0xE8C4D20 frameLength=166 more=0 destIdx=6 antModeXmit=0x0 bufferLength=156 dataLeng=0 pak=0x865ED988 pktType=0 noAck=0 dataFailCnt=1 RTSFailCnt=0, Filtered=0, fifoUnderrun=0 excessiveRetries=0 pktTransmitOk=1, txAnt=1, finalTSIdx=1 ackSigStrength=33 seqNum=1767, done=1 Queue Number = 2 ================ Q_TXDP=0x0 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x800 Q_RDYTIMECFG=0x0 Queue Number = 3 ================ Q_TXDP=0xE8C5520 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x800 Q_RDYTIMECFG=0x0 Desc=0xE8C5520
FirstDesc=0xE8C5520, LastDesc=0xE8C5520, nextPtr=0x0, StaleFlag=TRUE thisPhysPtr=0xE8C5520 frameLength=137 more=0 destIdx=6 antModeXmit=0x0 bufferLength=135 dataLeng=0 pak=0x84F74604 pktType=0 noAck=0 dataFailCnt=1 RTSFailCnt=0, Filtered=0, fifoUnderrun=0 excessiveRetries=0 pktTransmitOk=1, txAnt=0, finalTSIdx=0 ackSigStrength=33 seqNum=1071, done=1 Queue Number = 4 ================ Q_TXDP=0x0 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x800 Q_RDYTIMECFG=0x0 Queue Number = 5 ================ Q_TXDP=0x0 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x0 Q_RDYTIMECFG=0x0 Queue Number = 6 ================ Q_TXDP=0x0 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x0 Q_RDYTIMECFG=0x0 Queue Number = 7 ================ Q_TXDP=0x0 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x0 Q_RDYTIMECFG=0x0 Queue Number = 8 ================ Q_TXDP=0x0 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x0 Q_RDYTIMECFG=0x0 Queue Number = 9 ================ Q_TXDP=0xE8C5B20 Q_STS=0x0 Q_CBRCFG=0x0 Q_MISC=0x8A2 Q_RDYTIMECFG=0x0 Desc=0xE8C5B20 FirstDesc=0xE8C5B20, LastDesc=0xE8C5B20, nextPtr=0x0, StaleFlag=FALSE thisPhysPtr=0xE8C5B20 frameLength=4 more=0 destIdx=0 antModeXmit=0x0 bufferLength=0 dataLeng=0 pak=0x847F2C54 pktType=3 noAck=1 dataFailCnt=0 RTSFailCnt=0, Filtered=0, fifoUnderrun=0 excessiveRetries=0 pktTransmitOk=0, txAnt=0, finalTSIdx=0 ackSigStrength=0 seqNum=0, done=0 RADAR registers MAC_RX_FILTER = 0x97 MAC_PHY_ERROR = 0x0 PHY_RADAR_0 = 0x5D50E188 MAC Registers === 0x0008: 0x00000004
=== 0x000C: 0x0E8C3DE0 === 0x0010: 0x00000000 === 0x0014: 0x00000105 === 0x0018: 0x00000000 === 0x001C: 0x00000000 === 0x0020: 0x00000000 === 0x0024: 0x00000001 === 0x0028: 0x00000000 === 0x002C: 0x00000000 === 0x0030: 0x00000013 === 0x0034: 0x00000003 === 0x0038: 0x0E8C2CF0 === 0x003C: 0x00000000 === 0x0040: 0x00000001 === 0x0044: 0x00000008 === 0x0048: 0x00000008 === 0x004C: 0x00000010 === 0x0050: 0x00000000 === 0x0054: 0x0000001F === 0x0058: 0x00000000 === 0x005C: 0x009B30B4 === 0x0060: 0x00000000 === 0x0064: 0x00000000 === 0x0068: 0x00000000 === 0x006C: 0x00000000 === 0x0070: 0x00000000 === 0x0074: 0x00000000 === 0x0078: 0x00000000 === 0x007C: 0x00000000 === 0x0080: 0x00001000 === 0x0084: 0x00000000 === 0x0088: 0x00000000 === 0x008C: 0x08000000 === 0x0090: 0x00000000 === 0x0094: 0x00000000 === 0x0098: 0x00000000 === 0x009C: 0x00000000 === 0x00A0: 0x008809F5 === 0x00A4: 0x0000001F === 0x00A8: 0x0000001F === 0x00AC: 0x0000001F === 0x00B0: 0x00000000 === 0x00B4: 0x00000000
QCU Registers === 0x0800: 0x00000000 === 0x0804: 0x0E8C50A0 === 0x0808: 0x00000000 === 0x080C: 0x0E8C5520 === 0x0810: 0x00000000 === 0x0814: 0x00000000 === 0x0818: 0x00000000 === 0x081C: 0x00000000 === 0x0820: 0x00000000 === 0x0824: 0x00000000 === 0x08C0: 0x00000000 === 0x08C4: 0x00000000 === 0x08C8: 0x00000000 === 0x08CC: 0x00000000 === 0x08D0: 0x00000000 === 0x08D4: 0x00000000 === 0x08D8: 0x00000000 === 0x08DC: 0x00000000 === 0x08E0: 0x00000000 === 0x08E4: 0x00000000 === 0x09C0: 0x00000800 === 0x09C4: 0x00000800 === 0x09C8: 0x00000800 === 0x09CC: 0x00000800 === 0x09D0: 0x00000800 === 0x09D4: 0x00000000 === 0x09D8: 0x00000000 === 0x09DC: 0x00000000 === 0x09E0: 0x00000000 === 0x09E4: 0x000008A2
DCU Registers === 0x1000: 0x00000001 === 0x1004: 0x00000002 === 0x1008: 0x00000004 === 0x100C: 0x00000008 === 0x1010: 0x00000010 === 0x1014: 0x00000020 === 0x1018: 0x00000040 === 0x101C: 0x00000080
=== 0x1020: 0x00000100 === 0x1024: 0x00000200 === 0x1028: 0x00000000 === 0x102C: 0x00000000 === 0x1030: 0x00000160 === 0x1034: 0x00000000 === 0x1038: 0x00000000 === 0x103C: 0x00000000 === 0x1040: 0x007FFC0F === 0x1044: 0x002FFC0F === 0x1048: 0x00103C07 === 0x104C: 0x002FFC0F === 0x1050: 0x002FFC0F === 0x1054: 0x002FFC0F === 0x1058: 0x002FFC0F === 0x105C: 0x002FFC0F === 0x1060: 0x002FFC0F === 0x1064: 0x002FFC0F === 0x1068: 0x00000000 === 0x106C: 0x00000000 === 0x1070: 0x0000018C === 0x1074: 0x00000000 === 0x1078: 0x00000000 === 0x107C: 0x00000000 === 0x1080: 0x0008200F === 0x1084: 0x0008200F === 0x1088: 0x0008200F === 0x108C: 0x0008200F === 0x1090: 0x0008200F === 0x1094: 0x00020804 === 0x1098: 0x00020804 === 0x109C: 0x00020804 === 0x10A0: 0x00020804 === 0x10A4: 0x0008200F === 0x10A8: 0x00000000 === 0x10AC: 0x00000000 === 0x10B0: 0x00003E38 === 0x10B4: 0x00000000 === 0x10B8: 0x00000000 === 0x10BC: 0x00000000 === 0x10C0: 0x00000000 === 0x10C4: 0x00000000 === 0x10C8: 0x00100BC0
=== 0x10CC: 0x001005E0 === 0x10D0: 0x001005E0 === 0x10D4: 0x00000000 === 0x10D8: 0x00000000 === 0x10DC: 0x00000000 === 0x10E0: 0x00000000 === 0x10E4: 0x001005E0 === 0x10E8: 0x00000000 === 0x10EC: 0x00000000 === 0x10F0: 0x0000B0E0 === 0x1230: 0x00000000
PCI Registers === 0x4000: 0x00000000 === 0x4004: 0x00000000 === 0x4008: 0x00000000 === 0x400C: 0x00000000 === 0x4010: 0x00000014 === 0x4014: 0x00000000 === 0x4018: 0x00000000 === 0x401C: 0x00000000 === 0x4020: 0x00000059 === 0x4024: 0x00000000 === 0x4028: 0x00000000 === 0x402C: 0x000003FF === 0x4030: 0x00000000
Eeprom Registers === 0x6000: 0x00000000 === 0x6004: 0x00000000 === 0x6008: 0x00000000 === 0x600C: 0x00000000 === 0x6010: 0x00000000
PCU Registers === 0x8000: 0x12DF1700 === 0x8004: 0x3880C0B8 === 0x8008: 0x6151726E === 0x800C: 0x00006CA4 === 0x8010: 0x00000000 === 0x8014: 0x08400840 === 0x8018: 0x00000700 === 0x801C: 0x12E013AB
=== 0x801C: 0x12E013AB === 0x8020: 0x00000065 === 0x8024: 0x001FD9FF === 0x8028: 0x0000A4A2 === 0x802C: 0x00052500 === 0x8030: 0x00EE3260 === 0x8034: 0x0000A5BF === 0x8038: 0x0000FFFB === 0x803C: 0x00000097 === 0x8040: 0xBD7BDCB7 === 0x8044: 0x7FDFE7FF === 0x8048: 0x00000000 === 0x804C: 0x169671D9 === 0x8050: 0x00000050 === 0x8054: 0x00033FF8 === 0x8058: 0x00000001 === 0x805C: 0xFFFFC78F === 0x8060: 0x0000000F
BB Registers === 0x9800: 0x00000007 === 0x9804: 0x00000000 === 0x9808: 0x00000000 === 0x980C: 0xAD848E19 === 0x9810: 0x7D28E000 === 0x9814: 0xA9D27F6B === 0x9818: 0x00000043 === 0x981C: 0x00000001 === 0x9820: 0x02020200 === 0x9824: 0x00000E0E === 0x9828: 0x0A020201 === 0x982C: 0x0002A002 === 0x9830: 0x00000000 === 0x9834: 0x00000E0E === 0x9838: 0x0000000B === 0x983C: 0x00020100 === 0x9840: 0x206A017A === 0x9844: 0x137219A2 === 0x9848: 0x0019EA75 === 0x984C: 0x80C0613C === 0x9850: 0x0C98B0E0 === 0x9854: 0x00000859 === 0x9858: 0x7EC80D2E
=== 0x993C: 0x0000003C === 0x9940: 0x00000004 === 0x9944: 0xF7B81010 === 0x9948: 0x9280B212 === 0x994C: 0x00080F40 === 0x9950: 0x00000000 === 0x9954: 0x5D50E188 === 0x9958: 0x000000FF === 0x995C: 0x004B6A8E === 0x9960: 0x02082481 === 0x9964: 0x01041442 === 0x9968: 0x000003FF === 0x996C: 0x00000000 === 0x9970: 0x192FB515 === 0x9C00: 0x00000000 === 0x9C04: 0xDEAF84DB === 0x9C08: 0x000006EA === 0x9C0C: 0x00007D17 === 0x9C10: 0xC893067C === 0x9C14: 0xC944F68C === 0x9C18: 0xFBB9F9D4 === 0x9C1C: 0x00000010 Log Buffer:
++++++++++
... View more
Created by
Andriy Sidko
in Other Network Architecture Subjects
02-13-2019 09:23 AM
02-13-2019 09:23 AM
ok. config looks like this now: gate(config)#do sh runn | s dhcpip dhcp
binding cleanup interval 300...
Created by
Andriy Sidko
in Other Network Architecture Subjects
02-13-2019 07:54 AM
02-13-2019 07:54 AM
i took a look at post. It seems nothing related to issue I have.what do
you think if I upgrade route...
Created by
Andriy Sidko
in Other Network Architecture Subjects
02-12-2019 01:16 PM
02-12-2019 01:16 PM
Hi guys. I have C891FW router acting as DHCP server for lan clients
(vlan11) I put following configu...
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
12-21-2018 10:10 AM
12-21-2018 10:10 AM
Hi guys.I'd like to enable 300 for n mode clients (they are not not ac
compatible) at autonomous acc...
Created by
Andriy Sidko
in Firewalls
11-07-2018 06:56 AM
11-07-2018 06:56 AM
Hello. My router x.x.x.x utilizing CBAC time to time drops packets from
y.y.y.y to x.x.x.x x.x.x.x i...
Created by
Andriy Sidko
in VPN and AnyConnect
10-22-2018 07:27 AM
10-22-2018 07:27 AM
It's been duplicated OSPF ID key issue. This issue resolved.
Created by
Andriy Sidko
in VPN and AnyConnect
10-19-2018 08:45 AM
10-19-2018 08:45 AM
Hi guys. I'm hitting wield issue with OSPF via DVTI VPN. Whenever VPN
established I got OSPF routing...
Created by
Andriy Sidko
in Switching
10-11-2018 10:09 AM
10-11-2018 10:09 AM
disregard initial question please. I've found solution.
10-11-2018 06:12 AM
Hi guys. I have network like: nexus 5k (core&distribution) -VPC53, po53
-> enterasys access switch s...
10-02-2018 11:04 AM
Hi guys. I need to implement following scenario: When inside computer
192.168.172.20/28 opens connec...
Created by
Andriy Sidko
in VPN and AnyConnect
10-01-2018 07:06 AM
10-01-2018 07:06 AM
hi guys. I have HUB in head office and many small offices connected via
DVTI VPN (IKEV2) to HUB. yes...
Created by
Andriy Sidko
in Firewalls
09-28-2018 08:15 AM
09-28-2018 08:15 AM
Thank you Joel. commands bellow made the trick: no access-list
data_access_in extended permit tcp ob...
09-28-2018 07:25 AM
i guys. History: I got notification from IT security team that one
computer in subnet 10.244.244.0/2...
08-17-2018 06:50 AM
my side router is Cisco 877W + latest 3 years old image:
C870-ADVIPSERVICESK9-M), Version 15.1(4)M10...
Public Statistics
| Date Registered | 04-06-2010 11:33 AM |
| Date Last Visited | 04-09-2019 07:38 AM |
| Total Messages Posted | 61 |
| Total Helpful Votes Received | 5 |
