Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About axa-wongjeff
Stats
Member since
07-10-2006
51
Posts
0
Helpful
0
Solutions
Created by
axa-wongjeff
in Network Management
in Network Management
10-03-2013
12:27 PM
10-03-2013
12:27 PM
Attached is the output file of the debug.
... View more
Created by
axa-wongjeff
in Network Management
in Network Management
10-03-2013
07:18 AM
10-03-2013
07:18 AM
Attached is the TacacsPrompts.ini from the server. Attached is the screen shot of a Putty session to the Catalyst switch. Attached are screen shots of the RST packet.
... View more
Created by
axa-wongjeff
in Network Management
in Network Management
10-02-2013
10:47 PM
10-02-2013
10:47 PM
Running Ciscoworks LMS 3.2.1 with Common Services 3.3.1 and RME 4.3.2 I noticed that my legacy Cat6506 switches running CatOS are failing device credentials. The switches are running CatOS 8.3(3). Ciscoworks has an archived configuration, so it was working. I am unable to find any notices from the prior admin if there were any upgrades to Ciscoworks, which might have caused it to stop. I confirmed the credentials are valid, by manually Telnet and using the same credentials. I exported the device credentials to verify the cleartext passwords. There's no custom prompts, just using the system default login prompts. I did a packet capture taken from the Ciscoworks server during a device credential verification job. I noticed that the username was sent correctly by Ciscoworks. For some reason, the switch responds by sending only the capital "P" of the password prompt. Ciscoworks server then sends a FIN,ACK packet. I then see a RST packet from the switch with a "Reset cause: assword:" as the reason. I know I shouldn't dwell on this because these switches really need to get the boot and upgraded, but I am obligated to ensure backup configurations are current. Anyone else knows if there's a bug or how CatOS is handled with the Ciscoworks versions I'm using? I can share up screen shots of the packet details.
... View more
Labels:
01-09-2013
06:43 PM
I ran a debug dap trace and found the following entries: DAP_TRACE: dap_install_endpoint_data_to_lua:endpoint.device.MAC["000c.29e1.8552"]="true" DAP_TRACE: name = endpoint.device.MAC["000c.29e1.8552"], value = "true" DAP_TRACE: dap_install_endpoint_data_to_lua:endpoint.device.id="VMware-56 4d 3f 58 9b 8d 5a c4-23 69 6e 12 37 e1 85 52" DAP_TRACE: name = endpoint.device.id, value = "VMware-56 4d 3f 58 9b 8d 5a c4-23 69 6e 12 37 e1 85 52" I would like to create a dynamic attribute policy (DAP) that checks for "VMWare-" in order to continue the connection. I am only able to find MAC in the Device endpoint attribute type. Which Endpoint Attribute Type would I use/find to check endpoint.device.id="VMware? Thanks.
... View more
Labels:
Created by
axa-wongjeff
in VPN and AnyConnect
in VPN and AnyConnect
12-17-2012
10:16 PM
12-17-2012
10:16 PM
I launch ASDM from my browser and choose Java Web Start. I get a Security Information message popup stating "The application's digital signature has expired". I click on the links that allows me to look at the certificate details. Sure enough the Validity section shows a expiration date of this month and date. Where is the location of this certificate? I checked my ASA certificate management and was not able to locate it. I also checked my local computer certmgr.msc and Java console. How do I renew this Java-related certificate for my ASA? As always, thanks.
... View more
Labels:
Created by
axa-wongjeff
in VPN and AnyConnect
in VPN and AnyConnect
11-16-2012
12:27 PM
11-16-2012
12:27 PM
I'm doing some cleanup on the ASA configuration and trying to find a way to determine the last time each of my defined L2L (site-to-site) connection profiles was used/established. At this point I am relying on the syslog messages collected on my syslog server. I'm pretty sure I may not have a good complete picture. I'm going through the cisco command reference manual for any 'show' commands. Thanks.
... View more
Labels:
06-14-2012
09:52 AM
I'm seeing IPSec messages and trying to interrupt them. With the "SIP" in the beginning of the message, it's related to my telephony connection specifically. Cisco's message decoder did not provide any details. Anyone familiar with these types of messages? I'm going through some debug messages to see what these messages are a result of an event. Jun 13 13:32:49.506 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:082 TS:00013710619067346304 %IPSEC-3-HMAC_ERROR: IPSec SA receives HMAC error, DP Handle 39 Jun 13 13:58:09.782 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:005 TS:00013712135502608041 %IPSEC-3-HMAC_ERROR: IPSec SA receives HMAC error, DP Handle 39 Jun 13 13:58:09.839 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:099 TS:00013712135559380211 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 39 Jun 13 14:08:57.643 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:095 TS:00013712781726318684 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 39 Jun 13 14:57:47.999 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:008 TS:00013715704679756134 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 23 Jun 13 15:09:11.148 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:019 TS:00013716386099386336 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 19 Jun 13 15:21:14.648 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:085 TS:00013717107774726649 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 36 Jun 13 15:45:19.920 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:088 TS:00013718549395685276 %IPSEC-3-HMAC_ERROR: IPSec SA receives HMAC error, DP Handle 36 Jun 13 16:12:26.683 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:098 TS:00013720172049200355 %IPSEC-3-HMAC_ERROR: IPSec SA receives HMAC error, DP Handle 27 Jun 13 16:33:35.103 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:085 TS:00013721437264765164 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 27 Jun 13 16:45:37.085 EDT: %IOSXE-3-PLATFORM: SIP0: cpp_cp: QFP:00 Thread:019 TS:00013722157422203134 %IPSEC-3-HMAC_ERROR: IPSec SA receives HMAC error, DP Handle 27
... View more
- Tags:
- ipsec
Labels:
Created by
axa-wongjeff
in Switching
in Switching
04-05-2012
10:10 PM
04-05-2012
10:10 PM
I have a basic home user CVO router configuration where the user will be authentication via Radius and the router acting as the authentication proxy. I also want to ensure our standard Tacacs authentication for our router administrators is used. CVO router AAA commands: aaa authentication login default local group radius aaa authorization auth-proxy default group aaa-server Standard AAA authenticaiton for router login: aaa authentication login default group NetOps local What have others who implemented CVOs done regarding separating AAA authentication for the home user and local router admins?
... View more
Labels:
Created by
axa-wongjeff
in Switching
in Switching
04-04-2012
11:43 AM
04-04-2012
11:43 AM
Performed a 'show tech-support snmp' on a Nexus switch to investigate an issue with SNMP. One of the commands listed in the tech support output lists what could be packets causing the issue. There is an event that looks like a remote IP address of the following: 16.100.113.4 16.100.205.204 16.113.249.188 I did a packet capture on the traffic going in and out of the switch interfaces and did not find any SNMP packets with those outside addresses. Looking for assistance in interpreting this output to confirm if these are truly outside IP addresses trying to do an SNMP function on the switch. At this point I feel these are neither ingress or egress packets. It's just something internal to the Nexus. `show system internal snmp event-history pktdump` 1) Event:E_DEBUG, length:224, at 846968 usecs after Fri Mar 30 16:04:46 2012 [107] SNMPPKTSTRT: 3.000000 162 1157652703.000000 1157652703.000000 0.000000 0.000000 0 4 3 2 0 172.20.35.87 0 0 0 0.000000 0.000000 16.100.113.4 remote ip,v4: snmp_4401_172.20.35.87 11 0 11 admin 5 0 0 0x107ae674 86 2) Event:E_DEBUG, length:346, at 846900 usecs after Fri Mar 30 16:04:46 2012 [107] 1157652703.000000:iso.3.6.1.2.1.31.1.1.1.6.167772161 = Counter64: 10061161472 iso.3.6.1.2.1.31.1.1.1.10.167772161 = Counter64: 889856360 iso.3.6.1.2.1.2.2.1.13.167772161 = Counter32: 0 iso.3.6.1.2.1.2.2.1.19.167772161 = Counter32: 0 iso.3.6.1.2.1.2.2.1.14.167772161 = Counter32: 0 iso.3.6.1.2.1.2.2.1.20.167772161 = Counter32: 0 SNMPPKTEND 3) Event:E_DEBUG, length:46, at 846635 usecs after Fri Mar 30 16:04:46 2012 [107] SNMP PDU[ReqId:1157652703.000000 cmd:162] 4) Event:E_DEBUG, length:226, at 842551 usecs after Fri Mar 30 16:04:46 2012 [107] SNMPPKTSTRT: 3.000000 160 1157652703.000000 1157652703.000000 0.000000 0.000000 0 4 3 2 0 172.20.35.87 0 0 0 0.000000 0.000000 16.100.205.204 remote ip,v4: snmp_4401_172.20.35.87 11 0 11 admin 5 0 0 0x107ae674 86 5) Event:E_DEBUG, length:280, at 842482 usecs after Fri Mar 30 16:04:46 2012 [107] 1157652703.000000:iso.3.6.1.2.1.31.1.1.1.6.167772161 = NULL iso.3.6.1.2.1.31.1.1.1.10.167772161 = NULL iso.3.6.1.2.1.2.2.1.13.167772161 = NULL iso.3.6.1.2.1.2.2.1.19.167772161 = NULL iso.3.6.1.2.1.2.2.1.14.167772161 = NULL iso.3.6.1.2.1.2.2.1.20.167772161 = NULL SNMPPKTEND 6) Event:E_DEBUG, length:46, at 842245 usecs after Fri Mar 30 16:04:46 2012 [107] SNMP PDU[ReqId:1157652703.000000 cmd:160] 7) Event:E_DEBUG, length:226, at 532789 usecs after Fri Mar 30 16:04:44 2012 [107] SNMPPKTSTRT: 3.000000 162 1157652626.000000 1157652626.000000 0.000000 0.000000 0 4 3 2 0 172.20.35.87 0 0 0 0.000000 0.000000 16.113.249.188 remote ip,v4: snmp_4401_172.20.35.87 11 0 11 admin 5 0 0 0x1078f644 86 8) Event:E_DEBUG, length:501, at 532722 usecs after Fri Mar 30 16:04:44 2012 [107] 1157652626.000000:iso.3.6.1.2.1.31.1.1.1.6.17874944 = Counter64: 42837088 iso.3.6.1.2.1.31.1.1.1.10.17874944 = Counter64: 42837204 iso.3.6.1.2.1.2.2.1.13.17874944 = Counter32: 0 iso.3.6.1.2.1.2.2.1.19.17874944 = Counter32: 0 iso.3.6.1.2.1.2.2.1.14.17874944 = Counter32: 0 iso.3.6.1.2.1.2.2.1.20.17874944 = Counter32: 0 iso.3.6.1.2.1.31.1.1.1.6.34078720 = Counter64: 11767736126 iso.3.6.1.2.1.31.1.1.1.10.34078720 = Counter64: 2465339074 iso.3.6.1.2.1.2.2.1.13.34078720 = Counter32: 0 SNMPPKTEND 9) Event:E_DEBUG, length:173, at 532711 usecs after Fri Mar 30 16:04:44 2012 [107] 1157652626.000000:iso.3.6.1.2.1.2.2.1.19.34078720 = Counter32: 0 iso.3.6.1.2.1.2.2.1.14.34078720 = Counter32: 0 iso.3.6.1.2.1.2.2.1.20.34078720 = Counter32: 0 VARBIND
... View more
- Tags:
- nexus
Labels:
Created by
axa-wongjeff
in Policy and Access
in Policy and Access
02-04-2012
01:05 AM
02-04-2012
01:05 AM
I created a new Shell Command Authorization Set within ACS to only allow a port to be configured for a voice VLAN. >> Shell Command Authorization Sets Name: Restricted_Voice Description: Configure port voice vlan only. Unmatched Commands: Deny Add: enable Add: configure / permit terminal <cr> Add: interface / permit Gi* Add: interface / permit Fa* Add: switchport / permit voice vlan * My switch configuration has the following aaa authorization related lines: aaa authorization commands 1 default group tacacs+ if-authenticated aaa authorization commands 15 default group tacacs+ if-authenticated When I tested the Shell Set, I noticed that all (config) mode commands were allowed (ie description, hostname). It was only after I added "aaa authorization config-commands" to the switch configuration did my Shell Set began working as I expected it to be. I went and read up the command reference for "aaa authorization config-commands" in http://www.cisco.com/en/US/docs/ios/11_3/security/command/reference/sr_auth.html#wp3587 . My comprehension of the command is that by just issuing ' aaa authorization commands 15 ....' this command encompasses the checking of config mode commands and that I did not need to add the stand-alone "aaa authorization config-commands" statement. But clearly, from my testing, I needed the extra statement. It looks like I resolved my issue and need to add the new statement to all my switches, I'm wondering if someone can help clarify the usage guidelines for me. I'm I one of the few or only one that misinterpreted these "aaa authorization" commands?
... View more
- Tags:
- aaa
- authorization
Labels:
Created by
axa-wongjeff
in Network Management
in Network Management
01-27-2012
04:07 PM
01-27-2012
04:07 PM
I performed a Sync Archive on a device and noticed that it took 12 hrs to end with a result of 'Failed'. What logs or troubleshooting steps should I look at to find out the possible cause for this long delay? I don't believe I ever had to wait 12 hours for a Sync Archive completion. I'm running LMS 3.2 / RME 4.0. 5848 Sync Archive Failed(1) Sync Archive jwong Jan 25 2012 17:09:27 Jan 26 2012 05:58:38 Immediate
... View more
Labels:
01-25-2012
02:03 PM
I noticed in RME inventory, my ASR1001 hardware is not recognized. I checked my Ciscoworks and it only knows ASR1002, 1004, and 1006 routers. I checked the supported device table for LMS 3.2 and did not find ASR1001. Is there a separate device package I can download. This is not a deal breaker, but it's unnerving to see the question mark icon next to the name of my router in the Ciscoworks GUI.
... View more
Labels:
Created by
axa-wongjeff
in Application Networking
in Application Networking
06-24-2011
01:59 PM
06-24-2011
01:59 PM
My operations staff put in a suggestion where they would like the many graphs provided by the CM and WAE device onto a single web page. This will allow them a single glance of the overall health of the WAAS environment. My plan is to gather the SNMP OIDs used by the CM and the internal WAE graphing and duplicate the SNMP monitoring on my RRDtool backend server. I would then create a single web page for my operations staff displaying the same statistics graph. For example, the WAE internal MRTG CPU and connection statistics graphs are very helpful as indicated by the staff. Instead of reinventing the wheel and doing an snmpwalk on the WAE devices, is there a document that lists the OIDs used by the CM and the WAE graphs? Thanks.
... View more
Created by
axa-wongjeff
in Policy and Access
in Policy and Access
09-27-2010
09:25 AM
09-27-2010
09:25 AM
I'm getting a lot of questions from my operators that they do not know how to change their password when they see the TACACS warning message that their account will expire soon. I would like to have an auto banner setup so when a user who's password is about to expire logs into a Cisco router/switch, they will see a banner like the following: Password about to expire. Please change your password. To change password, hit <enter> at password prompt and system will prompt for your current password and ask for new password
... View more
Labels:
Created by
axa-wongjeff
in Network Management
in Network Management
08-09-2010
11:51 AM
08-09-2010
11:51 AM
Joe, The switch is running c2950-i6q4l2-mz.121-6.EA2a.bin
... View more
Created by
axa-wongjeff
in Network Management
10-03-2013
10-03-2013
Attached is the output file of the debug.
Created by
axa-wongjeff
in Network Management
10-03-2013
10-03-2013
Attached is the TacacsPrompts.ini from the server.Attached is the screen
shot of a Putty session to ...
Created by
axa-wongjeff
in Network Management
10-02-2013
10-02-2013
Running Ciscoworks LMS 3.2.1 with Common Services 3.3.1 and RME 4.3.2I
noticed that my legacy Cat650...
01-09-2013
I ran a debug dap trace and found the following entries:DAP_TRACE:
dap_install_endpoint_data_to_lua:...
Created by
axa-wongjeff
in VPN and AnyConnect
12-17-2012
12-17-2012
I launch ASDM from my browser and choose Java Web Start. I get a
Security Information message popup ...
11-16-2012
I'm doing some cleanup on the ASA configuration and trying to find a way
to determine the last time ...
06-14-2012
I'm seeing IPSec messages and trying to interrupt them. With the "SIP"
in the beginning of the messa...
Created by
axa-wongjeff
in Unified Communications Infrastructure
04-23-2012
04-23-2012
Thanks. I've been reading up on the Cisco Emergency Responder
documentation. Not sure if that's impl...
Created by
axa-wongjeff
in Unified Communications Infrastructure
04-23-2012
04-23-2012
It's been requested to display a reminder that "... dialing 9-1-1 may
not provide exact location and...
Created by
axa-wongjeff
in Switching
04-05-2012
04-05-2012
I have a basic home user CVO router configuration where the user will be
authentication via Radius a...
Created by
axa-wongjeff
in Switching
04-04-2012
04-04-2012
Performed a 'show tech-support snmp' on a Nexus switch to investigate an
issue with SNMP.One of the ...
Created by
axa-wongjeff
in Policy and Access
02-04-2012
02-04-2012
I created a new Shell Command Authorization Set within ACS to only allow
a port to be configured for...
01-27-2012
I performed a Sync Archive on a device and noticed that it took 12 hrs
to end with a result of 'Fail...
01-25-2012
I noticed in RME inventory, my ASR1001 hardware is not recognized.I
checked my Ciscoworks and it onl...
Created by
axa-wongjeff
in Application Networking
06-24-2011
06-24-2011
My operations staff put in a suggestion where they would like the many
graphs provided by the CM and...
Public Statistics
| Date Registered | 07-10-2006 08:35 AM |
| Date Last Visited | 10-09-2017 02:28 PM |
| Total Messages Posted | 51 |
Helpful Votes Given To
