About sebastian.lemke

sebastian.lemke · ‎04-20-2016

This does not look like the same problem I had ("a number of MAC addresses being deleted and added every few seconds"). Maybe in your case the problem is rather related to the printer than to the switches.

sebastian.lemke · ‎04-19-2016

Yes, confirmed. IOS Upgrade to c2960x-universalk9-mz.152-2.E3 fixed the problem.

sebastian.lemke · ‎03-24-2016

Thanks for your reply. IOS downgrade is not an option, since I need some of the newer features. FlexVPN itself doesn't require licenses - but I suppose the use of AnyConnect does. This brings me to the last free option of using the built-in Windows IKEv2 VPN client. I'll try it out in the next days... I suppose your assumption "hours and hours of effort" will be totally right, when looking at the howto's.

sebastian.lemke · ‎03-23-2016

Hi, I am trying to set up an L2TP over IPSec Tunnel between a Windows 7 Client and an 1921-SEC IOS Router with 15.3M. I closely sticked to the configuration provided in the following document (which uses a 26xx router with IOS 12.4): https://supportforums.cisco.com/document/9878401/l2tp-over-ipsec-cisco-ios-router-using-windows-8 The setup is working fine with IOS 15.1M - but with IOS 15.3M or 15.4M I get the windows error message 809, telling me that the remote server is not responding. Looking at the router, I see that the IPSec SA is correctly set up. But all other related debugs are completely quiet PPP: PPP authentication debugging is on PPP protocol negotiation debugging is on L2TP: L2TP errors debugging is on L2TP events debugging is on VPN: VPDN events debugging is on VPDN errors debugging is on There is no NAT/PAT or firewall in between router and client - it's a lab with directly connected devices. Nevertheless I tried changing the registry key as recommended by Microsoft, but that didn't change anything. The VPDN Configuration Guide for 15.4M says: Client-initiated VPDN tunneling can use the L2TP protocol or the L2TPv3 protocol if the client device is a router. If the client device is a PC, only the PPTP protocol is supported. Looks like I'm flogging a dead horse... However, does anybody has a solution to use L2TP on current IOS versions? If not, what would be your recommended alternative? PPTP is working fine, but it's not secure. Cisco VPN Client is EoL. Using FlexVPN with IKEv2 forces me to buy licenses. Is there any free secure option for VPN Dial-in on Cisco IOS routers?

sebastian.lemke · ‎03-23-2016

IOS Upgrade to c2960x-universalk9-mz.152-2.E3 fixed the problem.

sebastian.lemke · ‎10-13-2015

Yes, there are four dot1q trunk ports, the mentioned interface Gi1/0/24 being one of them. The switches are running rapid-pvst.

sebastian.lemke · ‎10-08-2015

Hi, I am experiencing a strange behaviour on a WS-C2960X-24TS-L running c2960x-universalk9-mz.150-2a.EX5.bin. MAC addresses are constantly deleted and Added on one port. I configured the following: mac address-table notification change interval 10 mac address-table notification change history-size 200 mac address-table notification change interface GigabitEthernet1/0/24 snmp trap mac-notification change added snmp trap mac-notification change removed The MAC address aging time is set to 300 s. When issuing a "show mac address-table notification change" I can see a number of MAC addresses being deleted and added every few seconds on the interface Gi1/0/24. The MAC addresses are not learned on any other port. Most of the time they don't appear in the output of a "show mac address-table". Only when constantly issuing this command i sometimes hit a moment where the MAC address is allocated to the interface Gi1/0/24. Anybody a hint why this is happening?

sebastian.lemke · ‎09-30-2015

No, this wasn't fixed unfortunately. The routers went back to our distributor...

sebastian.lemke · ‎06-16-2015

I found a good reference: http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115730-flexvpn-suiteb-00.html

sebastian.lemke · ‎06-16-2015

Hi, so the transform "esp-gcm" actually is AES-GCM? For phase 1, I will stick to "aes-cbc-256" which is not rated NGE by Cisco. Thanks Sebastian

sebastian.lemke · ‎06-11-2015

Dear experts, I am a little lost about how to implement Cisco's recommendations regarding Next Generation Encryption. Referring to the "Table 1. Recommendations for Cryptographic Algorithms" I would like to configure the IKEv2 and IPSec on a Cisco IOS (XE) router (ISR G2 or ISR 4000). Here are the relevant parts of my example configuration: crypto ikev2 proposal IKE1 encryption aes-cbc-256 integrity sha256 group 20 crypto ipsec transform-set TRANS esp-aes 256 esp-sha256-hmac mode transport crypto ipsec profile IPSEC set transform-set TRANS set pfs group20 The referred page states "AES-CBC" as "Acceptable" only - "AES-CGM" is recommended instead. How can I configure AES-CGM in my IKE proposal and my ipsec transform-set? Are all other parameters in my config "NGE-certified" or should I use other algorithms / parameters?

sebastian.lemke · ‎03-20-2015

Thanks Wen!! Thats exactly what I was looking for!

sebastian.lemke · ‎12-16-2014

Hi experts, I am currently using Flexible Netflow to do quick analyses concerning top talkers on WAN routers. My config looks like this: flow record FLOW match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect counter bytes collect application name flow monitor MON record FLOW cache timeout inactive 3600 cache timeout active 3600 interface Tunnel1 ip flow monitor MON input ip flow monitor MON output I am using the following command to display the top 50 talkers: show flow monitor MON cache aggregate ipv4 source address ipv4 destination address ipv4 protocol transport source-port transport destination-port collect application name counter bytes sort counter bytes top 50 This output gives me the data which is currently in my local cache = the flows which are not yet exported. I understand that - active flows are "cut" into separate flows after the configured timer of 3600 seconds - inactive flows are timed out after 3600 seconds as well In both cases the flows remain in my local cache for at least 3600 seconds. My question: What happens with flows which are terminated regularly, e.g. by capturing a TCP FIN flag. Are these flows immediately cleared from my cache? Can I somehow influence the behaviour to force the router to keep terminated flows in the cache for some time?

sebastian.lemke · ‎07-02-2014

Hi, I have the same problem with an ASR1001, running asr1001-universalk9.03.10.03.S.153-3.S3-ext.bin. Im am using IKEv2 and IPSec with PFS group20. Here's the relevant config (lab): crypto ikev2 proposal ikev2-prop_1 encryption aes-cbc-256 integrity sha512 group 20 crypto ikev2 policy ikev2-pol_1 match address local 10.10.0.1 proposal ikev2-prop_1 crypto ikev2 profile ikev2-prof_1 match address local interface GigabitEthernet0/0/1 match identity remote address 10.10.0.2 255.255.255.255 authentication remote pre-share authentication local pre-share keyring local keyring_1 dpd 10 3 on-demand crypto ipsec profile ipsec-prof_1 set transform-set tset_1 set pfs group20 set ikev2-profile ikev2-prof_1 interface Tunnel1 ip address 10.20.0.1 255.255.255.252 tunnel source GigabitEthernet0/0/1 tunnel destination 10.10.0.2 tunnel protection ipsec profile ipsec-prof_1 As soon as the IPSec SA is established, the "show crypto ipsec sa" command shows: PFS (Y/N): N, DH group: none But after the first rekeying (after default time of 3600 secs) it shows: PFS (Y/N): Y, DH group: group20 I consider this a cosmetical problem only, since PFS is doing its job. This can be told from the debugs during the first rekeying: 000492: Jul 2 11:20:41.790 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Checking for PFS configuration 000493: Jul 2 11:20:41.790 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):PFS configured, DH group 20 000494: Jul 2 11:20:41.790 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 20 000495: Jul 2 11:20:41.798 CEST: IKEv2:(SA ID = 2):[Crypto Engine -> IKEv2] DH key Computation PASSED 000496: Jul 2 11:20:41.798 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Request queued for computation of DH secret 000497: Jul 2 11:20:41.798 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Checking if IKE SA rekey 000498: Jul 2 11:20:41.798 CEST: IKEv2:(SESSION ID = 210,SA ID = 2):Load IPSEC key material 000499: Jul 2 11:20:41.798 CEST: IKEv2:(SA ID = 2):[IKEv2 -> IPsec] Create IPsec SA into IPsec database

sebastian.lemke · ‎03-12-2014

up until now I didn't find any reliable information either. I contacted the authour of the above html file, but there is no new version... Would also greatly appreciate an update :-)

Date Registered	‎09-03-2010 05:05 AM
Date Last Visited	‎09-05-2018 12:26 AM
Total Messages Posted	71
Total Helpful Votes Received	24

This does not look like the

Yes, confirmed.

Thanks for your reply.

L2TP over IPSec between Cisco IOS 15.3 ...

IOS Upgrade to c2960x

Yes, there are four dot1q

MAC addresses constantly Deleted and Ad...

No, this wasn't fixed

I found a good reference:http

Hi,so the transform "esp-gcm"

How to configure NGE (Next Generation E...

Thanks Wen!!Thats exactly

Netflow behaviour for terminating flows

Hi,I have the same problem

up until now I didn't find