I have just installed a CSR into Amazon AWS and have a query on routing between VPCs. There is a Public VPC with the CSR Outside interface in and a private VPC with a test server.   The CSR is fully integrated into our private DMVPN and that side seems to be working OK and the CSR can ping the test server.   The issue is that our remote sites can not ping the test server. The routes for the private VPC subnet are advertised out in DMVPN.   I understand that we don’t want the private VPC to route directly through the public VPC as that is not how AWS is supposed to work.   I am guessing the CSR is seeing the server through this interface –   interface VirtualPortGroup0  vrf forwarding GS  ip address 192.168.55.101 255.255.255.0  ip nat inside     and the rest of the config that is relevant   interface GigabitEthernet1  ip address dhcp  ip nat outside  negotiation auto   ip nat inside source list GS_NAT_ACL interface GigabitEthernet1 vrf GS overload   ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 10.180.100.1 ip route vrf GS 0.0.0.0 0.0.0.0 GigabitEthernet1 10.180.100.1 global     ip access-list standard GS_NAT_ACL  permit 192.168.35.0 0.0.0.255   Can anyone help with the routing to this server ?   ... View more

On some of my DAP's we use (and have been working for a few years) are set to, AAA attributes 'ldap.memberOf & cisco.tunnelgroup'. I was recently setting up a new DAP and noticed once I had set the 'ldap.memberof' I could still log into the profile, even though I was not in the AD group. I scratched my head for quite a while and then tested an older profile, which I am not an AD member of and noticed that was not working either. The main thing we have done recently is upgraded to 9.4.(4).16. AC is on 4.3.00748   Has anyone else come across this ? ... View more

I have a pair of switches that I need to set up ether-channel on. They currently have a single gigabit trunk link between then.   My question is, when I add the current live interfaces to the port-group will there be any interruption to the traffic currently passing over them ? ... View more

I have had to change the PPPOE username name remotely on a router and the ISP were not due to match this in thier server until a few hours later. Is there a way to check that the router is now using the new credentials ? It has been about 4 hours since the ISP made thier change and the device is still up and running as before. ... View more

I have run src NAT from one VLAN to other VLAN on the ACE OK for years. Now I need to ensure the outbound flow (to internet destination) from two servers is src natted. The inbound LB flow to the VIP (of the two servers) 10.100.60.10 tcp/25 is fine. This is how I would normally do it, but it is not nating the real IPs. access-list XX-XCH2010-EDGE line 20 extended permit ip any any   access-list XX-ACEDMZ-VIP line 10 extended permit ip any any   class-map match-all XX-XCH2010-EDGE   2 match virtual-address 10.100.60.10 tcp eq smtp   class-map match-any XX-XCH2010-EDGE-REALS   2 match source-address 10.100.72.10 255.255.255.255   3 match source-address 10.100.72.11 255.255.255.255   policy-map type loadbalance first-match XX-XCH2010-EDGE   class class-default     serverfarm XCH2010-EDGE-Servers   policy-map multi-match XX-ACEDMZ-VIPS   class XX-XCH2010-EDGE-REALS     nat dynamic 1 vlan 172   class XX-XCH2010-EDGE     loadbalance vip inservice     loadbalance policy XX-XCH2010-EDGE     loadbalance vip icmp-reply     interface vlan 160   description XX-ACEDMZ-VIPS   ip address 10.100.60.4 255.255.254.0     access-group input XX-ACEDMZ-VIP   service-policy input XX-ACEDMZ-VIPS     interface vlan 172   description XX-XCH2010-EDGE   ip address 10.100.72.4 255.255.254.0   access-group input XX-XCH2010-EDGE   nat-pool 1 10.100.60.10 10.100.60.10 netmask 255.255.254.0 pat   service-policy input XX-ACEDMZ-VIPS ... View more

We normally use Aliases and drop downs for our company users. For 3rd party access I would like a more direct type of access as per this - http://fortegac.blogspot.co.uk/2016/02/how-to-have-only-one-profile-shown.html I get the login prompt and can enter the details OK, but the next page starts the client download. Is there a way to stop it doing the download. Also not sure why it is asking as I have the most current client ... View more

We have been running two separate certificate servers for approx two years without issue. One of them did a forced reload the other night and from what I can tell it has lost one or both of its keys. Does anyone know if I can reapply them. I tried to re-import them from backup which seemed to complete, but they are still not showing DC-xx-xxx-RT2#sh cry pki ser Certificate Server dmvpn-xx-RT2:     Status: disabled, Server key not found, waiting for (offline) key     State: check failed     Server's configuration is locked  (enter "shut" to unlock it)     Issuer name: CN=xxVPNCERT     CA cert fingerprint: 1445C473 112DBE81 F01EFA73 F38383FD     Granting mode is: auto     Last certificate issued serial number (hex): 0     CA certificate expiration timer: 00:00:00 UTC Jan 1 1970     CRL not present.     Current primary storage dir: nvram     Database Level: Minimum - no cert data written to storage     Auto-Rollover configured, overlap period 50 days DC-xx-xxx-RT2# These files are in nvram: DC-xx-xxx-RT2#dir nvram: Directory of nvram:/     31  -rw-          32                    <no date>  dmvpn-xx-RT2.ser    34  -rw-         219                    <no date>  dmvpn-xx-RT2.crl    35  -rw-        1523                    <no date>  dmvpn-xx-RT2_00004.p12      44  -rw-        1523                    <no date>  dmvpn-xx-RT2_00001.p12 Only TP-self-signed keys showing. The other router has two extras for the certificate server RSA keys sh cry key mypubkey rsa Key name: TP-self-signed-xxxxxxx Key type: RSA KEYS  Storage Device: private-config  Usage: General Purpose Key  Key is not exportable.  Key Data:   "removed" Key name: TP-self-signed-xxxxxxx.server Key type: RSA KEYS Temporary key  Usage: Encryption Key  Key is not exportable.  Key Data:  "removed" ... View more