Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About sebastian.lemke
06-19-2019
Stats
Member since
09-03-2010
71
Posts
24
Helpful
1
Solution
04-20-2016
12:49 AM
This does not look like the same problem I had ("a number of MAC addresses being deleted and added every few seconds").
Maybe in your case the problem is rather related to the printer than to the switches.
... View more
04-19-2016
12:57 AM
Yes, confirmed.
IOS Upgrade to c2960x-universalk9-mz.152-2.E3 fixed the problem.
... View more
03-24-2016
01:47 AM
Thanks for your reply.
IOS downgrade is not an option, since I need some of the newer features.
FlexVPN itself doesn't require licenses - but I suppose the use of AnyConnect does.
This brings me to the last free option of using the built-in Windows IKEv2 VPN client. I'll try it out in the next days... I suppose your assumption "hours and hours of effort" will be totally right, when looking at the howto's.
... View more
Created by
sebastian.lemke
in VPN and AnyConnect
in VPN and AnyConnect
03-23-2016
03:28 AM
03-23-2016
03:28 AM
Hi,
I am trying to set up an L2TP over IPSec Tunnel between a Windows 7 Client and an 1921-SEC IOS Router with 15.3M.
I closely sticked to the configuration provided in the following document (which uses a 26xx router with IOS 12.4):
https://supportforums.cisco.com/document/9878401/l2tp-over-ipsec-cisco-ios-router-using-windows-8
The setup is working fine with IOS 15.1M - but with IOS 15.3M or 15.4M I get the windows error message 809, telling me that the remote server is not responding.
Looking at the router, I see that the IPSec SA is correctly set up. But all other related debugs are completely quiet
PPP: PPP authentication debugging is on PPP protocol negotiation debugging is on L2TP: L2TP errors debugging is on L2TP events debugging is on VPN: VPDN events debugging is on VPDN errors debugging is on
There is no NAT/PAT or firewall in between router and client - it's a lab with directly connected devices. Nevertheless I tried changing the registry key as recommended by Microsoft, but that didn't change anything.
The VPDN Configuration Guide for 15.4M says:
Client-initiated VPDN tunneling can use the L2TP protocol or the L2TPv3 protocol if the client device is a router. If the client device is a PC, only the PPTP protocol is supported.
Looks like I'm flogging a dead horse...
However, does anybody has a solution to use L2TP on current IOS versions? If not, what would be your recommended alternative?
PPTP is working fine, but it's not secure. Cisco VPN Client is EoL. Using FlexVPN with IKEv2 forces me to buy licenses.
Is there any free secure option for VPN Dial-in on Cisco IOS routers?
... View more
Labels:
10-13-2015
01:01 AM
Yes, there are four dot1q trunk ports, the mentioned interface Gi1/0/24 being one of them. The switches are running rapid-pvst.
... View more
Created by
sebastian.lemke
in Switching
in Switching
10-08-2015
04:19 AM
10-08-2015
04:19 AM
Hi, I am experiencing a strange behaviour on a WS-C2960X-24TS-L running c2960x-universalk9-mz.150-2a.EX5.bin. MAC addresses are constantly deleted and Added on one port. I configured the following: mac address-table notification change interval 10 mac address-table notification change history-size 200 mac address-table notification change interface GigabitEthernet1/0/24 snmp trap mac-notification change added snmp trap mac-notification change removed The MAC address aging time is set to 300 s. When issuing a "show mac address-table notification change" I can see a number of MAC addresses being deleted and added every few seconds on the interface Gi1/0/24. The MAC addresses are not learned on any other port. Most of the time they don't appear in the output of a "show mac address-table". Only when constantly issuing this command i sometimes hit a moment where the MAC address is allocated to the interface Gi1/0/24. Anybody a hint why this is happening?
... View more
Labels:
09-30-2015
11:27 PM
No, this wasn't fixed unfortunately. The routers went back to our distributor...
... View more
06-16-2015
08:30 AM
I found a good reference: http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115730-flexvpn-suiteb-00.html
... View more
06-16-2015
08:12 AM
Hi, so the transform "esp-gcm" actually is AES-GCM? For phase 1, I will stick to "aes-cbc-256" which is not rated NGE by Cisco. Thanks Sebastian
... View more
Created by
sebastian.lemke
in VPN and AnyConnect
in VPN and AnyConnect
06-11-2015
07:41 AM
06-11-2015
07:41 AM
Dear experts,
I am a little lost about how to implement Cisco's recommendations regarding Next Generation Encryption.
Referring to the "Table 1. Recommendations for Cryptographic Algorithms" I would like to configure the IKEv2 and IPSec on a Cisco IOS (XE) router (ISR G2 or ISR 4000).
Here are the relevant parts of my example configuration:
crypto ikev2 proposal IKE1
encryption aes-cbc-256
integrity sha256
group 20
crypto ipsec transform-set TRANS esp-aes 256 esp-sha256-hmac
mode transport
crypto ipsec profile IPSEC
set transform-set TRANS
set pfs group20
The referred page states "AES-CBC" as "Acceptable" only - "AES-CGM" is recommended instead. How can I configure AES-CGM in my IKE proposal and my ipsec transform-set?
Are all other parameters in my config "NGE-certified" or should I use other algorithms / parameters?
... View more
Labels:
Created by
sebastian.lemke
in Network Management
in Network Management
12-16-2014
02:45 AM
12-16-2014
02:45 AM
Hi experts,
I am currently using Flexible Netflow to do quick analyses concerning top talkers on WAN routers.
My config looks like this:
flow record FLOW
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect counter bytes
collect application name
flow monitor MON
record FLOW
cache timeout inactive 3600
cache timeout active 3600
interface Tunnel1
ip flow monitor MON input
ip flow monitor MON output
I am using the following command to display the top 50 talkers:
show flow monitor MON cache aggregate ipv4 source address ipv4 destination address ipv4 protocol transport source-port transport destination-port collect application name counter bytes sort counter bytes top 50
This output gives me the data which is currently in my local cache = the flows which are not yet exported.
I understand that
- active flows are "cut" into separate flows after the configured timer of 3600 seconds
- inactive flows are timed out after 3600 seconds as well
In both cases the flows remain in my local cache for at least 3600 seconds.
My question: What happens with flows which are terminated regularly, e.g. by capturing a TCP FIN flag. Are these flows immediately cleared from my cache? Can I somehow influence the behaviour to force the router to keep terminated flows in the cache for some time?
... View more
- Tags:
- netflow
Labels:
07-02-2014
02:33 AM
Hi, I have the same problem with an ASR1001, running asr1001-universalk9.03.10.03.S.153-3.S3-ext.bin. Im am using IKEv2 and IPSec with PFS group20. Here's the relevant config (lab): crypto ikev2 proposal ikev2-prop_1 encryption aes-cbc-256 integrity sha512 group 20 crypto ikev2 policy ikev2-pol_1 match address local 10.10.0.1 proposal ikev2-prop_1 crypto ikev2 profile ikev2-prof_1 match address local interface GigabitEthernet0/0/1 match identity remote address 10.10.0.2 255.255.255.255 authentication remote pre-share authentication local pre-share keyring local keyring_1 dpd 10 3 on-demand crypto ipsec profile ipsec-prof_1 set transform-set tset_1 set pfs group20 set ikev2-profile ikev2-prof_1 interface Tunnel1 ip address 10.20.0.1 255.255.255.252 tunnel source GigabitEthernet0/0/1 tunnel destination 10.10.0.2 tunnel protection ipsec profile ipsec-prof_1 As soon as the IPSec SA is established, the "show crypto ipsec sa" command shows: PFS (Y/N): N, DH group: none But after the first rekeying (after default time of 3600 secs) it shows: PFS (Y/N): Y, DH group: group20 I consider this a cosmetical problem only, since PFS is doing its job. This can be told from the debugs during the first rekeying: 000492: Jul 2 11:20:41.790 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Checking for PFS configuration 000493: Jul 2 11:20:41.790 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):PFS configured, DH group 20 000494: Jul 2 11:20:41.790 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 20 000495: Jul 2 11:20:41.798 CEST: IKEv2:(SA ID = 2):[Crypto Engine -> IKEv2] DH key Computation PASSED 000496: Jul 2 11:20:41.798 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Request queued for computation of DH secret 000497: Jul 2 11:20:41.798 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Checking if IKE SA rekey 000498: Jul 2 11:20:41.798 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Load IPSEC key material 000499: Jul 2 11:20:41.798 CEST: IKEv2:(SA ID = 2):[IKEv2 -> IPsec] Create IPsec SA into IPsec database
... View more
03-12-2014
01:39 AM
up until now I didn't find any reliable information either. I contacted the authour of the above html file, but there is no new version... Would also greatly appreciate an update :-)
... View more
04-20-2016
This does not look like the same problem I had ("a number of MAC
addresses being deleted and added e...
03-24-2016
Thanks for your reply. IOS downgrade is not an option, since I need some
of the newer features. Flex...
Created by
sebastian.lemke
in VPN and AnyConnect
03-23-2016
03-23-2016
Hi, I am trying to set up an L2TP over IPSec Tunnel between a Windows 7
Client and an 1921-SEC IOS R...
10-13-2015
Yes, there are four dot1q trunk ports, the mentioned interface Gi1/0/24
being one of them.The switch...
10-08-2015
Hi, I am experiencing a strange behaviour on a WS-C2960X-24TS-L running
c2960x-universalk9-mz.150-2a...
06-16-2015
I found a good
reference:http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115730-flexvpn-s...
06-16-2015
Hi,so the transform "esp-gcm" actually is AES-GCM?For phase 1, I will
stick to "aes-cbc-256" which i...
Created by
sebastian.lemke
in VPN and AnyConnect
06-11-2015
06-11-2015
Dear experts, I am a little lost about how to implement Cisco's
recommendations regarding Next Gener...
12-16-2014
Hi experts, I am currently using Flexible Netflow to do quick analyses
concerning top talkers on WAN...
07-02-2014
Hi,I have the same problem with an ASR1001, running
asr1001-universalk9.03.10.03.S.153-3.S3-ext.bin....
Public Statistics
| Date Registered | 09-03-2010 05:05 AM |
| Date Last Visited | 06-19-2019 12:35 AM |
| Total Messages Posted | 71 |
| Total Helpful Votes Received | 24 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 10 | |
| 5 |
.jpg "VIP Advisor"){kind=icon}
Helpful Votes From
