Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Damir Reic
Stats
Member since
11-23-2011
80
Posts
0
Helpful
0
Solutions
01-30-2018
02:52 AM
Were you able to deploy this in the end? I have same problem, I have VTI tunnel up but now not sure what is the IP of other end of the VTI tunnel that's on the Azure side.
... View more
Created by
Damir Reic
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2018
09:41 AM
01-29-2018
09:41 AM
It's what's available in GNS3 😊. It was either that or my host, I can try replacing the PC with another router and see what happens. But now you see why I am confused and frustrated :D
... View more
Created by
Damir Reic
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2018
07:22 AM
01-29-2018
07:22 AM
10.51.0.0/24 is Tunnel network directly connected to both R1 and R2 so they should both know where is it. When packet from VPC1 comes to R1, R1 knows where is it and should just route packet to int Tunnel0. R2 has a returning route so I don't really know what's the problem.
... View more
Created by
Damir Reic
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2018
03:32 AM
01-29-2018
03:32 AM
R1:
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key Cisco12345 address 0.0.0.0
!
!
crypto ipsec transform-set T1 esp-3des esp-sha-hmac
mode tunnel
!
crypto ipsec profile P1
set transform-set T1
interface Tunnel0
ip address 10.0.51.203 255.255.255.0
ip ospf mtu-ignore
load-interval 30
tunnel source 10.0.149.203
tunnel mode ipsec ipv4
tunnel destination 10.0.149.217
tunnel protection ipsec profile P1
!
interface FastEthernet0/0
ip address 10.0.35.203 255.255.255.0
duplex full
interface Ethernet2/0
ip address 10.0.149.203 255.255.255.0
duplex full
!
ip route 10.0.36.0 255.255.255.0 Tunnel0
R2
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key Cisco12345 address 0.0.0.0
!
!
crypto ipsec transform-set T1 esp-3des esp-sha-hmac
mode tunnel
!
crypto ipsec profile P1
set transform-set T1
!
interface Tunnel0
ip address 10.0.51.217 255.255.255.0
ip ospf mtu-ignore
tunnel source 10.0.149.217
tunnel mode ipsec ipv4
tunnel destination 10.0.149.203
tunnel protection ipsec profile P1
!
interface FastEthernet0/0
ip address 10.0.36.217 255.255.255.0
duplex full
interface Ethernet2/0
ip address 10.0.149.217 255.255.255.0
duplex full
!
ip route 10.0.35.0 255.255.255.0 Tunnel0
PC1 config:
NAME IP/MASK GATEWAY MAC LPORT RHOST:PORT
PC1 10.0.35.21/24 10.0.35.203 00:50:79:66:68:00 10018 127.0.0.1:10019
fe80::250:79ff:fe66:6800/64
PC1> ping 10.0.51.217
10.0.51.217 icmp_seq=1 timeout
10.0.51.217 icmp_seq=2 timeout
10.0.51.217 icmp_seq=3 timeout
10.0.51.217 icmp_seq=4 timeout
10.0.51.217 icmp_seq=5 timeout
PC1> trace 10.0.51.217
trace to 10.0.51.217, 8 hops max, press Ctrl+C to stop
1 10.0.35.203 4.500 ms 9.395 ms 9.508 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
R1 debug ICMP and Debug IP
*Jan 27 20:21:10.245: IP: tableid=0, s=10.0.35.21 (FastEthernet0/0), d=10.0.51.217 (Tunnel0), routed via FIB
*Jan 27 20:21:10.245: ICMP: time exceeded (time to live) sent to 10.0.35.21 (dest was 10.0.51.217), topology BASE, dscp 0 topoid 0
*Jan 27 20:21:10.249: IP: tableid=0, s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), routed via FIB
*Jan 27 20:21:10.249: IP: s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), len 56, sending
*Jan 27 20:21:10.253: IP: s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), len 56, sending full packet
*Jan 27 20:21:10.253: IP: s=10.0.35.21 (FastEthernet0/0), d=10.0.51.217, len 92, input feature, packet consumed, MCI Check(92), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Jan 27 20:21:10.253: IP: tableid=0, s=10.0.35.21 (FastEthernet0/0), d=10.0.51.217 (Tunnel0), routed via FIB
*Jan 27 20:21:10.253: ICMP: time exceeded (time to live) sent to 10.0.35.21 (dest was 10.0.51.217), topology BASE, dscp 0 topoid 0
*Jan 27 20:21:10.253: IP: tableid=0, s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), routed via FIB
*Jan 27 20:21:10.253: IP: s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), len 56, sending
*Jan 27 20:21:10.253: IP: s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), len 56, sending full packet
*Jan 27 20:21:10.257: IP: s=10.0.35.21 (FastEthernet0/0), d=10.0.51.217, len 92, input feature, packet consumed, MCI Check(92), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Jan 27 20:21:10.265: IP: tableid=0, s=10.0.35.21 (FastEthernet0/0), d=10.0.51.217 (Tunnel0), routed via FIB
*Jan 27 20:21:10.265: ICMP: time exceeded (time to live) sent to 10.0.35.21 (dest was 10.0.51.217), topology BASE, dscp 0 topoid 0
*Jan 27 20:21:10.265: IP: tableid=0, s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), routed via FIB
*Jan 27 20:21:10.265: IP: s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), len 56, sending
*Jan 27 20:21:10.265: IP: s=10.0.35.203 (local), d=10.0.35.21 (FastEthernet0/0), len 56, sending full packet
*Jan 27 20:21:10.265: IP: s=10.0.35.21 (FastEthernet0/0), d=10.0.51.217, len 92, input feature, packet consumed, MCI Check(92), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
... View more
Created by
Damir Reic
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2018
02:52 AM
01-29-2018
02:52 AM
Yes it does. I can ping LAN interface (def gw of pc1) of R1 from R2.
... View more
Created by
Damir Reic
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2018
12:23 AM
01-29-2018
12:23 AM
Hello,
I setup simple lab environment in GNS3 and found interesting problem. Used setup from https://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html#wp1080079(Configuration Examples for IPsec Virtual Tunnel Interface). So in this simple setup, tunnel interface is UP, from the router I can ping everything, but from the server on left and right side I can't ping tunnel endpoint or LAN IP of the other router. I have no idea why, it's totally not logical, servers are using LAN IP as default gateway.
So workstation PC1 can ping tunnel IP on R1 but can't ping tunnel IP on R2. Both ends have proper routes otherwise I wouldn't be able to ping "lan" interface from the router on the other side of the tunnel.
... View more
Labels:
12-04-2017
11:05 AM
Performance update 😊 With SSL inspection enabled Internet craws at 10Mbit. With SSL inspection disabled and rules set to enable file ispection, URL filtering (just few categories) I am getting around 150Mbit over speedtest. With SSL inspection disabled and all traffic set to trust 800Mbits. So yeah, 5506 hardware sux big time.
... View more
11-30-2017
08:37 AM
So to sum up, if rule include services and apps both of those have to mach to pass the user right (logical AND) ?
... View more
11-29-2017
01:25 PM
Yes I have trust rule already for management machine so I don't get myself locked out 😃 . For machines that will experience issues I would rather find the issue and allow it instead of trusting everything from the machine right?
... View more
11-29-2017
12:52 PM
Actually that helped ! So let's say I want to allow Ringcentral (there is no app or service for that). So I created group of subnets. So general order woul be something like that 1. Allow only URL categories I want 2. Allow application SSL,HTTP,HTTPS 3. Allow services 4. Allow any to destination Ips 5. Deny all rest Would ordering be OK ?
... View more
11-29-2017
09:52 AM
That wasn't really my question. When you have services and applications how do you best combine those, what is the best practice? Obviously I couldn't find the answer on that in official docs. I am going to production this weekend so I guess we will find out. I have something setup currently but we will see how much changes would it require to work as expected. Thanks anway!
... View more
11-24-2017
11:25 AM
Hello,
I have experience from PaloAlto L7 filtering and I am trying to mimic the behavior on the FTD but looks like it maybe doesn't work like that. In essence I want to only allow specific apps and deny everything else. The issues that I have on TFD is there is limit of 50 apps per rule which leads me to conclusion since there are over 3000 apps this is not the way to do it. I can make rule by Categories and Groups but then I can't fine grain what exactly do I want to allow. Now since most of the web is on port 80 and 443 where does services come in play? I am confused how to best create rules based on the services, applications and web categories. I didn't find cisco documentation of much use here so maybe someone with 1st hand experience can share what's the best practice to achieve what I want? I for sure want to deny everything at the end since I don't want unknown stuff making connections from inside to outside if app is not recognized by TFD. I don't like the idea of deny what I don't want and allow everything else since some computer can get infected by something and then it might send some sensitive data outside.
... View more
Labels:
07-19-2015
04:49 AM
Hi, I have 3850 configured as edge switch where I run BGP on it. I did not connect MGMT port to our internal mgmt network because of the security concerns. So my concern is if switch somehow gets hacked from the outside (we don't run SSH or HTTP server on it) will the attacker gain access to the MGMT port or not? Is MGMT interface on a separate data plane so there is no possible way to gain controller over with from switch ports? I couldn't find this info in admin guide so i am asking if someone of you knows :). Thank you!
... View more
Labels:
Created by
Damir Reic
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
01-29-2015
07:12 AM
01-29-2015
07:12 AM
Thanks Seve! I'll try it next week and hopefully i'll get appleTV going.
... View more
Created by
Damir Reic
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
01-29-2015
06:05 AM
01-29-2015
06:05 AM
Hello, i have a problem where when AppleTV and other remote clients connect to AP they can't communicate with AppleTV. If ApplTV and clients connect to some other non Cisco AP it works fine. I have no experience with AppleTV so is this maybe a known issue?
... View more
- Tags:
- apple appletv AIR
Public Statistics
| Date Registered | 11-23-2011 07:09 AM |
| Date Last Visited | 08-15-2018 02:19 AM |
| Total Messages Posted | 80 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 49 |
.jpg "Hall of Fame Master"){kind=icon}
