Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About davebornack
Stats
Member since
03-14-2005
52
Posts
8
Helpful
0
Solutions
04-06-2015
11:13 AM
Thanks, found it! OK, guys, thank you much for checking this out for me.
... View more
04-04-2015
10:25 AM
What is the band select command? I can't seem to find it, or a reference for it.
... View more
04-02-2015
01:55 PM
Yep.. already aware of that. Just want to make sure I'm set up correctly on the AP side. If I can't do anything about my adapter, then so be it.
... View more
03-01-2015
11:57 AM
OK, so technically, I'm not doing anything to prioritize these packets, and my config is incomplete? What I'm gathering form your answer is that I need to apply these to an interface, along with bandwidth guarantees and/or priorities? My end goal I guess, is to just make sure these packets get processed in the priority that I set them to. I'm not caring so much about bandwidth, as that I just want the higher priority traffic to have priority, packet-wise. I completely understand what I need to do to get this traffic prioritized inbound/return. Thanks. My apologies, but I'm not great at understanding how QoS.works.
... View more
02-28-2015
02:08 PM
Keep in mind this isn't the entire config, but can I just QoS based on ip access-lists and matching class/policy maps alone, or do I need to dig way deeper? Also, is QoS bi-directional in this case (return traffic also treated the same)? Or do I need ACLs for both ways? ip access-list extended CItrix permit tcp any any eq 1494 permit tcp any any eq 2598 class-map match-any Citrix match access-group name Citrix Policy-map QOS class Citrix set dscp af21 Thanks!!
... View more
Labels:
02-25-2015
09:00 AM
Still can't get this working for some reason. FOr the sake of getting this up quickly, I'll post the real config... anything?
global (outsidesw1) 215 192.235.87.15
nat (insidesw1) 215 access-list policy-nat
access-list InfoHedge extended permit ip 172.16.212.0 255.255.255.0 10.100.90.0 255.255.255.0 access-list policy-nat extended permit ip 172.16.212.0 255.255.255.0 10.100.90.0 255.255.255.0
crypto ipsec transform-set InfoHedge esp-3des esp-none
crypto map L2L_VPN 3 match address InfoHedge crypto map L2L_VPN 3 set pfs crypto map L2L_VPN 3 set peer 74.220.80.15 crypto map L2L_VPN 3 set transform-set InfoHedge crypto map L2L_VPN interface outsidesw1
isakmp identity address isakmp enable outsidesw1
isakmp policy 215 authentication pre-share isakmp policy 215 encryption 3des isakmp policy 215 hash sha isakmp policy 215 group 2 isakmp policy 215 lifetime 86400
tunnel-group 74.220.80.15 type ipsec-l2l
tunnel-group 74.220.80.15 ipsec-attributes
pre-shared-key ****
... View more
02-24-2015
10:57 AM
Awesome, I figured it was more difficult than that. I had more config planned that this, but I already basically have this in what I drafted. One more question.. I'm creating separate ACLs for interesting traffic for the VPN. Those are being referenced in the Crypto and ISAKMP config. The above is just the NAT, and won't have anything to do with the tunnel, correct?
... View more
02-24-2015
10:36 AM
Hey guys.. having issues taking my current knowledge and applying it to an old ASA running 7.x. Basically I want to perform the following: - Any Traffic sourced from 192.168.1.0/24 - Destined for 10.100.90.0/24 (Over an established VPN Tunnel) - Needs to be sourced from a specific address/ProxyID (1.2.3.4) Translated destination is Original Address How on earth do we do this in ASA 7.x? Thanks much for any help
... View more
Labels:
10-20-2014
01:45 PM
Can you post a config, or at least the ACLs that you have for either of those networks? You may need to enable logging on those particular ACLs in order for me/us to figure out why these are being denied. See this about turning logging on. It will give your logs more information, including which ACL is denying these packets http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/acl_logging.pdf
... View more
10-20-2014
01:37 PM
I'm pretty sure you can't use the MGMT port for failover functions. I would recommend that you use LAN-based failover using one of the "inline" interfaces that passes traffic, or if you have enough ports available, configure one just for failover operations.
... View more
Created by
davebornack
in Policy and Access
in Policy and Access
04-25-2013
09:16 AM
04-25-2013
09:16 AM
I'm thinking this is possible, but I just can't figure out how to set it up. Obviously I can group devices together however I want, but can I apply an Identity Store Sequence to one group of devices, and a different sequence to another group of devices? Thanks!!
... View more
Labels:
04-01-2013
10:24 AM
Right.. we know the problem exists there, but not sure why. Switch side is showing flaps every hour or two.. We're going to go through the entire path and replace everything tonight.. (cables, SFPs, patch panels, etc)
... View more
04-01-2013
10:11 AM
Here is sho fail state, along with relevant show int NY5ASADAT01# sho fail state State Last Failure Reason Date/Time This host - Secondary Active Ifc Failure 19:04:31 CDT Mar 28 2013 inside: Failed Other host - Primary Standby Ready Ifc Failure 06:17:45 CDT Apr 1 2013 inside: Failed ====Configuration State=== Sync Done Sync Done - STANDBY ====Communication State=== Mac set NY5ASADAT01# sho int Interface GigabitEthernet0/0 "Bloomberg", is up, line protocol is up Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps) Input flow control is unsupported, output flow control is off MAC address 0006.f62b.a5b7, MTU 1500 IP address 192.168.20.3, subnet mask 255.255.255.0 4120246861 packets input, 1370969656777 bytes, 0 no buffer Received 110 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 pause input, 0 resume input 0 L2 decode drops 2399153103 packets output, 207914420418 bytes, 0 underruns 0 pause output, 0 resume output 0 output errors, 0 collisions, 4 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops input queue (blocks free curr/low): hardware (477/431) output queue (blocks free curr/low): hardware (511/468) Traffic Statistics for "Bloomberg": 984151458 packets input, 291215187218 bytes 574218817 packets output, 36547292886 bytes 6801 packets dropped 1 minute input rate 3635 pkts/sec, 1126656 bytes/sec 1 minute output rate 2081 pkts/sec, 128221 bytes/sec 1 minute drop rate, 0 pkts/sec 5 minute input rate 3791 pkts/sec, 1224242 bytes/sec 5 minute output rate 2171 pkts/sec, 138509 bytes/sec 5 minute drop rate, 0 pkts/sec Interface GigabitEthernet0/1 "inside", is up, line protocol is up Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec Full-Duplex(Full-duplex), 1000 Mbps(1000 Mbps) Input flow control is unsupported, output flow control is off MAC address 0006.f62b.a5b3, MTU 1500 IP address 10.20.12.250, subnet mask 255.255.255.0 2405260026 packets input, 208355843428 bytes, 0 no buffer Received 321084 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 pause input, 0 resume input 0 L2 decode drops 4130727262 packets output, 1372552267221 bytes, 255 underruns 0 pause output, 0 resume output 0 output errors, 0 collisions, 7 interface resets 0 late collisions, 0 deferred 0 input reset drops, 768 output reset drops input queue (blocks free curr/low): hardware (469/448) output queue (blocks free curr/low): hardware (509/461) Traffic Statistics for "inside": 575054447 packets input, 36589063815 bytes 986282970 packets output, 291519926771 bytes 695436 packets dropped 1 minute input rate 2082 pkts/sec, 128269 bytes/sec 1 minute output rate 3637 pkts/sec, 1126900 bytes/sec 1 minute drop rate, 0 pkts/sec 5 minute input rate 2172 pkts/sec, 138556 bytes/sec 5 minute output rate 3793 pkts/sec, 1224581 bytes/sec 5 minute drop rate, 0 pkts/sec Interface GigabitEthernet0/7 "failover", is up, line protocol is up Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps) Input flow control is unsupported, output flow control is off Description: LAN/STATE Failover Interface MAC address 30f7.0d47.a017, MTU 1500 IP address 192.168.254.2, subnet mask 255.255.255.252 10674509 packets input, 2901999368 bytes, 0 no buffer Received 310 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 pause input, 0 resume input 0 L2 decode drops 55784212 packets output, 54562374044 bytes, 0 underruns 0 pause output, 0 resume output 0 output errors, 0 collisions, 6 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops input queue (blocks free curr/low): hardware (486/458) output queue (blocks free curr/low): hardware (455/334) Traffic Statistics for "failover": 2168497 packets input, 1234830690 bytes 8052935 packets output, 7748660590 bytes 1 packets dropped 1 minute input rate 1 pkts/sec, 118 bytes/sec 1 minute output rate 32 pkts/sec, 35048 bytes/sec 1 minute drop rate, 0 pkts/sec 5 minute input rate 1 pkts/sec, 117 bytes/sec 5 minute output rate 32 pkts/sec, 35040 bytes/sec 5 minute drop rate, 0 pkts/sec
... View more
04-02-2015
Yep.. already aware of that. Just want to make sure I'm set up correctly
on the AP side. If I can't ...
03-01-2015
OK, so technically, I'm not doing anything to prioritize these packets,
and my config is incomplete?...
Created by
davebornack
in Switching
02-28-2015
02-28-2015
Keep in mind this isn't the entire config, but can I just QoS based on
ip access-lists and matching ...
02-25-2015
Still can't get this working for some reason. FOr the sake of getting
this up quickly, I'll post the...
02-24-2015
Awesome, I figured it was more difficult than that. I had more config
planned that this, but I alrea...
Created by
davebornack
in Firewalls
02-24-2015
02-24-2015
Hey guys.. having issues taking my current knowledge and applying it to
an old ASA running 7.x. Basi...
10-20-2014
Can you post a config, or at least the ACLs that you have for either of
those networks?You may need ...
10-20-2014
I'm pretty sure you can't use the MGMT port for failover functions. I
would recommend that you use L...
04-25-2013
I'm thinking this is possible, but I just can't figure out how to set it
up.Obviously I can group de...
04-01-2013
Right.. we know the problem exists there, but not sure why.Switch side
is showing flaps every hour o...
Public Statistics
| Date Registered | 03-14-2005 09:17 AM |
| Date Last Visited | 08-18-2017 04:00 AM |
| Total Messages Posted | 52 |
| Total Helpful Votes Received | 8 |
.jpg "Hall of Fame Guru"){kind=icon}
