Hi guys. I'm configuring cisco 891w universal workgroup group bridge mode to non-cisco access point (MAC c24a.0040.9f36). This non-cisco access point has no filtering or other limitations. (it just performing WPA2/PSK)   c891w access point module successfully associated & authenticated with non-cisco access point ++++++++++++++++++++ gate-ap(config-if)#int do 0 gate-ap(config-if)#do sh ip int bri gate-ap(config-if)# no ssid a81m-guest gate-ap(config-if)# gate-ap(config-if)# ssid a81m-guest gate-ap(config-if)# *Mar 1 00:17:06.903: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up *Mar 1 00:17:06.907: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP c24a.0040.9f36 [None WPAv2 PSK] *Mar 1 00:17:07.903: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up *Mar 1 00:17:13.179: %DHCP-6-ADDRESS_ASSIGN: Interface BVI70 assigned DHCP address 192.168.172.54, mask 255.255.255.248, hostname gate-ap gate-ap(config-if)# ++++++++++++++++++++ leased IP assigned to access point int bvi70 ++++++++++++++++++++ gate-ap#sh ip int bri Interface IP-Address OK? Method Status Protocol BVI1 10.2.2.2 YES NVRAM up up BVI70 192.168.172.54 YES DHCP up up Dot11Radio0 unassigned YES NVRAM up up Dot11Radio0.70 unassigned YES unset up up Dot11Radio1 unassigned YES NVRAM administratively down down GigabitEthernet0 unassigned YES NVRAM up up GigabitEthernet0.70 unassigned YES unset up up Virtual-Dot11Radio0 unassigned YES unset up up Virtual-Dot11Radio0.70 unassigned YES unset up up gate-ap# ++++++++++++++++++++ from router module I see embedded access point MACs have been learned via interface wlan-g 0, native vlan70 ++++++++++++++++++++ gate#sh mac-address-table Destination Address Address Type VLAN Destination Port ------------------- ------------ ---- -------------------- 7426.ac22.7930 Self 1 Vlan1 7426.ac22.7930 Self 10 Vlan10 7426.ac22.7930 Self 60 Vlan60 0000.0ce0.cff4 Dynamic 70 Wlan-GigabitEthernet0 00ed.b184.2174 Dynamic 70 Wlan-GigabitEthernet0 2c54.2dba.136e Dynamic 70 Wlan-GigabitEthernet0 7426.ac22.7930 Self 70 Vlan70 74a2.e6fd.dfe0 Dynamic 70 Wlan-GigabitEthernet0 gate# ++++++++++++++++++++ where MAC 00ed.b184.2174 is access point BVI70 ++++++++++++++++++++ gate-ap#sh int bvi70 | i up|bia BVI70 is up, line protocol is up Hardware is BVI, address is 00ed.b184.2174 (bia 2c54.2dba.136e) gate-ap# ++++++++++++++++++++ So, I assume. logical interconnection between router and access point modules setup correctly. from router module I see same subnet IP (192.168.172.50) assigned to interface vlan 70 (because c891w access point module interface bvi 70 has ip helper pointing to DHCP server behing non-cisco DHCP access point) ++++++++++++++++++++ 000039: *Jun 14 08:29:37: %DHCP-6-ADDRESS_ASSIGN: Interface Vlan70 assigned DHCP address 192.168.172.50, mask 255.255.255.248, hostname gate gate# ++++++++++++++++++++ from access point module I can ping dfault gateway (192.168.172.49) ++++++++++++++++++++ gate-ap#ping 192.168.172.49 re 10 Type escape sequence to abort. Sending 10, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: !!!!!!!!!! Success rate is 100 percent (10/10), round-trip min/avg/max = 1/2/4 ms gate-ap# ++++++++++++++++++++ but from router module I cannot ping default gateway 192.168.172.49 but I can ping access point module 192.168.172.54 ++++++++++++++++++++ gate#p 192.168.172.49 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: .... Success rate is 0 percent (0/4) gate#p 192.168.172.54 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.54, timeout is 2 seconds: !!!! Success rate is 100 percent (4/4), round-trip min/avg/max = 1/1/4 ms gate# ++++++++++++++++++++   even adding static arp entry to access point module bridge 70 for router module vlan 70 (and same static arp from vla70 toward to bvi70) doesen't work. I still cannot ping default gateway from 891w router interface   ++++++++++++++++++++ gate#sh int vlan 70 | i bia Hardware is EtherSVI, address is 7426.ac22.7930 (bia 7426.ac22.7930) gate# gate-ap(config)#bridge 70 address 7426.ac22.7930 forward gi 0 gate-ap(config)# gate-ap(config)#do sh ip arp | i 49 Internet 192.168.172.49 128 74a2.e6fd.dfe0 ARPA BVI70 gate-ap(config)# gate-ap(config)#do sh ip arp | i 49 Internet 192.168.172.49 128 74a2.e6fd.dfe0 ARPA BVI70 gate-ap(config)# gate(config)#arp 192.168.172.49 7426.ac22.7948 arpa gate(config)# gate(config)#do pin 192.168.172.49 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: .... Success rate is 0 percent (0/4) gate(config)# ++++++++++++++++++++ Could somebody suggest what I'm doing wrong or how to fix it? c891w router and access point modules configuration attached. Thank you. ... View more

Hi guys. I have setup WGB from cisco 811W to non cisco (openwrt) access point (MAC: c25a.2040.9f36) using c811w following configuration: ++++++++++++++++++++++++++ dot11 vlan-name WIRELESS-UPLINK vlan 70 ! dot11 ssid a81m-guest vlan WIRELESS-UPLINK authentication open authentication key-management wpa version 2 wpa-psk ascii 0 superpupper-password interface Dot11Radio0 encryption vlan WIRELESS-UPLINK mode ciphers aes-ccm ssid a81m-guest station-role workgroup-bridge universal c25a.2040.9f36 interface Dot11Radio0.70 encapsulation dot1Q 70 native no ip route-cache bridge-group 1 interface BVI1 mac-address 00ed.b184.2174 ip address dhcp client-id Dot11Radio0 no ip route-cache ++++++++++++++++++++++++++ session is up: ++++++++++++++++++++++++++ gate881w-2753-ap(config-if)#do sh dot11 ass all Address : c25a.2040.9f36 Name : NONE IP Address : 0.0.0.0 IPv6 Address : :: Gateway Address : 0.0.0.0 Netmask Address : 0.0.0.0 Interface : Dot11Radio 0 Bridge-group : 0 reap_flags_1 : 0x0 ip_learn_type : 0x0 transient_static_i Device : unknown Software Version : NONE CCX Version : NONE Client MFP : Off State : Assoc Parent : - SSID : a81m-guest VLAN : 70 Hops to Infra : -1 Association Id : 1 Tunnel Address : 0.0.0.0 Key Mgmt type : WPAv2 PSK Encryption : AES-CCMP Current Rate : m15- Capability : ShortSlot Supported Rates : 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0-2 m1-2 m2-2 m3-2 m4 m13-2 m14-2 m15-2 Voice Rates : disabled Bandwidth : 20 MHz Signal Strength : -44 dBm Connected for : 22045 seconds Signal to Noise : 53 dB Activity Timeout : 13 seconds Power-save : Off Last Activity : 2 seconds ago Apsd DE AC(s) : NONE Packets Input : 6718 Packets Output : 1137 Bytes Input : 1083992 Bytes Output : 91845 gate881w-2753-ap(config-if)# ++++++++++++++++++++++++++ but no IP address assigned to BVI interface: ++++++++++++++++++++++++++ gate881w-2753-ap(config-if)#do sh ip int bri | i BVI BVI1 unassigned YES DHCP up up gate881w-2753-ap(config-if)# gate881w-2753-ap(config-if)#do sh int bvi 1 | i bia Hardware is BVI, address is 00ed.b184.2174 (bia 6400.f177.b74a) gate881w-2753-ap(config-if)# ++++++++++++++++++++++++++ meantime DHCP router behind foreign access point shows IP assigned to c811w int bvi1 ++++++++++++++++++++++++++ edge02(config-if)do sh ip dhcp bin | i edb1 192.168.172.158 0100.edb1.8421.74 May 30 2019 10:38 AM Automatic edge02(config-if)# ++++++++++++++++++++++++++ foreign access point powered by OpenWRT in dump bridge mode and not filtering any flows (it just performing authentication and autorisation using WPA2, aes-ccmp w/ PSK) ++++++++++++++++++++++++++ May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 IEEE 802.11: authenticated May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 IEEE 802.11: associated (aid 12) May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: AP-STA-CONNECTED 00:ed:b1:84:21:74 May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 RADIUS: starting accounting session 37D4323865C52E9C May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 WPA: pairwise key handshake completed (RSN) ++++++++++++++++++++++++++ whenever I connect from Windows 7 x64 computer to same SSID a81m-guest using same PSK it gets assigned IP address and unrestricted access to internet. ipconfig /all output from windows 7 computer joined a81m-guest: +++++++++++++++++ Wireless LAN adapter Wi-Fi: Connection-specific DNS Suffix . : st1.net Description . . . . . . . . . . . : Qualcomm Atheros AR9485 Wireless Network Adapter Physical Address. . . . . . . . . : 14-CC-20-2D-E4-49 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.173.132(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.254.0 Lease Obtained. . . . . . . . . . : Monday, May 29, 2019 6:07:44 PM Lease Expires . . . . . . . . . . : Tuesday, May 30, 2019 6:07:44 AM Default Gateway . . . . . . . . . : 192.168.173.254 DHCP Server . . . . . . . . . . . : 192.168.173.254 DNS Servers . . . . . . . . . . . : 192.168.172.9 192.168.172.27 +++++++++++++++++ Could somebody explain what I did wrong?   Thank you in advance.   p.s. 811w router access point module configuration attached. ... View more

Hi guys.   I have Cisco 881gw w/ embedded wireless access point. I configured two bridges between ap and router modules like: - BVI1 access point control plane link 10.1.1.4/30, where: 10.1.1.5 - router bvi1, 10.1.1.6 - access point bvi1 - BVI7 - data plane link between AP and router modules - 10.1.1.8/30, where:  router bvi7, 10.1.1.9 - access point bvi7 - 10.1.1.10 ping ap bvi1 & 7 from router module failed meantime I see arp ently for AP bvi 1 only: +++++++++++ gate(config)#do ping 10.1.1.6 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.1.6, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) gate(config)#do ping 10.1.1.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.1.10, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) gate(config)#do sh ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.1.5 - 30e4.db20.d3d0 ARPA BVI1 Internet 10.1.1.6 0 6400.f177.b74a ARPA BVI1 Internet 10.1.1.9 - 0000.0cb6.2f28 ARPA BVI7 Internet 10.1.1.10 0 Incomplete ARPA gate(config)# +++++++++++ configurations attached.   Could somebody help? Thank you.   p.s. attached configuration is very simple. I'm truing to setup two bridge only BVI1 for management link to router module and BVI7 for future wireless link from int do0.7 p.p.s most suspicious (for me) thing is: ping fails from both sides but router see ap mac but not vice versa: router side: ++++++++++++++ gate#pin 10.1.1.6 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.6, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate#pin 10.1.1.10 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.10, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate#sh ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.1.5 - 30e4.db20.d3d0 ARPA BVI1 Internet 10.1.1.6 0 6400.f177.b74a ARPA BVI1 Internet 10.1.1.9 - 0000.0cb6.2f28 ARPA BVI7 Internet 10.1.1.10 1 6400.f177.b74a ARPA BVI7 gate# ++++++++++++++ AP side:   ++++++++++++++ gate-ap(config-subif)#do pin 10.1.1.5 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.5, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate-ap(config-subif)#do pin 10.1.1.9 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.9, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate-ap(config-subif)#do sh ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.1.5 0 Incomplete ARPA Internet 10.1.1.6 - 6400.f177.b74a ARPA BVI1 Internet 10.1.1.9 0 Incomplete ARPA Internet 10.1.1.10 - 6400.f177.b74a ARPA BVI7 gate-ap(config-subif)# ++++++++++++++   ... View more

Hi guys. I have router c881GN w/ embedded AP but I cannot ping AP from router and vise wersa. Could you suggest what is wrong with router & ap modules configurations bellow? router: ++++++++ vlan 7 name APMGR ! interface wlan-ap0 description Service module interface to manage the embedded AP ip unnumbered Vlan7 ! interface Wlan-GigabitEthernet0 description Internal switch interface connecting to the embedded AP switchport trunk native vlan 7 switchport mode trunk no ip address ! interface Vlan7 description -= ip for AP management =- ip address 10.1.1.1 255.255.255.252 ! embedded ap: ++++++++ dot11 ssid a81m-guest vlan 2 authentication open authentication key-management wpa version 2 wpa-psk ascii 0 supper-pupper-password@! bridge irb interface Dot11Radio0 description -= outside WBR 2 management AP =- no ip address no ip route-cache ! encryption vlan 2 mode ciphers aes-ccm ! ssid a81m-guest ! antenna gain 0 speed basic-1.0 basic-2.0 basic-5.5 basic-11.0 basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36 .0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. power local cck 15 power client 20 packet retries 24 drop-packet station-role non-root beacon period 101 beacon dtim-period 1 world-mode dot11d country-code CA outdoor no cdp enable bridge-group 1 ! interface Dot11Radio0.2 encapsulation dot1Q 2 no ip route-cache bridge-group 2 bridge-group 2 spanning-disabled bridge-group 2 block-unknown-source no bridge-group 2 source-learning ! interface GigabitEthernet0 description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router no ip address no ip route-cache ! interface GigabitEthernet0.2 encapsulation dot1Q 2 no ip route-cache bridge-group 2 bridge-group 2 spanning-disabled no bridge-group 2 source-learning ! interface GigabitEthernet0.7 encapsulation dot1Q 7 native no ip route-cache bridge-group 1 bridge-group 1 spanning-disabled no bridge-group 1 source-learning ! interface BVI1 ip address 10.1.1.2 255.255.255.252 no ip route-cache interface BVI2 ip address dhcp no ip route-cache ! ip default-gateway 10.1.1.1 bridge 1 protocol ieee bridge 1 route ip bridge 2 protocol ieee bridge 2 route ip both router and AP modules boot w/o erors, inerfaces vlan7, Wlan-Gig0 and wlan-ap0 are UP/UP AP and router modules can ping itself but NOT eachother: AP +++++++++ gate-ap#ping 10.1.1.2 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds: !!! Success rate is 100 percent (3/3), round-trip min/avg/max = 1/2/4 ms gate-ap#ping 10.1.1.1 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate-ap# router +++++++++ gate#ping 10.1.1.1 rep 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds: !!! Success rate is 100 percent (3/3), round-trip min/avg/max = 1/1/1 ms gate#ping 10.1.1.2 rep 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate# logs for both modules don't have any related info. Any ideas? Thank you. ... View more

Hi guys.   I have  C891FW router acting as DHCP server for lan clients (vlan11)  I put following configuration: ++++++++++++++++++ ip dhcp binding cleanup interval 300 ip dhcp excluded-address 192.168.172.1 192.168.172.18 ip dhcp excluded-address 192.168.172.0 192.168.172.17 ip dhcp excluded-address 192.168.172.31 192.168.172.255 ip dhcp ping timeout 150 ip dhcp pool wifipool import all utilization mark high 80 log network 192.168.172.16 255.255.255.240 default-router 192.168.172.17 domain-name st1.net option 150 ip 192.168.172.2 dns-server 192.168.172.9 192.168.172.2 lease 1 3 30 ip dhcp snooping vlan 11 ip dhcp snooping ++++++++++++++++++   time to time all clients (it happening different for every clients) lost/cannot renew IP assigned by DHCP (gettig self assigned 169.254.x.x)   force clients manually re-obtain IP resolve issue till next time.   Thank you in advance.   p.s. time whenever issue is happening random. p.p.s router running IOS c800-universalk9-mz.SPA.154-3.M10.bin   ... View more

Hi guys. I'd like to enable 300 for n mode clients (they are not not ac compatible) at autonomous access point CAP3702e. I applied followin configuration: ++++++++++ dot11 vlan-name a81m vlan 11 dot11 ssid a81m vlan 11 authentication open eap EAP_METHODS authentication network-eap EAP_METHODS authentication key-management wpa version 2 mbssid guest-mode interface Dot11Radio0 no ip address no ip route-cache ! encryption vlan 11 mode ciphers aes-ccm ! ! encryption mode ciphers aes-ccm ! ssid a81m ! ! antenna gain 0 stbc mbssid speed basic-6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23. channel least-congested 2437 2462 station-role root no cdp enable bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding interface Dot11Radio0.11 encapsulation dot1Q 11 no ip route-cache no cdp enable bridge-group 2 bridge-group 2 subscriber-loop-control bridge-group 2 spanning-disabled bridge-group 2 block-unknown-source no bridge-group 2 source-learning no bridge-group 2 unicast-flooding interface Dot11Radio1 no ip address no ip route-cache shutdown ! encryption vlan 11 mode ciphers aes-ccm ! ssid a81m ! antenna gain 0 peakdetect dfs band 3 block stbc mbssid speed basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23. a1ss9 a2ss9 a3ss9 channel width 40-below channel dfs station-role root no cdp enable bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding interface Dot11Radio1.11 encapsulation dot1Q 11 no ip route-cache no cdp enable bridge-group 2 bridge-group 2 subscriber-loop-control bridge-group 2 spanning-disabled bridge-group 2 block-unknown-source no bridge-group 2 source-learning no bridge-group 2 unicast-flooding interface GigabitEthernet0 description -= .1q trunk to gate's gi6 - private VLAN 11 =- no ip address no ip route-cache duplex auto speed auto ! ! interface GigabitEthernet0.11 description -= private wireless subnet 192.168.172.16/28 =- encapsulation dot1Q 11 no ip route-cache bridge-group 2 no bridge-group 2 spanning-disabled no bridge-group 2 source-learning ! interface BVI1 description -= management subnet 192.168.172.0/28 =- mac-address e865.1998.2fc4 ip address 192.168.172.11 255.255.255.240 no ip route-cache ! interface BVI2 description -= private wireless subnet 192.168.172.16/28 =- mac-address 0005.4938.23c6 no ip address no ip route-cache ++++++++++ as results. whenever GN clients joined AP, successfully authenticated but getting just 150 mpbs. I tried to setup "aXssXX" parameters for interface Dot11Radio0 but there is no options to do that. Could you suggest? p.s. interface bvi1 is AP management link. Thank you. ... View more

Hello.   My router x.x.x.x utilizing CBAC time to time drops packets from y.y.y.y to x.x.x.x x.x.x.x is writes following in log file: +++++++++ Nov 7 01:01:47 gate.sta17.net 998275: Nov 7 01:01:46: %FW-6-DROP_PKT: Dropping tcp session x.x.x.x:55802 y.y.y.y:443 due to RST inside current window with ip ident 24576 tcpflags 0x5014 seq.no 2217371408 ack 3597684402 +++++++++ gate router config looks like: +++++++++ gate(config)#do sh runn | s ip inspect ip inspect log drop-pkt ip inspect audit-trail ip inspect max-incomplete high 10000 ip inspect max-incomplete low 8900 ip inspect one-minute low 8900 ip inspect one-minute high 10000 ip inspect udp idle-time 360 ip inspect dns-timeout 20 ip inspect tcp idle-time 7200 ip inspect tcp finwait-time 32 ip inspect tcp max-incomplete host 800 block-time 0 ip inspect tcp reassembly queue length 1024 ip inspect tcp reassembly timeout 120 ip inspect tcp reassembly memory limit 512000 ip inspect tcp reassembly alarm on ip inspect name DIAL_OUT ftp alert on audit-trail off timeout 120 ip inspect name DIAL_OUT router alert on audit-trail off timeout 120 ip inspect name DIAL_OUT tcp alert on audit-trail off timeout 120 ip inspect name DIAL_OUT udp alert on audit-trail off timeout 120 ip inspect name DIAL_OUT rtsp alert on audit-trail off timeout 120 +++++++++ where interface gi8 is outside one connected to ISP: +++++++++ gate(config)#do sh ip inspec inter Interface Configuration Interface GigabitEthernet8 Inbound inspection rule is not set Outgoing inspection rule is DIAL_OUT ftp alert is on audit-trail is off timeout 120 router alert is on audit-trail is off timeout 120 tcp alert is on audit-trail is off timeout 120 udp alert is on audit-trail is off timeout 120 rtsp alert is on audit-trail is off timeout 120 Inbound access list is DI_IN Outgoing access list is not set gate(config)# +++++++++   Could you suggest what wrong with config above? Also please suggest how to exclude IP y.y.y.y from x.x.x.x's CBAC inspection?   Thank you. Thank you. ... View more