Hi All,     I am having a case where my customer trying to change his connection from Framerelay to E-Line. In the main site they have a software with NetBEUI the terminals were working with the Framerelay. Now I am using the Cisco 1841 router with enterprise service ios, with configuration in the main site as follows: Main Site bridge irb interface fast ethernet 0/0 ip address 10.0.0.10 bridge group 1 interface fastethernet 0/1 no ip address interface fastethernet 0/1.2 description connection to First Branch encapsulation dot1Q  2 ip address 172.16.0.1 255.255.255.0 bridge group 1 interface fastethernet 0/1.4 encapsulation dot1Q  4 ip address 172.17.0.1 255.255.255.0 bridge group 1 bridge 1 protocol ieee bridge 1 route ip Branch 1 interface fast ethernet 0/0 ip address 10.10.0.1 bridge group 1 interface fastethernet 0/1 no ip address interface fastethernet 0/1.2 encapsulation dot1Q  2 ip address 172.16.0.2 255.255.255.0 bridge group 1 bridge 1 protocol ieee bridge 1 route ip Branch 2 interface fast ethernet 0/0 ip address 10.20.0.1 bridge group 1 interface fastethernet 0/1 no ip address interface fastethernet 0/1.4 encapsulation dot1Q  4 ip address 172.17.0.2 255.255.255.0 bridge group 1 bridge 1 protocol ieee bridge 1 route ip When I started with the first branch it works (NetBeui application) and the connection was stable, I mean regarding the layer 3 (routing was working) and the NetBeui (I can see the Mac addresses of the main site in the branch site and the oppesite). When I put the second branch I have both of the branched working for layer three but the NetBeui worked only for few minutes before I lost the (NetBeui) connectivity for the two branch (still the layer three working in both branches) My question is: do I need to add extra configuration for NetBeui to work with multiple sites? or does the configuration is suffice and we have to do something in the software? Thanks in advance. With best regards, Essa Anas ... View more

Hi All,    I need to implement the following scenario: 2 branches sites connected to the HQ with E-Line, there are three vlans per site, vlan1,2,3, and spread with the help of the IS, between the sites, which means that vlan 2 has a broadcast domain spread on the three sites, same with the rest vlans. I need to but Cisco router to work as bridge, by configuring cisco 861 port as a trunk and confgure the WAN interface as QinQ to pass the vlan traffic through the provider. Will this configuration work? The current configuration is as follows: ip source-route ! ip cef bridge irb bridge mac-address-table limit 1200 ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 switchport mode trunk no ip address ! interface FastEthernet4 no ip address no ip route-cache duplex auto speed auto ! interface FastEthernet4.2 encapsulation dot1Q 2 second-dot1q any no ip route-cache no cdp enable bridge-group 1 ! interface FastEthernet4.3 encapsulation dot1Q 3 second-dot1q any no ip route-cache no cdp enable bridge-group 1 ! interface Vlan1 no ip address ip tcp adjust-mss 1452 bridge-group 1 bridge-group 1 spanning-disabled ! interface BVI1 ip address 172.16.0.1 255.255.0.0 ! bridge 1 protocol ieee bridge 1 route ip ! end               ip source-route ! ip cef no ip domain lookup ip domain name yourdomain.com ! bridge irb bridge mac-address-table limit 1200 ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 switchport mode trunk no ip address ! interface FastEthernet4 no ip address no ip route-cache duplex auto speed auto ! interface FastEthernet4.2 encapsulation dot1Q 2 second-dot1q any no ip route-cache no cdp enable bridge-group 1 ! interface FastEthernet4.3 encapsulation dot1Q 3 second-dot1q any no ip route-cache no cdp enable bridge-group 1 ! interface Vlan1 no ip address ip tcp adjust-mss 1452 bridge-group 1 bridge-group 1 spanning-disabled ! interface BVI1 ip address 172.16.0.1 255.255.0.0 ! ! ! bridge 1 protocol ieee bridge 1 route ip ! end ... View more

Hi,    I have problem in the configuration of Cisco ASA 5520, IOS version 8.4. The connection is as follows: LAN network--> Firewall --> Routers with GLBP with virtual ip address. the clients can not ping the virtual interface of the GLBP group, but I can ping it from the firewall, and I can ping the clients from the firewall, I checked the packet tracer it gives : Phase: 7 Type: NAT Subtype: Result: DROP Config: nat (inside10,outside) source dynamic LAN interface Additional Information: Forward Flow based lookup yields rule: in  id=0x74331ed8, priority=6, domain=nat, deny=false         hits=1390, user_data=0x74334578, cs_id=0x0, use_real_addr, flags=0x0, protocol=0         src ip/id=10.X.X.X, mask=255.255.0.0, port=0         dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0         input_ifc=inside10, output_ifc=outside The firewall configuration is as follows: ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address XX.XX.0.XX 255.255.255.240 ! interface GigabitEthernet0/1 no nameif no security-level no ip address ! interface GigabitEthernet0/1.10 description DataVLAN vlan 10 nameif inside10 security-level 100 ip address X.X.X.X 255.255.0.0 object-group network LAN network-object X.X.X.X 255.255.0.0 nat (inside10,outside) source dynamic LAN interface route outside 0.0.0.0 0.0.0.0 GLBP_Virtual_Interface policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp   inspect ip-options   inspect icmp   The GLBP Routers are configured with natting also as follows: interface GigabitEthernet0/0 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$ ip address ISP_CLIENT_SIDE 255.255.255.252 ip nat outside ip virtual-reassembly in duplex auto speed auto ! interface GigabitEthernet0/1 ip address XX.XX.0.XX 255.255.255.240 ip nat inside ip virtual-reassembly in glbp 1 ip GLBP_VIRTUAL_IP duplex auto speed auto ! ip nat inside source list 1 interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 ISP_GW access-list 1 permit any Regards Essa ... View more

Hi, I have problem to pass a SIP call to the PSTN when I am using the Remote-Party-ID. If INVITE message coming with a field Remote-Party-ID: <sip: 8843838488834@domain.com > the call will not complete, If this field removed the call will complete, when I debugging with debug ccsip messages and debug isdn q931 I see that when the call complete the sip message logs coming and the the ISDN Q931, but when the call is not completed I see only INVITE messages with some replays but no log of the ISDN Q931. Seems like the SIP message is not successfully translated to trigger the ISDN channel, I am using E1 line with 30 channels. I visited also the link : http://www.cisco.com/en/US/docs/ios/12_3/sip/configuration/guide/chapter9.html which was good, but didn't help. This is sample INVITE message: INVITE sip:9710000100@172.91.10.71 SIP/2.0 Record-Route: <sip:172.91.10.100;lr=on> Via: SIP/2.0/UDP 172.91.10.100;branch=z9hG4bKb887.6439d695.1 Via: SIP/2.0/UDP 172.91.10.10:33654;received=172.91.10.10;branch=z9hG4bK-d8754z-963d044746776977-1---d8754z-;rport=33654 Max-Forwards: 69 Contact: <sip:1000@172.91.10.10:33654> To: <sip:9710000100@172.91.10.100> From: "1000"<sip:1000@172.91.10.100>;tag=206cf76c Call-ID: ZGQ1ODIwOWNlZTA2MWYyOGFkZDQzZTRkMjNlZmM3MDI. CSeq: 2 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: ******************************** Content-Length: 545 Remote-Party-ID: <sip:75653434535@**************> Please Advice Essa Anas ... View more

Hi,   I need to configure cisco 2801 router as an SS7 gateway from the PSTN side and a SIP dial peer from the VoIP side. The router include a E1 interface, Is this configuration is possible? is there a documents shows such configuration? With best regards Essa Anas ... View more

Hi,   I have the following Setup, Two Cisco ASA 5520 needed to be  configured in HA Active/Passive. The Firewalls includes also AIP module. Does the ASA 5520 will internally make the AIP modules also HA Active/Passive? Is there a document regarding the issue? Is there a seperate license for the AIP modules for HA scenario? Regards Essa Anas ... View more

Hi,   I have the following case. On the HQ there is DLSw service. on the remote site we would like to build network with VLANs. Is the Cisco 3750 which software support the DLSw, is it the LAN base, IP Base, IP Service? I assume that we configure the dlsw commands under the vlan interfaces? ... View more

Hello All,   It is 31 of Decemeber 2010, happy new Year. I have very strange issue:   Cisco Adaptive Security Appliance Software Version 8.2(1) Device Manager Version 6.2(1) I have also : nat (inside) 0 0.0.0.0 0.0.0.0 , because I don’t want to do NAT translation. and enable traffic through the firewall without address translation is activated: no nat-control   command I allow traffic to pass through from outside (security level = 0) to inside (security level = 100) and it is working. The strange thing is that I have windows cluster of two Servers with cluster IP address and to ip addresses for the physical servers as you know. Locally I can ping these interfaces without problem and the users on the local site are happy, I can ping them also from the inside interfaces, and the IP/MAC address list shows on the ASA ARP list.       On the remote sites however, the issue is that I can ping the physical ip of the servers but I cannot ping the ip address of the cluster, ASA gives the following error message on the log: 3|Dec 31 2010|09:05:16|305005|10.213.12.13||||No translation group found for icmp src outside:Router_172.16.1.2 dst inside:10.213.12.13 (type 8, code 0) I have exactly the same case with virtual interface of a virtual server on a VMWARE machine. HOWEVER everything can work if I ping from the Cluster server or from the virtual machine outside (in the inside network) to any IP address outside the network. If I explain it well in means that If I just pass traffic from the cluster server to outside then pinging and other services from outside-in start working. Did I miss something in the configuration ASA Version 8.2(1) ! hostname ciscoasa names name XX.XXX.0.0 Remote_PO name 172.16.1.2 Router_172.16.1.2 ! interface Ethernet0/0 nameif outside security-level 0 ip address 172.16.1.1 255.255.255.252 ! interface Ethernet0/1 nameif inside security-level 100 ip address XX.XXX.12.200 255.255.255.0 ! interface Ethernet0/2 nameif dmz security-level 50 ip address XX.XXX.72.1 255.255.255.0 ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 management-only ! ftp mode passive clock timezone EEST 2 clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00 object-group icmp-type ICMP_GRP icmp-object echo-reply object-group network DM_INLINE_NETWORK_1 network-object Remote_PO 255.255.0.0 network-object host Router_172.16.1.2 access-list inside_access_in extended permit icmp any any object-group ICMP_GRP access-list inside_access_in extended permit ip any any access-list dmz_access_in extended permit icmp any any object-group ICMP_GRP access-list outside_access_in extended permit ip object-group DM_INLINE_NETWORK_1 XX.XXX.12.0 255.255.255.0 pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 mtu dmz 1500 mtu management 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 nat (inside) 0 0.0.0.0 0.0.0.0 access-group outside_access_in in interface outside access-group inside_access_in in interface inside access-group dmz_access_in in interface dmz route outside 0.0.0.0 0.0.0.0 Router_172.16.1.2 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.1.0 255.255.255.0 management http XX.XXX.12.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet XX.XXX.12.0 255.255.255.0 inside telnet 192.168.1.0 255.255.255.0 management telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 192.168.1.2-192.168.1.254 management dhcpd enable management ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp   inspect icmp   inspect icmp error ! service-policy global_policy global prompt hostname context Cryptochecksum:a5b9f09e919607c4c09f01132b2eebcb : end ciscoasa# I also want to mention couple of things, before I did this configuration, ASA was configured in context mode and I change it to single mode. I also delete the startup file to start from scratch. copy flash:old_running.cfg startup-config; single mode The second thing is that the local PCs on the network sometimes they are losing connectivity with the firewall, which means I cannot ping the ASA or go to the Internet, only if I change the IP address of the PC. Any Suggestions will be appreciated ... View more