Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About DON BROWN
Stats
Member since
06-11-2013
15
Posts
0
Helpful
0
Solutions
06-17-2017
07:04 PM
Thank you for that prompt reply.
I had seen the post on whirlpool but from what I can see that does not provide the vlan tagging on the wan connection ?
Or am I missing something ?
Thanks
... View more
06-17-2017
05:48 PM
We have a new NBN Internet that was supplied with an Audiocodes MP264.
The WAN connection uses PPPoE over Vlan 100
The ISP advises this router does not support bridge mode so they have provide a TP-Link TD-VG5612 that does.
I have a Cisco C881-K9 that was used with my previous ISP that I want to use with this new connection.
I am looking for a simple example how I can establish the WAN connection with this router.
The part I am stuck on is how to tag the WAN connection with Vlan 100.
Any assistance appreciated.
Thanks
... View more
Labels:
Hello,
Thank you for the responses. I will try this configuration and see how we go.
Really appreciate your assistance
Thanks
... View more
Hello,
Thank you for your response ..
Looking at the data sheet for the c819g-4g-ga-k9 it says it does support EEM
http://www.cisco.com/c/en/us/products/collateral/routers/819-integrated-services-router-isr/datasheet_c78-732558.html
Do you have any examples of using EEM to do what I was after ?
Thanks
... View more
10-29-2016
01:44 AM
I am using Cisco C819G router with 4G for the failover.
I have configured an ip sla to verify the primary connection is up.
I have configured a track to reroute traffic via the Cellular interface if the primary connection fails.
This seems to be working.
But I want the Cellular interface to be disconnected if the primary comes back on line
So looking at the snippet of the config below if the status of sla 1 is down the first route will be removed and all traffic will be routed via the cellular interface - all good. Now if the Gi0 interface comes back up and therefore the sla 1 is now up the the first route is reinstated - good. But how can I force the cellular interface down ?
I am also looking for a way to be notified repeatedly if the 4G interface is being used. I have looked at the
event manager environment _ifDown_rcpt ...
configuration but this seems to be a once off process, is there a way to repeatedly send an email on a specific interval ?
track 1 ip sla 1 reachability delay down 12
ip route 0.0.0.0 0.0.0.0 111.111.111.11 track 1 ip route 0.0.0.0 0.0.0.0 Cellular0 20
ip sla 1 icmp-echo 222.222.222.22 source-interface GigabitEthernet0 timeout 10000 frequency 15
Thanks for any suggestions
Don
... View more
Labels:
08-27-2016
08:03 PM
I want to block Internet access specifically ports 80 and 443 for a specific IP address during specific hours.
I was also trying to test the ACL by adding additional deny statements - possibly this is causing the issue - don't know.
Here is the relevant parts of the config
interface Vlan1 ip address 10.1.2.254 255.255.255.0 ip access-group SchoolHours in ip nat inside ip virtual-reassembly in
ip access-list extended SchoolHours deny tcp host 10.1.2.65 eq www any time-range schoolHours deny tcp host 10.1.2.65 eq 443 any time-range schoolHours deny tcp host 10.1.2.83 eq www any deny tcp host 10.1.2.84 eq www any deny tcp host 10.1.2.84 eq 443 any deny tcp host 10.1.2.83 eq 443 any permit ip any any
time-range schoolHours periodic weekdays 8:00 to 15:30
My laptop has address 10.1.2.84 but I am still able to browse the internet
Do I need to set up inspection of tcp traffic before this will work ?
Any suggestion most welcomed
Thanks
... View more
Labels:
Created by
DON BROWN
in Small Business Routers
in Small Business Routers
08-23-2016
11:29 PM
08-23-2016
11:29 PM
I have a need to set up an extended acl with a time range.
I want to be able to configure the time-range for 8:00 to 17:00 Monday to Friday BUT I want to exclude specific public holidays.
This is on an C881 Ethernet router with version 15.4
As you can only have one absolute rule in a time range I can not see any way this can be achieved ?
Would appreciate any suggestions or examples how I might achieve this.
Thank you
... View more
Labels:
08-06-2016
06:15 AM
Thank you Karsten!
I have made the changes and tested and it appears to be working as required.
The addition of router-traffic to the IP Inspect seems to have made the difference as I believe I had actually tried all the other permutations of cbac and reflective acl.
I will have to read up on the difference of omitting/adding the router-traffic has made the difference.
Thank you for your assistance - it is very much appreciated!!
... View more
08-06-2016
04:03 AM
Thank you Karsten,
I am not sure I understand you suggestion so I have included the changes you have suggested below. Could you confirm this is as you have suggested or if not show how you are suggesting.
I will then apply and test.
ip inspect name fw tcp router-traffic ip inspect name fw udp router-traffic ip inspect name fw icmp router-traffic
interface Vlan1 description Internal LAN ip address 192.168.0.254 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452
interface Dialer3 description ADSL Connection ip address 165.1.1.1 255.255.255.0 ip nat outside ip virtual-reassembly in encapsulation ppp ip access-group OutsideIn in ip inspect fw out
Extended IP access list OutsideIn 5 permit tcp any host 165.1.1.1 eq 22 (49995 matches) 10 permit tcp any host 165.1.1.1 eq smtp (226 matches) 20 permit tcp any host 165.1.1.1 eq whois 30 permit tcp any host 165.1.1.1 eq www (4 matches) 31 permit tcp host 210.1.1.1 165.1.1.1 0.0.0.255 (49609 matches)
Thank you for your response - I appreciate your assistance
... View more
08-06-2016
02:59 AM
Thanks Karsten,
I have removed the OutsideOut from D3
I have removed the evaluate and established from OutsideIn
When you suggest keeping the outgoing inspection on D3 you mean keep the OutsideIn inwards inspection ????
What will the router-traffic do to the CBAC inspect rules ?
At this stage if I can just get the inward restrictions on the outside interface and still retain Internet access for the inside LAN then I can expand the ACL as required. My main issue is when I apply the inward ACL to D3 I lose internet access from the inside.
Appreciate your response - any other suggestions ?
Thanks
... View more
08-06-2016
02:28 AM
Yes you are correct.
Initially I had reflective and when that was not working correctly I remove reflective and applied CBAC which also did not provide desired result.
I cannot see why when the acl is applied to the dialer3 interface that it stops Internet access and I do not know how to debug this.
Appreciate you replying - any thoughts ?
... View more
08-06-2016
12:56 AM
When I apply the access lists to D3 interface inbound access is restricted correctly but inside LAN loses Internet Before applying the ACL's to D3 interface ping 8.8.8.8 sour vlan1 works After applying ping 8.8.8.8 sour vlan1 fails
Partial Config
interface Vlan1 description Internal LAN ip address 192.168.0.254 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 interface Dialer3 description ADSL Connection ip address 165.1.1.1 255.255.255.0 ip nat outside ip virtual-reassembly in encapsulation ppp ip access-group OutsideIn in ip access-group OutsideOut out ip nat inside source list 22 interface Dialer3 overload ip nat inside source static tcp 192.168.0.103 25 165.1.1.1 25 extendable ip nat inside source static tcp 192.168.0.103 43 165.1.1.1 43 extendable ip nat inside source static tcp 192.168.0.103 80 165.1.1.1 80 extendable ip nat inside source static tcp 192.168.0.103 443 165.1.1.1 443 extendable ip nat inside source static tcp 192.168.0.103 3389 165.1.1.1 3389 extendable ip nat inside source static tcp 192.168.0.101 3390 165.1.1.1 3390 extendable ip nat inside source static tcp 192.168.0.102 3389 165.1.1.1 3391 extendable ip route 0.0.0.0 0.0.0.0 Dialer3 Extended IP access list OutsideIn 5 permit tcp any host 165.1.1.1 eq 22 (49995 matches) 10 permit tcp any host 165.1.1.1 eq smtp (226 matches) 20 permit tcp any host 165.1.1.1 eq whois 30 permit tcp any host 165.1.1.1 eq www (4 matches) 31 permit tcp host 210.1.1.1 165.1.1.1 0.0.0.255 (49609 matches) 50 permit tcp any any established (108 matches) 60 evaluate tcptraffic
#Lines 50 and 60 have been added and removed in testing with no difference
Extended IP access list OutsideOut 10 permit ip any any reflect tcptraffic (5502 matches)
#I initially did not have an out access list specified on the D3 interface
I have also added and tried with no change
ip inspect name fw tcp ip inspect name fw udp ip inspect name fw icmp
interface Dialer3
ip inspect fw out
Would be very happy to find what I am missing ... please
Thank you for any assistance.
Don
... View more
Labels:
Created by
DON BROWN
in Network Security
in Network Security
06-11-2013
04:19 AM
06-11-2013
04:19 AM
Hello Jouni, would I be able to achieve the PBR using the 2 existing routers ? (878 and 877) or would I have to replace this with one router establishing both internet connections ? Any suggestion or example would be good. Thank you ... Don
... View more
Created by
DON BROWN
in Network Security
in Network Security
06-11-2013
01:25 AM
06-11-2013
01:25 AM
I am setting up an ASA5515 to replace an existing Linux based firewall. Unfortunately the ASA5515 does not support source based routing. I have two internet connections currently used for specific connections - the second connection is NOT a failover connection. I have the default route to Internet connection 1. I want to route smtp out the second Internet connection. The routers connecting to the internet are a 877 and an 878 The options I am considering is a layer 3 switch between the firewall and the routers to enable source based routing or replacing the 2 routers with a single router and the appropriate wic interfaces. Would you have any better suggestion or an alternative suggestion or any suggestion on how this could be achieved. Thank you for any assistance. Don
... View more
Labels:
Created by
DON BROWN
in Unified Communications Infrastructure
01-05-2018
01-05-2018
I am trying to deploy the OVA for Expressway 8.2.1 (File
s42700x8_2_1.ova) under ESXi 4.1 and the de...
06-17-2017
Thank you for that prompt reply. I had seen the post on whirlpool but
from what I can see that does ...
06-17-2017
We have a new NBN Internet that was supplied with an Audiocodes MP264.
The WAN connection uses PPPoE...
10-29-2016
I am using Cisco C819G router with 4G for the failover. I have
configured an ip sla to verify the pr...
08-27-2016
I want to block Internet access specifically ports 80 and 443 for a
specific IP address during speci...
Created by
DON BROWN
in Small Business Routers
08-23-2016
08-23-2016
I have a need to set up an extended acl with a time range. I want to be
able to configure the time-r...
08-06-2016
Thank you Karsten! I have made the changes and tested and it appears to
be working as required. The ...
08-06-2016
Thank you Karsten, I am not sure I understand you suggestion so I have
included the changes you have...
08-06-2016
Thanks Karsten, I have removed the OutsideOut from D3 I have removed the
evaluate and established fr...
08-06-2016
Yes you are correct. Initially I had reflective and when that was not
working correctly I remove ref...
08-06-2016
When I apply the access lists to D3 interface inbound access is
restricted correctly but inside LAN ...
06-11-2013
Hello Jouni,would I be able to achieve the PBR using the 2 existing
routers ? (878 and 877)or would ...
Public Statistics
| Date Registered | 06-11-2013 01:14 AM |
| Date Last Visited | 08-24-2018 02:02 AM |
| Total Messages Posted | 15 |
