Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Simon O'Sullivan
Stats
Member since
08-18-2010
97
Posts
9
Helpful
0
Solutions
Created by
Simon O'Sullivan
in Network Security
in Network Security
10-18-2016
04:21 PM
10-18-2016
04:21 PM
Hi, I tested out FTD on a 5508. I want to roll it back to normal ASA but I can't get the image to boot via the normal rommon recovery.
The images copies via tftp, but then won't boot automatically.
If I try "boot" I get:
" File system not supported"
Anyone any ideas?
Log below
rommon 15 > tftp ? ADDRESS: 10.47.20.99 NETMASK: 255.255.255.0 GATEWAY: 10.47.20.1 SERVER: 10.47.20.100 IMAGE: asdm-762-150.bin MACADDR: 00:f6:63:47:82:59 VERBOSITY: Progress RETRY: 40 PKTTIMEOUT: 7200 BLKSIZE: 1460 CHECKSUM: Yes PORT: GbE/1 PHYMODE: Auto Detect
Receiving asdm-762-150.bin from 10.47.20.100!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! File reception completed. Boot buffer bigbuf=3ffff018 Boot image size = 26053720 (0x18d8c58) bytes [image size] 26053720 [MD5 signaure] eec67ea0f38aa249b18ef6f4e0667ebe rommon 16 > boot File system not supported boot: cannot determine first file name on device "disk0:"
... View more
Labels:
09-12-2016
03:24 PM
Hi Mikael,
Thanks I saw that doc previously, but it doesn't help. I have found more detail on the issue though...
What happens is that lots of devices do make use of MultiCast traffic but do not make use of IGMP and do not send IGMP report messages. An example of such devices are devices that make use of "Precision Time Protocol" (PTPv2).
On most Cisco Catalyst switches with IGMP snooping enabled:
When it sees multicast traffic for a destination that it has not seen any IGMP reports for it will flood that traffic out all ports in the vlan (normal switch behavor for unknown destination mac address).
On a Cisco 6807 with IGMP snooping enabled:
when it sees multicast traffic for a destination that it has not seen any IGMP reports for it will drop that traffic.
Unfortunately according to Cisco the only fix on a 6807 is to disable IGMP snooping on the entire vlan (or setup static MAC entries which is not scalable). Configuring an IGMP querier does not help as the devices in question do not do IGMP.
Thanks, Simon
... View more
Created by
Simon O'Sullivan
in Switching
in Switching
09-07-2016
04:14 PM
09-07-2016
04:14 PM
Hi all,
We have recently upgraded some switches from Catalyst 4506 to Catalyst 6807 Sup6T.
Since moving to the 6807, we have found that some multicast traffic is no longer delivered around the network as expected.
The traffic is L2 only - no routing involved.
Can anyone tell me what is the expected behavior of multicast traffic when:
IGMP snooping is enabled
the hosts participating in the multicast traffic do not send IGMP messages
Should the traffic be flooded to all ports in the vlan (as unknown multicast)?
What settings should I look for to ensure that the (unknown) multicast is flooded?
What we are seeing is that the 4506 floods the multicast traffic, but the 6807 does not.
The 6807 does see that it is receiving multicast traffic on a port because the interface counters for multicast increment.
We have tested this with two deivces connected directly to ports on the 6807 (no other switches involved).
Thanks, Simon.
... View more
Labels:
Created by
Simon O'Sullivan
in Routing
in Routing
07-26-2016
07:55 PM
07-26-2016
07:55 PM
Hi all,
I have a large number of remote networks that are spread all over the world. Currently they are all individual island with no connectivity to anywhere else.
What I would like to do is connect them all back to head office over the internet so I can remotely access them. The internet service I get from every site will be different and unknown e.g some directly on the internet, some behind NAT.
So I think the solution to this is DMVPN.
But my problem is that all of the remote sites have the same internal subnet. So how can I make sure they are all connected and the remote devices are all accessible at the same time?
I'm wondering if I can setup NAT on perhaps the Spoke router so that every device has a static nat with the Natted IP being unique. I have labbed this up in GNS3 and it seems to work. However the problem is that there are hundreds of devices at each site, which means a lot of NAT entries.
I'm wondering is it possible to do a full 1:1 Nat just specifying an entire network to network. E.g something like 192.168.20.0/24 NAT to 10.0.1.0/24 if try to access 192.168.20.5 it actually connects to 10.0.1.5
Has anyone ever got something like this working?
Is there a good solution?
Thanks, Simon
... View more
Labels:
Created by
Simon O'Sullivan
in Routing
in Routing
09-06-2015
11:10 PM
09-06-2015
11:10 PM
Hello all, On a Cisco 800 series router why can't I type this command? "ip nat inside source static tcp 192.168.1.5 443 interface dialer1 443 route-map NONAT" I have to type this command for it to work: ip nat inside source static tcp 192.168.1.5 443 X.X.X.X 443 oute-map NONAT (Where X.X.X.X = IP address of dialer1) Seems to work ok. Just can't understand why I can't use the top one. Thanks
... View more
Labels:
08-26-2015
02:49 PM
Hi Marvin, Yes recently spoke to our Cisco/SourceFire account manager. My understanding is that the version 6 Firesight will be heading that way and is targeted for early next year. I also got the impresson that general firewall config will move out of the ASDM to the Firesight. It will be a bit like Checkpoint with the manager/gateway setup. (It needs to, its not clean having two management interfaces) Cheers
... View more
08-03-2015
09:52 PM
Thanks for the reply Paul. Basically clients what to know - if I have a PC that is infected with a virus, can IPS alert me and tell me the IP address of the PC so I can go and take it off the network. So would a PC infected with a virus be considered Malware, and require a malware license to detect?or could it be detected as a malicious attack come under the IPS license? Simon.
... View more
Created by
Simon O'Sullivan
in Network Security
in Network Security
08-03-2015
08:16 PM
08-03-2015
08:16 PM
Hi all, I'm after a plain English answer for a simple tech like myself. I'm trying to understand what each licensing component of the Cisco Firepower suite are. I work for a Cisco partner (I'm Cisco qualified), and neither our Cisco contact or distributor has been able to give me a clear answer. This is a typical question I get from a Client who is considering and ASA with firepower.... Say a client installs a Cisco ASA with firepower installed. They want to be able to detect a PC that is behaving unusually - eg it is infected with a virus and is perhaps a spambot, is scanning the network for SMB shares that are not secure, or any other odd behavior that may indicate an issue. My understanding is that IPS license on its own should be able to achieve the basic anomaly detection described above. The options are: IPS URL AMP (or some combination of the above) What license do they need to achieve the above? If someone describe me a real world examples of what each license actually protects against that would be great as well. e.g. Developers call them "stories". Thanks
... View more
Labels:
Created by
Simon O'Sullivan
in Wireless and Mobility
in Wireless and Mobility
07-26-2015
03:31 PM
07-26-2015
03:31 PM
Thanks ali aqrabawi, I'm aware of the auth. issues if the wan is down, so for this particular ssid we are using PSK. The security of this is another issue that does not need to be addressed here. So if I understand you correctly I should leave my WLAN as centrally switched (don't select the "flexconnect local switching" option), but if the controller goes offline the AP will locally switch? One thing I'm a bit confused about some of my sites don't have matching vlans, so I woudl like to configure Flexconnect groups and confiugre vlan maps for particular groups. But when I disable "flexconnect local switching" it tells me I can't have vlan maps. Do you know the answer to this? Thanks, Simon
... View more
Created by
Simon O'Sullivan
in Wireless and Mobility
in Wireless and Mobility
07-26-2015
02:37 AM
07-26-2015
02:37 AM
Hi all, I'm new to Cisco wireless and have a question about Flexconnect. Is it possible to configure Cisco AP's so that when the controller is reachable they centrally auth, and switch traffic (at the controller) and only when the controller is un-reachable they go to locally switched? I have been testing and from what I can tell its a either - or option. When I turn on locally switched, that is what the AP does even if it can see the controller. The reason I would like this "best of both worlds" is because I understand debug/troubleshooting/visability is easier when traffic is centrally switched (I've had to debug client roaming in the past and I couldn't get much info on locally switched AP's). But I would like to know that if the controller/wan is down AP's can go to local auth/switch. Cheers Simon
... View more
Labels:
06-30-2015
10:02 PM
Hi all, We have clients using anyconnect vpn to connect via a Cisco 2900 router. We would like to monitor the active anyconnect vpn user sessions. I can see this information using this command line: Show webvpn stats (see below for output) I would like to monitor the "active user sessions" via snmp. Does anyone know what the SNMP OID's are to retrieve this information? Thanks, Simon ROUTER# sh webvpn stats User session statistics: Active user sessions : 5 AAA pending reqs : 0 Peak user sessions : 12 Peak time : 2w6d Active user TCP conns : 3 Terminated user sessions : 346 Session alloc failures : 0 Authentication failures : 61
... View more
- Tags:
- webvpn snmp oid
Labels:
Created by
Simon O'Sullivan
in Other Network Architecture Subjects
in Other Network Architecture Subjects
06-17-2015
03:14 PM
06-17-2015
03:14 PM
If you have muitiple sites you need to do GRE tunnel (route based VPN) to Azure which ASAs do not support. (You can kludge something on servers but with ASA its so painful to be unusable.)
... View more
06-17-2015
03:08 PM
I believe you need to do GRE tunnel (route based VPN) to Azure which your router should support (If you have an ASA its so painful to be unusable.)
... View more
Created by
Simon O'Sullivan
in Switching
in Switching
06-08-2015
06:07 PM
06-08-2015
06:07 PM
Hello, I would like to have the default action clarified for storm control on a catalyst switch. Say I have this configured on a 1Gig switchport: storm-control broadcast level 10 (with the default action) Can someone please clarify if with the default action configured: Once broadcast reaches 100Mbit/s (approx) The storm control will filter/block all broadcast traffic into that interface or storm control will rate limit all broadcast traffic at 100Mb/s into that interface. What happens if storm control is configured on a trunk port? Will it filter all broadcasts on all vlans?
... View more
Labels:
Created by
Simon O'Sullivan
in Wireless Security and Network Management
in Wireless Security and Network Management
04-16-2015
01:50 AM
04-16-2015
01:50 AM
Hi all, Is it possible to create voucher based user auth tickets for guest wireless on the Cisco WLC? We are running the vWLC latest version Cheers, Simon
... View more
Created by
Simon O'Sullivan
in Network Security
10-18-2016
10-18-2016
Hi, I tested out FTD on a 5508. I want to roll it back to normal ASA but
I can't get the image to bo...
09-12-2016
Hi Mikael, Thanks I saw that doc previously, but it doesn't help. I have
found more detail on the is...
Created by
Simon O'Sullivan
in Switching
09-07-2016
09-07-2016
Hi all, We have recently upgraded some switches from Catalyst 4506 to
Catalyst 6807 Sup6T. Since mov...
Created by
Simon O'Sullivan
in Routing
07-26-2016
07-26-2016
Hi all, I have a large number of remote networks that are spread all
over the world. Currently they ...
09-06-2015
Hello all, On a Cisco 800 series router why can't I type this
command?"ip nat inside source static t...
08-26-2015
Hi Marvin,Yes recently spoke to our Cisco/SourceFire account manager. My
understanding is that the v...
08-03-2015
Thanks for the reply Paul.Basically clients what to know - if I have a
PC that is infected with a vi...
08-03-2015
Hi all,I'm after a plain English answer for a simple tech like myself.
I'm trying to understand what...
07-26-2015
Thanks ali aqrabawi,I'm aware of the auth. issues if the wan is down, so
for this particular ssid we...
Created by
Simon O'Sullivan
in Wireless and Mobility
07-26-2015
07-26-2015
Hi all,I'm new to Cisco wireless and have a question about
Flexconnect.Is it possible to configure C...
Created by
Simon O'Sullivan
in VPN
06-30-2015
06-30-2015
Hi all,We have clients using anyconnect vpn to connect via a Cisco 2900
router.We would like to moni...
Created by
Simon O'Sullivan
in Other Network Architecture Subjects
06-17-2015
06-17-2015
If you have muitiple sites you need to do GRE tunnel (route based VPN)
to Azure which ASAs do not su...
06-17-2015
I believe you need to do GRE tunnel (route based VPN) to Azure which
your router should support(If y...
Created by
Simon O'Sullivan
in Switching
06-08-2015
06-08-2015
Hello,I would like to have the default action clarified for storm
control on a catalyst switch.Say I...
Public Statistics
| Date Registered | 08-18-2010 09:14 PM |
| Date Last Visited | 10-09-2019 12:10 AM |
| Total Messages Posted | 97 |
| Total Helpful Votes Received | 9 |
